Merge WebKit at r71558: Initial merge by git.

Change-Id: Ib345578fa29df7e4bc72b4f00e4a6fddcb754c4c

1 files changed, 6432 insertions, 1 deletions

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 44714b7..6bf8f3c 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,6324 @@
+2010-11-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove the remaining editing-style functions from ApplyStyleCommand
+        https://bugs.webkit.org/show_bug.cgi?id=49155
+
+        Replaced removeNonEditingProperties, editingStyleAtPosition, prepareEditingStyleToApplyAt,
+        and removeStylesAddedByNode in ApplyStyleCommand.cpp by removeNonEditingProperties, EditingStyle::create,
+        prepareToApplyAt, and removeStyleAddedByNode in EditingStyle.cpp.
+
+        Also removed unnecessary header includes from various cpp files.
+
+        No tests are added since this is a cleanup.
+
+        * editing/ApplyStyleCommand.cpp: Removed removeNonEditingProperties, editingStyleAtPosition,
+        prepareEditingStyleToApplyAt, and removeStylesAddedByNode.
+        * editing/ApplyStyleCommand.h: Ditto.
+        * editing/DeleteSelectionCommand.cpp: Removed removeEnclosingAnchorStyle.
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Calls removeStylesAddedByNode instead.
+        * editing/EditingStyle.cpp:
+        (WebCore::copyEditingProperties): Moved and renamed ApplyStyleCommand::removeNonEditingProperties.
+        (WebCore::editingStyleFromComputedStyle): Calls copyEditingProperties. Changed the argument to PassRefPtr
+        as supposed to a raw pointer for convenience.
+        (WebCore::EditingStyle::init): Calls editingStyleFromComputedStyle.
+        (WebCore::EditingStyle::removeStyleAddedByNode): Added.
+        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode): Added.
+        (WebCore::EditingStyle::removeNonEditingProperties): Added.
+        (WebCore::editingStyleIncludingTypingStyle): Calls copyEditingProperties.
+        * editing/EditingStyle.h: Added prototypes.
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionComputedStyle): Uses EditingStyle.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Ditto.
+        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Ditto.
+        * editing/InsertParagraphSeparatorCommand.h:
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Ditto.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion): Ditto.
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Ditto.
+        (WebCore::ReplaceSelectionCommand::doApply): Ditto.
+        (WebCore::ReplaceSelectionCommand::completeHTMLReplacement): Ditto.
+        * editing/ReplaceSelectionCommand.h:
+        * editing/markup.cpp: Removed removeEnclosingMailBlockquoteStyle and removeDefaultStyles.
+        (WebCore::createMarkup): Uses EditingStyle.
+
+2010-11-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Media objects in nested iframes showing above everything else in TinyMCE
+        https://bugs.webkit.org/show_bug.cgi?id=44877
+
+        Tests: compositing/iframes/become-composited-nested-iframes.html
+               compositing/iframes/overlapped-nested-iframes.html
+        
+        The overlap testing logic that connects compositing across iframe boundaries
+        needed to be educated about nestd iframes, for platforms (i.e. Mac) where iframes
+        are allowed to be independently composited.
+        
+        Also fix a bug that could cause iframes (and possibly other elements) that share
+        style to fail to become composited.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Disable style sharing for elements
+        that force synethetic style updates in order to gain RenderLayers, so they can become
+        composited. This is tested by become-composited-nested-iframes.html, though it is very
+        timing-dependent.
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCompositedContentIncludingDescendants): New method that
+        is a "deep" version of hasCompositedContent() on platforms where that is necessary to ask.
+        
+        (WebCore::FrameView::hasCompositingAncestor): New method.
+        (WebCore::FrameView::setIsOverlapped): If we can have independently composited iframes,
+        we need to force all descendant iframes to update so that compositing gets hooked up across
+        nested iframes.
+        
+        (WebCore::FrameView::isOverlappedIncludingAncestors): New method, only called on platforms
+        where allowsIndependentlyCompositedIFrames() is true.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::allowsIndependentlyCompositedIFrames): Utility method that
+        returns true if an iframe can be a compositing root.
+        
+        (WebCore::RenderLayerCompositor::shouldPropagateCompositingToEnclosingIFrame): Make use of
+        allowsIndependentlyCompositedIFrames().
+        
+        (WebCore::RenderLayerCompositor::notifyIFramesOfCompositingChange): We need to notify all
+        descendant frames, not just children.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle): Add assert to ensure that we don't do style sharing
+        for elements that play tricks with synthetic style changes.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Run overlap testing if a frame has any composited
+        descendants.
+
+2010-11-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect image map used when multiple maps have the same name
+        https://bugs.webkit.org/show_bug.cgi?id=49086
+
+        Tests: fast/images/image-map-multiple.html
+               fast/images/image-map-multiple-xhtml.xhtml
+
+        Factored out the code used to look up elements by id and reused it
+        to look up maps by name. It handles multiple elements efficiently.
+
+        * dom/Document.cpp:
+        (WebCore::Document::DocumentOrderedMap::clear): Added.
+        (WebCore::Document::DocumentOrderedMap::add): Added. Has code that
+        was formerly in addElementById.
+        (WebCore::Document::DocumentOrderedMap::remove): Added. Has code that
+        was formerly in removeElementById.
+        (WebCore::Document::DocumentOrderedMap::get): Added. Has code that
+        was formerly in getElementById.
+        (WebCore::keyMatchesId): Added.
+        (WebCore::Document::getElementById): Use DocumentOrderedMap::get.
+        (WebCore::Document::addElementById): Use DocumentOrderedMap::add.
+        (WebCore::Document::removeElementById): Use DocumentOrderedMap::remove.
+        (WebCore::Document::addImageMap): Use DocumentOrderedMap::add.
+        (WebCore::Document::removeImageMap): Use DocumentOrderedMap::remove.
+        (WebCore::keyMatchesMapName): Added.
+        (WebCore::keyMatchesLowercasedMapName): Added.
+        (WebCore::Document::getImageMap): Use DocumentOrderedMap::get.
+
+        * dom/Document.h: Added DocumentOrderedMap class, used inside the
+        Document class. Changed m_imageMapsByName to be a DocumentOrderedMap.
+        Changed m_elementsById to be a DocumentOrderedMap. Eliminated
+        m_duplicateIds, since DocumentOrderedMap now has that internally.
+
+2010-11-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48685
+        Notify UI process about focused frame
+
+        * WebCore.xcodeproj/project.pbxproj: Adding developmentRegion back.
+
+        * loader/EmptyClients.h: (WebCore::EmptyChromeClient::focusedFrameChanged):
+        * page/Chrome.cpp: (WebCore::Chrome::focusedFrameChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        Added a new Chrome client notification.
+
+        * page/FocusController.cpp: (WebCore::FocusController::setFocusedFrame): Notify chrome.
+
+2010-11-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove use of HIGetScaleFactor
+        https://bugs.webkit.org/show_bug.cgi?id=49186
+        <rdar://problem/8618410>
+
+        Scale factors can vary on a display-by-display basis and it doesn't make sense
+        to compute scale factor event coordinates like this.
+
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::globalMousePosForPlugin):
+
+2010-11-08  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Make the necessary changes in TextureMapperNode in preparation of making it possible to paint it
+        from a different thread.
+        The main problematic part was the cache, which made it so that textures can become invalid and have to
+        be rerendered from content during paint. This is solved here by creating a pack/unpack function for
+        textures, which lets a texture archive its data away from video memory, or do whatever the platform
+        thinks is right for freeing memory without needing to re-render again from content (which cannot be
+        made thread safe).
+
+        After this change, TextureMapperNode moved to its own file, and has 2 entry points: paint and syncCompositingState.
+        The idea is that syncCompositingState has to be called in the UI thread, paint can be called from a different
+        thread, and they should block each other.
+
+        The new test tests the cache code-path, to show that the pack/unpack technique works for cases where it
+        kicks in.
+
+        Test: compositing/layer-creation/many-layers.html
+
+        * WebCore.pro:
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::~BitmapTextureGL):
+        (WebCore::BitmapTextureGL::BitmapTextureGL):
+        (WebCore::TextureMapperGL::TextureMapperGL):
+        (WebCore::TextureMapperGL::drawTexture):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::create):
+        * platform/graphics/qt/TextureMapperQt.cpp:
+        (WebCore::BitmapTextureQt::pack):
+        (WebCore::BitmapTextureQt::unpack):
+        (WebCore::TextureMapper::create):
+        (WebCore::BitmapTextureQt::BitmapTextureQt):
+        * platform/graphics/qt/TextureMapperQt.h: Added.
+
+2010-11-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Allow applets to participate in accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=49117
+        <rdar://problem/8625819>
+        
+        Add RenderApplet to the list of renderers that can optionally get RenderLayers,
+        and be composited for some reason.
+
+        Not currently testable.
+
+        * rendering/RenderApplet.h: Outdented the class declaration.
+
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::requiresLayer): Return true if the underlying widget
+        has a platform layer.
+        (WebCore::RenderApplet::allowsAcceleratedCompositing): Check the widget to see
+        if it has a platform layer.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly): Reformat, and add isApplet().
+        (WebCore::RenderLayer::isSelfPaintingLayer): Reformat, and add isApplet().
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Use 'renderer' local variable
+        for efficiency. Now check for embedded objects and applets.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin): Check for embedded objects and applets.
+
+2010-11-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add missing files to fix distcheck.
+
+2010-11-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        getPropertyValue("background") causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=49055
+
+        Test: fast/css/background-norepeat-crash.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+
+2010-11-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Wrapped DOM bindings GObjects do not disconnect event listeners when they die
+        https://bugs.webkit.org/show_bug.cgi?id=49136
+
+        When GObjects are finalized and freed, disconnect their event listeners, so that
+        WebCore does not try to fire signals on dead GObjects. We do this by holding a weak
+        reference to the GObject in the signal listener. When the weak reference notification
+        callback is executed, we disconnect the event listener.
+
+        No new tests; this fix is proved by prevention of crashes in soon to be
+        landed editing delegate signals, which are covered by the layout tests.
+
+        * bindings/gobject/GObjectEventListener.cpp:
+        (WebCore::GObjectEventListener::GObjectEventListener): Updated the constructor.
+        (WebCore::GObjectEventListener::~GObjectEventListener): Disconnect the weak reference
+        if the GObject is still alive.
+        (WebCore::GObjectEventListener::gobjectDestroyed): When the GObject is destroyed,
+        disconnect the appropriate event listener.
+        (WebCore::GObjectEventListener::handleEvent): Changes to reflect use of CString
+        instead of WebCore string.
+        * bindings/gobject/GObjectEventListener.h:
+        (WebCore::GObjectEventListener::addEventListener): Changed create to addEventListener,
+        so that the connection and disconnection is an internal contract to the class.
+        (WebCore::GObjectEventListener::gobjectDestroyedCallback): Added.
+        * bindings/scripts/CodeGeneratorGObject.pm: Modified the code generate to use
+        GObjectEventListener::addEventListener and no longer call addEventListener on
+        its own.
+
+2010-11-08  Adam Roben  <aroben@apple.com>
+
+        Windows Release build fix after r71514
+
+        The build was failing due to an alignment error. Strangely, depending
+        on the order of SVGStaticPropertyTearOff's members, the build will
+        either fail in Release (as it does before this change), or Debug (as it
+        did before r71514), but not both.
+
+        * svg/properties/SVGStaticPropertyTearOff.h:
+        (WebCore::SVGStaticPropertyTearOff::SVGStaticPropertyTearOff): Copied
+        the #pragma pack trick from JSSVGPODTypeWrapper.h, which has similar
+        issues.
+
+2010-11-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: decouple ScriptArguments from ScriptCallStack
+        https://bugs.webkit.org/show_bug.cgi?id=48058
+
+        ScriptCallFrame and ScriptCallStack are now the same for both JSC and V8.
+        The factory functions that allow to create ScriptCallStack from VM-specific
+        objects are defined in ScriptCallStackFactory.cpp.
+
+        ScriptArguments class is used for passing arguments from JS code to the native
+        part.
+
+        No new tests. This refactoring is covered with existing Console tests.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/js/ScriptCallStackFactory.cpp: Renamed from WebCore/bindings/js/ScriptCallStack.cpp.
+        (WebCore::createScriptCallStack):
+        (WebCore::createScriptArguments):
+        (WebCore::ScriptCallStack::stackTrace):
+        * bindings/js/ScriptCallStackFactory.h: Copied from WebCore/bindings/js/ScriptCallFrame.cpp.
+        * bindings/js/ScriptState.cpp:
+        (WebCore::ScriptStateProtectedPtr::~ScriptStateProtectedPtr):
+        (WebCore::ScriptStateProtectedPtr::ScriptStateProtectedPtr):
+        (WebCore::ScriptStateProtectedPtr::get):
+        * bindings/js/ScriptState.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionCustomArgsAndException):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::customArgsAndExceptionCallback):
+        * bindings/v8/ScriptCallFrame.h: Removed.
+        * bindings/v8/ScriptCallStack.h: Removed.
+        * bindings/v8/ScriptCallStackFactory.cpp: Renamed from WebCore/bindings/v8/ScriptCallStack.cpp.
+        (WebCore::toScriptCallFrame):
+        (WebCore::toScriptCallFramesVector):
+        (WebCore::createScriptCallStack):
+        (WebCore::createScriptArguments):
+        (WebCore::ScriptCallStack::stackTrace):
+        * bindings/v8/ScriptCallStackFactory.h: Copied from WebCore/bindings/js/ScriptCallFrame.cpp.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::setCaptureCallStackForUncaughtExceptions):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptStateProtectedPtr::get):
+        * bindings/v8/V8ConsoleMessage.cpp:
+        (WebCore::V8ConsoleMessage::handler):
+        (WebCore::V8ConsoleMessage::dispatchNow):
+        * bindings/v8/V8ConsoleMessage.h:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::traceCallback):
+        (WebCore::V8Console::assertCallback):
+        (WebCore::V8Console::profileCallback):
+        (WebCore::V8Console::profileEndCallback):
+        * dom/NodeFilter.h:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        * inspector/InspectorController.h:
+        * inspector/ScriptArguments.cpp: Copied from WebCore/bindings/v8/ScriptCallFrame.cpp.
+        (WebCore::ScriptArguments::ScriptArguments):
+        (WebCore::ScriptArguments::~ScriptArguments):
+        (WebCore::ScriptArguments::argumentAt):
+        (WebCore::ScriptArguments::globalState):
+        (WebCore::ScriptArguments::getFirstArgumentAsString):
+        (WebCore::ScriptArguments::isEqual):
+        * inspector/ScriptArguments.h: Copied from WebCore/bindings/js/ScriptCallFrame.h.
+        (WebCore::ScriptArguments::argumentCount):
+        * inspector/ScriptCallFrame.cpp: Renamed from WebCore/bindings/v8/ScriptCallFrame.cpp.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::isEqual):
+        (WebCore::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h: Renamed from WebCore/bindings/js/ScriptCallFrame.h.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        * inspector/ScriptCallStack.cpp: Renamed from WebCore/bindings/js/ScriptCallFrame.cpp.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        (WebCore::ScriptCallStack::size):
+        (WebCore::ScriptCallStack::isEqual):
+        (WebCore::ScriptCallStack::buildInspectorObject):
+        * inspector/ScriptCallStack.h: Renamed from WebCore/bindings/js/ScriptCallStack.h.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        (WebCore::Console::debug):
+        (WebCore::Console::error):
+        (WebCore::Console::info):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::dirxml):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::count):
+        (WebCore::Console::markTimeline):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupCollapsed):
+        (WebCore::Console::shouldCaptureFullStackTrace):
+        (WebCore::Console::warn):
+        * page/Console.h:
+        (WebCore::Console::profiles):
+        * page/Console.idl:
+
+2010-11-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix.
+        
+        Attempt to fix windows builds after r71512. Swap order of members to avoid warning C4121.
+
+        * svg/properties/SVGStaticPropertyTearOff.h:
+        (WebCore::SVGStaticPropertyTearOff::SVGStaticPropertyTearOff):
+
+2010-11-08  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Unreviewed. Fix Qt build after r71511.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+
+2010-11-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Convert SVGPoint/SVGPointList to the new SVGPropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=49067
+
+        Remove SVGAnimatedPoints interface, not reachable through bindings anyway, it was just another MI interface, that
+        now has been integrated into SVGPolylineElement/SVGPolygonElement, simplfying the generation and avoiding virtual
+        calls in SVGPolylineElement/SVGPolygonElement.
+
+        Remove the need to use manual XML <-> SVG DOM synchronization. The points/animatedPoints methods now create
+        SVGListPropertyTearOffs, thus using the same synchronization/expose-to-bindings concept like all other
+        animated properties.
+
+        Convert SVGPoint/SVGPointList to use the new SVGPropertyTearOff concept, adapted all code, as SVGPointList
+        is now a plain Vector<FloatPoint>. Enable StrictTypeChecking for SVGPoint.
+
+        Test: svg/dom/SVGPoint.html
+
+        * Android.derived.v8bindings.mk: Remove SVGAnimatedPoints (and IDL generation).
+        * Android.mk: Ditto.
+        * CMakeLists.txt: Ditto.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto. Add SVGStaticPropertyTearOff.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.order: Remove SVGAnimatedPoints symbols.
+        * WebCore.pro: Remove SVGAnimatedPoints (and IDL generation). Add SVGStaticPropertyTearOff.h to build.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOMSVG.h: Remove DOMSVGAnimatedPoints include.
+        * bindings/scripts/CodeGenerator.pm: Adapt code converting SVGPoint/SVGPointList to use the new SVGPropertyTearOff concepts.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * rendering/SVGRenderTreeAsText.cpp: Adapt for SVGPolyElement API change, use pointList() instead of points() (which is only used for bindings now).
+        (WebCore::operator<<):
+        * svg/SVGAllInOne.cpp: Remove SVGAnimatedPoints.cpp.
+        * svg/SVGAnimateElement.cpp: Adapt for SVGPointList API change, it's not refcounted anymore.
+        (WebCore::SVGAnimateElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateElement::calculateFromAndToValues):
+        (WebCore::SVGAnimateElement::applyResultsToTarget):
+        * svg/SVGAnimateElement.h:  Ditto.
+        * svg/SVGAnimatedPoints.cpp: Removed.
+        * svg/SVGAnimatedPoints.h: Removed.
+        * svg/SVGAnimatedPoints.idl: Removed.
+        * svg/SVGParserUtilities.cpp: Adapt for SVGPointList API change, it's not refcounted anymore.
+        (WebCore::pointsListFromSVGData):
+        * svg/SVGParserUtilities.h: Ditto.
+        * svg/SVGPoint.idl: Remove PODType marker, and add StrictTypeChecking for x/y attributes.
+        * svg/SVGPointList.cpp: SVGPointList is now a plain Vector<FloatPoint>, rewrite.
+        (WebCore::SVGPointList::valueAsString):
+        (WebCore::SVGPointList::createAnimated):
+        * svg/SVGPointList.h: Ditto.
+        (WebCore::SVGPointList::SVGPointList):
+        * svg/SVGPolyElement.cpp: Remove manual SVG <-> XML DOM synchronization. Now handles through the SVGAnimatedPropertyTearOff concept.
+        (WebCore::SVGPolyElement::parseMappedAttribute):
+        (WebCore::SVGPolyElement::svgAttributeChanged):
+        (WebCore::SVGPolyElement::synchronizeProperty):
+        (WebCore::SVGPolyElement::synchronizePoints):
+        (WebCore::SVGPolyElement::points):
+        (WebCore::SVGPolyElement::animatedPoints):
+        * svg/SVGPolyElement.h: Reindented.
+        (WebCore::SVGPolyElement::pointList):
+        (WebCore::SVGPolyElement::isValid):
+        (WebCore::SVGPolyElement::supportsMarkers):
+        * svg/SVGPolygonElement.cpp: Adapt for SVGPointList API change.
+        (WebCore::SVGPolygonElement::toPathData):
+        * svg/SVGPolygonElement.idl: Remove SVGAnimatedPoints inheritance.
+        * svg/SVGPolylineElement.cpp: Adapt for SVGPointList API change.
+        (WebCore::SVGPolylineElement::toPathData):
+        * svg/SVGPolylineElement.idl: Remove SVGAnimatedPoints inheritance.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::setCurrentTranslate): Use updateCurrentTranslate().
+        (WebCore::SVGSVGElement::updateCurrentTranslate): Added, only used by the bindings, after changing a value of SVGStaticPropertyTearOff object.
+        * svg/SVGSVGElement.h:
+        (WebCore::SVGSVGElement::currentTranslate): Return reference to m_translation.
+        * svg/properties/SVGPropertyTearOff.h: Made constructors protected, as SVGStaticPropertyTearOff inherits from it.
+        (WebCore::SVGPropertyTearOff::commitChange):
+        * svg/properties/SVGPropertyTraits.h: Add SVGPointList handing.
+        * svg/properties/SVGStaticPropertyTearOff.h: Added. Used for SVGProperty types returned by attributes, that are not associated with a SVGAnimatedProperty. (SVGSVGElement::currentTranslate).
+        (WebCore::SVGStaticPropertyTearOff::create):
+        (WebCore::SVGStaticPropertyTearOff::commitChange):
+        (WebCore::SVGStaticPropertyTearOff::SVGStaticPropertyTearOff):
+
+2010-11-08  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Web Inspector [Chromium]: Make CPU profiling to survive navigation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48843
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+        (WebCore::InspectorController::reuseFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::restoreProfiler):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::startProfiling):
+        (WebCore::InspectorController::stopProfiling):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        (WebCore::InspectorProfilerAgent::stopUserInitiatedProfiling):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.hasTemporaryProfile):
+        (WebInspector.ProfilesPanel.prototype.hasProfile):
+        * inspector/front-end/inspector.js:
+        (WebInspector.setRecordingProfile):
+
+2010-11-08  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGFEConvolveMatrixElement doesn't support dynamic invalidation
+        https://bugs.webkit.org/show_bug.cgi?id=47660
+
+        Wrap orderX and orderY into the common order property according to the w3 standard and remove them from svnattrs.in.
+        The patch implements the orderXIdentifier and orderYIdentifier getter functions to reach
+        properly the orderX and orderY components of order property from SVG DOM.
+
+        Tests: svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-bias-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-divisor-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-edgeMode-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-in-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-kernelMatrix-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-kernelUnitLength-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-order-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-preserveAlpha-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-targetX-prop.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-svgdom-targetY-prop.html
+
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::orderXIdentifier):
+        (WebCore::SVGFEConvolveMatrixElement::orderYIdentifier):
+        * svg/SVGFEConvolveMatrixElement.h:
+        * svg/svgattrs.in:
+
+2010-11-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Rename CachedResourceLoader::m_doc to CachedResourceLoader::m_document
+        https://bugs.webkit.org/show_bug.cgi?id=49163
+
+        The usual convention is to use "document", not "doc" to refer to the
+        document.
+
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::cachedImage):
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::shouldAllowExternalLoad):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::CachedResourceLoader):
+        (WebCore::CachedResourceLoader::frame):
+        (WebCore::CachedResourceLoader::requestImage):
+        (WebCore::CachedResourceLoader::canRequest):
+        (WebCore::CachedResourceLoader::requestResource):
+        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
+        (WebCore::CachedResourceLoader::preload):
+        (WebCore::CachedResourceLoader::checkForPendingPreloads):
+        (WebCore::CachedResourceLoader::requestPreload):
+        * loader/cache/CachedResourceLoader.h:
+        (WebCore::CachedResourceLoader::document):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::requestResource):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::Host::servePendingRequests):
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::docLoaderFunc):
+
+2010-11-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Remove some unneeded includes.
+
+        * loader/FrameLoader.cpp:
+        * loader/PlaceholderDocument.cpp:
+
+2010-11-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename Cache to MemoryCache
+        https://bugs.webkit.org/show_bug.cgi?id=49159
+
+        So sayeth the diagram.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSImageValue.cpp:
+        * dom/ContainerNode.cpp:
+        * history/PageCache.cpp:
+        * inspector/InspectorCSSStore.h:
+        * inspector/InspectorResourceAgent.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        * loader/cache/Cache.cpp: Removed.
+        * loader/cache/Cache.h: Removed.
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
+        * loader/cache/CachedFont.cpp:
+        * loader/cache/CachedFont.h:
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::destroyDecodedData):
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedResource.cpp:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        * loader/cache/CachedResourceLoader.h:
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::destroyDecodedData):
+        * loader/cache/MemoryCache.cpp: Copied from WebCore/loader/cache/Cache.cpp.
+        (WebCore::cache):
+        (WebCore::MemoryCache::MemoryCache):
+        (WebCore::MemoryCache::requestResource):
+        (WebCore::MemoryCache::requestUserCSSStyleSheet):
+        (WebCore::MemoryCache::revalidateResource):
+        (WebCore::MemoryCache::revalidationSucceeded):
+        (WebCore::MemoryCache::revalidationFailed):
+        (WebCore::MemoryCache::resourceForURL):
+        (WebCore::MemoryCache::deadCapacity):
+        (WebCore::MemoryCache::liveCapacity):
+        (WebCore::MemoryCache::pruneLiveResources):
+        (WebCore::MemoryCache::pruneDeadResources):
+        (WebCore::MemoryCache::setCapacities):
+        (WebCore::MemoryCache::makeResourcePurgeable):
+        (WebCore::MemoryCache::evict):
+        (WebCore::MemoryCache::addCachedResourceLoader):
+        (WebCore::MemoryCache::removeCachedResourceLoader):
+        (WebCore::MemoryCache::lruListFor):
+        (WebCore::MemoryCache::removeFromLRUList):
+        (WebCore::MemoryCache::insertInLRUList):
+        (WebCore::MemoryCache::resourceAccessed):
+        (WebCore::MemoryCache::removeFromLiveDecodedResourcesList):
+        (WebCore::MemoryCache::insertInLiveDecodedResourcesList):
+        (WebCore::MemoryCache::addToLiveResourcesSize):
+        (WebCore::MemoryCache::removeFromLiveResourcesSize):
+        (WebCore::MemoryCache::adjustSize):
+        (WebCore::MemoryCache::TypeStatistic::addResource):
+        (WebCore::MemoryCache::getStatistics):
+        (WebCore::MemoryCache::setDisabled):
+        (WebCore::MemoryCache::dumpStats):
+        (WebCore::MemoryCache::dumpLRULists):
+        * loader/cache/MemoryCache.h: Copied from WebCore/loader/cache/Cache.h.
+        (WebCore::MemoryCache::shouldMakeResourcePurgeableOnEviction):
+        * loader/loader.cpp:
+        * page/EventSource.cpp:
+        * page/Settings.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest):
+
+2010-11-07  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Attempt to fix the windows build.
+
+        Move the rest of the cache-related files into loader/cache
+        https://bugs.webkit.org/show_bug.cgi?id=49156
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+
+2010-11-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move the rest of the cache-related files into loader/cache
+        https://bugs.webkit.org/show_bug.cgi?id=49156
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/CachePolicy.h: Removed.
+        * loader/CachedCSSStyleSheet.cpp: Removed.
+        * loader/CachedCSSStyleSheet.h: Removed.
+        * loader/CachedFont.cpp: Removed.
+        * loader/CachedFont.h: Removed.
+        * loader/CachedImage.cpp: Removed.
+        * loader/CachedImage.h: Removed.
+        * loader/CachedResource.cpp: Removed.
+        * loader/CachedResource.h: Removed.
+        * loader/CachedResourceClient.h: Removed.
+        * loader/CachedResourceClientWalker.cpp: Removed.
+        * loader/CachedResourceClientWalker.h: Removed.
+        * loader/CachedResourceHandle.cpp: Removed.
+        * loader/CachedResourceHandle.h: Removed.
+        * loader/CachedResourceLoader.cpp: Removed.
+        * loader/CachedResourceLoader.h: Removed.
+        * loader/CachedScript.cpp: Removed.
+        * loader/CachedScript.h: Removed.
+        * loader/CachedXSLStyleSheet.cpp: Removed.
+        * loader/CachedXSLStyleSheet.h: Removed.
+        * loader/cache/CachePolicy.h: Copied from WebCore/loader/CachePolicy.h.
+        * loader/cache/CachedCSSStyleSheet.cpp: Copied from WebCore/loader/CachedCSSStyleSheet.cpp.
+        * loader/cache/CachedCSSStyleSheet.h: Copied from WebCore/loader/CachedCSSStyleSheet.h.
+        * loader/cache/CachedFont.cpp: Copied from WebCore/loader/CachedFont.cpp.
+        * loader/cache/CachedFont.h: Copied from WebCore/loader/CachedFont.h.
+        * loader/cache/CachedImage.cpp: Copied from WebCore/loader/CachedImage.cpp.
+        * loader/cache/CachedImage.h: Copied from WebCore/loader/CachedImage.h.
+        * loader/cache/CachedResource.cpp: Copied from WebCore/loader/CachedResource.cpp.
+        * loader/cache/CachedResource.h: Copied from WebCore/loader/CachedResource.h.
+        * loader/cache/CachedResourceClient.h: Copied from WebCore/loader/CachedResourceClient.h.
+        * loader/cache/CachedResourceClientWalker.cpp: Copied from WebCore/loader/CachedResourceClientWalker.cpp.
+        * loader/cache/CachedResourceClientWalker.h: Copied from WebCore/loader/CachedResourceClientWalker.h.
+        * loader/cache/CachedResourceHandle.cpp: Copied from WebCore/loader/CachedResourceHandle.cpp.
+        * loader/cache/CachedResourceHandle.h: Copied from WebCore/loader/CachedResourceHandle.h.
+        * loader/cache/CachedResourceLoader.cpp: Copied from WebCore/loader/CachedResourceLoader.cpp.
+        * loader/cache/CachedResourceLoader.h: Copied from WebCore/loader/CachedResourceLoader.h.
+        * loader/cache/CachedScript.cpp: Copied from WebCore/loader/CachedScript.cpp.
+        * loader/cache/CachedScript.h: Copied from WebCore/loader/CachedScript.h.
+        * loader/cache/CachedXSLStyleSheet.cpp: Copied from WebCore/loader/CachedXSLStyleSheet.cpp.
+        * loader/cache/CachedXSLStyleSheet.h: Copied from WebCore/loader/CachedXSLStyleSheet.h.
+
+2010-11-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename X-Purpose to Purpose
+        https://bugs.webkit.org/show_bug.cgi?id=47802
+
+        As requested by IETF HTTP WG.  This patch is part of a larger movement
+        in the HTTP community to move away from X- headers.  Various senior
+        folks at the IETF believe they're a failed experiment:
+
+        http://tools.ietf.org/html/draft-saintandre-xdash-considered-harmful
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2010-11-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Barth.
+
+        Assert that a non-null PassRefPtr<Document> has a non-null frame in Frame::setDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=49152
+
+        Add an ASSERT to ensure that a non-null Document has a non-null Frame
+        in Frame::setDocument().
+
+        Currently, whenever Frame::setDocument() is called with a non-null
+        Document the Document has a non-null Frame. We should assert this
+        invariant.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setDocument):
+
+2010-11-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move Cache.* into loader/cache in as a start to cleaning up loader/
+        https://bugs.webkit.org/show_bug.cgi?id=49153
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/cache/Cache.cpp: Renamed from WebCore/loader/Cache.cpp.
+        (WebCore::cache):
+        (WebCore::Cache::Cache):
+        (WebCore::createResource):
+        (WebCore::Cache::requestResource):
+        (WebCore::Cache::requestUserCSSStyleSheet):
+        (WebCore::Cache::revalidateResource):
+        (WebCore::Cache::revalidationSucceeded):
+        (WebCore::Cache::revalidationFailed):
+        (WebCore::Cache::resourceForURL):
+        (WebCore::Cache::deadCapacity):
+        (WebCore::Cache::liveCapacity):
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::setCapacities):
+        (WebCore::Cache::makeResourcePurgeable):
+        (WebCore::Cache::evict):
+        (WebCore::Cache::addCachedResourceLoader):
+        (WebCore::Cache::removeCachedResourceLoader):
+        (WebCore::fastLog2):
+        (WebCore::Cache::lruListFor):
+        (WebCore::Cache::removeFromLRUList):
+        (WebCore::Cache::insertInLRUList):
+        (WebCore::Cache::resourceAccessed):
+        (WebCore::Cache::removeFromLiveDecodedResourcesList):
+        (WebCore::Cache::insertInLiveDecodedResourcesList):
+        (WebCore::Cache::addToLiveResourcesSize):
+        (WebCore::Cache::removeFromLiveResourcesSize):
+        (WebCore::Cache::adjustSize):
+        (WebCore::Cache::TypeStatistic::addResource):
+        (WebCore::Cache::getStatistics):
+        (WebCore::Cache::setDisabled):
+        (WebCore::Cache::dumpStats):
+        (WebCore::Cache::dumpLRULists):
+        * loader/cache/Cache.h: Renamed from WebCore/loader/Cache.h.
+        (WebCore::Cache::LRUList::LRUList):
+        (WebCore::Cache::TypeStatistic::TypeStatistic):
+        (WebCore::Cache::loader):
+        (WebCore::Cache::disabled):
+        (WebCore::Cache::setPruneEnabled):
+        (WebCore::Cache::prune):
+        (WebCore::Cache::setDeadDecodedDataDeletionInterval):
+        (WebCore::Cache::deadDecodedDataDeletionInterval):
+        (WebCore::Cache::remove):
+        (WebCore::Cache::shouldMakeResourcePurgeableOnEviction):
+
+2010-11-05  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] box-shadow does not blur (is solid) when using border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=46327
+
+        Implement blurred box-shadow when styling with border-radius.
+        This change is related to https://bugs.webkit.org/show_bug.cgi?id=44488
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+2010-11-07  John Reck  <jreck@google.com>
+
+        Reviewed by Steve Block.
+
+        Implements navigator.language for Android
+        https://bugs.webkit.org/show_bug.cgi?id=49099
+        
+        Android was previously hardcoding the value for WebCore::platformDefaultLanguage().
+        This patch removes the hardcoding and calls into the PlatformBridge to get the
+        correct language based off of the user's settings.
+
+        No new tests needed, this is already covered
+
+        * Android.mk:
+        * platform/android/LanguageAndroid.cpp: Added.
+        (WebCore::platformDefaultLanguage):
+        * platform/android/PlatformBridge.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+
+2010-11-07  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [qt] screenDepthPerComponent returns the wrong value
+
+        Return best estimate of the number of bits per color
+        rather than screen depth.
+
+        Add a layout test to sanity check screenDepthPerComponent.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20289
+
+        Test: fast/css/media-rule-screenDepthPerComponent.html
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+
+2010-11-07  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Add a helper function to avoid duplicated code.
+        https://bugs.webkit.org/show_bug.cgi?id=49085
+
+        * dom/SelectElement.cpp:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isKeyboardFocusable):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultArrowEventHandler):
+        * page/SpatialNavigation.cpp:
+        (WebCore::isSpatialNavigationEnabled):
+        * page/SpatialNavigation.h:
+
+2010-11-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: Some image resources don't display the image when selected in the Resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=48935
+
+        Marked resources loaded from memory cache as finished.
+
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.prototype.didLoadResourceFromMemoryCache):
+
+2010-11-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: XHR logging is not checked in context menu after browser restart.
+        https://bugs.webkit.org/show_bug.cgi?id=49133
+
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+
+2010-11-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed Windows build fix.
+
+        * editing/EditingAllInOne.cpp: Added EditingStyle.cpp
+
+2010-11-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 46335 - Add EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=46335
+
+        Added EditingStyle to WebCore/editing.  This class is intended to encapsulate getPropertiesNotIn, removeNonEditingProperties,
+        editingStyleAtPosition, and prepareEditingStyleToApplyAt in ApplyStyleCommand.cpp once deployed everywhere.
+        Deployed it in typing styles.
+
+        No new tests are added since this is a refactoring in progress.
+
+        * CMakeLists.txt: Added EditingStyle.cpp
+        * GNUmakefile.am: Added EditingStyle.cpp and EditingStyle.h
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs): Calls editingStyleIncludingTypingStyle.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses EditingStyle.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Ditto.
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Ditto.
+        * editing/DeleteSelectionCommand.h:
+        * editing/EditingStyle.cpp: Added.
+        (WebCore::editingStyleFromComputedStyle): Added.
+        (WebCore::EditingStyle::EditingStyle): Added.
+        (WebCore::EditingStyle::init): Added; a clone of ApplyStyleCommand::editingStyleAtPosition.
+        (WebCore::EditingStyle::removeTextFillAndStrokeColorsIfNeeded): Extracted from init.
+        (WebCore::EditingStyle::replaceFontSizeByKeywordIfPossible): Extracted from init.
+        (WebCore::EditingStyle::isEmpty): Added.
+        (WebCore::EditingStyle::setStyle): Added.
+        (WebCore::EditingStyle::clear): Added.
+        (WebCore::EditingStyle::removeBlockProperties): Added.
+        (WebCore::EditingStyle::prepareToApplyAt): Added.
+        (WebCore::editingStyleIncludingTypingStyle): Added.
+        * editing/EditingStyle.h: Added.
+        (WebCore::EditingStyle::create): Added.
+        (WebCore::EditingStyle::style): Added.
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Uses EditingStyle.
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::typingStyle): Uses EditingStyle.
+        (WebCore::SelectionController::clearTypingStyle): Uses EditingStyle.
+        (WebCore::SelectionController::setTypingStyle): Uses EditingStyle.
+        * rendering/style/RenderStyle.h: Added EditingStyle as a friend.
+
+2010-11-05  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47237
+        
+        Make selection work with vertical text.  This patch fixes a bug in the computation of lineTop.  For lines
+        with positive leading, lineTop was incorrectly including the top leading.  Since the flipping of lines
+        for "lr" and "bt" writing modes involved flipping using lineTop and lineBottom, an incorrect lineTop meant
+        that those modes were mis-rendering.  This is why the Japanese "lr" text examples have the first line smushed
+        too far against the border.
+        
+        Fixing lineTop to no longer incorrectly include top leading has implications for editing.  I ended up
+        rewriting positionForPoint to exactly match selection, since that seemed to be the most intuitive
+        behavior.  I got rid of the verticalClickFudgeFactor and now just use selectionTop and selectionBottom
+        instead of lineTop and lineBottom.  I am pretty sure the code used selectionTop in a previous incarnation
+        anyway and that I moved away from it when I implemented lineTop and lineBottom.  The code then grew
+        more complicated from people trying to work with lineTop and lineBottom, but going back to selectionTop
+        and selectionBottom is the right behavior I think.  One editing test has been updated after this change
+        (editing/selection/after-line-break.html), and one DOM test has been changed to not hit test past the
+        bottom of a line (fast/dom/Document/CaretRangeFromPoint/basic.html).
+        
+        I patched selection painting of InlineTextBoxes so that the leading going up to the next line box is used
+        for "lr" and "bt" modes instead of the previous box.  This makes sense for English text, but we may want
+        a different policy for Japanese text eventually (possibly just splitting the difference instead).  Leaving it
+        this way for now, and we can collect feedback on the design.
+        
+        I rewrote all of the selection gap painting code to be writing-mode aware.  During the course of rewriting this
+        code I noticed a bug in the logicalLeftSelectionOffset and logicalRightSelectionOffset functions where there
+        was a coordinate space mismatch on a comparison.  Fixing this improves the repaint/selection-clear.html test.
+
+        Added new tests in fast/blockflow/.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionBottom):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::blockDirectionOffset):
+        (WebCore::inlineDirectionOffset):
+        (WebCore::RenderBlock::logicalRectToPhysicalRect):
+        (WebCore::RenderBlock::selectionGaps):
+        (WebCore::RenderBlock::inlineSelectionGaps):
+        (WebCore::RenderBlock::blockSelectionGaps):
+        (WebCore::RenderBlock::blockSelectionGap):
+        (WebCore::RenderBlock::logicalLeftSelectionGap):
+        (WebCore::RenderBlock::logicalRightSelectionGap):
+        (WebCore::RenderBlock::logicalLeftSelectionOffset):
+        (WebCore::RenderBlock::logicalRightSelectionOffset):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::flipForWritingMode):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::logicalBottom):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        (WebCore::RootInlineBox::lineSelectionGap):
+        (WebCore::RootInlineBox::selectionTop):
+        (WebCore::RootInlineBox::selectionBottom):
+        * rendering/RootInlineBox.h:
+
+2010-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Just put things back the way they were. Too many mysterious linker errors.
+
+2010-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Undo most of the previous commit since the compiler seems to have trouble
+        with an inlined operator++ in debug builds.
+
+        * platform/DeprecatedPtrListImpl.cpp:
+        (WebCore::DeprecatedPtrListImplIterator::operator++):
+        * platform/DeprecatedPtrListImpl.h:
+
+2010-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Inline some DeprecatedPtrListImplIterator methods for performance
+        https://bugs.webkit.org/show_bug.cgi?id=49124
+
+        This is a ~4% performance improvement on some Peacekeepr "Community" tests.
+
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/DeprecatedPtrListImpl.h:
+        (WebCore::DeprecatedListNode::DeprecatedListNode):
+        (WebCore::DeprecatedPtrListImplIterator::current):
+        (WebCore::DeprecatedPtrListImplIterator::operator++):
+
+2010-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Gray-scale PNGs with color profiles don't decode properly on Chromium Mac
+        https://bugs.webkit.org/show_bug.cgi?id=49110
+
+        Applying the color profile from this PNG was causing the image to
+        triple in width.  This seems to be because both the PNG decoder and
+        CoreGraphics were trying to expand the gray-scale image to RGB.  To fix
+        this issue, I've disabled color profile support for gray-scale PNGs.
+
+        Test: fast/images/gray-scale-png-with-color-profile.html
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+
+2010-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Need to check if page is detached in Frame::transferChildFrameToNewDocument to avoid occasional crash
+        https://bugs.webkit.org/show_bug.cgi?id=49116
+
+        The fix is to add the check.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+
+2010-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Pasting large amounts of plain text in a text area is very slow
+        https://bugs.webkit.org/show_bug.cgi?id=49040
+        <rdar://problem/7640912>
+        
+        The optimization consists in skipping the ApplyStyle command when
+        pasting into a text area or into an element that has -webkit-user-modify: read-write-plaintext-only.
+        The biggest performance hit comes from iterating through
+        a large number of paragraph when no style change is needed.
+        A further step will be to improve the paragraph iteration when it
+        can't be avoided.
+        
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply): Check if the selection
+        is in a text form control or in an element that has -webkit-user-modify: read-write-plaintext-only
+        and force no style matching.
+
+2010-11-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by David Levin.
+
+        JSCallbackData::invokeCallback triggers layout from a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=49096
+
+        Fixed the bug by only calling updateStyleForAllDocuments when the context is document in
+        JSCallbackData::invokeCallback.
+
+        No new tests are added since many of existing workers tests hit the added assertion in debug builds.
+
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback): No longer calls updateStyleForAllDocuments unconditionally.
+        * dom/Document.cpp:
+        (WebCore::Document::updateStyleIfNeeded): Added ASSERT(isMainThread()).
+        (WebCore::Document::updateStyleForAllDocuments): Ditto.
+        (WebCore::Document::updateLayout): Ditto.
+
+2010-11-05  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Querying selection start and end should be const
+        https://bugs.webkit.org/show_bug.cgi?id=48786
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionStart):
+        (WebCore::RenderTextControl::selectionEnd):
+        (WebCore::RenderTextControl::visiblePositionForIndex):
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTextControl.h:
+
+2010-11-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Move resumeAnimations/suspendAnimations from Frame to AnimationController.
+        https://bugs.webkit.org/show_bug.cgi?id=49073
+
+        Changed the name of suspendAnimations/resumeAnimations to
+        suspendAnimationsInDocument/resumeAnimationsInDocument. These are no
+        longer exported, but have the same functionality as before. I then
+        added new suspendAnimations/resumeAnimations function which take
+        no params and suspend/resume on the frame owning the animation
+        controller and all its child frames. These are the functions that
+        are now exported. I then changed all the platform specific WebKit
+        code to use these functions.
+
+        * WebCore.exp.in:
+        * page/Frame.cpp:
+        * page/Frame.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::suspendAnimations):
+        (WebCore::AnimationControllerPrivate::resumeAnimations):
+
+2010-11-04  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Need to simulate DEPTH_STENCIL in framebufferRenderbuffer / getFramebufferAttachmentParameter
+        https://bugs.webkit.org/show_bug.cgi?id=49020
+
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::WebGLFramebuffer::getAttachment): Return the attached renderbuffer/texture.
+        (WebCore::WebGLFramebuffer::isIncomplete): Add an extra parameter deciding whether we should check internal format matching the attachment point or not.
+        (WebCore::WebGLFramebuffer::onAccess): Pass extra parameter in isIncomplete.
+        * html/canvas/WebGLFramebuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::checkFramebufferStatus): Pass extra parameter in isIncomplete.
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer): Emulate DEPTH_STENCIL_ATTACHMENT; re-attach previously conflicted buffers upon detachment.
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter): Throw an error when conflicted attachments exist.
+        (WebCore::WebGLRenderingContext::renderbufferStorage): Map DEPTH_STENCIL to DEPTH24_STENCIL8.
+        * platform/graphics/Extensions3D.h: Add DEPTH24_STENCIL8 enum and update the documentation.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer): Remove emulation code at this level.
+
+2010-11-05  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Keep a reference to the scrollbar in accessibility scrollbar.
+        https://bugs.webkit.org/show_bug.cgi?id=48896
+
+        * accessibility/AccessibilityScrollbar.h:
+        (WebCore::AccessibilityScrollbar::scrollbar):
+
+2010-11-05  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Add support for <select> element in single selection mode. We use space to
+        trigger arrow key handling for selection change or spatial navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=48937
+
+        * dom/SelectElement.cpp:
+        (WebCore::isSpatialNavigationEnabled):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2010-11-05  Charlie Reis  <creis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Need to expose HistoryController::previousItem() for Chromium WebKit API.
+        https://bugs.webkit.org/show_bug.cgi?id=48809
+
+        * loader/HistoryController.h:
+
+2010-11-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash in ApplyStyleCommand::surroundNodeRangeWithElement
+        https://bugs.webkit.org/show_bug.cgi?id=48581
+
+        The crash was caused by a false assertion that we can always recover selection in
+        ApplyStyleCommand::removeInlineStyle.  Fixed the crash by removing the assertion
+        and adding an early exit to the call site.  Also converted raw pointers to RefPtr
+        in surroundNodeRangeWithElement and addInlineStyleIfNeeded.
+
+        Test (non-Mac platforms): editing/style/iframe-onload-crash.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+
+2010-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49008
+        <rdar://problem/7906226> Frequent crashes on mail.yahoo.co.jp
+
+        Instance::m_runtimeObject used to be zeroed out by RuntimeObject destructor. But the
+        destructor may not be called immediately - GC first marks an object as dead, and only 
+        destroys it when its cell is overwritten. So, m_runtimeObject would keep pointing to a dead
+        object.
+
+        Functions in JSPluginElementFunctions.cpp put the RuntimeObject on stack for later use,
+        but if it's already dead, it can be overwritten before use.
+
+        The solution is of course to use WeakGCPtr, which returns 0 for dead objects.
+
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::Instance):
+        (JSC::Bindings::Instance::~Instance):
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::willDestroyRuntimeObject):
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::~RuntimeObject):
+        (JSC::Bindings::RuntimeObject::invalidate):
+
+2010-11-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make suspendAnimations/resumeAnimations and setCSSAnimations traverse through subframes and remember state
+        https://bugs.webkit.org/show_bug.cgi?id=46945
+
+        Add new funtions to suspend and resume animations. The go through all subframes and suspend or resume them
+        recursively.
+
+        Test: animations/stop-animation-on-suspend.html
+
+        * WebCore.exp.in:
+        * page/Frame.cpp:
+        (WebCore::Frame::suspendAnimations):
+        (WebCore::Frame::resumeAnimations):
+        * page/Frame.h:
+
+2010-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash in InspectorDOMAgent::innerParentNode.
+        https://bugs.webkit.org/show_bug.cgi?id=49054
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+
+2010-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: XHR logging in console should give complete view of resource.
+        https://bugs.webkit.org/show_bug.cgi?id=48998
+
+        Drive-by fixes: linkify line number to scripts panel, fall back to resources;
+        enable multiline console entry on shift modifier as well.
+        
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype._reset):
+        (WebInspector.NetworkPanel.prototype.refreshResource):
+        (WebInspector.NetworkPanel.prototype.canShowSourceLine):
+        (WebInspector.NetworkPanel.prototype.showSourceLine):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.showSourceLine):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showPanel):
+        (WebInspector.linkifyStringAsFragment):
+
+2010-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Clean up IDBTransactionBackend/Coordinator
+        https://bugs.webkit.org/show_bug.cgi?id=48425
+
+        Get rid of obsolete id and thus we don't need the factory method
+        on IDBTransactionCoordinator that creates IDBTransactionBackends.
+
+        Add an assert to IDBTransactionBackend to make sure we're not in
+        the coordinator and then remove the coordinators ref counting link
+        to the transaction.
+
+        Have the transaction backend zero out refs to the database when its
+        done using it.
+
+        Existing tests provide coverage for this refactoring.
+
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::create):
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::~IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::abort):
+        (WebCore::IDBTransactionBackendImpl::commit):
+        * storage/IDBTransactionBackendImpl.h:
+        * storage/IDBTransactionBackendInterface.h:
+        * storage/IDBTransactionCoordinator.cpp:
+        (WebCore::IDBTransactionCoordinator::didStartTransaction):
+        (WebCore::IDBTransactionCoordinator::didFinishTransaction):
+        (WebCore::IDBTransactionCoordinator::isActive):
+        (WebCore::IDBTransactionCoordinator::processStartedTransactions):
+        * storage/IDBTransactionCoordinator.h:
+
+2010-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        IDBFactoryBackend's reference to IDBDatabaseBackend should be weak
+        https://bugs.webkit.org/show_bug.cgi?id=48416
+
+        The factory's lifetime is that of the application, so without making
+        this weak, IDBDatabaseBackend's will never be closed until the app
+        terminates.
+
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::~IDBDatabaseBackendImpl):
+        * storage/IDBDatabaseBackendImpl.h:
+        (WebCore::IDBDatabaseBackendImpl::create):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::removeIDBDatabaseBackend):
+        (WebCore::IDBFactoryBackendImpl::removeSQLiteDatabase):
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBFactoryBackendImpl.h:
+
+2010-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        IDBObjectStoreBackend and IDBIndexBackend should not depend on IDBDatabaseBackend
+        https://bugs.webkit.org/show_bug.cgi?id=48410
+
+        Break dependency cyles between IDBDatabaseBackend and the other classes listed.
+        This was causing memory leaks.
+
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
+        (WebCore::IDBCursorBackendImpl::updateInternal):
+        (WebCore::IDBCursorBackendImpl::removeInternal):
+        (WebCore::IDBCursorBackendImpl::database):
+        * storage/IDBCursorBackendImpl.h:
+        (WebCore::IDBCursorBackendImpl::create):
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::sqliteDatabase):
+        * storage/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::create):
+        (WebCore::IDBIndexBackendImpl::storeName):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::sqliteDatabase):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::create):
+
+2010-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: inspector lags on large resources with numerous <script> tags.
+        https://bugs.webkit.org/show_bug.cgi?id=49060
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+
+2010-11-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace ARRAYSIZE with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48903
+
+        * platform/UUID.cpp:
+        (WebCore::createCanonicalUUIDString):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getWebLocData):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::createGlobalHDropContent):
+        (WebCore::createGlobalImageFileDescriptor):
+        (WebCore::ClipboardWin::files):
+        (WebCore::ClipboardWin::writeURL):
+        * platform/win/DragDataWin.cpp:
+        (WebCore::DragData::asFilenames):
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::safeCreateFile):
+
+2010-11-05  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Bug 48979 - [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48979
+
+        Function removeItemValuesAndWrappers(): Move code out of 'if' statement so that
+        'wrappers' and 'values' stay synced.
+
+        test: svg/dom/baseVal-animVal-crash.html doesn't ASSERT
+
+        * svg/properties/SVGListProperty.h:
+        (WebCore::SVGListProperty::removeItemValuesAndWrappers):
+
+2010-11-05  John Reck  <jreck@google.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        The change to SVGPropertyTearOff by CodeGeneratorV8.pm caused two build failures
+        for Android. One was a missing SVGPropertyTearOff.h include, the other was a 
+        missing forward declaration of FloatRect. Seems to be the result of:
+        https://bugs.webkit.org/show_bug.cgi?id=48204
+
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=49025
+
+        No tests needed, fixes build issue.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-11-05  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        CSSRule#parentRule always null
+        https://bugs.webkit.org/show_bug.cgi?id=46228
+
+        Ensure MediaList child rules have the MediaList set as parent
+        in order to correct their parentRule correctness.
+
+        Test: fast/dom/css-mediarule-parentRule.html
+
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::CSSMediaRule):
+
+2010-11-04  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2010-10-20  Chang Shu  <chang.shu@nokia.com>, Antonio Gomes <tonikitoo@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [Qt] Makes <input type=text> and <textarea> functional with
+        Spatial Navigation enabled. Before this patch, the focus cannot
+        move away from input box once it is in. This patch allows focus
+        move to neighbor nodes when the caret reaches the edge of the texts.
+        This patch does not support yet cases where the focused <input>
+        has a JS handler for the arrow keys.
+        https://bugs.webkit.org/show_bug.cgi?id=37153
+
+        Tests: fast/events/spatial-navigation/snav-input.html
+               fast/events/spatial-navigation/snav-textarea.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeMoveDown):
+        (WebCore::executeMoveLeft):
+        (WebCore::executeMoveRight):
+        (WebCore::executeMoveUp):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify):
+
+2010-11-04  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::dismissCorrectionPanel):
+
+2010-11-04  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        reversion bubble in WebViews
+        https://bugs.webkit.org/show_bug.cgi?id=47630
+        <rdar://problem/8530960>
+
+        Added manual test:
+        manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html
+        manual-tests/autocorrection/delete-to-dismiss-reversion.html
+        manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html
+        manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html
+        manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html
+
+        We can only manully test this feature for two reasons:
+        1. On Mac OS X, the result of spell checking is partly determined by past user usage. We can't
+           realiably generating test cases until we can disable user custom data during spell checking.
+        2. To exerciese this feature, we need a minimum of 0.3 second delay using WebCore timer.
+
+        This patch is to add reversion to correction panel. It consists of following major code changes:
+        1. Collected all autocorrection related member variables in Editor into a CorrectionPanelInfo
+           class to improve readability.
+        2. Changed signature of Editor::startCorrectionPanelTimer() to allow caller to specify the
+           type of correction panel--regular correction or reversion.
+        3. Made necessary changes to adopt reversion API in AppKit.
+        4. Use SUPPORT_CORRECTION_PANEL macro to improve readability.
+
+        * GNUmakefile.am: Added CorrectionPanelInfo.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/CorrectionPanelInfo.h: Added.
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection): Start correction panel timer for reversion when
+          the new selection is a caret selection at end of a previously corrected word.
+        (WebCore::Editor::appliedEditing): Stop timer at the beginning of the method instead of at the end.
+        (WebCore::Editor::~Editor): Adopted new method dismissCorrectionPanel().
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition): Adopted new method applyCorrectionPanelInfo().
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Code change for new m_correctionPanelInfo
+          member variable.
+        (WebCore::Editor::correctionPanelTimerFired): Change to handle reversion panel type.
+        (WebCore::Editor::handleRejectedCorrection): Ditto.
+        (WebCore::Editor::startCorrectionPanelTimer): Changed signature to allow passing in panel type.
+        (WebCore::Editor::stopCorrectionPanelTimer): Adopted macro SUPPORT_CORRECTION_PANEL.
+        (WebCore::Editor::handleCancelOperation): Ditto.
+        (WebCore::Editor::isShowingCorrectionPanel): Ditto.
+        (WebCore::Editor::dismissCorrectionPanel): Update m_correctionPanelInfo when correction panel
+          is dismissed.
+        (WebCore::Editor::applyCorrectionPanelInfo): Factored out code that applies autocorrection.
+        (WebCore::Editor::changeSelectionAfterCommand): Adopt macro SUPPORT_CORRECTION_PANEL.
+        * editing/Editor.h: Adopted CorrectionPanelInfo and add new member methods.
+        * editing/EditorCommand.cpp: Adopted macro SUPPORT_CORRECTION_PANEL
+        (WebCore::createCommandMap):
+        * editing/TypingCommand.cpp: Adopted macro SUPPORT_CORRECTION_PANEL and new signature of
+          startCorrectionPanelTimer().
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::showCorrectionPanel): Adopted new signature of base class method.
+        (WebCore::EmptyEditorClient::dismissCorrectionPanel):  Ditto.
+        * manual-tests/autocorrection/continue-typing-to-dismiss-reversion.html: Added.
+        * manual-tests/autocorrection/delete-to-dismiss-reversion.html: Added.
+        * manual-tests/autocorrection/delete-to-end-of-word-to-show-reversion.html: Added.
+        * manual-tests/autocorrection/move-to-end-of-word-to-show-reversion.html: Added.
+        * manual-tests/autocorrection/type-whitespace-to-dismiss-reversion.html: Added.
+        * page/EditorClient.h: Changed signature of showCorrectionPanel() and dismissCorrectionPanel().
+        * platform/graphics/mac/GraphicsContextMac.mm: Added comment to improve readability.
+        (WebCore::GraphicsContext::drawLineForTextChecking):
+
+2010-11-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made table layout and painting work with all writing modes. Hit-testing, repainting, tables
+        where some elements have their own layers, and cells whose writing mode differs from the
+        table’s are not supported yet.
+
+        Make tables work with vertical text
+        https://bugs.webkit.org/show_bug.cgi?id=46417
+
+        Tests: fast/table/027-vertical.html
+               fast/table/028-vertical.html
+               fast/table/035-vertical.html
+               fast/table/038-vertical.html
+               fast/table/040-vertical.html
+               fast/table/auto-with-percent-height-vertical.html
+               fast/table/border-collapsing/001-vertical.html
+               fast/table/border-collapsing/002-vertical.html
+               fast/table/border-collapsing/003-vertical.html
+               fast/table/border-collapsing/004-vertical.html
+               fast/table/border-collapsing/border-collapsing-head-foot-vertical.html
+               fast/table/border-collapsing/equal-precedence-resolution-vertical.html
+               fast/table/border-collapsing/rtl-border-collapsing-vertical.html
+               fast/table/colspanMinWidth-vertical.html
+               fast/table/fixed-with-auto-with-colspan-vertical.html
+               fast/table/growCellForImageQuirk-vertical.html
+               fast/table/height-percent-test-vertical.html
+               fast/table/percent-widths-stretch-vertical.html
+               fast/table/rowspan-paint-order-vertical.html
+               fast/table/table-display-types-vertical.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Changed to allow all writing modes for tables,
+        make row groups, rows, column groups and columns inherit the table’s writing mode. For now,
+        make cells do this too.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::parseMappedAttribute): Map align=center using logical properties.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable): Initialize m_borderStart and m_borderEnd.
+        (WebCore::RenderTable::styleDidChange): Changed the rule for when to use auto layout to look
+        at the logical width instead of the width.
+        (WebCore::RenderTable::computeLogicalWidth): Uses logical widths and works with perpendicular
+        containing blocks.
+        (WebCore::RenderTable::layout): Use logical lengths.
+        (WebCore::RenderTable::setCellLogicalWidths): Renamed setCellWidths() to this and updated for
+        the renaming of RenderTableSection::setCellWidths().
+        (WebCore::RenderTable::paintObject): Account for flipped modes.
+        (WebCore::RenderTable::subtractCaptionRect): Added this helper method the considers writing modes.
+        (WebCore::RenderTable::paintBoxDecorations): Adopted subtractCaptionRect().
+        (WebCore::RenderTable::paintMask): Ditto.
+        (WebCore::RenderTable::computePreferredLogicalWidths): Updated for the renaming of
+        recalcHorizontalBorders().
+        (WebCore::RenderTable::calcBorderStart): Renamed calcBorderLeft() to this and changed it to use
+        borderStart(). Splits odd number of pixels based on the physical side.
+        (WebCore::RenderTable::calcBorderEnd): Similar.
+        (WebCore::RenderTable::recalcBordersInRowDirection): Renamed recalcHorizontalBorders() to this
+        and updated for other renames.
+        (WebCore::RenderTable::borderBefore): Replaced borderTop() with this.
+        (WebCore::RenderTable::borderAfter): Similar.
+        (WebCore::RenderTable::outerBorderBefore): Similar.
+        (WebCore::RenderTable::outerBorderAfter): Similar.
+        (WebCore::RenderTable::outerBorderStart): Similar.
+        (WebCore::RenderTable::outerBorderEnd): Similar.
+        (WebCore::RenderTable::firstLineBoxBaseline): Changed to use logical heights.
+        (WebCore::RenderTable::overflowClipRect): Account for writing modes.
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::borderStart):
+        (WebCore::RenderTable::borderEnd):
+        (WebCore::RenderTable::borderLeft):
+        (WebCore::RenderTable::borderRight):
+        (WebCore::RenderTable::borderTop):
+        (WebCore::RenderTable::borderBottom):
+        (WebCore::RenderTable::outerBorderLeft):
+        (WebCore::RenderTable::outerBorderRight):
+        (WebCore::RenderTable::outerBorderTop):
+        (WebCore::RenderTable::outerBorderBottom):
+        (WebCore::RenderTable::bordersPaddingAndSpacingInRowDirection): Changed to match its name.
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleWillChange): Changed to detect changes to logical height.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowLogicalHeightToRowStyleLogicalHeightIfNotRelative): Renamed and changed to use
+        logical heights.
+        (WebCore::RenderTableSection::RenderTableSection): Updated initializers for new member variables.
+        (WebCore::RenderTableSection::addChild): Updated for rename.
+        (WebCore::RenderTableSection::ensureRows): Ditto.
+        (WebCore::RenderTableSection::addCell): Ditto. Also use logical heights.
+        (WebCore::RenderTableSection::setCellLogicalWidths): Renamed setCellWidths() to this, changed
+        to use logical widths.
+        (WebCore::RenderTableSection::calcRowLogicalHeight): Added “logical” to the name. Updated with
+        logical heights.
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::calcOuterBorderBefore):
+        (WebCore::RenderTableSection::calcOuterBorderAfter):
+        (WebCore::RenderTableSection::calcOuterBorderStart):
+        (WebCore::RenderTableSection::calcOuterBorderEnd):
+        (WebCore::RenderTableSection::recalcOuterBorder):
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        (WebCore::RenderTableSection::paintCell):
+        (WebCore::RenderTableSection::recalcCells):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::outerBorderBefore):
+        (WebCore::RenderTableSection::outerBorderAfter):
+        (WebCore::RenderTableSection::outerBorderStart):
+        (WebCore::RenderTableSection::outerBorderEnd):
+
+2010-11-04  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, trivial test fix.
+
+        Fix GTK build for http://trac.webkit.org/changeset/71373 .
+
+        * GNUmakefile.am: Add HTMLOutputElement.{cpp,h}
+
+2010-11-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Stale reference to RenderObject held as FrameView layoutRoot
+        https://bugs.webkit.org/show_bug.cgi?id=48019
+        
+        <progress> and <meter> shouldn't have children of its RenderObject,
+        which caused unexpected result.
+        This change suppresses child creation to prevent it.
+
+        Tests: fast/dom/HTMLMeterElement/meter-element-with-child-crash.html
+               fast/dom/HTMLProgressElement/progress-element-with-child-crash.html
+
+        * rendering/RenderIndicator.h:
+        (WebCore::RenderIndicator::canHaveChildren):
+
+2010-11-04  Kenichi Ishibashi  <bashi@google.com>
+
+        Reviewed by Kent Tamura.
+
+        [HTML5][Forms] Support for <output> element
+        https://bugs.webkit.org/show_bug.cgi?id=29363
+
+        Support for <output> element.
+
+        Tests: fast/dom/HTMLOutputElement/dom-settable-token-list.html
+               fast/dom/HTMLOutputElement/htmloutputelement-reset-event.html
+               fast/dom/HTMLOutputElement/htmloutputelement-validity.html
+               fast/dom/HTMLOutputElement/htmloutputelement-value.html
+               fast/dom/HTMLOutputElement/htmloutputelement.html
+
+        * Android.derived.jscbindings.mk: Added JSHTMLOutputElement.h.
+        * Android.derived.v8bindings.mk: Added V8HTMLOutputElement.h.
+        * Android.jscbindings.mk: Added JSHTMLOutputElementCustom.cpp.
+        * Android.mk: Added HTMLOutputElement.cpp.
+        * Android.v8bindings.mk: Added V8HTMLOutputElementCustom.cpp.
+        * CMakeLists.txt: Added HTMLOutputElement.{idl,cpp} and JSHTMLOutputElementCustom.cpp.
+        * DerivedSources.cpp: Added JSHTMLOutputElement.cpp.
+        * DerivedSources.make: Added HTMLOutputElement entry.
+        * GNUmakefile.am: Added JSHTMLOutputElement.{cpp,h}
+        * WebCore.gypi: Added HTMLOutputElement.{idl,cpp,h}, JSHTMLOutputElementCustom.cpp and V8HTMLOutputElementCustom.cpp
+        * WebCore.pri: Added HTMLOutputElement.idl.
+        * WebCore.pro: Added V8HTMLOutputElementCustom.cpp, JSHTMLOutputElementCustom.cpp and HTMLOutputElement.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Added entries for JSHTMLOutputElement.{cpp,h} and JSHTMLOutputElementCustom.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Added entries for JSHTMLOutputElementCustom.cpp, HTMLOutputElement.{cpp,h,idl}, JSHTMLOutputElement.{cpp,h}
+        * bindings/js/JSBindingsAllInOne.cpp: Added JSHTMLOutputElementCustom.cpp.
+        * bindings/js/JSHTMLOutputElementCustom.cpp: Added.
+        (WebCore::JSHTMLOutputElement::htmlFor):
+        (WebCore::JSHTMLOutputElement::setHtmlFor):
+        * bindings/v8/custom/V8DOMSettableTokenListCustom.cpp: Modified.
+        (WebCore::V8DOMSettableTokenList::indexedPropertyGetter): Returns null if the index is out of range.
+        * bindings/v8/custom/V8HTMLOutputElementCustom.cpp: Added.
+        (WebCore::V8HTMLOutputElement::htmlForAccessorGetter):
+        (WebCore::V8HTMLOutputElement::htmlForAccessorSetter):
+        * css/html.css: Added a default style of output element.
+        (output):
+        * html/DOMSettableTokenList.cpp: Fix bugs.
+        (WebCore::DOMSettableTokenList::item): Returns null string if the index is out of range.
+        (WebCore::DOMSettableTokenList::addInternal): Added check m_tokens.isNull().
+        (WebCore::DOMSettableTokenList::setValue): Set the value case sensitive.
+        * html/HTMLOutputElement.cpp: Added.
+        (WebCore::HTMLOutputElement::HTMLOutputElement):
+        (WebCore::HTMLOutputElement::create):
+        (WebCore::HTMLOutputElement::formControlType):
+        (WebCore::HTMLOutputElement::parseMappedAttribute):
+        (WebCore::HTMLOutputElement::htmlFor):
+        (WebCore::HTMLOutputElement::setFor):
+        (WebCore::HTMLOutputElement::setForm):
+        (WebCore::HTMLOutputElement::childrenChanged):
+        (WebCore::HTMLOutputElement::reset):
+        (WebCore::HTMLOutputElement::value):
+        (WebCore::HTMLOutputElement::setValue):
+        (WebCore::HTMLOutputElement::defaultValue):
+        (WebCore::HTMLOutputElement::setDefaultValue):
+        (WebCore::HTMLOutputElement::setTextContentInternal):
+        * html/HTMLOutputElement.h: Added.
+        (WebCore::HTMLOutputElement::isEnumeratable):
+        (WebCore::HTMLOutputElement::willValidate):
+        * html/HTMLOutputElement.idl: Added.
+        * html/HTMLTagNames.in: Added "output".
+        * page/DOMWindow.idl: Added an attribute for HTMLOutputElement.
+
+2010-11-04  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Remove IMPLEMENTATION_COLOR_READ_FORMAT and TYPE
+        https://bugs.webkit.org/show_bug.cgi?id=48938
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::readPixels):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getIntegerv):
+
+2010-11-04  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        TypedArray should throw exception if length not a multiple of element size
+        https://bugs.webkit.org/show_bug.cgi?id=45487
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArray):
+
+2010-11-04  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Mac: WebGL: all textured content is blue
+        https://bugs.webkit.org/show_bug.cgi?id=49021
+
+        Added support for 8-bit, little-endian CGImages. The previous
+        image decode path used the default byte order, which is apparently
+        big-endian.
+
+        Tested with various WebGL content and layout tests in Chromium.
+        Ran layout tests in WebKit and tested various WebGL content in
+        Safari. Was not able to run layout tests with Chromium port of
+        DumpRenderTree due to build failures currently in the tree.
+
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::doPacking):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::getSourceDataFormat):
+        (WebCore::GraphicsContext3D::getImageData):
+
+2010-11-03  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        renderbufferStorage(DEPTH_STENCIL) shouldn't generate an error
+        https://bugs.webkit.org/show_bug.cgi?id=48891
+
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::WebGLFramebuffer::isIncomplete): Considering the case where DEPTH_STENCIL is not supported.
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer): Init added members.
+        * html/canvas/WebGLRenderbuffer.h: Add members and accessor functions.
+        (WebCore::WebGLRenderbuffer::setInternalFormat): 
+        (WebCore::WebGLRenderbuffer::setSize):
+        (WebCore::WebGLRenderbuffer::getWidth):
+        (WebCore::WebGLRenderbuffer::getHeight):
+        (WebCore::WebGLRenderbuffer::setIsValid):
+        (WebCore::WebGLRenderbuffer::isValid):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext): Check if packed_depth_stencil extension exists.
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter): Simulate the case for DEPTH_STENCIL where packed_depth_stencil is not supported.
+        (WebCore::WebGLRenderingContext::renderbufferStorage): Bypass the call if packed_depth_stencil is not supported.
+        * html/canvas/WebGLRenderingContext.h:
+
+2010-11-04  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Web Inspector: Enable files ystem UI for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=48963
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore::InspectorFileSystemAgent::getFileSystemPathAsync):
+        * inspector/InspectorFileSystemAgent.h:
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView):
+        (WebInspector.FileSystemView.prototype.setFileSystemDisabled):
+        (WebInspector.FileSystemView.prototype._createTextAndButton):
+        (WebInspector.FileSystemView.prototype.refreshFileSystem):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.setFileSystemDisabled):
+        * inspector/front-end/inspector.js:
+        (WebInspector.didGetFileSystemDisabled):
+        (WebInspector.reset):
+
+2010-11-04  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Stale reference to JSDOMWindow in ScriptController::m_cacheableBindingObject
+
+        After bug 37725 we need to update the globalObject() (i.e. JSDOMWindow)
+        associated with the m_cacheablebindingRootObject every time we clear the
+        frame and load a new page. This allows the runtime objects
+        (e.g. LayoutTestController etc.) to persist between navigations as
+        before but also ensures that when qt_runtime, or any other bridge,
+        looks at the root->globalObject() of a cacheable binding object
+        it gets the DOMWindow of the current page rather than the DOMWindow
+        that was in place when m_cacheableBindingRootObject was created.
+
+        Fixes fast/dom/nodesFromRect-basic.html on Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48758
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::updateGlobalObject):
+        * bridge/runtime_root.h:
+
+2010-11-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Delegate scrolling via a separate method
+        https://bugs.webkit.org/show_bug.cgi?id=48988
+
+        Add a delegatedScrollRequested method to HostWindow for delegating
+        scrolling to the view. This is only used in conjunction with tiling,
+        and is ifdef'ed.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::delegatedScrollRequested):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+
+2010-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Need better way of switching back to the Timeline view of the Network tab.
+        https://bugs.webkit.org/show_bug.cgi?id=48995
+
+        - Moved close button to the left, preceding tab headers;
+        - Auto-adjusting summary bar width when switching to the preview mode
+        - Auto-scrolling network log if it was scrolled to bottom.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.isScrolledToLastRow):
+        (WebInspector.DataGrid.prototype.scrollToLastRow):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype.updateSidebarWidth):
+        (WebInspector.NetworkPanel.prototype._positionSummaryBar):
+        (WebInspector.NetworkPanel.prototype.refresh):
+        (WebInspector.NetworkPanel.prototype._reset):
+        (WebInspector.NetworkPanel.prototype._toggleGridMode):
+        * inspector/front-end/inspector.css:
+        (.tabbed-pane-header li):
+        * inspector/front-end/networkPanel.css:
+        (.network-summary-bar):
+        (#network-close-button):
+        (#network-views.small #network-close-button):
+        (#network-views .resource-view .tabbed-pane-header):
+        (#network-views.small .resource-view .tabbed-pane-header):
+
+2010-11-04  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support box-sizing without the vendor prefix
+        https://bugs.webkit.org/show_bug.cgi?id=36713
+
+        Based on patch by Peter Beverloo <peter@lvp-media.com>
+
+        Test: fast/css/box-sizing-backwards-compat-prefix.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::cssPropertyID): This handles -webkit-box-sizing and maps it to box-sizing.
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/quirks.css: Change -webkit-box-sizing to box-sizing.
+        (input:not([type=image]), textarea):
+        * css/view-source.css: Ditto.
+        (.webkit-line-gutter-backdrop, .webkit-line-number):
+        * css/wml.css: Ditto.
+        (do):
+        (select):
+
+2010-11-04  John Reck  <jreck@google.com>
+
+        Reviewed by Steve Block.
+
+        Fix a linker failure when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=48964
+        
+        The Android stub for setCookieStoragePrivateBrowsingEnabled(bool) wasn't in the WebCore namespace, which caused
+        a linker failure when building for Android. Moved the stub to the WebCore namespace. This was caused by 
+        http://trac.webkit.org/changeset/70400
+        
+        No new tests, build fix only
+
+        * platform/android/TemporaryLinkStubs.cpp:
+
+2010-11-04  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Request.h getters can be made const
+        https://bugs.webkit.org/show_bug.cgi?id=49003
+
+        Added the const qualifier to some getters that don't mutate the object.
+
+        * loader/Request.h:
+        (WebCore::Request::cachedResource):
+        (WebCore::Request::cachedResourceLoader):
+        (WebCore::Request::isIncremental):
+        (WebCore::Request::isMultipart):
+
+2010-11-03  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        User scripts shouldn't be injected in a frame's empty initial document.
+        https://bugs.webkit.org/show_bug.cgi?id=48970
+        <rdar://problem/8618164>
+        <rdar://problem/8082122>
+        
+        When a frame loads, it first creates an empty initial document, then navigates to the correct URL. Our
+        current policy with user scripts is to inject them into both the initial empty document, and then inject
+        them again.
+        
+        This causes developers to think their scripts have been injected twice into all iframes, and there is a timing
+        issue between WebKit1 and WebKit2 that causes start scripts to be injected into the initial empty document
+        of the main frame when a new tab or window is created.
+        
+        The fix for this is to not inject user scripts when the frame is creating its initial empty document before loading
+        the correct source.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+
+2010-11-04  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        GraphicsContext: Don't do full save/restore when painting with low quality scaling
+        https://bugs.webkit.org/show_bug.cgi?id=48738
+
+        Stash the imageInterpolationQuality() in a local and reset it after painting.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        (WebCore::GraphicsContext::drawImageBuffer):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2010-11-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Refactor SVGStringListPropertyTearOff/SVGListPropertyTearOff to use a common base class
+        https://bugs.webkit.org/show_bug.cgi?id=48990
+
+        Introduce SVGListProperty as common base class between static lists (SVGStringListPropertyTearOff) and dynamic lists (SVGListPropertyTearOff).
+        This is a preparation for the addition of the next static list type: SVGPointList.
+
+        * GNUmakefile.am: Add new files to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/scripts/CodeGenerator.pm: s/SVGStringListPropertyTearOff/SVGStaticListPropertyTearOff/.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/properties/SVGAnimatedListPropertyTearOff.h: Include SVGStaticListPropertyTearOff.h here, to avoid special dependencies in CodeGenerator*.pm
+        * svg/properties/SVGListProperty.h: Added.
+        * svg/properties/SVGListPropertyTearOff.h: Use SVGList API implementation from SVGListProperty base class.
+        * svg/properties/SVGStaticListPropertyTearOff.h: Added. Use SVGList API implementation from SVGListProperty base class.
+        * svg/properties/SVGStringListPropertyTearOff.h: Removed.
+
+2010-11-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed. Fixed WebCore.xcodeproject
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-11-04  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Should make use of purge priorities for different resource types
+        https://bugs.webkit.org/show_bug.cgi?id=48684
+
+        Assign purge priorities to CachedResource objects. JavaScript and CSS stylesheets are more
+        important than images so hint to the kernel to purge them last. We do this by repurposing
+        the previously unused function, PurgeableBuffer::setPurgePriority(). It now just sets the
+        priority field and does not have side-effects like calling makePurgeable(true).
+
+        Also, remove unusued PurgeableBuffer::create(const Vector<char>&) function and move the
+        purgeable memory size threshold from CachedResource to PurgeableBuffer.
+
+        * WebCore.xcodeproj/project.pbxproj: Add new PurgePriority.h header and mark it as private
+        header.
+        * loader/CachedCSSStyleSheet.h:
+        (WebCore::CachedCSSStyleSheet::purgePriority):
+        * loader/CachedImage.h:
+        (WebCore::CachedImage::purgePriority):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::makePurgeable): Set the purge priority on the PurgeableBffer.
+        Also, move the check for purgeable size threshold to PurgeableBuffer.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::purgePriority): Added. New virtual method that lets the class
+        specify its purge priority.
+        * loader/CachedScript.h:
+        (WebCore::CachedScript::purgePriority):
+        * platform/PurgePriority.h: Added. Move the PurgePriority enum from PurgeableBuffer class to
+        its own header file.
+        (WebCore::):
+        * platform/PurgeableBuffer.h:
+        (WebCore::PurgeableBuffer::setPurgePriority): Update this previously unused function to just
+        set the priority and not call makePurgeable(true).
+        * platform/mac/PurgeableBufferMac.cpp: Update size threshold to 16KB which is what
+        CachedResource was using.
+
+2010-11-04  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Ignore static text children of text field controls in the accessibility tree.
+        https://bugs.webkit.org/show_bug.cgi?id=48944
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2010-11-04  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Computed style is not correct for negative values in the presence of zooming
+        https://bugs.webkit.org/show_bug.cgi?id=48855
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::adjustForAbsoluteZoom): When the value is less than zero we need to decrement instead of increment.
+
+2010-11-04  Shane Stephens  <shanestephens@google.com>
+
+        Reviewed by Tony Chang.
+
+        SVGStyledTransformableElement supplemental transforms pre-multiplied
+        but should be post-multiplied.
+        https://bugs.webkit.org/show_bug.cgi?id=48026
+
+        Test: svg/animations/animate-path-nested-transforms.svg
+
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::animatedLocalTransform):
+        
+        Switched order of multiplication.  Note that due to a bug in
+        AffineTransform's operator* implementation the order of arguments is
+        reversed (see http://bugs.webkit.org/show_bug.cgi?id=48031).
+
+2010-11-04  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Web Timing] Implement dom* timing marks
+        https://bugs.webkit.org/show_bug.cgi?id=46301
+
+        Test: fast/dom/webtiming-document-open.html
+
+        * GNUmakefile.am: Added DocumentTiming.h
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::setReadyState): Set DOM WebTiming marks.
+        (WebCore::Document::finishedParsing): Set DOM WebTiming marks.
+        * dom/Document.h:
+        (WebCore::Document::timing): Added.
+        * dom/DocumentTiming.h: Added.
+        (WebCore::DocumentTiming::DocumentTiming):
+        * page/Timing.cpp: Added DOM timing.
+        (WebCore::Timing::domLoading): Ditto.
+        (WebCore::Timing::domInteractive): Ditto.
+        (WebCore::Timing::domContentLoaded): Ditto.
+        (WebCore::Timing::domComplete): Ditto.
+        (WebCore::Timing::documentTiming): Ditto.
+        * page/Timing.h: Ditto.
+        * page/Timing.idl: Ditto.
+
+2010-11-04  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement unencodable characters handling in TextCodecGtk::encode()
+        https://bugs.webkit.org/show_bug.cgi?id=48902
+
+        Fixes a crash in test fast/encoding/char-encoding.html.
+
+        * platform/text/gtk/TextCodecGtk.cpp:
+        (WebCore::TextCodecGtk::encode):
+
+2010-11-04  Adam Barth  <abarth@webkit.org>
+
+        Enabled ICCJPEG on Chromium Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48977
+
+        Add iccjpeg as a dependency.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2010-11-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Framework to show form validation message for invalid controls
+        https://bugs.webkit.org/show_bug.cgi?id=31718
+
+        HTMLFormElement::validateInteractively() shows a validation message for
+        an invalid control by HTMLFormControlElement::updateVisibleValidationMessage(),
+        and the message is hidden when the invalid control looses focus, becomes
+        valid, detached, or the form is submitted again.
+
+        Introduce ValidationMessage class to manage visible form validation
+        message. It has no implementation to show/hide a message yet.
+
+        No new tests. New behavior is disabled by default, and is timing-dependent.
+
+        * Android.mk: Add ValidationMessage.
+        * CMakeLists.txt: ditto.
+        * GNUmakefile.am: ditto.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::detach): Hides a validation message.
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+           Hides a validation message if validation is not needed.
+        (WebCore::HTMLFormControlElement::updateVisibleValidationMessage):
+        (WebCore::HTMLFormControlElement::hideVisibleValidationMessage):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+          Hides a validation message or updates the validation message.
+        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
+          Hides a validation message.
+        (WebCore::HTMLFormControlElement::visibleValidationMessage):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively):
+         - Hide existing validation messages before showing new message.
+         - Show new validation message.
+        * html/ValidationMessage.cpp: Added.
+        (WebCore::ValidationMessage::ValidationMessage):
+        (WebCore::ValidationMessage::~ValidationMessage):
+        (WebCore::ValidationMessage::create):
+        (WebCore::ValidationMessage::setMessage):
+        (WebCore::ValidationMessage::hideMessage):
+        * html/ValidationMessage.h: Added.
+        (WebCore::ValidationMessage::message):
+
+2010-11-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Port WCDataObject.cpp to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=48921
+
+        OleDuplicateData is not supported on WinCE.
+
+        * platform/win/WCDataObject.cpp:
+        (WebCore::WCDataObject::CopyMedium):
+
+2010-11-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Port ClipboardWin.cpp to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=48412
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::writeFileToDataObject):
+
+2010-11-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Port ClipboardWin.cpp to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=48412
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::createGlobalHDropContent):
+        (WebCore::ClipboardWin::files):
+
+2010-11-03  Vincent Scheib  <scheib@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] GraphicsContext3D creation attributes include canRecoverFromContextLoss option
+        https://bugs.webkit.org/show_bug.cgi?id=48850
+
+        Implementations of GraphicsContext3D may respect the creation attribute
+        canRecoverFromContextLoss being false, and then only succeeding initialization if
+        the context can satisfy that request of never being lost. DX9 on XP can not satisfy
+        such a request.
+
+        Test by use of accelerated canvas 2d in Chromium with ANGLE on XP machines.
+
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::Attributes::Attributes):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+
+2010-11-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use sentence boundaries instead of start/end sentence
+        https://bugs.webkit.org/show_bug.cgi?id=48422
+
+        Using sentence boundaries all intersentence
+        whitespace/control/format characters are assigned to a
+        sentence. This is what ICU does, so we have to do the same in
+        order to get the same results with glib unicode backend. It fixes
+        the sentence tests cases in test fast/dom/Range/range-expand.html.
+
+        * platform/text/gtk/TextBreakIteratorGtk.cpp:
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+
+2010-11-03  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        depthRange should generate INVALID_OPERATION if zNear is greater than zFar
+        https://bugs.webkit.org/show_bug.cgi?id=48676
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::depthRange):
+
+2010-11-03  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Properly return empty strings instead of null when using invalid
+        objects for some WebGL calls.  This fixes issues caused by r71274.
+        https://bugs.webkit.org/show_bug.cgi?id=48962
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+
+2010-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash in ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=48581
+
+        The crash was caused by RemoveNodePreservingChildrenCommand's calling removeNode
+        on m_node without checking that m_node has a parent and it's still in the document.
+        Fixed the crash by adding an early exit in CompositeEditCommand::removeNode and
+        deploying RefPtr in several places of ApplyStyleCommand.cpp.
+
+        Test: editing/style/iframe-onload-crash.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removeNode):
+
+2010-11-03  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crashes in WebCore::DocumentMarkerController::removeMarkersFromMarkerMapVectorPair() when deleting multiple lines of text.
+        https://bugs.webkit.org/show_bug.cgi?id=48918
+        <rdar://problem/8620602>
+
+        I haven't been able to found a reliable way to reproduce the bug. However, whenever it happens,
+        the crash is caused by a null node pointer returned by TextIterator. So it seems to be a 
+        safe fix to guard against that. 
+
+        * editing/Editor.cpp: (WebCore::Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited):
+
+2010-11-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        A different mask or reference value in stencil operations should generate INVALID_OPERATION
+        https://bugs.webkit.org/show_bug.cgi?id=48669
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext): Init stencil func ref/mask and stencil mask to default.
+        (WebCore::WebGLRenderingContext::stencilFunc): Cache ref/mask value.
+        (WebCore::WebGLRenderingContext::stencilFuncSeparate): Generate error if front/back values differ.
+        (WebCore::WebGLRenderingContext::stencilMask): Cache mask value.
+        (WebCore::WebGLRenderingContext::stencilMaskSeparate): Generate error if front/back values differ.
+        (WebCore::WebGLRenderingContext::validateFace): Validate face parameter.
+        (WebCore::WebGLRenderingContext::validateStencilFunc): Validate stencil func parameter.
+        * html/canvas/WebGLRenderingContext.h: Add members to track stencil func ref/mask and stencil mask.
+
+2010-11-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting r71244, r71248 and r71250. Broke default event handling inside text fields.
+        https://bugs.webkit.org/show_bug.cgi?id=46015
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::notifyChildInserted):
+        * dom/DOMAllInOne.cpp:
+        * dom/EventContext.cpp: Removed.
+        * dom/EventContext.h: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::markAncestorsWithChildNeedsStyleRecalc):
+        (WebCore::Node::createRendererIfNeeded):
+        (WebCore::Node::eventParentNode):
+        (WebCore::Node::enclosingLinkEventParentOrSelf):
+        (WebCore::eventTargetAsSVGElementInstance):
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        (WebCore::Node::eventAncestors):
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/Node.h:
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer):
+        * dom/WindowEventContext.cpp: Removed.
+        * dom/WindowEventContext.h: Removed.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::willDispatchEvent):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        * rendering/ShadowElement.h:
+        (WebCore::ShadowElement::shadowParent):
+        (WebCore::ShadowElement::shadowParentNode):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::eventParentNode):
+        * svg/SVGElement.h:
+
+2010-11-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CG use of WebKit image decoders crashes on some animated GIFs
+        https://bugs.webkit.org/show_bug.cgi?id=48955
+
+        It turns out CFDataGetMutableBytePtr isn't safe call on a null pointer.
+
+        Test: fast/images/dont-crash-with-null-gif-frames.html
+
+        * platform/image-decoders/cg/ImageDecoderCG.cpp:
+        (WebCore::RGBA32Buffer::copyReferenceToBitmapData):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+
+2010-11-03  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Implement lost, restored, and creation failure context events for
+        WebGLRenderingContext.  The lost and restored functions are not hooked
+        up yet, but the context now acts according to the spec as it should
+        during a lost context.  Tested manually, as there's no programmatic
+        way to lose a context yet.
+        https://bugs.webkit.org/show_bug.cgi?id=35626
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getAttachedShaders):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+        * dom/EventNames.h:
+        * html/canvas/WebGLContextEvent.cpp: Added.
+        (WebCore::WebGLContextEvent::WebGLContextEvent):
+        (WebCore::WebGLContextEvent::~WebGLContextEvent):
+        (WebCore::WebGLContextEvent::initEvent):
+        * html/canvas/WebGLContextEvent.h: Added.
+        (WebCore::WebGLContextEvent::create):
+        (WebCore::WebGLContextEvent::statusMessage):
+        * html/canvas/WebGLContextEvent.idl: Added.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::blendColor):
+        (WebCore::WebGLRenderingContext::blendEquation):
+        (WebCore::WebGLRenderingContext::blendEquationSeparate):
+        (WebCore::WebGLRenderingContext::blendFunc):
+        (WebCore::WebGLRenderingContext::blendFuncSeparate):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::checkFramebufferStatus):
+        (WebCore::WebGLRenderingContext::clear):
+        (WebCore::WebGLRenderingContext::clearColor):
+        (WebCore::WebGLRenderingContext::clearDepth):
+        (WebCore::WebGLRenderingContext::clearStencil):
+        (WebCore::WebGLRenderingContext::colorMask):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::copyTexImage2D):
+        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
+        (WebCore::WebGLRenderingContext::createBuffer):
+        (WebCore::WebGLRenderingContext::createFramebuffer):
+        (WebCore::WebGLRenderingContext::createTexture):
+        (WebCore::WebGLRenderingContext::createProgram):
+        (WebCore::WebGLRenderingContext::createRenderbuffer):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::cullFace):
+        (WebCore::WebGLRenderingContext::deleteBuffer):
+        (WebCore::WebGLRenderingContext::deleteFramebuffer):
+        (WebCore::WebGLRenderingContext::deleteProgram):
+        (WebCore::WebGLRenderingContext::deleteRenderbuffer):
+        (WebCore::WebGLRenderingContext::deleteShader):
+        (WebCore::WebGLRenderingContext::deleteTexture):
+        (WebCore::WebGLRenderingContext::depthFunc):
+        (WebCore::WebGLRenderingContext::depthMask):
+        (WebCore::WebGLRenderingContext::depthRange):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disable):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enable):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::finish):
+        (WebCore::WebGLRenderingContext::flush):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::frontFace):
+        (WebCore::WebGLRenderingContext::generateMipmap):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getAttachedShaders):
+        (WebCore::WebGLRenderingContext::getAttribLocation):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getContextAttributes):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::getVertexAttribOffset):
+        (WebCore::WebGLRenderingContext::hint):
+        (WebCore::WebGLRenderingContext::isBuffer):
+        (WebCore::WebGLRenderingContext::isContextLost):
+        (WebCore::WebGLRenderingContext::isEnabled):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::lineWidth):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::pixelStorei):
+        (WebCore::WebGLRenderingContext::polygonOffset):
+        (WebCore::WebGLRenderingContext::readPixels):
+        (WebCore::WebGLRenderingContext::releaseShaderCompiler):
+        (WebCore::WebGLRenderingContext::renderbufferStorage):
+        (WebCore::WebGLRenderingContext::sampleCoverage):
+        (WebCore::WebGLRenderingContext::scissor):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::stencilFunc):
+        (WebCore::WebGLRenderingContext::stencilFuncSeparate):
+        (WebCore::WebGLRenderingContext::stencilMask):
+        (WebCore::WebGLRenderingContext::stencilMaskSeparate):
+        (WebCore::WebGLRenderingContext::stencilOp):
+        (WebCore::WebGLRenderingContext::stencilOpSeparate):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texParameter):
+        (WebCore::WebGLRenderingContext::texSubImage2DBase):
+        (WebCore::WebGLRenderingContext::texSubImage2DImpl):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::viewport):
+        (WebCore::WebGLRenderingContext::loseContext):
+        (WebCore::WebGLRenderingContext::restoreContext):
+        (WebCore::WebGLRenderingContext::addObject):
+        (WebCore::WebGLRenderingContext::vertexAttribfImpl):
+        (WebCore::WebGLRenderingContext::vertexAttribfvImpl):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+
+2010-11-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Redesign extension mechanism in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=46894
+
+        Upon request, factored out extension support from GraphicsContext3D
+        into a new Extensions3D class. (The plural was chosen because the
+        class and subclasses hold multiple extensions.)
+
+        Unlike GraphicsContext3D, Extensions3D contains only pure virtual
+        methods. This was done because Extensions3D's inheritance diagram
+        and usage pattern is very different from that of GraphicsContext3D,
+        and the concrete subclasses need to decide how to implement the
+        various entry points. Requiring them to be placed at the
+        Extensions3D level will cause implementation details to leak into
+        the base class, which is highly undesirable. Any virtual call
+        overhead to these entry points will be negligible.
+
+        Changed call sites utilizing these extensions to call through the
+        Extensions3D object or its subclasses.
+
+        Tested:
+         - Chromium on Linux with accelerated 2D canvas and HTML5 video
+         - Chromium on Mac OS X with WebGL and CSS 3D content
+         - Safari on Mac OS X with WebGL and CSS 3D content
+
+        No new tests. Covered by existing tests.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/Extensions3D.h: Added.
+        (WebCore::Extensions3D::~Extensions3D):
+        * platform/graphics/GraphicsContext3D.cpp:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        * platform/graphics/chromium/Extensions3DChromium.h: Added.
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateTexture):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::supportsBGRA):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        * platform/graphics/gpu/Texture.cpp:
+        (WebCore::convertFormat):
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Added.
+        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL):
+        (WebCore::Extensions3DOpenGL::~Extensions3DOpenGL):
+        (WebCore::Extensions3DOpenGL::supports):
+        (WebCore::Extensions3DOpenGL::getGraphicsResetStatusARB):
+        * platform/graphics/opengl/Extensions3DOpenGL.h: Added.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getExtensions):
+        * platform/graphics/qt/Extensions3DQt.cpp: Added.
+        (WebCore::Extensions3DQt::Extensions3DQt):
+        (WebCore::Extensions3DQt::~Extensions3DQt):
+        (WebCore::Extensions3DQt::supports):
+        (WebCore::Extensions3DQt::getGraphicsResetStatusARB):
+        * platform/graphics/qt/Extensions3DQt.h: Added.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getExtensions):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::readbackHardwareToSoftware):
+
+2010-11-03  Mike Thole  <mthole@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Tweak coding style (follow-up to r71264).
+        
+        * platform/mac/Language.mm:
+        (WebCore::createHTTPStyleLanguageCode): Style tweaks.
+
+2010-11-03  Darin Adler  <darin@apple.com>
+
+        Updated Xcode projects by opening them with Xcode 3.2.4.
+        Updated svn:ignore for Xcode projects.
+
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj: Added property svn:ignore.
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj: Updated with Xcode 3.2.4.
+
+2010-11-03  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix canvas/philip/tests/2d.pattern.image.undefined.html
+        https://bugs.webkit.org/show_bug.cgi?id=48894
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp: Changed error thrown to match the spec.
+
+2010-11-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Crash when setting context font to bad value
+        https://bugs.webkit.org/show_bug.cgi?id=48948
+        
+        Null-check the CSSValue passed to CSSStyleSelector::applyPropertyToStyle(),
+        since it may be null if the style declaration does not contain a value
+        for the 'font' property.
+
+        Test: fast/canvas/invalid-set-font-crash.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyPropertyToStyle):
+
+2010-11-03  Mike Thole  <mthole@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash under WebCore::platformDefaultLanguage() when using Arabic language
+        https://bugs.webkit.org/show_bug.cgi?id=48946
+
+        * platform/mac/Language.mm:
+        (WebCore::createHTTPStyleLanguageCode):
+        Retain the lowercaseLanguageCode string before returning it.  This was the code path that
+        would lead to a crash.  Also removed early return to prevent a leak of preferredLanguageCode.
+
+2010-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made table column width allocation algorithms use logical widths.
+
+        Part of: Make tables work with vertical text
+        https://bugs.webkit.org/show_bug.cgi?id=46417
+
+        No new tests since tables don’t support different block flows yet.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::AutoTableLayout):
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::fullRecalc):
+        (WebCore::AutoTableLayout::computePreferredLogicalWidths):
+        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
+        (WebCore::AutoTableLayout::insertSpanCell):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/AutoTableLayout.h:
+        (WebCore::AutoTableLayout::Layout::Layout):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        (WebCore::FixedTableLayout::computePreferredLogicalWidths):
+        (WebCore::FixedTableLayout::layout):
+        * rendering/FixedTableLayout.h:
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::bordersPaddingAndSpacingInRowDirection): Renamed, but not changed yet.
+
+2010-11-03  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Unreviewed build fix for r71253
+
+        #endif for TILED_BACKING_STORE was at the wrong place.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStoreBackgroundColor):
+
+2010-11-03  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48945
+        
+        Patch logicalLeftSelectionOffset and logicalRightSelectionOffset to be directionally abstract.
+        
+        Also make sure writing mode roots are also selection painting roots.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::logicalLeftSelectionOffset):
+        (WebCore::RenderBlock::logicalRightSelectionOffset):
+        * rendering/RenderBlock.h:
+
+2010-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: main resource is being re-assigned upon iframe's commit load.
+        https://bugs.webkit.org/show_bug.cgi?id=48940
+
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.prototype.identifierForInitialRequest):
+        (WebInspector.ResourceManager.prototype.didCommitLoadForFrame):
+
+2010-11-03  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Wait to stop all loads for a frame being detached until after its
+        chidlren have been detached. This ensures that any loads started
+        by a child's unload event handler will be properly cancelled.
+        https://bugs.webkit.org/show_bug.cgi?id=46579
+
+        Tests: fast/loader/ping-error.html
+               http/tests/navigation/image-load-in-subframe-unload-handler.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::detachFromParent):
+
+2010-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: show proper image size for cached resources.
+        https://bugs.webkit.org/show_bug.cgi?id=48915
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView.prototype.contentTabSelected.onImageLoad):
+        (WebInspector.ImageView.prototype.contentTabSelected):
+        (WebInspector.ImageView.prototype._base64ToSize):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkDataGridNode.prototype._refreshNameCell):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.set finished):
+        (WebInspector.Resource.prototype.get content):
+        (WebInspector.Resource.prototype.requestContent):
+        (WebInspector.Resource.prototype._innerRequestContent):
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.requestContent):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+
+2010-11-03  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] GraphicsLayer: support tiling
+        https://bugs.webkit.org/show_bug.cgi?id=39691
+
+        Add support for TiledBackingStore in GraphicsLayerQt, when a layer is too large.
+
+        No new tests. Tests in LayoutTests/compositing/tiling now work with OpenGL enabled.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStorePaintBegin):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStorePaint):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStorePaintEnd):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStoreContentsRect):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStoreBackgroundColor):
+        (WebCore::GraphicsLayerQtImpl::tiledBackingStoreVisibleRect):
+
+2010-11-03  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Undo r54932 which inappropriately adjusts font sizes on zoomed pages
+        https://bugs.webkit.org/show_bug.cgi?id=48890
+
+        Test: editing/inserting/page-zoom-font-size.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance):
+
+2010-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make collapsed borders in tables work with different block flows
+        https://bugs.webkit.org/show_bug.cgi?id=46191
+
+        No new tests since tables don’t support different block flows yet.
+
+        This change still doesn’t support cells whose block flow differs from the table’s.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn): Updated for the renaming of styleOrColWidth().
+        (WebCore::AutoTableLayout::calcEffectiveWidth): Ditto.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleOrColLogicalWidth): Renamed styleOrColWidth() to this and
+        changed to use logical widths.
+        (WebCore::RenderTableCell::computePreferredLogicalWidths): Updated for the above rename.
+        (WebCore::RenderTableCell::updateLogicalWidth): Renamed updateWidth() to this and changed
+        to set the logical width.
+        (WebCore::RenderTableCell::collapsedStartBorder): Changed collapsedLeftBorder() into this.
+        Note that “start” here will refer to the table’s block flow, not the cell’s, once we allow
+        the two to differ.
+        (WebCore::RenderTableCell::collapsedEndBorder): Similar.
+        (WebCore::RenderTableCell::collapsedBeforeBorder): Similar.
+        (WebCore::RenderTableCell::collapsedAfterBorder): Similar.
+        (WebCore::RenderTableCell::collapsedLeftBorder): Resolves “left” to a logical side using
+        the table’s block flow.
+        (WebCore::RenderTableCell::collapsedRightBorder): Similar.
+        (WebCore::RenderTableCell::collapsedTopBorder): Similar.
+        (WebCore::RenderTableCell::collapsedBottomBorder): Similar.
+        (WebCore::RenderTableCell::borderStart): Use borderHalfStart().
+        (WebCore::RenderTableCell::borderEnd): Similar.
+        (WebCore::RenderTableCell::borderBefore): Similar.
+        (WebCore::RenderTableCell::borderAfter): Similar.
+        (WebCore::RenderTableCell::borderHalfLeft): Resolves “left” to a logical side using the
+        table’s block flow.
+        (WebCore::RenderTableCell::borderHalfRight): Similar.
+        (WebCore::RenderTableCell::borderHalfTop): Similar.
+        (WebCore::RenderTableCell::borderHalfBottom): Similar.
+        (WebCore::RenderTableCell::borderHalfStart): Added. Uses collapsedStartBorder(). Splits odd
+        widths based on physical side.
+        (WebCore::RenderTableCell::borderHalfEnd): Similar.
+        (WebCore::RenderTableCell::borderHalfBefore): Similar.
+        (WebCore::RenderTableCell::borderHalfAfter): Similar.
+        (WebCore::RenderTableCell::collectBorderStyles): Use logical methods.
+        (WebCore::RenderTableCell::paintCollapsedBorder): Updated.
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellWidths): Updated for the renaming of updateWidth().
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::borderBefore): Added.
+        (WebCore::RenderStyle::borderAfter): Added.
+        (WebCore::RenderStyle::borderStart): Added.
+        (WebCore::RenderStyle::borderEnd): Adeed.
+        * rendering/style/RenderStyle.h:
+
+2010-11-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix Win build correctly after r71244 and r71248
+
+        * WebCore.vcproj/WebCore.vcproj: Added XML gobbledygook back.
+        * dom/DOMAllInOne.cpp: Added files to build into a combined file.
+
+2010-11-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix Qt, Win builds after r71244.
+
+        * WebCore.vcproj/WebCore.vcproj: Removed XML gobbledygook that prevents files from building.
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer): Moved parentOrHost inside ENABLE(SVG) guard.
+
+2010-11-03  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48928
+        
+        Rename all the selection gap functions to not be directionally specific.  Left and Right turn into LogicalLeft and
+        LogicalRight.  Horizontal becomes Line.  Vertical becomes Block.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::fillLineSelectionGap):
+        (WebCore::RenderBlock::fillBlockSelectionGap):
+        (WebCore::RenderBlock::fillLogicalLeftSelectionGap):
+        (WebCore::RenderBlock::fillLogicalRightSelectionGap):
+        (WebCore::RenderBlock::getSelectionGapInfo):
+        (WebCore::RenderBlock::logicalLeftSelectionOffset):
+        (WebCore::RenderBlock::logicalRightSelectionOffset):
+        * rendering/RenderBlock.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+
+2010-11-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement shadow DOM-aware event targeting and introduce EventContext to track the context of each event dispatch.
+        https://bugs.webkit.org/show_bug.cgi?id=46015
+
+        This patch adds the notion of EventContext (and a very similar-acting WindowEventContext, specifically
+        for DOMWindow), an abstraction that carries information around dispatching an event for any given Node.
+
+        This abstraction is necessary to ensure that events, fired from shadow DOM nodes are properly retargeted to
+        appear as if they are coming from their host, thus never exposing the shadow DOM nodes to the world outside.
+
+        * Android.mk: Added EventContext, WindowEventContext files.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * dom/ContainerNode.cpp:
+        (WebCore::notifyChildInserted): Changed to be shadow DOM-aware.
+        * dom/EventContext.cpp: Added.
+        * dom/EventContext.h: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::markAncestorsWithChildNeedsStyleRecalc): Changed to be shadow DOM-aware.
+        (WebCore::Node::createRendererIfNeeded): Ditto.
+        (WebCore::Node::parentOrHostNode): Added new helper method.
+        (WebCore::Node::enclosingLinkEventParentOrSelf): Changed to be shadow DOM-aware.
+        (WebCore::eventTargetRespectingSVGTargetRules): Collapsed two helper methods into one.
+        (WebCore::Node::eventAncestors): Refactored to collect a vector of EventContexts.
+        (WebCore::Node::topEventContext): Added.
+        (WebCore::eventHasListeners): Changed to use EventContexts.
+        (WebCore::Node::dispatchGenericEvent): Ditto.
+        * dom/Node.h: Removed eventParentNode that's no longer needed, added parentOrHostNode decl,
+            and changed signature of eventAncestors to use EventContexts.
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer): Changed to be shadow DOM-aware.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode): Changed to use EventContexts.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateMouseEventTargetNode): Removed code that's no longer necessary.
+        * rendering/ShadowElement.h: Made m_shadowParent a RefPtr to avoid stale references when parent
+        is deleted.
+        * svg/SVGElement.cpp: Removed eventParentNode that's no longer needed.
+        * svg/SVGElement.h: Ditto.
+        * dom/WindowEventContext.cpp: Added.
+        * dom/WindowEventContext.h: Added.
+
+2010-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix console messages about starting and finishing profiling.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48825
+
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::addStartProfilingMessageToConsole):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        chrome.dll!WebCore::SVGLength::SVGLength ...
+        https://bugs.webkit.org/show_bug.cgi?id=48831
+
+        Test: svg/dom/baseVal-animVal-crash.html
+
+        * svg/properties/SVGListPropertyTearOff.h:
+        (WebCore::SVGListPropertyTearOff::initialize): Renamed removeItemFromListIfNeeded to processIncomingListItem, to reflect its new job.
+        (WebCore::SVGListPropertyTearOff::insertItemBefore): Ditto.
+        (WebCore::SVGListPropertyTearOff::replaceItem): Ditto.
+        (WebCore::SVGListPropertyTearOff::appendItem): Ditto.
+        (WebCore::SVGListPropertyTearOff::processIncomingListItem): Copy incoming item, if necessary, see inline comments.
+        * svg/properties/SVGPropertyTearOff.h:
+        (WebCore::SVGPropertyTearOff::detachWrapper): Remove association with SVGAnimatedProperty, when wrapper is detached.
+
+2010-11-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Make it possible to delegate scrolling to the UI
+        https://bugs.webkit.org/show_bug.cgi?id=48907
+
+        Add a WebCore setting for delegating scrolling to the actual
+        WebKit view, which means that setScrollPosition will call
+        scrollContents directly without going though the scrollbar
+        code.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::delegatesScrolling):
+        * page/FrameView.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShouldDelegateScrolling):
+        * page/Settings.h:
+        (WebCore::Settings::shouldDelegateScrolling):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::delegatesScrolling):
+
+2010-11-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Add SharedBitmap
+        https://bugs.webkit.org/show_bug.cgi?id=28272
+
+        SharedBitmap is a helper class used as NativeImagePtr for WinCE.
+        It's wide used by WinCE graphics files as a replacement of HBITMAP.
+
+        Originally written by Yong Li <yong.li@torchmobile.com>.
+
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::TransparentLayerDC::TransparentLayerDC):
+        (WebCore::TransparentLayerDC::~TransparentLayerDC):
+        (WebCore::ScopeDCProvider::ScopeDCProvider):
+        (WebCore::ScopeDCProvider::~ScopeDCProvider):
+        (WebCore::GraphicsContext::drawText):
+        * platform/graphics/wince/SharedBitmap.cpp: Added.
+        (WebCore::SharedBitmap::create):
+        (WebCore::SharedBitmap::SharedBitmap):
+        (WebCore::SharedBitmap::~SharedBitmap):
+        (WebCore::SharedBitmap::resetPixels):
+        (WebCore::convert32To16):
+        (WebCore::SharedBitmap::to16bit):
+        (WebCore::SharedBitmap::freeMemory):
+        (WebCore::SharedBitmap::createHandle):
+        (WebCore::SharedBitmap::ensureHandle):
+        (WebCore::SharedBitmap::draw):
+        (WebCore::SharedBitmap::clipBitmap):
+        (WebCore::drawPatternSimple):
+        (WebCore::normalizePhase):
+        (WebCore::SharedBitmap::drawPattern):
+        (WebCore::SharedBitmap::DCProvider::getDC):
+        (WebCore::SharedBitmap::DCProvider::releaseDC):
+        (WebCore::SharedBitmap::clearPixels):
+        * platform/graphics/wince/SharedBitmap.h: Added.
+        (WebCore::DCProvider::getDC):
+        (WebCore::DCProvider::releaseDC):
+        (WebCore::DCProvider::DCHolder::DCHolder):
+        (WebCore::DCProvider::DCHolder::~DCHolder):
+        (WebCore::DCProvider::DCHolder::set):
+        (WebCore::DCProvider::DCHolder::get):
+        (WebCore::DCProvider::DCHolder::clearInternal):
+        (WebCore::DCProvider::DCHolder::setInternal):
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        chrome.dll!WebCore::SVGListPropertyTearOff<...>::getItem ReadAV@NULL (578c0f7f21ca517ba29a4eafb7099c1b)
+        https://bugs.webkit.org/show_bug.cgi?id=48829
+
+        Share SVGPropertyTearOff wrapper cache between SVGAnimatedListPropertyTearOff::baseVal/animVal.
+        When modifying the list through baseVal, and then grabbing the animVal list an assertion was fired,
+        as the wrapper cache was out of sync with the underlying SVG*List vector.
+
+        Test: svg/dom/baseVal-animVal-list-crash.html
+
+        * svg/properties/SVGAnimatedListPropertyTearOff.h:
+        (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
+        (WebCore::SVGAnimatedListPropertyTearOff::animVal):
+        (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
+        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
+        (WebCore::SVGAnimatedListPropertyTearOff::values):
+        (WebCore::SVGAnimatedListPropertyTearOff::wrappers):
+        (WebCore::SVGAnimatedListPropertyTearOff::create):
+        (WebCore::SVGAnimatedListPropertyTearOff::SVGAnimatedListPropertyTearOff):
+        * svg/properties/SVGListPropertyTearOff.h:
+        (WebCore::SVGListPropertyTearOff::create):
+        (WebCore::SVGListPropertyTearOff::removeItemFromList):
+        (WebCore::SVGListPropertyTearOff::clear):
+        (WebCore::SVGListPropertyTearOff::numberOfItems):
+        (WebCore::SVGListPropertyTearOff::initialize):
+        (WebCore::SVGListPropertyTearOff::getItem):
+        (WebCore::SVGListPropertyTearOff::insertItemBefore):
+        (WebCore::SVGListPropertyTearOff::replaceItem):
+        (WebCore::SVGListPropertyTearOff::removeItem):
+        (WebCore::SVGListPropertyTearOff::appendItem):
+        (WebCore::SVGListPropertyTearOff::SVGListPropertyTearOff):
+        (WebCore::SVGListPropertyTearOff::commitChange):
+
+2010-11-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Remove obsolete code.
+        It is not required to push onload and DOMContentLoaded events times to the fresh instance of Inspector.
+        Network Panel is showing the markers only after reloading the inspected page.
+        https://bugs.webkit.org/show_bug.cgi?id=48854
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        * inspector/InspectorController.h:
+
+2010-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Web Inspector: brush up breakpoints UI and UX.
+        https://bugs.webkit.org/show_bug.cgi?id=48901
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.DOMBreakpoint.prototype.populateLabelElement):
+        (WebInspector.XHRBreakpoint.prototype.populateLabelElement):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpointItem):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.addBreakpointItem):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._hideEditBreakpointDialog):
+        (WebInspector.BreakpointItem):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu.handlerFunction):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/inspector.css:
+        (.monospace):
+        (body.platform-mac.platform-mac-snowleopard .source-code):
+        (body.platform-windows .monospace, body.platform-windows .source-code):
+        (body.platform-linux .monospace, body.platform-linux .source-code):
+        (.source-code):
+        (.section .header):
+        (.section .header::before):
+        (.section .header .title, .event-bar .header .title):
+        (.section .header .subtitle, .event-bar .header .subtitle):
+        (.section.expanded .properties, .event-bar.expanded .event-properties):
+        (.event-listener-breakpoints .event-category):
+        (.event-listener-breakpoints.properties-tree .children li):
+        (.event-listener-breakpoints .checkbox-elem):
+        (.event-bar):
+        (.event-bars .event-bar .header .title):
+        (.event-bars .event-bar .header::before):
+        (.pane > .body .info):
+        (.pane > .body .placard + .info):
+        (ol.breakpoint-list):
+        (.breakpoint-list li):
+        (.pane .breakpoint-hit):
+        (.cursor-pointer):
+        (.cursor-auto):
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Convert SVGAnimatedString/SVGStringList to the new SVG*PropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48898
+
+        Fix Chromium/V8 build for real, verified using a local ToT Chromium build.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Convert SVGAnimatedString/SVGStringList to the new SVG*PropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48898
+
+        Next attempt to fix the Chromium/V8 builds - a class forward in the headers was still missing.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Add SVGStringListPropertyTearOff in the V8SVGStringList header.
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Convert SVGAnimatedString/SVGStringList to the new SVG*PropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48898
+
+        Attempt to fix the Chromium/V8 builds.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Add missing "SVGStringListPropertyTearOff.h" include, also replaces some commas by semicolons (no idea why it worked before, Perl is not strict...)
+
+2010-11-03  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Convert SVGAnimatedString/SVGStringList to the new SVG*PropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48898
+
+        Convert SVGAnimatedString/SVGStringList to the new svg animated type concept.
+        SVGStringList is special compared to all other SVG*Lists, as it returns non-live elements.
+        That means myStringList.getItem(0) = 'foobar' doesn't take effect.
+
+        When appending an item to a SVGStringList, that has been taken from another list, it's not removed from the list origin.
+        That demanded a new SVGStringListPropertyTearOff which does just that.
+
+        Tests: svg/W3C-SVG-1.1-SE/types-dom-06-f.svg
+               svg/dom/SVGStringList.html
+
+        * GNUmakefile.am: Add SVGAnimatedString.h / SVGStringListPropertyTearOff.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAnimatedString as new style svg animated type. Map SVGStringList to SVGStringListPropertyTearOff.
+        * bindings/scripts/CodeGeneratorJS.pm: Handle SVGStringListPropertyTearOff in GetSVGPropertyTypes.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/DeprecatedSVGAnimatedPropertyTraits.h: Remove SVGAnimatedString handling.
+        * svg/DeprecatedSVGAnimatedTemplate.h: Ditto.
+        * svg/SVGAElement.cpp: Renamed target to svgTarget() to avoid clashes with Element::target(), adjust the bindings to call svgTarget() instead of target(), when processing SVGAElement.
+        (WebCore::SVGAElement::parseMappedAttribute):
+        (WebCore::SVGAElement::synchronizeProperty):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARED_ANIMATED_STATIC_PROPERTY_NEW/
+        * svg/SVGAnimatedString.h: Added.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGFEBlendElement.h: Ditto.
+        * svg/SVGFEColorMatrixElement.h: Ditto.
+        * svg/SVGFEComponentTransferElement.h: Ditto.
+        * svg/SVGFECompositeElement.h: Ditto.
+        * svg/SVGFEConvolveMatrixElement.h: Ditto.
+        * svg/SVGFEDiffuseLightingElement.h: Ditto.
+        * svg/SVGFEDisplacementMapElement.h: Ditto.
+        * svg/SVGFEGaussianBlurElement.h: Ditto.
+        * svg/SVGFEImageElement.h: Ditto.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFEMorphologyElement.h: Ditto.
+        * svg/SVGFEOffsetElement.h: Ditto.
+        * svg/SVGFESpecularLightingElement.h: Ditto.
+        * svg/SVGFETileElement.h: Ditto.
+        * svg/SVGFilterElement.h: Ditto.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Ditto.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto. 
+        * svg/SVGLengthList.idl: Remove leftover SVGListProperty marker.
+        * svg/SVGMPathElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARED_ANIMATED_STATIC_PROPERTY_NEW/
+        * svg/SVGPatternElement.h: Ditto.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGStringList.cpp: Make SVGStringList a plain Vector<String>.
+        (WebCore::SVGStringList::commitChange): React to SVGStringList changes.
+        (WebCore::SVGStringList::reset):
+        (WebCore::SVGStringList::parse):
+        * svg/SVGStringList.h:
+        (WebCore::SVGStringList::SVGStringList):
+        * svg/SVGStyledElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARED_ANIMATED_STATIC_PROPERTY_NEW/
+        * svg/SVGTRefElement.h: Ditto.
+        * svg/SVGTests.cpp: Adapt to SVGStringList API changes.
+        (WebCore::SVGTests::SVGTests):
+        (WebCore::SVGTests::hasExtension):
+        (WebCore::SVGTests::isValid):
+        (WebCore::SVGTests::parseMappedAttribute):
+        (WebCore::SVGTests::isKnownAttribute):
+        * svg/SVGTests.h: Ditto.
+        (WebCore::SVGTests::requiredFeatures):
+        (WebCore::SVGTests::requiredExtensions):
+        (WebCore::SVGTests::systemLanguage):
+        * svg/SVGTextPathElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARED_ANIMATED_STATIC_PROPERTY_NEW/
+        * svg/SVGURIReference.h: Adapt to SVGStringList API changes.
+        (WebCore::SVGURIReference::~SVGURIReference):
+        * svg/SVGUseElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARED_ANIMATED_STATIC_PROPERTY_NEW/
+        * svg/SVGViewElement.cpp: Adapt to SVGStringList API changes.
+        (WebCore::SVGViewElement::SVGViewElement):
+        (WebCore::SVGViewElement::parseMappedAttribute):
+        * svg/SVGViewElement.h: Ditto.
+        (WebCore::SVGViewElement::viewTarget):
+        * svg/properties/SVGAnimatedPropertyMacros.h: Moved GetOwnerElementForType heleprs from SVGAnimatedPropertySynchronizer into this file.
+        * svg/properties/SVGAnimatedPropertySynchronizer.h: 
+        * svg/properties/SVGPropertyTraits.h: Handle SVGStringList.
+        * svg/properties/SVGStringListPropertyTearOff.h: Added. This is a simplified version of SVGListPropertyTearOff, tied to SVGStringList and its special demands.
+        (WebCore::SVGStringListPropertyTearOff::create):
+        (WebCore::SVGStringListPropertyTearOff::clear):
+        (WebCore::SVGStringListPropertyTearOff::numberOfItems):
+        (WebCore::SVGStringListPropertyTearOff::initialize):
+        (WebCore::SVGStringListPropertyTearOff::getItem):
+        (WebCore::SVGStringListPropertyTearOff::insertItemBefore):
+        (WebCore::SVGStringListPropertyTearOff::replaceItem):
+        (WebCore::SVGStringListPropertyTearOff::removeItem):
+        (WebCore::SVGStringListPropertyTearOff::appendItem):
+        (WebCore::SVGStringListPropertyTearOff::SVGStringListPropertyTearOff):
+
+2010-11-03  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        SVG FELighting performance issues
+        https://bugs.webkit.org/show_bug.cgi?id=48212
+
+        This patch speeds-up FELighting filter painting by 40%
+        It reduces the number of floating point operations and
+        empolys faster pixel manipulation (both for read and
+        write). Furthermore the length() member of FloatPoint3D
+        is made inline to speed up vector length calculations.
+
+        The lighting filter pixels tests are cover this patch.
+
+        * platform/graphics/FloatPoint3D.cpp:
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::FloatPoint3D::length):
+        * platform/graphics/filters/FELighting.cpp:
+        (WebCore::FELighting::LightingData::topLeft):
+        (WebCore::FELighting::LightingData::topRow):
+        (WebCore::FELighting::LightingData::topRight):
+        (WebCore::FELighting::LightingData::leftColumn):
+        (WebCore::FELighting::LightingData::interior):
+        (WebCore::FELighting::LightingData::rightColumn):
+        (WebCore::FELighting::LightingData::bottomLeft):
+        (WebCore::FELighting::LightingData::bottomRow):
+        (WebCore::FELighting::LightingData::bottomRight):
+        (WebCore::FELighting::inlineSetPixel):
+        (WebCore::FELighting::setPixel):
+        (WebCore::FELighting::drawLighting):
+        (WebCore::FELighting::apply):
+        * platform/graphics/filters/FELighting.h:
+        * platform/graphics/filters/LightSource.cpp:
+        (WebCore::PointLightSource::updatePaintingData):
+        (WebCore::SpotLightSource::updatePaintingData):
+        (WebCore::DistantLightSource::initPaintingData):
+        * platform/graphics/filters/LightSource.h:
+
+2010-11-03  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Barth.
+
+        For unnamed frames, window.name returns a generated name
+        https://bugs.webkit.org/show_bug.cgi?id=6751
+
+        Part 2 of 2.
+
+        Fixes an issue where the window.name of an unnamed frame returns
+        a unique generated name that is used internally to identify the
+        frame. Instead, we should return an empty string as implied by
+        section 5.1.6 of the HTML5 spec. (http://www.w3.org/TR/html5/browsers.html#browsing-context-names).
+        This section describes that a browsing context can have no name or be
+        the empty string.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL): Removed ASSERT for empty
+        frame name since this is valid as per the HTML5 spec.
+        (WebCore::HTMLFrameElementBase::setName): Removed the call to FrameTree::uniqueChildName()
+        since the loader code no longer depends on the frame name being unique.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::name): Modified to call FrameTree::name().
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::setName):
+        (WebCore::FrameTree::clearName):
+        * page/FrameTree.h:
+        (WebCore::FrameTree::name): Re-added; returns the DOM-specified name of the
+        frame. Previously, this method returned the internal frame name.
+
+2010-11-03  takano takumi  <takano1@asia.apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add text-combine property to our property list. Reflect the setting to a RenderStyle object.
+        https://bugs.webkit.org/show_bug.cgi?id=48608
+
+        Test: fast/text/international/text-combine-parser-test.html
+
+        * css/CSSComputedStyleDeclaration.cpp: Added text-combine property support.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp: Added text-combine property support.
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h: Added a primitive value mapper for text-combine
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextCombine):
+        * css/CSSPropertyNames.in: Added "text-combine".
+        * css/CSSStyleSelector.cpp: Added text-combine property support.
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in: Added values for text-combine.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Added check of text-combine value.
+        * rendering/style/RenderStyle.h: Added accessors for text-combine.
+        (WebCore::InheritedFlags::textCombine):
+        (WebCore::InheritedFlags::setTextCombine):
+        (WebCore::InheritedFlags::initialTextCombine):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareNonInheritedData.cpp: Added text-combine property support.
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h: Added text-combine entry for RenderStyle object here.
+
+2010-11-02  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Barth.
+
+        For unnamed frames, window.name returns a generated name
+        https://bugs.webkit.org/show_bug.cgi?id=6751
+
+        Part 1 of 2.
+
+        Towards fixing bug #6751, rename FrameTree::name() to FrameTree::uniqueName(),
+        which is more descriptive of its purpose. A follow up patch will re-add
+        FrameTree::name() which will return the DOM-specified name of the frame.
+
+        We will also take this opportunity to verify that we have found all the
+        call sites of FrameTree::name().
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainResource): Use FrameTree::uniqueName().
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Ditto.
+        (WebCore::FrameLoader::commitProvisionalLoad): Ditto.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::saveDocumentState): Ditto.
+        (WebCore::HistoryController::restoreDocumentState): Ditto.
+        (WebCore::HistoryController::createItem): Ditto.
+        (WebCore::HistoryController::currentFramesMatchItem): Ditto.
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted): Ditto.
+        (WebCore::ProgressTracker::progressCompleted): Ditto.
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Ditto.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::name): Ditto.
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::setName): Ditto.
+        (WebCore::FrameTree::clearName): Ditto.
+        (WebCore::FrameTree::uniqueChildName): Ditto.
+        (WebCore::FrameTree::child): Ditto.
+        (WebCore::FrameTree::find): Ditto.
+        * page/FrameTree.h:
+        (WebCore::FrameTree::uniqueName): Renamed (formerly FrameTree::name()).
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add AudioProcessingEvent files
+        https://bugs.webkit.org/show_bug.cgi?id=48884
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioProcessingEvent.cpp: Added.
+        (WebCore::AudioProcessingEvent::create):
+        (WebCore::AudioProcessingEvent::AudioProcessingEvent):
+        (WebCore::AudioProcessingEvent::~AudioProcessingEvent):
+        (WebCore::AudioProcessingEvent::isAudioProcessingEvent):
+        * webaudio/AudioProcessingEvent.h: Added.
+        (WebCore::AudioProcessingEvent::inputBuffer):
+        (WebCore::AudioProcessingEvent::outputBuffer):
+        * webaudio/AudioProcessingEvent.idl: Added.
+
+2010-11-02  Al Patrick  <apatrick@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Added PluginLayerChromium, which composites plugin instances that have an associated OpenGL backing texture.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48032
+
+        * WebCore.gypi:
+        * loader/SubframeLoader.cpp
+        (WebCore::SubframeLoader::loadPlugin):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::pluginLayerSharedValues):
+        * platform/graphics/chromium/PluginLayerChromium.cpp: Added.
+        (WebCore::PluginLayerChromium::SharedValues::SharedValues):
+        (WebCore::PluginLayerChromium::SharedValues::~SharedValues):
+        (WebCore::PluginLayerChromium::create):
+        (WebCore::PluginLayerChromium::PluginLayerChromium):
+        (WebCore::PluginLayerChromium::updateContents):
+        (WebCore::PluginLayerChromium::draw):
+        * platform/graphics/chromium/PluginLayerChromium.h: Added.
+        (WebCore::PluginLayerChromium::drawsContent):
+        (WebCore::PluginLayerChromium::setTextureId):
+        (WebCore::PluginLayerChromium::SharedValues::shaderProgram):
+        (WebCore::PluginLayerChromium::SharedValues::shaderSamplerLocation):
+        (WebCore::PluginLayerChromium::SharedValues::shaderMatrixLocation):
+        (WebCore::PluginLayerChromium::SharedValues::shaderAlphaLocation):
+        (WebCore::PluginLayerChromium::SharedValues::initialized):
+
+2010-11-02  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        mathml in html sometimes incorrectly parsed
+        https://bugs.webkit.org/show_bug.cgi?id=48105
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag): Fixed to match HTML5 spec.
+
+2010-11-02  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Null check obj in AXObjectCache::postPlatformNotification.
+        https://bugs.webkit.org/show_bug.cgi?id=48896
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2010-11-02  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        [FileSystem] Support not creating directories when queried by inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=48169
+
+        * fileapi/LocalFileSystem.cpp:
+        (WebCore::openFileSystem):
+        (WebCore::LocalFileSystem::readFileSystem):
+        (WebCore::LocalFileSystem::requestFileSystem):
+        * fileapi/LocalFileSystem.h:
+        * platform/AsyncFileSystem.cpp:
+        (WebCore::AsyncFileSystem::openFileSystem):
+        * platform/AsyncFileSystem.h:
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioBufferSourceNode files
+        https://bugs.webkit.org/show_bug.cgi?id=48012
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioBufferSourceNode.cpp: Added.
+        (WebCore::AudioBufferSourceNode::create):
+        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
+        (WebCore::AudioBufferSourceNode::~AudioBufferSourceNode):
+        (WebCore::AudioBufferSourceNode::process):
+        (WebCore::AudioBufferSourceNode::provideInput):
+        (WebCore::AudioBufferSourceNode::readFromBuffer):
+        (WebCore::AudioBufferSourceNode::readFromBufferWithGrainEnvelope):
+        (WebCore::AudioBufferSourceNode::reset):
+        (WebCore::AudioBufferSourceNode::setBuffer):
+        (WebCore::AudioBufferSourceNode::numberOfChannels):
+        (WebCore::AudioBufferSourceNode::noteOn):
+        (WebCore::AudioBufferSourceNode::noteGrainOn):
+        (WebCore::AudioBufferSourceNode::noteOff):
+        (WebCore::AudioBufferSourceNode::totalPitchRate):
+        * webaudio/AudioBufferSourceNode.h: Added.
+        (WebCore::AudioBufferSourceNode::buffer):
+        (WebCore::AudioBufferSourceNode::looping):
+        (WebCore::AudioBufferSourceNode::setLooping):
+        (WebCore::AudioBufferSourceNode::gain):
+        (WebCore::AudioBufferSourceNode::playbackRate):
+        (WebCore::AudioBufferSourceNode::setPannerNode):
+        * webaudio/AudioBufferSourceNode.idl: Added.
+
+2010-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        [Cairo] Remove PlatformRefPtrCairo
+        https://bugs.webkit.org/show_bug.cgi?id=48192
+
+        Replace PlatformRefPtrCairo with a RefPtr specialization for Cairo and
+        Fontconfig types. This is the first step toward removing PlatformRefPtr,
+        whose job is better handled by RefPtr.
+
+        * CMakeListsEfl.txt: Update the sources list to include RefPtrCairo
+        instead of PlatformRefPtrCairo.
+        * GNUmakefile.am: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * platform/graphics/GraphicsContext.h: Replace PlatformRefPtrCairo with
+        RefPtrCairo.
+        * platform/graphics/cairo/CairoUtilities.cpp: Ditto.
+        (WebCore::drawPatternToCairoContext): Ditto.
+        * platform/graphics/cairo/FontCacheFreeType.cpp: Ditto.
+        (WebCore::FontCache::getFontDataForCharacters): Ditto.
+        (WebCore::FontCache::createFontPlatformData): Ditto.
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp: Ditto.
+        (WebCore::FontPlatformData::FontPlatformData): Ditto.
+        (WebCore::FontPlatformData::initializeWithFontFace): Ditto.
+        * platform/graphics/cairo/FontPlatformDataFreeType.h: Ditto.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Ditto.
+        * platform/graphics/cairo/ImageCairo.cpp: Ditto.
+        * platform/graphics/cairo/RefPtrCairo.cpp: Renamed from WebCore/platform/graphics/cairo/PlatformRefPtrCairo.cpp.
+        (WTF::refIfNotNull): Added.
+        (WTF::derefIfNotNull): Added.
+        * platform/graphics/cairo/RefPtrCairo.h: Renamed from WebCore/platform/graphics/cairo/PlatformRefPtrCairo.h.
+        * platform/gtk/CursorGtk.cpp: Replace PlatformRefPtrCairo with
+        RefPtrCairo.
+        (WebCore::createNamedCursor): Ditto.
+        * platform/gtk/DragImageGtk.cpp: Ditto.
+        (WebCore::scaleDragImage): Ditto.
+        (WebCore::dissolveDragImageToFraction): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+        (WebCore::PluginView::paint): Ditto.
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Simple followup changes to files affected by AudioNodeInput thread safety
+        https://bugs.webkit.org/show_bug.cgi?id=48661
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioBasicProcessorNode.cpp:
+        (WebCore::AudioBasicProcessorNode::checkNumberOfChannelsForInput):
+        * webaudio/AudioChannelSplitter.cpp:
+        (WebCore::AudioChannelSplitter::process):
+        * webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::initialize):
+        (WebCore::AudioDestinationNode::uninitialize):
+        (WebCore::AudioDestinationNode::provideInput):
+        * webaudio/AudioGainNode.cpp:
+        (WebCore::AudioGainNode::checkNumberOfChannelsForInput):
+        * webaudio/AudioPannerNode.cpp:
+        (WebCore::AudioPannerNode::notifyAudioSourcesConnectedToNode):
+
+2010-11-02  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Chromium: Propagate a document value changed notification on scroll.
+        https://bugs.webkit.org/show_bug.cgi?id=48817
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isAccessibilityScrollbar):
+        * accessibility/AccessibilityScrollbar.h:
+        (WebCore::AccessibilityScrollbar::scrollbar):
+        (WebCore::AccessibilityScrollbar::isAccessibilityScrollbar):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add ConvolverNode files
+        https://bugs.webkit.org/show_bug.cgi?id=47941
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/ConvolverNode.cpp: Added.
+        (WebCore::ConvolverNode::ConvolverNode):
+        (WebCore::ConvolverNode::~ConvolverNode):
+        (WebCore::ConvolverNode::process):
+        (WebCore::ConvolverNode::reset):
+        (WebCore::ConvolverNode::initialize):
+        (WebCore::ConvolverNode::uninitialize):
+        (WebCore::ConvolverNode::setBuffer):
+        (WebCore::ConvolverNode::buffer):
+        * webaudio/ConvolverNode.h: Added.
+        (WebCore::ConvolverNode::create):
+        * webaudio/ConvolverNode.idl: Added.
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add RealtimeAnalyser files
+        https://bugs.webkit.org/show_bug.cgi?id=48810
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/RealtimeAnalyser.cpp: Added.
+        (WebCore::RealtimeAnalyser::RealtimeAnalyser):
+        (WebCore::RealtimeAnalyser::~RealtimeAnalyser):
+        (WebCore::RealtimeAnalyser::reset):
+        (WebCore::RealtimeAnalyser::setFftSize):
+        (WebCore::RealtimeAnalyser::writeInput):
+        (WebCore::RealtimeAnalyser::doFFTAnalysis):
+        (WebCore::RealtimeAnalyser::getFloatFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteTimeDomainData):
+        * webaudio/RealtimeAnalyser.h: Added.
+        (WebCore::RealtimeAnalyser::fftSize):
+        (WebCore::RealtimeAnalyser::frequencyBinCount):
+        (WebCore::RealtimeAnalyser::setMinDecibels):
+        (WebCore::RealtimeAnalyser::minDecibels):
+        (WebCore::RealtimeAnalyser::setMaxDecibels):
+        (WebCore::RealtimeAnalyser::maxDecibels):
+        (WebCore::RealtimeAnalyser::setSmoothingTimeConstant):
+        (WebCore::RealtimeAnalyser::smoothingTimeConstant):
+        (WebCore::RealtimeAnalyser::magnitudeBuffer):
+
+2010-11-02  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Avoid overlapping label text in autofill popup with icon.
+        Updates the menu width computation to take the icon width into account.
+        https://bugs.webkit.org/show_bug.cgi?id=48497
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::layout):
+
+2010-10-28  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Perform framebuffer attachment checking upon draw call rather than attachment
+        https://bugs.webkit.org/show_bug.cgi?id=46318
+
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::getInternalFormat): Helper function to get an attachment's internal format.
+        (WebCore::isUninitialized): Helper function to decide if an attachment is initialized or not.
+        (WebCore::setInitialized): Helper funtion to set an attachment as being initialized.
+        (WebCore::WebGLFramebuffer::setAttachment): No longer perform buffer initialization at this point.
+        (WebCore::WebGLFramebuffer::removeAttachment): Ditto.
+        (WebCore::WebGLFramebuffer::getColorBufferFormat): Make it const.
+        (WebCore::WebGLFramebuffer::isIncomplete): Attachments conflict check.
+        (WebCore::WebGLFramebuffer::onAccess): Check atatchment conflicts and buffer initialization if necessary.
+        (WebCore::WebGLFramebuffer::initializeRenderbuffers): Return a boolean whether the framebuffer is complete or not.
+        * html/canvas/WebGLFramebuffer.h: Add new function declaration and remove some outdated functions.
+        (WebCore::WebGLFramebuffer::isColorAttached):
+        (WebCore::WebGLFramebuffer::isDepthAttached): Make this private.
+        (WebCore::WebGLFramebuffer::isStencilAttached): Ditto.
+        (WebCore::WebGLFramebuffer::isDepthStencilAttached): Ditto.
+        * html/canvas/WebGLRenderbuffer.h:
+        (WebCore::WebGLRenderbuffer::setInternalFormat): Also set the renderbuffer as uninitialized.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::bindFramebuffer): No longer perform framebuffer initialization at this point.
+        (WebCore::WebGLRenderingContext::checkFramebufferStatus): Check WebGL specific attachment conflicts.
+        (WebCore::WebGLRenderingContext::clear): Call WebGLFramebuffer::onAccess.
+        (WebCore::WebGLRenderingContext::copyTexImage2D): Ditto.
+        (WebCore::WebGLRenderingContext::copyTexSubImage2D): Ditto.
+        (WebCore::WebGLRenderingContext::drawArrays): Ditto.
+        (WebCore::WebGLRenderingContext::drawElements): Ditto.
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer): No longer perform framebuffer initialization at this point.
+        (WebCore::WebGLRenderingContext::readPixels): Call WebGLFramebuffer::onAccess.
+        (WebCore::WebGLRenderingContext::renderbufferStorage): No longer perform framebuffer initialization at this point.
+        (WebCore::WebGLRenderingContext::texImage2DBase): Ditto.
+
+2010-11-01  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        blendFunc should generate INVALID_OPERATION if constant color and constant alpha are together as source and destination factors
+        https://bugs.webkit.org/show_bug.cgi?id=48674
+
+        Test: fast/canvas/webgl/webgl-specific.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::blendFunc):
+        (WebCore::WebGLRenderingContext::blendFuncSeparate):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::validateBlendFuncFactors): Helper function to do the checking.
+
+2010-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Overlapped nested iframes show smearing when scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=48873
+
+        A FrameView goes into slow scrolling mode (not blitting) when told that it is
+        overlapped. However, a nested iframe could still try to use fast scrolling
+        when its parent is overlapped, which could result in bad rendering.
+        
+        Fixed by making useSlowRepaints() and useSlowRepaintsIfNotOverlapped()
+        walk up their parent chain, asking if their parents also use slow
+        repaints.
+        
+        All the places that call setCanBlitOnScroll() now call
+        updateCanBlitOnScrollRecursively() to ensure that the canBlitOnScroll
+        flag is updated correctly on subframes.
+        
+        Repaint tests do not work on nested iframes, so added manual test.
+
+        * manual-tests/frames/nested-iframe-blit-on-scroll.html: Added.
+        * manual-tests/frames/resources/blit-on-scroll-subframe.html: Added.
+        * manual-tests/frames/resources/blit-on-scroll-subsubframe.html: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::updateCanBlitOnScrollRecursively):
+        (WebCore::FrameView::setUseSlowRepaints):
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        (WebCore::FrameView::setIsOverlapped):
+        (WebCore::FrameView::setContentIsOpaque):
+        * page/FrameView.h:
+
+2010-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Iframes nested inside a compositing layer don't repaint correctly
+        https://bugs.webkit.org/show_bug.cgi?id=48880
+        <rdar://problem/8194698>
+        
+        The isEnclosedInCompositingLayer() is used to modify the behavior of
+        -[WebClipView visibleRect:] in WebKit, so that scrolling-related repaints
+        are correct in composited iframes. Previously it only asked whether the
+        frame's renderer was in a compositing layer, but we actually need to
+        consult all ancestors.
+        
+        Test: compositing/iframes/nested-iframe-scrolling.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isEnclosedInCompositingLayer):
+
+2010-11-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48672
+        
+        Make vertical glyph offset hit testing work with inline boxes.  This allows selection to paint
+        properly for vertical text (although gap-filling is still broken).
+        
+        Refactored and cleaned up the writing mode flipping functions, and also did some cleanup to
+        better share code between hit testing and painting.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::locationIncludingFlipping):
+        (WebCore::InlineBox::flipForWritingMode):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        (WebCore::InlineTextBox::positionForOffset):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::flipForWritingMode):
+        (WebCore::RenderBox::locationOffsetIncludingFlipping):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::rangeIntersectsRect):
+        (WebCore::RenderLineBoxList::anyLineIntersectsRect):
+        (WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+
+2010-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        JPEG decoders should understand color profiles
+        https://bugs.webkit.org/show_bug.cgi?id=48819
+
+        This patch is currently a no-op because no one defines USE(ICCJPEG).
+        We'll enable this for Chromium Mac once we have ICCJPEG landed in
+        Chromium's third_party directory.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readColorProfile):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setColorProfile):
+
+2010-11-02  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Crash when encountering history.back() call during Page::goToItem execution
+        https://bugs.webkit.org/show_bug.cgi?id=48477
+        
+        For the Chromium port, BackForwardList::itemAtIndex synthesizes a 
+        HistoryItem and saves a pointer to it in m_pendingItem. During 
+        Page::goToItem we call FrameLoader::stopAllLoaders, which can trigger
+        onload handlers (if a subframe was not considered committed by the frame
+        loader). If one of those handlers calls calls history.back() or another
+        operation that ends up in NavigationScheduler::scheduleHistoryNavigation,
+        we would call BackForwardList::itemAtIndex, which means that we would 
+        lose the m_pendingItem RefPtr that pointed to the item being navigated 
+        to, causing its ref count to go to 0*, and thus for the HistoryItem to
+        be deleted before we were done navigating to it.
+        
+        This is fixed in two ways:
+        - Add a protector RefPtr in Page::goToItem to make sure that the item is
+          still around for when we pass it to HistoryController:goToItem.
+        - Change NavigationScheduler::scheduleHistoryNavigation to not use
+          BackForwardList::itemAtIndex and instead look at the
+          forward/backListCount() (since it doesn't actually care about the
+          returned HistoryItem).
+        
+        * Full annotated stack trace of this is at http://crbug.com/59554#c9.        
+
+        Test: http/tests/history/back-during-onload-triggered-by-back.html
+
+        * loader/NavigationScheduler.cpp:
+        (WebCore::NavigationScheduler::scheduleHistoryNavigation):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-10-28  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Update getUniform for bvec[234] to return boolean[] rather than Uint8Array
+        https://bugs.webkit.org/show_bug.cgi?id=47568
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add RealtimeAnalyserNode files
+        https://bugs.webkit.org/show_bug.cgi?id=48798
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/RealtimeAnalyserNode.cpp: Added.
+        (WebCore::RealtimeAnalyserNode::RealtimeAnalyserNode):
+        (WebCore::RealtimeAnalyserNode::~RealtimeAnalyserNode):
+        (WebCore::RealtimeAnalyserNode::process):
+        (WebCore::RealtimeAnalyserNode::pullInputs):
+        (WebCore::RealtimeAnalyserNode::reset):
+        * webaudio/RealtimeAnalyserNode.h: Added.
+        (WebCore::RealtimeAnalyserNode::create):
+        (WebCore::RealtimeAnalyserNode::fftSize):
+        (WebCore::RealtimeAnalyserNode::setFftSize):
+        (WebCore::RealtimeAnalyserNode::frequencyBinCount):
+        (WebCore::RealtimeAnalyserNode::setMinDecibels):
+        (WebCore::RealtimeAnalyserNode::minDecibels):
+        (WebCore::RealtimeAnalyserNode::setMaxDecibels):
+        (WebCore::RealtimeAnalyserNode::maxDecibels):
+        (WebCore::RealtimeAnalyserNode::setSmoothingTimeConstant):
+        (WebCore::RealtimeAnalyserNode::smoothingTimeConstant):
+        (WebCore::RealtimeAnalyserNode::getFloatFrequencyData):
+        (WebCore::RealtimeAnalyserNode::getByteFrequencyData):
+        (WebCore::RealtimeAnalyserNode::getByteTimeDomainData):
+        * webaudio/RealtimeAnalyserNode.idl: Added.
+
+2010-11-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r71152.
+        http://trac.webkit.org/changeset/71152
+        https://bugs.webkit.org/show_bug.cgi?id=48866
+
+        Causes lots and lots of crashes (Requested by jamesr_ on
+        #webkit).
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+
+2010-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48813
+        <rdar://problem/8602552> REGRESSION (r63622): DNS prefetching for <link> tags doesn't work
+        in non-HTTP documents
+
+        Cannot test DNS prefetching.
+
+        * html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::process): We should be looking at
+        preferences, not at whether this document has prefetching enabled.
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Web Inspector: follow up to r71139. Fixed Mac monospace
+        height style.
+
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/inspector.css:
+
+2010-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        JPEG decoders should understand color profiles
+        https://bugs.webkit.org/show_bug.cgi?id=48819
+
+        This patch is currently a no-op because no one defines USE(ICCJPEG).
+        We'll enable this for Chromium Mac once we have ICCJPEG landed in
+        Chromium's third_party directory.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readColorProfile):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setColorProfile):
+
+2010-11-02  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Marks selectionStart() and selectionEnd() as const.
+        https://bugs.webkit.org/show_bug.cgi?id=48786
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        * html/HTMLFormControlElement.h:
+
+2010-11-02  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix license for audio files
+        https://bugs.webkit.org/show_bug.cgi?id=48859
+
+        * webaudio/AudioChannelSplitter.cpp:
+        * webaudio/AudioChannelSplitter.h:
+        * webaudio/AudioDestinationNode.cpp:
+        * webaudio/AudioDestinationNode.h:
+        * webaudio/AudioGainNode.cpp:
+        * webaudio/AudioGainNode.h:
+        * webaudio/AudioPannerNode.cpp:
+        * webaudio/AudioPannerNode.h:
+        * webaudio/AudioPannerNode.idl:
+
+2010-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Remove special handling of HashTableDeletedValue in PlatformRefPtr and manually manage memory that cannot be controlled by HashTraits
+        https://bugs.webkit.org/show_bug.cgi?id=48841
+
+        Switch to manually managing the memory in FontPlatformDataFreeType. This
+        is necessary because smart pointers do not know how to deal with a pointer
+        value of -1 (HashTableDeletedValue) and HashTraits can only manage the type
+        contained in the HashMap. 
+
+        No new tests as this should not change functionality.
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::initializeWithFontFace):
+        * platform/graphics/cairo/FontPlatformDataFreeType.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::scaledFont):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/cairo/GlyphPageTreeNodeCairo.cpp:
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2010-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        querySelectorAll('body>:last-child') does not work unless HTML file ends with 'new-line'.
+        https://bugs.webkit.org/show_bug.cgi?id=47166
+
+        We need to pop all the open elements when we end the document in the
+        AfterAfterBody state.
+
+        Test: fast/parser/pop-all-after-after-body.html
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+
+2010-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cleanup createGlobalImageFileDescriptor in ClipboardWin
+        https://bugs.webkit.org/show_bug.cgi?id=48189
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::writeURL):
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: display frame names in the resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=48839
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::frameId):
+        (WebCore::buildObjectForDocumentLoader):
+        (WebCore::buildObjectForFrame):
+        (WebCore::buildObjectForFrameTree):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::InspectorResourceAgent::frameForId):
+        (WebCore::InspectorResourceAgent::resourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.prototype.didCommitLoadForFrame):
+        (WebInspector.ResourceManager.prototype._processCachedResources):
+        (WebInspector.ResourceManager.prototype._addFramesRecursively):
+        (WebInspector.ResourceTreeModel.prototype.addOrUpdateFrame):
+        (WebInspector.ResourceTreeModel.prototype.didCommitLoadForFrame):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.addOrUpdateFrame):
+        (WebInspector.BaseStorageTreeElement.prototype.get titleText):
+        (WebInspector.FrameTreeElement):
+        (WebInspector.FrameTreeElement.prototype.onattach):
+        (WebInspector.FrameTreeElement.prototype.get nameForSorting):
+        (WebInspector.FrameTreeElement.prototype.setTitles):
+        (WebInspector.FrameTreeElement.prototype.set hovered):
+        * inspector/front-end/inspector.css:
+        (li.selected .base-storage-tree-element-subtitle):
+        (.base-storage-tree-element-subtitle):
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Follow up to r71139: removing unused images.
+        https://bugs.webkit.org/show_bug.cgi?id=48827
+
+        * WebCore.gypi:
+        * inspector/front-end/Images/grayConnectorPoint.png: Removed.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Removed.
+        * inspector/front-end/WebKit.qrc:
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: make properties and event listeners look consistent with the styles section.
+        https://bugs.webkit.org/show_bug.cgi?id=48827
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/inspector.css:
+        (.events-pane .section:not(:nth-of-type(1))):
+        (.event-bar:first-child):
+        (.section .header):
+        (.section .header::before):
+        (.section.expanded .header::before):
+        (.section .header .title, .event-bar .header .title):
+        (.section .header .subtitle, .event-bar .header .subtitle):
+        (.section.expanded .properties, .event-bar.expanded .event-properties):
+        (.properties-tree):
+        (.event-bar):
+        (.event-bars .event-bar .header):
+        (.event-bars .event-bar .header .title):
+        (.event-bars .event-bar .header::before):
+
+2010-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused methods and member variables from AutoTableLayout.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::AutoTableLayout): Removed initialization of m_percentagesDirty
+        and m_totalPercent.
+        (WebCore::AutoTableLayout::fullRecalc): Removed setting of m_percentagesDirty.
+        (WebCore::AutoTableLayout::calcPercentages): Removed.
+        * rendering/AutoTableLayout.h: Removed totalPercent(), m_percentagesDirty, and m_totalPercent.
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear / hide timing information for cached resources.
+        https://bugs.webkit.org/show_bug.cgi?id=48848
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.set cached):
+        (WebInspector.Resource.prototype.get timing):
+        (WebInspector.Resource.prototype.set timing):
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.prototype.markResourceAsCached):
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: improve network's 'preview close' usability.
+        https://bugs.webkit.org/show_bug.cgi?id=48846
+
+        * inspector/front-end/networkPanel.css:
+        (#network-close-button:hover):
+        (#network-close-button:active):
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Image heights are displayed as 0.
+        https://bugs.webkit.org/show_bug.cgi?id=40817
+
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView.prototype.contentTabSelected):
+        (WebInspector.ImageView.prototype.contentTabSelected.onImageLoad):
+
+ 2010-10-31  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Some refactor for texmap to enable WebKit2: remove globals, and allow TextureMapper to exist without a GraphicsContext.
+        This will allow rendering the TextureMapperNode tree without an active QPainter, into the current GL context.
+        Most of the changes simply move the globas in TextureMapperGL into members of that class.
+
+        No new tests. Old tests in LayoutTests/compositing cover this.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGLData::ShaderInfo::getUniformLocation):
+        (WebCore::TextureMapperGLData::ShaderInfo::createShaderProgram):
+        (WebCore::TextureMapperGLData::DirectlyCompositedImageRepository::findOrCreate):
+        (WebCore::TextureMapperGLData::DirectlyCompositedImageRepository::deref):
+        (WebCore::TextureMapperGLData::DirectlyCompositedImageRepository::DirectlyCompositedImageRepository):
+        (WebCore::TextureMapperGLData::DirectlyCompositedImageRepository::~DirectlyCompositedImageRepository):
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (WebCore::TextureMapperGL::TextureMapperGL):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::BitmapTextureGL::setContentsToImage):
+        (WebCore::BitmapTextureGL::destroy):
+        (WebCore::TextureMapperGL::~TextureMapperGL):
+        (WebCore::TextureMapperGL::makeContextCurrent):
+        (WebCore::TextureMapperGL::obtainCurrentContext):
+        (WebCore::TextureMapperGL::bindSurface):
+        (WebCore::TextureMapperGL::paintToTarget):
+        (WebCore::TextureMapperGL::createTexture):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::data):
+        * platform/graphics/qt/TextureMapperQt.cpp:
+        (WebCore::TextureMapperQt::TextureMapperQt):
+        (WebCore::TextureMapperQt::setGraphicsContext):
+        (WebCore::TextureMapper::create):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::TextureMapperNode::paint):
+        (WebCore::TextureMapperNode::uploadTextureFromContent):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::TextureMapper::setGraphicsContext):
+        (WebCore::TextureMapper::setImageInterpolationQuality):
+        (WebCore::TextureMapper::setTextDrawingMode):
+        (WebCore::TextureMapper::imageInterpolationQuality):
+        (WebCore::TextureMapper::textDrawingMode):
+        (WebCore::TextureMapper::TextureMapper):
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (WebCore::TextureMapperContentLayer::paint):
+
+ 2010-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Kent Tamura.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=48814
+        <rdar://problem/8546143> Attempting to redo typing in apple.com/startpage search field causes infinite recursion in TextControlInnerTextElement::defaultEventHandler
+
+        Test: editing/undo/redo-after-detach.html
+
+        * rendering/TextControlInnerElements.cpp: (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        A TextControlInnerTextElement will almost always have a shadowAncestorNode, the HTMLInputElement.  In this case, 
+        after the renderer was destroyed, this shadow node was kept alive by the EditCommand, even though its not hooked up 
+        anymore to the shadow DOM.  EditCommands can sometimes operate on stale selections and are expected to fail silently.  
+        So here we prevent the infinite loop during event dispatch, and the rest of the redo operation will fail silently.
+
+2010-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        When animations are paused, play-state can cause them to be unpaused.
+        https://bugs.webkit.org/show_bug.cgi?id=46525
+
+        I Changed updatePlayState() to only unpause when both play-state is 
+        "running" and not suspended. Likewise I pause animation when either
+        play-state is "paused" or suspended.
+
+        Test: animations/play-state-suspend.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updatePlayState):
+
+2010-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make RenderStyle::playState() return typed value and cleanup naming in Animation code
+        https://bugs.webkit.org/show_bug.cgi?id=48844
+
+        playState() function was returning unsigned value, but there is a EAnimPlayState
+        enum type which has the legal playState values. This type is now used everywhere.
+        I also changed the naming of the m_isSuspended to m_suspended to match the style
+        elsewhere in the code.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updatePlayState):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::clear):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::suspended):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::playState):
+        (WebCore::Animation::setPlayState):
+        (WebCore::Animation::initialAnimationPlayState):
+
+2010-11-01  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Andreas Kling.
+
+        vertexAttribPointer should generate INVALID_VALUE if the stride exceeds 255
+        https://bugs.webkit.org/show_bug.cgi?id=48677
+
+        Test: fast/canvas/webgl/gl-vertexattribpointer.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer): Generate INVALID_VALUE if stride > 255.
+
+2010-11-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Soup] Random crashes in http/tests/websocket/tests/workers/worker-handshake-challenge-randomness.html
+        https://bugs.webkit.org/show_bug.cgi?id=48805
+
+        Track active WebSocket handles via a sequential id. This ensures
+        that when a handle is reallocated into a recently used segment of
+        memory, it doesn't trigger a false positive in the code which ensures
+        the original handle is active.
+
+        No new tests. This test should stop crashing on the bots, proving the fix.
+
+        * platform/network/soup/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::id): Added an m_id member and accessor
+        to SocketStreamHandle.
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+        (WebCore::getHandleFromId): Updated to work with HashMap of handle ids to
+        SocketStreamHandle*.
+        (WebCore::deactivateHandle): Ditto.
+        (WebCore::activateHandle): Ditto.
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Ditto.
+        (WebCore::SocketStreamHandle::connected): Ditto.
+        (WebCore::SocketStreamHandle::readBytes): Ditto.
+        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability): Ditto.
+        (WebCore::connectedCallback): Ditto.
+        (WebCore::readReadyCallback): Ditto.
+        (WebCore::writeReadyCallback): Ditto.
+
+2010-11-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed trivial fix.
+
+        * WebCore.pro: Remove inspector/InspectorResource.h after r71035.
+
+2010-11-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: make xhr breakpoints editable
+        https://bugs.webkit.org/show_bug.cgi?id=48830
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.Breakpoint.prototype.set sourceText):
+        (WebInspector.Breakpoint.prototype.click):
+        (WebInspector.Breakpoint.prototype.populateLabelElement):
+        (WebInspector.XHRBreakpoint.prototype.populateEditElement):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpointItem):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointItemClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype._contextMenuEventFired):
+        (WebInspector.BreakpointsSidebarPane.prototype._addListElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._removeListElement):
+        (WebInspector.XHRBreakpointsSidebarPane.addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._startEditingBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._hideEditBreakpointDialog):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._breakpointItemClicked):
+        (WebInspector.BreakpointItem):
+        (WebInspector.BreakpointItem.prototype.get element):
+        (WebInspector.BreakpointItem.prototype.click):
+        (WebInspector.BreakpointItem.prototype.populateEditElement):
+        (WebInspector.BreakpointItem.prototype.remove):
+        (WebInspector.BreakpointItem.prototype._hitStateChanged):
+        (WebInspector.BreakpointItem.prototype._labelChanged):
+        (WebInspector.BreakpointItem.prototype._createLabelElement):
+        * inspector/front-end/inspector.js:
+        (WebInspector.createJSBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createJSBreakpointsSidebarPane):
+        (WebInspector.createDOMBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createDOMBreakpointsSidebarPane):
+        (WebInspector.createXHRBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createXHRBreakpointsSidebarPane):
+
+2010-11-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix for breakpoints not restored on live edit bug
+        https://bugs.webkit.org/show_bug.cgi?id=48833
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2010-11-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] Rule addition/selector editing result in unusable rules
+        https://bugs.webkit.org/show_bug.cgi?id=48826
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+
+2010-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Don't include Objective-C sources in SOURCES
+
+        * WebCore.pro:
+
+2010-11-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: persist native breakpoints in localStorage
+        https://bugs.webkit.org/show_bug.cgi?id=48711
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::clearNativeBreakpoints):
+        * inspector/InspectorController.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager):
+        (WebInspector.DOMBreakpoint):
+        (WebInspector.EventListenerBreakpoint):
+        (WebInspector.EventListenerBreakpoint.eventNameForUI):
+        (WebInspector.EventListenerBreakpoint.prototype._uiEventName):
+        (WebInspector.XHRBreakpoint):
+        (WebInspector.XHRBreakpoint.prototype.populateStatusMessageElement):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointHit):
+        (WebInspector.BreakpointItem.prototype._hitStateChanged):
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/EventListenersSidebarPane.js:
+        * inspector/front-end/NetworkPanel.js:
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ResourceView.js:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        (WebInspector.Settings.prototype.inspectedURLChanged):
+        (WebInspector.Settings.prototype._formatProjectKey):
+        * inspector/front-end/StoragePanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        * inspector/front-end/inspector.css:
+        (.pane .breakpoint-hit):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentPanel):
+        (WebInspector.doLoadedDone.onPopulateScriptObjects):
+        (WebInspector.doLoadedDone):
+        (WebInspector.reset):
+        (WebInspector.inspectedURLChanged):
+
+2010-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: use mimeType from cached resource
+        in case response data contains none.
+        https://bugs.webkit.org/show_bug.cgi?id=48773
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype._createTable):
+
+2010-11-01  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Extensions API] expose API to create properties watch sidebar panes
+        https://bugs.webkit.org/show_bug.cgi?id=48761
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.PanelImpl.prototype.createSidebarPane):
+        (WebInspector.injectedExtensionAPI.PanelImpl.prototype.createWatchExpressionSidebarPane.callbackWrapper):
+        (WebInspector.injectedExtensionAPI.PanelImpl.prototype.createWatchExpressionSidebarPane):
+        (WebInspector.injectedExtensionAPI):
+        (WebInspector.injectedExtensionAPI.WatchExpressionSidebarPaneImpl):
+        (WebInspector.injectedExtensionAPI.WatchExpressionSidebarPaneImpl.prototype.setExpression):
+        (WebInspector.injectedExtensionAPI.WatchExpressionSidebarPaneImpl.prototype.setObject):
+        * inspector/front-end/ExtensionPanel.js: Added ExtensionWatchSidebarPane
+        (WebInspector.ExtensionWatchSidebarPane):
+        (WebInspector.ExtensionWatchSidebarPane.prototype.setObject):
+        (WebInspector.ExtensionWatchSidebarPane.prototype.setExpression):
+        (WebInspector.ExtensionWatchSidebarPane.prototype._onEvaluate):
+        (WebInspector.ExtensionWatchSidebarPane.prototype._setObject):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype.notifyExtensionWatchSidebarUpdated):
+        (WebInspector.ExtensionServer.prototype._onCreateSidebar):
+        (WebInspector.ExtensionServer.prototype._onCreateWatchExpressionSidebarPane):
+        (WebInspector.ExtensionServer.prototype._createSidebar):
+        (WebInspector.ExtensionServer.prototype._onSetWatchSidebarContent):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        * inspector/front-end/RemoteObject.js: Added a wrapper for local JSON object to simulate RemoteObject interface.
+        (WebInspector.RemoteObject.fromLocalObject):
+        (WebInspector.LocalJSONObject):
+        (WebInspector.LocalJSONObject.prototype.get description):
+        (WebInspector.LocalJSONObject.prototype.get type):
+        (WebInspector.LocalJSONObject.prototype.get hasChildren):
+        (WebInspector.LocalJSONObject.prototype.getOwnProperties):
+        (WebInspector.LocalJSONObject.prototype.getProperties):
+        (WebInspector.LocalJSONObject.prototype.isError):
+
+2010-11-02  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix for EFL build with libcurl
+
+        [EFL] remove multiple definition with libcurl
+        https://bugs.webkit.org/show_bug.cgi?id=48499
+
+        Add macro to isolate setCookieStoragePrivateBrowsingEnabled from EFL
+        build because it was duplicated.
+
+        * platform/network/curl/CookieJarCurl.cpp:
+
+2010-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: highlight frame on hover in resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=48760
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::highlightFrame):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::hideFrameHighlight):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.showView):
+        (WebInspector.StoragePanel.prototype._onmousemove):
+        (WebInspector.StoragePanel.prototype._onmouseout):
+        (WebInspector.FrameTreeElement.prototype.onselect):
+        (WebInspector.FrameTreeElement.prototype.ondeselect):
+        (WebInspector.FrameTreeElement.prototype.set displayName):
+        (WebInspector.FrameTreeElement.prototype.set hovered):
+        * inspector/front-end/inspector.css:
+        (.storage.panel .sidebar li.selected .selection):
+        (.storage.panel .sidebar :focus li.selected .selection):
+        (body.inactive .storage.panel .sidebar li.selected .selection):
+
+2010-11-02  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Rob Buis.
+
+        Convert SVGPreserveAspectRatio to the new SVGPropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48822
+
+        Convert the next type to use the SVGPropertyTearOffConcept. Just SVGAnimatedTransformList/SVGTransform/SVGStringList are missing.
+
+        Tests: svg/dom/SVGAnimatedPreserveAspectRatio.html
+               svg/dom/SVGPreserveAspectRatio.html
+
+        * GNUmakefile.am: Add SVGAnimatedPreserveAspectRatio.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAnimatedPreserveAspectRatio as new style animated type.
+        * bindings/scripts/CodeGeneratorJS.pm: Remove special SVGPreserveAspectRatio handling.
+        * bindings/scripts/CodeGeneratorObjC.pm: Always include the type wrapped by SVGPropertyTearOff<> - this was missing before, and now become visible as missing include.
+        * bindings/scripts/CodeGeneratorV8.pm: Remove special SVGPreserveAspectRatio handling.
+        * svg/DeprecatedSVGAnimatedPropertyTraits.h: Remove SVGPreserveAspectRatio handling.
+        * svg/DeprecatedSVGAnimatedTemplate.h: Ditto.
+        * svg/SVGAnimatedPreserveAspectRatio.h: Added.
+        * svg/SVGFEImageElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARE_ANIMATED_PROPERTY_NEW/ where SVGPreserveAspectRatio is used.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform): SVGPreserveAspectRatio::getCTM doesn't need x/y parameters, they were not used anywhere, remove them.
+        * svg/SVGFitToViewBox.h: Replace includes by class forwards.
+        * svg/SVGImageElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARE_ANIMATED_PROPERTY_NEW/ where SVGPreserveAspectRatio is used.
+        * svg/SVGLocatable.cpp: Add SVGNames.h include, to allow Qt to build (thanks ews!).
+        * svg/SVGMarkerElement.h: Ditto.
+        * svg/SVGPatternElement.h: Ditto.
+        * svg/SVGPreserveAspectRatio.cpp: Modernize code, add error handling for align/meetOrSlice covered by the new tests.
+        (WebCore::SVGPreserveAspectRatio::SVGPreserveAspectRatio):
+        (WebCore::SVGPreserveAspectRatio::setAlign):
+        (WebCore::SVGPreserveAspectRatio::setMeetOrSlice):
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        (WebCore::SVGPreserveAspectRatio::transformRect):
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        (WebCore::SVGPreserveAspectRatio::valueAsString):
+        * svg/SVGPreserveAspectRatio.h: Reindented header.
+        (WebCore::SVGPreserveAspectRatio::align): Inlined.
+        (WebCore::SVGPreserveAspectRatio::meetOrSlice): Inlined.
+        * svg/SVGPreserveAspectRatio.idl: Enable StrictTypeChecking for the align/meetOrSlice properties.
+        * svg/SVGSVGElement.h: s/DECLARE_ANIMATED_PROPERTY/DECLARE_ANIMATED_PROPERTY_NEW/ where SVGPreserveAspectRatio is used.
+        * svg/SVGStyledTransformableElement.h: Add SVGAnimatedPropertyMacros.h include, needed by efl to build (thanks ews!).
+        * svg/SVGSymbolElement.h: Ditto.
+        * svg/SVGViewElement.h: Ditto.
+        * svg/SVGViewSpec.h: Ditto.
+
+2010-11-01  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        @spellcheck attribute at the child of contentEditable node is ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=48418
+
+        Changed to check spellcheck availability against a node under the
+        selection (caret) instead of the focus. For shadow elements, the
+        check now refers its host node.  Note that the original code didn't
+        care shadows because focus is never set on them.
+        
+        Test: editing/spelling/spelling-attribute-at-child.html
+
+        * dom/Element.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::isSpellCheckingEnabledFor): 
+        (WebCore::Editor::isSpellCheckingEnabledInFocusedNode): Now just calling isSpellCheckingEnabledFor()
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        * editing/Editor.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::isSpellCheckingEnabled): Added.
+        * rendering/TextControlInnerElements.h:
+
+2010-11-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Daniel Bates.
+
+        [GTK] PopupMenuGtk has a very confusing if-else block
+        https://bugs.webkit.org/show_bug.cgi?id=48816
+
+        Small code cleanup for PopupMenuGtk.
+
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenuGtk::show):
+
+2010-11-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Add ICC support for PNG on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48170
+
+        This just pipes the ICC profile from libpng to CoreGraphics.  This
+        patch would have been a lot prettier on Snow Leopard, but we have to
+        use a somewhat ugly API to get this to work on Leopard.
+
+        This is covered by about infinite tests.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/image-decoders/cg/ImageDecoderCG.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+
+2010-11-01  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Leave SelectElement key handling without setting event default
+        handled when the selection reaches the boundary so focus can 
+        move to neighbor nodes in spatial navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=48145
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2010-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r71080.
+        http://trac.webkit.org/changeset/71080
+        https://bugs.webkit.org/show_bug.cgi?id=48815
+
+        This change caused many crashes on the debug bot. (Requested
+        by mrobinson on #webkit).
+
+        * platform/network/soup/SocketStreamHandle.h:
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+        (WebCore::isActiveHandle):
+        (WebCore::deactivateHandle):
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::connected):
+        (WebCore::SocketStreamHandle::readBytes):
+        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability):
+        (WebCore::connectedCallback):
+        (WebCore::readReadyCallback):
+        (WebCore::writeReadyCallback):
+
+2010-11-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Soup] Random crashes in http/tests/websocket/tests/workers/worker-handshake-challenge-randomness.html
+        https://bugs.webkit.org/show_bug.cgi?id=48805
+
+        Track active WebSocket handles via a sequential id. This ensures
+        that when a handle is reallocated into a recently used segment of
+        memory, it doesn't trigger a false positive in the code which ensures
+        the original handle is active.
+
+        No new tests. This test should stop crashing on the bots, proving the fix.
+
+        * platform/network/soup/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::id): Added an m_id member and accessor
+        to SocketStreamHandle.
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+        (WebCore::getHandleFromId): Updated to work with HashMap of handle ids to
+        SocketStreamHandle*.
+        (WebCore::deactivateHandle): Ditto.
+        (WebCore::activateHandle): Ditto.
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Ditto.
+        (WebCore::SocketStreamHandle::connected): Ditto.
+        (WebCore::SocketStreamHandle::readBytes): Ditto.
+        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability): Ditto.
+        (WebCore::connectedCallback): Ditto.
+        (WebCore::readReadyCallback): Ditto.
+        (WebCore::writeReadyCallback): Ditto.
+
+2010-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed. Run sort-Xcode-project-file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-11-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in FrameView::layout when clicking on a YouTube video on youtube.com front page
+        https://bugs.webkit.org/show_bug.cgi?id=44287
+        
+        When removing subframes, it's possible for layout() to get called on a FrameView
+        for a Frame that has been removed from the frame tree. This can happen if the parent
+        document happens to do a layout() while RenderView still has a reference to the widget
+        for the removed frame; updateWidgetPosition() will try to force a layout() on the 
+        subframe.
+        
+        Fix by checking that the FrameView's Frame still has a reference to the page before
+        calling layout() on the subframe.
+
+        Test: fast/frames/layout-after-destruction.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+
+2010-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r71065.
+        http://trac.webkit.org/changeset/71065
+        https://bugs.webkit.org/show_bug.cgi?id=48801
+
+        Seem to breake a lot of tests on Chromium bots (Requested by
+        dimich on #webkit).
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/image-decoders/cg/ImageDecoderCG.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+
+2010-11-01  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting attr repeatDur=0 on SVG element causes hang
+        https://bugs.webkit.org/show_bug.cgi?id=48785
+
+        Test: svg/animations/repeatDur-zero.xhtml
+
+        * svg/animation/SVGSMILElement.cpp: Fixing bound checking for legal repeatDur values.
+
+2010-10-31  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Add ICC support for PNG on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48170
+
+        This just pipes the ICC profile from libpng to CoreGraphics.  This
+        patch would have been a lot prettier on Snow Leopard, but we have to
+        use a somewhat ugly API to get this to work on Leopard.
+
+        This is covered by about infinite tests.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/image-decoders/cg/ImageDecoderCG.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::setColorProfile):
+
+2010-11-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48776
+        
+        Change isVertical() on InlineBox to isHorizontal() instead.  This makes the horizontal code path come
+        first if you branch on isHorizontal() and makes the code read better (since that's the more common code
+        path).
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::logicalHeight):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isHorizontal):
+        (WebCore::InlineBox::setIsHorizontal):
+        (WebCore::InlineBox::width):
+        (WebCore::InlineBox::height):
+        (WebCore::InlineBox::logicalLeft):
+        (WebCore::InlineBox::setLogicalLeft):
+        (WebCore::InlineBox::logicalTop):
+        (WebCore::InlineBox::setLogicalTop):
+        (WebCore::InlineBox::baselinePosition):
+        (WebCore::InlineBox::lineHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::computeBlockDirectionOverflow):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::marginLogicalLeft):
+        (WebCore::InlineFlowBox::marginLogicalRight):
+        (WebCore::InlineFlowBox::borderLogicalLeft):
+        (WebCore::InlineFlowBox::borderLogicalRight):
+        (WebCore::InlineFlowBox::paddingLogicalLeft):
+        (WebCore::InlineFlowBox::paddingLogicalRight):
+        (WebCore::InlineFlowBox::setInlineDirectionOverflowPositions):
+        (WebCore::InlineFlowBox::setBlockDirectionOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::applyShadowToGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::blockDirectionOverflow):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::placeEllipsis):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::baselinePosition):
+        (WebCore::RootInlineBox::lineHeight):
+
+2010-11-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Multiple background properties are not retrievable via DOM method getComputedStyle
+        https://bugs.webkit.org/show_bug.cgi?id=23203
+        
+        Return lists of values from getComputedStyle() for multiple backgrounds,
+        and multiple masks.
+
+        Test: fast/backgrounds/multiple-backgrounds-computed-style.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillSizeToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2010-11-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48663
+
+        Make repaint invalidation work with vertical lines.  Rewrite linesBoundingBox for RenderText and
+        RenderInline to give the correct rectangle back for vertical lines.  Also patch linesVisibleOverflowBoundingBox
+        to give back the correct rectangle for vertical lines.
+
+        Fix bugs in the overflow accessors of InlineFlowBox when m_overflow was 0.
+        
+        Patch hit testing to also account for "rt" and "bt" blocks.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustForFlippedBlocksWritingMode):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::logicalLeftVisibleOverflow):
+        (WebCore::InlineFlowBox::logicalRightVisibleOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::adjustForFlippedBlocksWritingMode):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesBoundingBox):
+
+2010-11-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7660547> and https://bugs.webkit.org/show_bug.cgi?id=48699
+        Context menu support for WebKit 2.
+
+        Add a "showContextMenu" call to Chrome/ChromeClient:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::showContextMenu):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::showContextMenu):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+        Add a "platform description to ContextMenuItem" creator, will be needed by WebKit2
+        * platform/ContextMenu.h:
+        * platform/mac/ContextMenuMac.mm:
+        (WebCore::contextMenuItemVector):
+
+        * platform/mac/ContextMenuItemMac.mm:
+        (WebCore::ContextMenuItem::checked): WebKit2 ports now need this implemented.
+
+        Stub these out to keep their WK2 ports building:
+        * platform/qt/ContextMenuItemQt.cpp:
+        (WebCore::ContextMenuItem::checked):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::contextMenuItemVector):
+        * platform/win/ContextMenuItemWin.cpp:
+        (WebCore::ContextMenuItem::checked):
+        * platform/win/ContextMenuWin.cpp:
+        (WebCore::contextMenuItemVector):
+
+2010-11-01  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Seeking by very small increment doesn't generate 'seeked' event
+        https://bugs.webkit.org/show_bug.cgi?id=48530
+
+        Test: media/video-seek-by-small-increment.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::seek): Ask the media engine for its closest time value so we can
+        avoid asking it to seek to the current time.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::mediaTimeForTimeValue): New.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::mediaTimeForTimeValue): Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::mediaTimeForTimeValue): Return the closest value in the movie's time scale.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::mediaTimeForTimeValue): Ditto
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
+
+        * platform/graphics/win/QTMovie.cpp:
+        (QTMovie::timeScale): Return the movie's time scale.
+        * platform/graphics/win/QTMovie.h:
+
+2010-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Chromium build fix. Adding missing transitive dependency.
+
+        * inspector/InspectorResourceAgent.cpp:
+
+2010-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Removing references to removed file from project files.
+
+        * WebCore.gypi:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+
+2010-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: remove old resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=45657
+
+        * CMakeLists.txt:
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/Inspector.idl:
+        * inspector/InspectorCSSStore.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::releaseFrontendLifetimeAgents):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::unbindAllResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::frameDetachedFromParent):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::markResourceAsCached):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didCreateWebSocket):
+        (WebCore::InspectorController::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorController::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorController::didCloseWebSocket):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorResource.cpp: Removed.
+        * inspector/InspectorResource.h: Removed.
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setOverrideContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage):
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onRevealAndSelectResource):
+        * inspector/front-end/Images/resourcesSilhouette.png: Removed.
+        * inspector/front-end/Resource.js:
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.getContent):
+        * inspector/front-end/ResourcesPanel.js: Removed.
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.get toolbarItemLabel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.get networkResources):
+        (WebInspector.forAllResources):
+        (WebInspector.resourceForURL):
+        (WebInspector.doLoadedDone.populateInspectorState):
+        (WebInspector.openResource):
+        (WebInspector.domContentEventFired):
+        (WebInspector.loadEventFired):
+        (WebInspector.reset):
+        (WebInspector._choosePanelToShowSourceLine):
+
+2010-10-28  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix enum naming style violation in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=48441
+
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData):
+        (WebCore::GraphicsContext3D::extractTextureData):
+        (WebCore::doPacking):
+        (WebCore::GraphicsContext3D::packPixels):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::getSourceDataFormat):
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2010-11-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Pasting markup into Thunderbird compose window produces no text
+        https://bugs.webkit.org/show_bug.cgi?id=43737
+
+        Include a content-type meta tag prefix on all clipboard markup. Programs like
+        Thunderbird expect this meta tag and will not paste anything unless it is there.
+
+        This is covered by changes to WebKit/gtk/tests/testcopyandpaste.c. This patch was
+        written in such a way as to not affect layout test results, otherwise there
+        would be many new GTK+-specific results that say "FAIL").
+
+        * platform/gtk/PasteboardHelper.cpp:
+        (WebCore::removeMarkupPrefix): Added this helper which removes the prefix
+        when found on incoming clipboard and drag-and-drop text.
+        (WebCore::PasteboardHelper::getClipboardContents): Remove the meta tag prefix.
+        (WebCore::PasteboardHelper::fillSelectionData): Add the meta tag prefix.
+        (WebCore::PasteboardHelper::fillDataObjectFromDropData): Remove the meta tag prefix
+
+2010-11-01  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Check for NULL node in SVGUseElement::associateInstancesWithShadowTreeElements loop
+        https://bugs.webkit.org/show_bug.cgi?id=48741
+
+        Test: svg/custom/use-on-use-with-child-and-empty-target.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::associateInstancesWithShadowTreeElements):
+
+2010-11-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] AtkHyperlink needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=33785
+
+        Implemented the AtkHyperlink/AtkHypertext stuff in the GTK port.
+
+        Even thought these kind of tasks are usually about implementing an
+        interface, in this case it was needed to implement some more
+        things due to the fact that AtkHyperlink is neither an interface
+        nor an AtkObject, but just an abstract class child of GObject that
+        needs to be redefined in a specific subclass of that one. On top
+        of that, it was needed to implement the AtkAction interface as
+        well for that new class, so exposed hyperlinks can work as
+        expected with Assistive Technologies based on ATK.
+
+        Furthermore, as there's no mechanism to get an instance of that
+        AtkHyperlink other than doing it through an AtkObject implementing
+        the AtkHypertext interface, it was needed to also add the code to
+        implement that one, so it makes possible to ask for the
+        'hyperlinks' under an 'hypertext' accessible object.
+
+        Finally, to complete the implementation of all this stuff and make
+        it all consistent, it was needed as well to implement the
+        AtkHyperlinkImpl interface (providing just one method only) so
+        that allows retrieving the AtkHyperlink object associated to an
+        AtkObject implementing such an interface.
+
+        * GNUmakefile.am: Add the new WebKitAccessibleHyperlink.[h|cpp]
+        files to the sources list for the GTK port.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core): New function to return the core accessibility object
+        related to an AtkObject implementing the AtkHypertext interface.
+        (webkitAccessibleHypertextGetLink): New, part of the
+        implementation of the AtkHypertext interface.
+        (webkitAccessibleHypertextGetNLinks): New, likewise.
+        (webkitAccessibleHypertextGetLinkIndex): New, likewise.
+        (atkHypertextInterfaceInit): New, initialize the AtkHypertext
+        interface.
+        (webkitAccessibleHyperlinkImplGetHyperlink): New, part of the
+        implementation of the AtkHyperlinkImpl interface.
+        (atkHyperlinkImplInterfaceInit): New, initialize the
+        AtkHyperlinkImpl interface.
+        (GetAtkInterfaceTypeFromWAIType): Add ATK_TYPE_HYPERTEXT and
+        ATK_TYPE_HYPERLINK_IMPL to the list of recognized types.
+        (getInterfaceMaskFromObject): Decide when it's needed to add
+        WAI_HYPERTEXT and WAI_HYPERLINK to the interface mask.
+
+        * accessibility/gtk/WebKitAccessibleHyperlink.h: Added.
+        * accessibility/gtk/WebKitAccessibleHyperlink.cpp: Added.
+        (returnString): Return (const char*) from String variables.
+        (core): Return the associated AccessibilityObject.
+        (webkitAccessibleHyperlinkActionDoAction): Part of the
+        implementation of the AtkAction interface.
+        (webkitAccessibleHyperlinkActionGetNActions): Likewise.
+        (webkitAccessibleHyperlinkActionGetDescription): Likewise.
+        (webkitAccessibleHyperlinkActionGetKeybinding): Likewise.
+        (webkitAccessibleHyperlinkActionGetName): Likewise.
+        (atkActionInterfaceInit): Initialize the AtkAction interface.
+        (getRangeLengthForObject): Returns the length for a given Range,
+        considering special cases (e.g. List item markers).
+        (webkitAccessibleHyperlinkGetURI): Implementation of one of the
+        methods in the AtkHyperlink abstract class.
+        (webkitAccessibleHyperlinkGetObject): Likewise.
+        (webkitAccessibleHyperlinkGetStartIndex): Likewise.
+        (webkitAccessibleHyperlinkGetEndIndex): Likewise.
+        (webkitAccessibleHyperlinkIsValid): Likewise.
+        (webkitAccessibleHyperlinkGetNAnchors): Likewise.
+        (webkitAccessibleHyperlinkIsSelectedLink): Likewise.
+        (webkitAccessibleHyperlinkGetProperty): Getter method.
+        (webkitAccessibleHyperlinkSetProperty): Setter method.
+        (webkitAccessibleHyperlinkFinalize): Finalize method.
+        (webkitAccessibleHyperlinkClassInit): Initialize the
+        WebKitAccessibleHyperlink class.
+        (webkitAccessibleHyperlinkInit): Initialize the
+        WebKitAccessibleHyperlink instance.
+        (webkitAccessibleHyperlinkGetType): Implementation of the
+        get_type() function for the WebKitAccessibleHyperlink class.
+        (webkitAccessibleHyperlinkNew): Returns an instance of the class
+        associated to a given AtkHyperlinkImpl object.
+        (webkitAccessibleHyperlinkGetAccessibilityObject): Public function
+        returning the AccessibilityObject associated to the instance of
+        the WebKitAccessibleHyperlink class.
+
+2010-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: simplify inspector styles test to make all bots happy.
+        (drive-by fix for overriden inspector styles in network panel).
+
+        * inspector/InspectorController.h:
+        * inspector/front-end/networkPanel.css:
+
+2010-11-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Rob Buis.
+
+        Enable StrictTypeChecking for all types using SVG(Animated)PropertyTearOff
+        https://bugs.webkit.org/show_bug.cgi?id=48715
+
+        Enable StrictTypeChecking for all readwrite attributes and function calls of all types using the new SVG(Animated)PropertyTearOff concept.
+        Also enable RequiresAllArguments=Raise for all function calls of these new types. Cover this functionality by tests for each of them.
+
+        When testing SVGLength it became obvious that quite a lot of functionality was missing.
+        Conversion from relative arguments (percentage, ems, exs) to user specified units was missing, added that functionality and tested it.
+        User units to pt conversion was wrong, fixed that.
+
+        Tests: svg/dom/SVGAnimatedAngle.html
+               svg/dom/SVGAnimatedBoolean.html
+               svg/dom/SVGAnimatedEnumeration.html
+               svg/dom/SVGAnimatedInteger.html
+               svg/dom/SVGAnimatedLength.html
+               svg/dom/SVGAnimatedLengthList.html
+               svg/dom/SVGAnimatedRect.html
+               svg/dom/SVGLength-px-with-context.html
+               svg/dom/SVGLength-px.html
+               svg/dom/SVGLength.html
+
+        * bindings/js/JSSVGLengthCustom.cpp: These SVGLength methods now take an ExceptionCode parameter, adapt to that. 
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::setValue):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/scripts/CodeGeneratorObjC.pm: Remove FIXMEs, pass real context instead off null pointer. DOMSVGLength::value is functional now.
+        * bindings/v8/custom/V8SVGLengthCustom.cpp: These SVGLength methods now take an ExceptionCode parameter, adapt to that.
+        (WebCore::V8SVGLength::valueAccessorGetter):
+        (WebCore::V8SVGLength::valueAccessorSetter):
+        (WebCore::V8SVGLength::convertToSpecifiedUnitsCallback):
+        * rendering/style/SVGRenderStyle.h: Adapt to SVGLength API changes.
+        (WebCore::SVGRenderStyle::initialBaselineShiftValue):
+        (WebCore::SVGRenderStyle::initialKerning):
+        (WebCore::SVGRenderStyle::initialStrokeDashOffset):
+        (WebCore::SVGRenderStyle::initialStrokeWidth):
+        * svg/SVGAngle.idl: Add StrictTypeChecking, RequiresAllArguments=Raise to all methods.
+        * svg/SVGAnimatedBoolean.idl: Remove StrictTypeChecking from animVal, it's readonly so this is useless.
+        * svg/SVGAnimatedEnumeration.idl: Add StrictTypeChecking to all attributes.
+        * svg/SVGAnimatedInteger.idl: Ditto.
+        * svg/SVGLength.cpp: Implement all missing features of SVGLength. Conform to our style guide (s/.0f// etc)
+        (WebCore::lengthTypeToString):
+        (WebCore::SVGLength::SVGLength):
+        (WebCore::SVGLength::value): Throw NOT_SUPPORTED_ERR when trying to obtain to relative units, when no context is given (SVGLength created by createSVGLength()).
+        (WebCore::SVGLength::setValue): Ditto, for the setter.
+        (WebCore::SVGLength::valueAsPercentage): Use m_valueInSpecifiedUnits instead of valueInSpecifiedUnits().
+        (WebCore::SVGLength::setValueAsString): Throw SYNTAX_ERR if parsing failed.
+        (WebCore::SVGLength::valueAsString): Use makeString() instead of String and operator+.
+        (WebCore::SVGLength::newValueSpecifiedUnits): Add ExceptionCode parameter, throw NOT_SUPPORTED_ERR, if the given unit type is invalid.
+        (WebCore::SVGLength::convertToSpecifiedUnits): Ditto.
+        (WebCore::SVGLength::determineViewport): Added helper function used by convertValue*Percentage*.
+        (WebCore::SVGLength::convertValueFromUserUnitsToPercentage): Add new helper functions, used by value/setValue.
+        (WebCore::SVGLength::convertValueFromPercentageToUserUnits): Ditto.
+        (WebCore::SVGLength::convertValueFromUserUnitsToEMS): Ditto.
+        (WebCore::SVGLength::convertValueFromEMSToUserUnits): Ditto.
+        (WebCore::SVGLength::convertValueFromUserUnitsToEXS): Ditto.
+        (WebCore::SVGLength::convertValueFromEXSToUserUnits): Ditto.
+        (WebCore::SVGLength::fromCSSPrimitiveValue): Adapt to newValueSpecifiedUnits API change.
+        (WebCore::SVGLength::toCSSPrimitiveValue): Remove default switch case.
+        * svg/SVGLength.h:
+        (WebCore::SVGLength::valueInSpecifiedUnits): Inlined.
+        (WebCore::SVGLength::setValueInSpecifiedUnits): Ditto.
+        (WebCore::SVGLength::isRelative):
+        * svg/SVGLength.idl: Add StrictTypeChecking for all attributes/functions and RequiresAllArguments=Raise for all functions.
+        * svg/SVGLengthList.cpp: Adapt to SVGLength API changes.
+        (WebCore::SVGLengthList::parse):
+
+2010-10-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: unhide new network and resources panels.
+        https://bugs.webkit.org/show_bug.cgi?id=48725
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.h:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addResourceToFrame):
+        (WebInspector.StoragePanel.prototype.addDocumentURL):
+        (WebInspector.StoragePanel.prototype.showFileSystem):
+        (WebInspector.FileSystemTreeElement):
+        (WebInspector.FileSystemTreeElement.prototype.get itemURL):
+        (WebInspector.FileSystemTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * inspector/front-end/networkPanel.css:
+        (#network-close-button):
+        (.network.panel.viewing-resource #network-close-button):
+
+2010-10-26  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Refactoring: Spellchecking related static functions could form a class
+        https://bugs.webkit.org/show_bug.cgi?id=48287
+
+        Extracted spellcheck related static functions to TextCheckingHelper class,
+        which has EditorClient and Range as its member.
+        
+        No new tests. Just a refactoring.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/EditingAllInOne.cpp
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::isSelectionUngrammatical):
+        (WebCore::Editor::guessesForUngrammaticalSelection):
+        (WebCore::Editor::guessesForMisspelledOrUngrammaticalSelection):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        * editing/Editor.h:
+        * editing/TextCheckingHelper.cpp: Added.
+        (WebCore::TextCheckingHelper::TextCheckingHelper):
+        (WebCore::TextCheckingHelper::~TextCheckingHelper):
+        (WebCore::TextCheckingHelper::paragraphAlignedRange):
+        (WebCore::TextCheckingHelper::findFirstMisspelling):
+        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
+        (WebCore::TextCheckingHelper::findFirstGrammarDetail):
+        (WebCore::TextCheckingHelper::findFirstBadGrammar):
+        (WebCore::TextCheckingHelper::isUngrammatical):
+        (WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
+        (WebCore::TextCheckingHelper::markAllMisspellings):
+        (WebCore::TextCheckingHelper::markAllBadGrammar):
+        * editing/TextCheckingHelper.h: Added.
+
+2010-10-31  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        Do not use broken/deprecated functions that won't be available
+        with G_DISABLE_DEPRECATED (used in debug builds).
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2010-10-31  Kenichi Ishibashi  <bashi@google.com>
+
+        Reviewed by Adam Barth.
+
+        V8 binding for DOMSettableTokenList
+        https://bugs.webkit.org/show_bug.cgi?id=47812
+
+        Tests for this change will be included in the change for supporting
+        the <output> element.
+        See https://bugs.webkit.org/show_bug.cgi?id=29363.
+
+        * bindings/v8/custom/V8DOMSettableTokenListCustom.cpp: Implemented.
+        (WebCore::V8DOMSettableTokenList::indexedPropertyGetter): Just calls DOMSettableTokenList::item(index).
+
+2010-10-31  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] [Gtk] Plug-ins having upper case in mime type are failing to load
+
+        Qt and Gtk are case-sensitive when storing the declared mime-type
+        of plugins. Since plugin mime-types are lowercased prior to searching
+        for them in the plugin database, ensure they are loaded with the
+        mime-type in lower case too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36815
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::setMIMEDescription):
+
+2010-10-31  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Support nodesFromRect in DRT
+
+        Pass a Document object as a QWebElement. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=48716
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2010-10-31  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Treat GIFs with no loop count as "loop once".
+        https://bugs.webkit.org/show_bug.cgi?id=47302
+
+        Test: fast/images/gif-loop-count.html
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::gifComplete):
+
+2010-10-31  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Build fix for X11.
+
+        No new tests; build fix.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::platformStart):
+
+2010-10-31  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the unused GraphicsContext::clipOutEllipseInRect(IntRect)
+        https://bugs.webkit.org/show_bug.cgi?id=48727
+
+        This function was added in <http://trac.webkit.org/changeset/18654> for CSS3 box-shadows.
+        All use of the function was removed in <http://trac.webkit.org/changeset/21601>
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+
+2010-10-31  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        [Qt] Respect the "antialiased" argument in clipConvexPolygon()
+        https://bugs.webkit.org/show_bug.cgi?id=48734
+
+        Set (or unset) the QPainter::Antialiased render hint for antialiased
+        clipping based on the "antialiased" argument.
+
+        No test since Qt doesn't have pixel tests yet.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+
+2010-10-31  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the unused GraphicsContext::strokeRect(FloatRect)
+        https://bugs.webkit.org/show_bug.cgi?id=48726
+
+        This function was only implemented by GraphicsContextOpenVG and not
+        called from anywhere.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+
+2010-10-31  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the unused GraphicsContext::origin()
+        https://bugs.webkit.org/show_bug.cgi?id=48732
+
+        This method was not called from anywhere.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+
+2010-10-31  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        [Qt] Remove GraphicsContext::pen()
+        https://bugs.webkit.org/show_bug.cgi?id=48733
+
+        Have PathQt obtain the pen() through the platformContext() instead.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::strokeBoundingRect):
+
+2010-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70959.
+        http://trac.webkit.org/changeset/70959
+        https://bugs.webkit.org/show_bug.cgi?id=48731
+
+        It broke fast/events/spatial-navigation tests (Requested by
+        Ossy on #webkit).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustForFlippedBlocksWritingMode):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesBoundingBox):
+
+2010-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: new resources and network panel usability improvements.
+        https://bugs.webkit.org/show_bug.cgi?id=48680
+
+        By default, navigation clears network log, added 'preserve log' button,
+        that prevents log from being cleared.
+
+        Storing expanded state of all group items, restoring last selected item,
+        fall back to main frame's main resource by default.
+        Do not list XHRs and redirects in resources.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype.get statusBarItems):
+        (WebInspector.NetworkPanel.prototype._positionSummaryBar):
+        (WebInspector.NetworkPanel.prototype._updateFilter):
+        (WebInspector.NetworkPanel.prototype._createStatusbarButtons):
+        (WebInspector.NetworkPanel.prototype._onPreserveLogClicked):
+        (WebInspector.NetworkPanel.prototype.reset):
+        (WebInspector.NetworkPanel.prototype.refreshResource):
+        * inspector/front-end/ResourceManager.js:
+        (WebInspector.ResourceManager.prototype.identifierForInitialRequest):
+        (WebInspector.ResourceManager.prototype.willSendRequest):
+        (WebInspector.ResourceManager.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.ResourceManager.prototype.setOverrideContent):
+        (WebInspector.ResourceManager.prototype.didCreateWebSocket):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype._initDefaultSelection):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addResourceToFrame):
+        (WebInspector.StoragePanel.prototype.refreshResource):
+        (WebInspector.StoragePanel.prototype.showDatabase):
+        (WebInspector.BaseStorageTreeElement.prototype.onselect):
+        (WebInspector.StorageCategoryTreeElement):
+        (WebInspector.StorageCategoryTreeElement.prototype.get itemURL):
+        (WebInspector.StorageCategoryTreeElement.prototype.onselect):
+        (WebInspector.StorageCategoryTreeElement.prototype.onattach):
+        (WebInspector.StorageCategoryTreeElement.prototype.onexpand):
+        (WebInspector.StorageCategoryTreeElement.prototype.oncollapse):
+        (WebInspector.FrameTreeElement.prototype.get itemURL):
+        (WebInspector.FrameTreeElement.prototype.onselect):
+        (WebInspector.FrameResourceTreeElement.prototype.get itemURL):
+        (WebInspector.FrameResourceTreeElement.prototype.onselect):
+        (WebInspector.DatabaseTreeElement.prototype.get itemURL):
+        (WebInspector.DatabaseTreeElement.prototype.onselect):
+        (WebInspector.DatabaseTableTreeElement.prototype.get itemURL):
+        (WebInspector.DatabaseTableTreeElement.prototype.onselect):
+        (WebInspector.DOMStorageTreeElement.prototype.get itemURL):
+        (WebInspector.DOMStorageTreeElement.prototype.onselect):
+        (WebInspector.CookieTreeElement.prototype.get itemURL):
+        (WebInspector.CookieTreeElement.prototype.onselect):
+        (WebInspector.ApplicationCacheTreeElement.prototype.get itemURL):
+        (WebInspector.ApplicationCacheTreeElement.prototype.onselect):
+
+2010-10-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix after r70846.
+
+        * platform/graphics/wince/ImageWinCE.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2010-10-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r70984.
+        http://trac.webkit.org/changeset/70984
+        https://bugs.webkit.org/show_bug.cgi?id=46015
+
+        Made media/audio-delete-while-slider-thumb-clicked.html crash.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::notifyChildInserted):
+        * dom/EventContext.cpp: Removed.
+        * dom/EventContext.h: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::markAncestorsWithChildNeedsStyleRecalc):
+        (WebCore::Node::createRendererIfNeeded):
+        (WebCore::Node::eventParentNode):
+        (WebCore::Node::enclosingLinkEventParentOrSelf):
+        (WebCore::eventTargetAsSVGElementInstance):
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        (WebCore::Node::eventAncestors):
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/Node.h:
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer):
+        * dom/WindowEventContext.cpp: Removed.
+        * dom/WindowEventContext.h: Removed.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::willDispatchEvent):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::eventParentNode):
+        * svg/SVGElement.h:
+
+2010-10-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement shadow DOM-aware event targeting and introduce EventContext to track the context of each event dispatch.
+        https://bugs.webkit.org/show_bug.cgi?id=46015
+
+        This patch adds the notion of EventContext (and a very similar-acting WindowEventContext, specifically
+        for DOMWindow), an abstraction that carries information around dispatching an event for any given Node.
+
+        This abstraction is necessary to ensure that events, fired from shadow DOM nodes are properly retargeted to
+        appear as if they are coming from their host, thus never exposing the shadow DOM nodes to the world outside.
+
+        * Android.mk: Added EventContext, WindowEventContext files.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/ContainerNode.cpp:
+        (WebCore::notifyChildInserted): Changed to be shadow DOM-aware.
+        * dom/EventContext.cpp: Added.
+        * dom/EventContext.h: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::markAncestorsWithChildNeedsStyleRecalc): Changed to be shadow DOM-aware.
+        (WebCore::Node::createRendererIfNeeded): Ditto.
+        (WebCore::Node::parentOrHostNode): Added new helper method.
+        (WebCore::Node::enclosingLinkEventParentOrSelf): Changed to be shadow DOM-aware.
+        (WebCore::eventTargetRespectingSVGTargetRules): Collapsed two helper methods into one.
+        (WebCore::Node::eventAncestors): Refactored to collect a vector of EventContexts.
+        (WebCore::Node::topEventContext): Added.
+        (WebCore::eventHasListeners): Changed to use EventContexts.
+        (WebCore::Node::dispatchGenericEvent): Ditto.
+        * dom/Node.h: Removed eventParentNode that's no longer needed, added parentOrHostNode decl,
+            and changed signature of eventAncestors to use EventContexts.
+        * dom/Text.cpp:
+        (WebCore::Text::createRenderer): Changed to be shadow DOM-aware.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode): Changed to use EventContexts.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateMouseEventTargetNode): Removed code that's no longer necessary.
+        * svg/SVGElement.cpp: Removed eventParentNode that's no longer needed.
+        * svg/SVGElement.h: Ditto.
+        * dom/WindowEventContext.cpp: Added.
+        * dom/WindowEventContext.h: Added.
+
+2010-10-30  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Rob Buis.
+
+        Convert SVGAnimatedNumber/SVGAnimatedNumberList to the new SVGAnimatedPropertyTearOff concept
+        https://bugs.webkit.org/show_bug.cgi?id=48686
+
+        Convert the next set of primitives to use the new SVG(Animated)PropertyTearOff concept.
+
+        Tests: svg/dom/SVGAnimatedNumber.html
+               svg/dom/SVGAnimatedNumberList.html
+               svg/dom/SVGNumber.html
+
+        * GNUmakefile.am: Add SVGAnimatedNumber.h / SVGAnimatedNumberList.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAnimatedNumber/SVGAnimatedNumberList as new style SVG animated properties. Remove SVGNumber from PODType hash.
+        * bindings/scripts/CodeGeneratorJS.pm: Remove special SVGNumber handing, it's obsolete now.
+        * bindings/scripts/CodeGeneratorObjC.pm: Add special SVGNumber handling, as it's the first of the converted dynamic SVGAnimatedProperty types that's not in WebCore namespace.
+        * bindings/scripts/CodeGeneratorV8.pm: Use AvoidInclusionOfType method from CodeGenerator.pm, remove special SVGNumber handling, that's obsolete now.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::extractFloatValuesFromSVGNumberList): Adapt to SVGNumberList change, which is a plain Vector<float> now.
+        * svg/DeprecatedSVGAnimatedPropertyTraits.h: Remove SVGAnimatedNumber/SVGAnimatedNumberList handling.
+        * svg/DeprecatedSVGAnimatedTemplate.h: Ditto.
+        * svg/SVGAnimatedNumber.h: Added.
+        * svg/SVGAnimatedNumber.idl: Enable StrictTypeChecking.
+        * svg/SVGAnimatedNumberList.h: Added.
+        * svg/SVGAnimatedNumberList.idl: Ditto.
+        * svg/SVGComponentTransferFunctionElement.cpp: Switch animated float properties to the new SVGAnimatedNumber(List).
+        (WebCore::SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement):
+        (WebCore::SVGComponentTransferFunctionElement::parseMappedAttribute):
+        (WebCore::SVGComponentTransferFunctionElement::transferFunction):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFEColorMatrixElement.cpp: Ditto.
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::parseMappedAttribute):
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFECompositeElement.h: Ditto.
+        * svg/SVGFEConvolveMatrixElement.cpp: Ditto.
+        (WebCore::SVGFEConvolveMatrixElement::SVGFEConvolveMatrixElement):
+        (WebCore::SVGFEConvolveMatrixElement::kernelUnitLengthXIdentifier): Added, replacing char[] hack by a static atomic string.
+        (WebCore::SVGFEConvolveMatrixElement::kernelUnitLengthYIdentifier): Ditto.
+        (WebCore::SVGFEConvolveMatrixElement::parseMappedAttribute):
+        (WebCore::SVGFEConvolveMatrixElement::build):
+        * svg/SVGFEConvolveMatrixElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFEDiffuseLightingElement.cpp: Ditto.
+        (WebCore::SVGFEDiffuseLightingElement::kernelUnitLengthXIdentifier): Remove trailing whitespace.
+        (WebCore::SVGFEDiffuseLightingElement::kernelUnitLengthYIdentifier): Ditto.
+        * svg/SVGFEDiffuseLightingElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFEDisplacementMapElement.h: Ditto.
+        * svg/SVGFEGaussianBlurElement.cpp: Ditto.
+        (WebCore::SVGFEGaussianBlurElement::stdDeviationXIdentifier): Remove trailing whitespace.
+        (WebCore::SVGFEGaussianBlurElement::stdDeviationYIdentifier): Ditto.
+        * svg/SVGFEGaussianBlurElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFELightElement.h: Ditto.
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::radiusXIdentifier): Added, replacing char[] hack by a static atomic string.
+        (WebCore::SVGFEMorphologyElement::radiusYIdentifier): Ditto.
+        * svg/SVGFEMorphologyElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFEOffsetElement.h: Ditto.
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::kernelUnitLengthXIdentifier): Remove trailing whitespace.
+        (WebCore::SVGFESpecularLightingElement::kernelUnitLengthYIdentifier): Ditto.
+        * svg/SVGFESpecularLightingElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::baseFrequencyXIdentifier): Remove trailing whitespace.
+        (WebCore::SVGFETurbulenceElement::baseFrequencyYIdentifier): Ditto.
+        * svg/SVGFETurbulenceElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::filterResXIdentifier): Remove trailing whitespace.
+        (WebCore::SVGFilterElement::filterResYIdentifier): Ditto.
+        * svg/SVGLengthList.idl: Remove leftover [SVGListProperty] marker.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::orientTypeIdentifier): Remove trailing whitespace.
+        (WebCore::SVGMarkerElement::orientAngleIdentifier): Ditto.
+        * svg/SVGNumber.idl: Remove [PODType] marker, add StrictTypeChecking.
+        * svg/SVGNumberList.cpp: Convert from SVGPODList<RefPtr<SVGPODListItem<float> > > to plain Vector<float>, just like it has been done for SVGLengthList before.
+        (WebCore::SVGNumberList::parse):
+        (WebCore::SVGNumberList::valueAsString):
+        * svg/SVGNumberList.h:
+        (WebCore::SVGNumberList::SVGNumberList):
+        * svg/SVGPathElement.h: Switch animated float properties to the new SVGAnimatedNumber(List).
+        * svg/SVGStopElement.h: Ditto.
+        * svg/SVGTextPositioningElement.cpp: Switch animated float properties to the new SVGAnimatedNumber(List).
+        (WebCore::SVGTextPositioningElement::SVGTextPositioningElement):
+        (WebCore::SVGTextPositioningElement::parseMappedAttribute):
+        * svg/SVGTextPositioningElement.h: Ditto.
+        * svg/properties/SVGPropertyTraits.h: Add SVGNumberList handling.
+
+2010-10-29  Daniel Bates  <dbates@rim.com>
+
+        No review, rolling out 70971.
+        http://trac.webkit.org/changeset/70971
+        https://bugs.webkit.org/show_bug.cgi?id=6751
+
+        Rolling out changeset 70971 <http://trac.webkit.org/changeset/70971> since
+        it caused layout test failures on all bots. In particular, the
+        child count in a generated frame name differs after this patch. We need
+        to look into this further.
+
+        Test: fast/frames/iframe-set-inner-html.html
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL):
+        (WebCore::HTMLFrameElementBase::setName):
+        * html/HTMLFrameElementBase.h:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::createItem):
+        (WebCore::HistoryController::currentFramesMatchItem):
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted):
+        (WebCore::ProgressTracker::progressCompleted):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create):
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::setName):
+        (WebCore::FrameTree::clearName):
+        (WebCore::FrameTree::uniqueChildName):
+        (WebCore::FrameTree::child):
+        (WebCore::FrameTree::find):
+        * page/FrameTree.h:
+        (WebCore::FrameTree::name):
+
+2010-10-28  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Ojan Vafai.
+
+        Needs a "LinuxEditingBehavior", perhaps with a better name
+        https://bugs.webkit.org/show_bug.cgi?id=36627
+
+        Added EditingUnixBehavior editing type aim to cover the cases when
+        neither Mac or Windows behaviors are appropriated.
+
+        It was decided to name it Unix not Linux.
+
+        No new tests. The current editing tests that involve platform specific
+        bahaviors are coded so that they go through all editing behavior
+        types possible. There will be a follow up bug where all of them will
+        be updated to include the new editing behavior ("unix").
+
+        * editing/EditingBehaviorTypes.h:
+        * page/Settings.cpp:
+        (WebCore::editingBehaviorTypeForPlatform):
+        (WebCore::Settings::Settings):
+
+2010-10-29  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Barth.
+
+        For unnamed frames, window.name returns a generated name
+        https://bugs.webkit.org/show_bug.cgi?id=6751
+
+        Fixes an issue where the window.name of an unnamed frame returns
+        a unique generated name that is used internally to identify the
+        frame. Instead, we should return an empty string as implied by
+        section 5.1.6 of the HTML5 spec. (http://www.w3.org/TR/html5/browsers.html#browsing-context-names).
+        This section describes that a browsing context can have no name or be
+        the empty string.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL): Removed ASSERT for empty
+        frame name since this is valid as per the HTML5 spec.
+        (WebCore::HTMLFrameElementBase::setName): Removed the call to FrameTree::uniqueChildName()
+        since the loader code no longer depends on the frame name being unique.
+        * html/HTMLFrameElementBase.h:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainResource): Use FrameTree::uniqueName().
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Ditto.
+        (WebCore::FrameLoader::commitProvisionalLoad): Ditto.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::saveDocumentState): Ditto.
+        (WebCore::HistoryController::restoreDocumentState): Ditto.
+        (WebCore::HistoryController::createItem):
+        (WebCore::HistoryController::currentFramesMatchItem): Ditto.
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted): Ditto.
+        (WebCore::ProgressTracker::progressCompleted): Ditto.
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Ditto.
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::setName): Modified to store the DOM-specified
+        name of the frame.
+        (WebCore::FrameTree::clearName):
+        (WebCore::FrameTree::uniqueChildName): Use FrameTree::uniqueName().
+        (WebCore::FrameTree::child): Ditto.
+        (WebCore::FrameTree::find): Ditto.
+        * page/FrameTree.h:
+        (WebCore::FrameTree::uniqueName): Added.
+
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Try to fix build.
+
+        * page/ContextMenuController.cpp: Added include of BackForwardController.h.
+        * page/DOMWindow.cpp: Ditto.
+        * page/History.cpp: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+
+2010-10-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More back/forward refactoring
+
+        * WebCore.exp.in: Updated.
+
+        * GNUmakefile.am: Removed BackForwardControllerClient.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * history/BackForwardControllerClient.h: Removed.
+
+        * history/BackForwardController.cpp:
+        (WebCore::BackForwardController::BackForwardController):
+        Set up just m_client.
+        (WebCore::BackForwardController::~BackForwardController):
+        Removed call to backForwardControllerDestroyed.
+        (WebCore::BackForwardController::canGoBackOrForward): Added.
+        (WebCore::BackForwardController::goBackOrForward): Added.
+        (WebCore::BackForwardController::goBack): Added.
+        (WebCore::BackForwardController::goForward): Added.
+        (WebCore::BackForwardController::addItem): Added.
+        (WebCore::BackForwardController::setCurrentItem): Added.
+        (WebCore::BackForwardController::count): Added.
+        (WebCore::BackForwardController::backCount): Added.
+        (WebCore::BackForwardController::forwardCount): Added.
+        (WebCore::BackForwardController::itemAtIndex): Added.
+        (WebCore::BackForwardController::isActive): Added.
+        (WebCore::BackForwardController::close): Added.
+
+        * history/BackForwardController.h: Added functions from Page
+        and BackForwardList that should be called here instead.
+        Note that BackForwardList is to be renamed BackForwardClient soon.
+
+        * history/BackForwardList.h: Removed many now-unneeded
+        virtual functions.
+
+        * history/BackForwardListImpl.h: Moved BackForwardListClient
+        in here.
+
+        * history/PageCache.cpp:
+        (WebCore::logCanCachePageDecision): Use backForward().
+        (WebCore::PageCache::canCache): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::transitionToCommitted): Removed unneeded
+        null check of backFowardList, which is never null.
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Use backForward.
+        (WebCore::FrameLoader::didFirstLayout): Ditto.
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Ditto.
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation): Ditto.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::goToItem): Ditto.
+        (WebCore::HistoryController::updateForStandardLoad): Ditto.
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList): Ditto.
+        (WebCore::HistoryController::updateBackForwardListClippedAtTarget): Ditto.
+        (WebCore::HistoryController::pushState): Ditto.
+        * loader/NavigationScheduler.cpp:
+        (WebCore::ScheduledHistoryNavigation::fire): Ditto.
+        (WebCore::NavigationScheduler::scheduleHistoryNavigation): Ditto.
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close): Ditto.
+        * page/History.cpp:
+        (WebCore::History::length): Ditto.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page): Use more adoptPtr. Use backForwardClient instead of
+        backForwardControllerClient.
+        (WebCore::Page::~Page): Use backForward.
+        (WebCore::Page::backForwardList): Ditto.
+        (WebCore::Page::goBack): Ditto.
+        (WebCore::Page::goForward): Ditto.
+        (WebCore::Page::canGoBackOrForward): Ditto.
+        (WebCore::Page::goBackOrForward): Ditto.
+        (WebCore::Page::getHistoryLength): Ditto.
+        (WebCore::Page::PageClients::PageClients): Made non-inline.
+        (WebCore::Page::PageClients::~PageClients): Ditto.
+
+        * page/Page.h: Made PageClients constructor and destructor non-inline.
+        Added backForward function. Marked old functions as deprecated.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setUsesPageCache): Use backForward.
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate): Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded): Ditto.
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler): Ditto.
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing): Ditto.
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::reset): Ditto.
+        (WebCore::tryAccessHistoryURLs): Ditto.
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask): Ditto.
+
+2010-10-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48663
+
+        Make repaint invalidation work with vertical lines.  Rewrite linesBoundingBox for RenderText and
+        RenderInline to give the correct rectangle back for vertical lines.  Also patch linesVisibleOverflowBoundingBox
+        to give back the correct rectangle for vertical lines.
+        
+        Fix bugs in the overflow accessors of InlineFlowBox when m_overflow was 0.
+
+        Added fast/repaint/inline-vertical-lr-overflow.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustForFlippedBlocksWritingMode):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::logicalLeftVisibleOverflow):
+        (WebCore::InlineFlowBox::logicalRightVisibleOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::adjustForFlippedBlocksWritingMode):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesBoundingBox):
+
+2010-10-29  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Fix canvas/philip/tests/2d.imageData.get.source.negative
+        https://bugs.webkit.org/show_bug.cgi?id=48277
+
+        Handle negative width/height.
+        See http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#pixel-manipulation
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+
+2010-10-29  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: FileSystem integration
+        https://bugs.webkit.org/show_bug.cgi?id=45982
+
+        Adding filesystem support for Inspector under storage tab. This fetches root paths for
+        temporary and persistent filesystems and allows "reveal folder in OS" option that
+        launches native file browser. Currently this feature is disabled for non-chromium platforms.
+
+        * CMakeLists.txt:
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::releaseFrontendLifetimeAgents):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::fileSystemAgent):
+        * inspector/InspectorFileSystemAgent.cpp: Added.
+        * inspector/InspectorFileSystemAgent.h: Added.
+        * inspector/front-end/FileSystemView.js: Added.
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addFileSystem):
+        (WebInspector.StoragePanel.prototype.showFileSystem):
+        (WebInspector.StoragePanel.prototype.updateFileSystemPath):
+        (WebInspector.StoragePanel.prototype.updateFileSystemError):
+        (WebInspector.FileSystemTreeElement):
+        (WebInspector.FileSystemTreeElement.prototype.onselect):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.file-system-storage-tree-item .icon):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        (WebInspector._addFileSystemOrigin):
+        (WebInspector.didGetFileSystemPath):
+        (WebInspector.didGetFileSystemError):
+        (WebInspector.reset):
+        * platform/AsyncFileSystem.h:
+        (WebCore::AsyncFileSystem::root):
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::revealFolderInOS):
+
 2010-10-29  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
@@ -6287,6 +12608,116 @@
 
 2010-10-21  Yury Semikhatsky  <yurys@chromium.org>
 
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: decouple ScriptArguments from ScriptCallStack
+        https://bugs.webkit.org/show_bug.cgi?id=48058
+
+        ScriptCallFrame and ScriptCallStack are now the same for both JSC and V8.
+        The factory functions that allow to create ScriptCallStack from VM-specific
+        objects are defined in ScriptCallStackFactory.cpp.
+
+        ScriptArguments class is used for passing arguments from JS code to the native
+        part.
+
+        No new tests. This refactoring is covered with existing Console tests.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptCallFrame.cpp: Removed.
+        * bindings/js/ScriptCallFrame.h: Removed.
+        * bindings/js/ScriptCallStack.cpp: Removed.
+        * bindings/js/ScriptCallStack.h: Removed.
+        * bindings/js/ScriptCallStackFactory.cpp: Added.
+        (WebCore::createScriptCallStack):
+        (WebCore::createScriptArguments):
+        (WebCore::ScriptCallStack::stackTrace):
+        * bindings/js/ScriptCallStackFactory.h: Added.
+        * bindings/js/ScriptState.h:
+        (WebCore::ScriptStateProtectedPtr::get):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallFrame.cpp: Removed.
+        * bindings/v8/ScriptCallFrame.h: Removed.
+        * bindings/v8/ScriptCallStack.cpp: Removed.
+        * bindings/v8/ScriptCallStack.h: Removed.
+        * bindings/v8/ScriptCallStackFactory.cpp: Added.
+        (WebCore::toScriptCallFrame):
+        (WebCore::toScriptCallFramesVector):
+        (WebCore::createScriptCallStack):
+        (WebCore::createScriptArguments):
+        (WebCore::ScriptCallStack::stackTrace):
+        * bindings/v8/ScriptCallStackFactory.h: Added.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::setCaptureCallStackForUncaughtExceptions):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptStateProtectedPtr::get):
+        * bindings/v8/V8ConsoleMessage.cpp:
+        (WebCore::V8ConsoleMessage::handler):
+        (WebCore::V8ConsoleMessage::dispatchNow):
+        * bindings/v8/V8ConsoleMessage.h:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::traceCallback):
+        (WebCore::V8Console::assertCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        * inspector/InspectorController.h:
+        * inspector/ScriptArguments.cpp: Added.
+        (WebCore::ScriptArguments::ScriptArguments):
+        (WebCore::ScriptArguments::~ScriptArguments):
+        (WebCore::ScriptArguments::argumentAt):
+        (WebCore::ScriptArguments::globalState):
+        (WebCore::ScriptArguments::getFirstArgumentAsString):
+        (WebCore::ScriptArguments::isEqual):
+        * inspector/ScriptArguments.h: Added.
+        (WebCore::ScriptArguments::argumentCount):
+        * inspector/ScriptCallFrame.cpp: Added.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::isEqual):
+        (WebCore::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h: Added.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        * inspector/ScriptCallStack.cpp: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        (WebCore::ScriptCallStack::size):
+        (WebCore::ScriptCallStack::isEqual):
+        (WebCore::ScriptCallStack::buildInspectorObject):
+        * inspector/ScriptCallStack.h: Added.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        (WebCore::Console::debug):
+        (WebCore::Console::error):
+        (WebCore::Console::info):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::dirxml):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::count):
+        (WebCore::Console::markTimeline):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupCollapsed):
+        (WebCore::Console::shouldCaptureFullStackTrace):
+        (WebCore::Console::warn):
+        * page/Console.h:
+
+2010-10-21  Yury Semikhatsky  <yurys@chromium.org>
+
         Unreviewed. Revert r70232. Chromium compilation failure.
 
 2010-10-21  Yury Semikhatsky  <yurys@chromium.org>
@@ -80395,7 +86826,7 @@
 
         Reviewed by Gustavo Noronha Silva.
 
-        Bug 41340 - [GStreamer] Subtle race condition during seeks
+        Bug 41340 - [GStreamer] Subtle race condition during seeks
         https://bugs.webkit.org/show_bug.cgi?id=41340
 
         * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp: