Merge changes I2e7e2317,Ie6ccde3a,I3e89f231,Id06ff339,I268dfe7d,Icaf70d9f,Ie234f1a0,Iff5c7aaa,I69b75bf0,Ifbf384f4

* changes:
  Merge WebKit at r65615 : Update WebKit revision number
  Merge WebKit at r65615 : Ignore http/tests/appcache/origin-quota.html
  Merge WebKit at r65615 : Android-specific results for Geolocation tests.
  Merge WebKit at r65615 : Fix GraphicsContext and ImageBuffer.
  Merge WebKit at r65615 : processingUserGesture() is now static.
  Merge WebKit at r65615 : UTF8String() becomes utf8().
  Merge WebKit at r65615 : Fix include paths for string headers.
  Merge WebKit at r65615 : Fix Makefiles.
  Merge WebKit at r65615 : Fix conflicts.
  Merge WebKit at r65615 : Initial merge by git.

1 files changed, 47 insertions, 20 deletions

diff --git a/WebCore/html/HTMLTreeBuilder.cpp b/WebCore/html/HTMLTreeBuilder.cpp
index 2c7d40d..fd0b62e 100644
--- a/WebCore/html/HTMLTreeBuilder.cpp
+++ b/WebCore/html/HTMLTreeBuilder.cpp
@@ -39,7 +39,6 @@
 #include "HTMLScriptElement.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
-#include "LegacyHTMLDocumentParser.h"
 #include "LegacyHTMLTreeBuilder.h"
 #include "LocalizedStrings.h"
 #include "MathMLNames.h"
@@ -67,6 +66,11 @@ inline bool isTreeBuilderWhitepace(UChar c)
     return c == '\t' || c == '\x0A' || c == '\x0C' || c == '\x0D' || c == ' ';
 }
 
+inline bool isNotTreeBuilderWhitepace(UChar c)
+{
+    return !isTreeBuilderWhitepace(c);
+}
+
 inline bool isTreeBuilderWhitepaceOrReplacementCharacter(UChar c)
 {
     return isTreeBuilderWhitepace(c) || c == 0xFFFD;
@@ -303,21 +307,17 @@ public:
 
     void skipLeadingWhitespace()
     {
-        ASSERT(!isEmpty());
-        while (isTreeBuilderWhitepace(*m_current)) {
-            if (++m_current == m_end)
-                return;
-        }
+        skipLeading<isTreeBuilderWhitepace>();
     }
 
     String takeLeadingWhitespace()
     {
-        ASSERT(!isEmpty());
-        const UChar* start = m_current;
-        skipLeadingWhitespace();
-        if (start == m_current)
-            return String();
-        return String(start, m_current - start);
+        return takeLeading<isTreeBuilderWhitepace>();
+    }
+
+    String takeLeadingNonWhitespace()
+    {
+        return takeLeading<isNotTreeBuilderWhitepace>();
     }
 
     String takeRemaining()
@@ -352,6 +352,27 @@ public:
     }
 
 private:
+    template<bool characterPredicate(UChar)>
+    void skipLeading()
+    {
+        ASSERT(!isEmpty());
+        while (characterPredicate(*m_current)) {
+            if (++m_current == m_end)
+                return;
+        }
+    }
+
+    template<bool characterPredicate(UChar)>
+    String takeLeading()
+    {
+        ASSERT(!isEmpty());
+        const UChar* start = m_current;
+        skipLeading<characterPredicate>();
+        if (start == m_current)
+            return String();
+        return String(start, m_current - start);
+    }
+
     const UChar* m_current;
     const UChar* m_end;
 };
@@ -391,13 +412,14 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, DocumentFragment* fra
 {
     if (shouldUseLegacyTreeBuilder(fragment->document()))
         return;
-    // This is steps 2-6 of the HTML5 Fragment Case parsing algorithm:
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
-    if (contextElement)
+    if (contextElement) {
+        // Steps 4.2-4.6 of the HTML5 Fragment Case parsing algorithm:
+        // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
         m_document->setParseMode(contextElement->document()->parseMode());
-    processFakeStartTag(htmlTag);
-    resetInsertionModeAppropriately();
-    m_tree.setForm(closestFormAncestor(contextElement));
+        processFakeStartTag(htmlTag);
+        resetInsertionModeAppropriately();
+        m_tree.setForm(closestFormAncestor(contextElement));
+    }
 }
 
 HTMLTreeBuilder::~HTMLTreeBuilder()
@@ -1997,7 +2019,9 @@ void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
         m_tree.openElements()->popUntilPopped(token.name());
         m_tree.activeFormattingElements()->clearToLastMarker();
         setInsertionMode(InRowMode);
-        ASSERT(m_tree.currentElement()->hasTagName(trTag));
+        // FIXME: The fragment case of this ASSERT is a spec bug:
+        // http://www.w3.org/Bugs/Public/show_bug.cgi?id=10338
+        ASSERT(m_tree.currentElement()->hasTagName(trTag) || (isParsingFragment() && m_fragmentContext.contextElement()->hasTagName(trTag)));
         return;
     }
     if (token.name() == bodyTag
@@ -2628,7 +2652,10 @@ ReprocessBuffer:
             return;
         if (!processColgroupEndTagForInColumnGroup()) {
             ASSERT(isParsingFragment());
-            return;
+            // The spec tells us to drop these characters on the floor.
+            buffer.takeLeadingNonWhitespace();
+            if (buffer.isEmpty())
+                return;
         }
         goto ReprocessBuffer;
     }