2011-09-15 Mark Rowe Merge r89705. 2011-06-24 Abhishek Arya Reviewed by Darin Adler. Add clamping for CSSPrimitiveValues and SVGInlineText font size. https://bugs.webkit.org/show_bug.cgi?id=53449 Test: svg/text/svg-zoom-large-value.xhtml * css/CSSPrimitiveValue.cpp: (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): add asserts to detect if the number created is valid. * css/CSSPrimitiveValue.h: add clamping checks to prevent overflows. (WebCore::CSSPrimitiveValue::getFloatValue): (WebCore::CSSPrimitiveValue::getIntValue): * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): split into two static functions, one specific to CSSStyleSelector and other generic to help in clamping font size for other callers like svg text, etc. * css/CSSStyleSelector.h: * platform/graphics/FontDescription.h: add asserts to detect if the new font size is valid. (WebCore::FontDescription::setComputedSize): (WebCore::FontDescription::setSpecifiedSize): * rendering/svg/RenderSVGInlineText.cpp: (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle): use the new helper from CSSStyleSelector to help in clamping new scaled font size. do not use "smart minimum" since svg allows really small unreadable fonts (tested by existing layout tests). Document's minimum font size clamp (0 in my case) and harmless epsilon check in CSSStyleSelector function should still hold for svg. 2011-09-15 Mark Rowe Merge r91386. 2011-07-20 Tony Chang Stale pointer due to floats not removed (flexible box display) https://bugs.webkit.org/show_bug.cgi?id=64603 Reviewed by David Hyatt. Flexbox items should avoid floats. Test: fast/flexbox/horizontal-box-float-crash.html * rendering/RenderBox.cpp: (WebCore::RenderBox::avoidsFloats): * rendering/RenderBox.h: (WebCore::RenderBox::isDeprecatedFlexItem): 2011-09-15 Mark Rowe Merge r88139. 2011-06-04 Abhishek Arya Reviewed by Kent Tamura. Add some asserts for array boundary checks in TextRun. Fix an integer issue in linux text controller code. https://bugs.webkit.org/show_bug.cgi?id=62085 Testing ComplexTextControllerLinux change requires a testcase > 32 kb which is not feasible. All other changes are tested by existing layouttests. * platform/graphics/TextRun.h: (WebCore::TextRun::operator[]): add assert. (WebCore::TextRun::data): add assert. * platform/graphics/WidthIterator.cpp: (WebCore::WidthIterator::advance): bail early and prevent access to one byte across the text run boundary. * platform/graphics/chromium/ComplexTextControllerLinux.cpp: (WebCore::ComplexTextController::getNormalizedTextRun): wrong int16 vs int comparison. * rendering/svg/SVGTextRunRenderingContext.cpp: (WebCore::SVGTextRunWalker::walk): bail early when from and to is outside the text run boundary. this hit easily after adding the assert when from = to = end and read in run.data(from). 2011-09-15 Mark Rowe Merge r90568. 2011-07-07 Julien Chaffraix Reviewed by David Hyatt. Partial layout when a flex-box has visibility: collapse https://bugs.webkit.org/show_bug.cgi?id=63776 Tests: fast/flexbox/crash-button-input-autofocus.html fast/flexbox/crash-button-keygen.html fast/flexbox/crash-button-relayout.html The issue is that FlexBoxIterator would skip any child if it has visibility: collapsed. However if one of the child is anonymous, it may wrap some other child that would be skipped. Now FlexBoxIterator is called during the layout phase and thus some nodes would not relayouted as expected. * rendering/RenderDeprecatedFlexibleBox.cpp: (WebCore::FlexBoxIterator::next): When iterating, don't skip anonymous content as there may be real content hiding below. 2011-09-15 Mark Rowe Merge r95057. 2011-09-13 Jeff Miller WebCore::Cursor::ensurePlatformCursor() should always set a valid platform cursor on Windows https://bugs.webkit.org/show_bug.cgi?id=68043 Make sure we set a valid platform cursor in the Cursor::NoDrop case, and add a default clause that uses the arrow cursor in case another cursor type is added in the future and we forget to update ensurePlatformCursor(). Reviewed by Anders Carlsson. * platform/win/CursorWin.cpp: (WebCore::Cursor::ensurePlatformCursor): Always set a valid platform cursor. 2011-09-15 Mark Rowe Merge r95056. 2011-09-12 Jon Honeycutt MSAA: WebKit reports the document state as disabled https://bugs.webkit.org/show_bug.cgi?id=67974 Reviewed by Brian Weinstein. Test: platform/win/accessibility/document-enabled-state.html * accessibility/AccessibilityScrollView.h: (WebCore::AccessibilityScrollView::isEnabled): This object backs the AccessibleDocument on Windows - always return true for its enabled state. 2011-09-06 Mark Rowe Merge r94251. 2011-08-31 Jeff Miller REGRESSION(92210): AVFoundation media engine is disabled on OS X https://bugs.webkit.org/show_bug.cgi?id=67316 Move the definition of WTF_USE_AVFOUNDATION on the Mac back to JavaScriptCore/wtf/Platform.h, since WebKit2 doesn't have access to WebCore/config.h on this platform. This reverts the changes that were made in r92210. Reviewed by Darin Adler. No new tests, covered by existing media tests. * config.h: Removed definition of WTF_USE_AVFOUNDATION on the Mac, add a comment about fixing this on Windows in the future. 2011-08-29 Lucas Forschler Merged 92982 2011-08-12 Andy Estes Cancel in onbeforeunload dialog sometime causes a button to stop working. https://bugs.webkit.org/show_bug.cgi?id=26211 Reviewed by Alexey Proskuryakov. Test: fast/loader/form-submission-after-beforeunload-cancel.html If an onbeforeunload handler cancels a navigation that was triggered by a form submission, WebCore's multiple form submission protection prevents the form from being submitted a second time even though no first submission actually took place. Fix this by clearing m_submittedFormURL if the onbeforeunload handler cancels the load. This allows the submission to be retried. * loader/FrameLoader.cpp: (WebCore::FrameLoader::shouldClose): Set m_submittedFormURL to KURL() if shouldClose() will return false. 2011-08-29 Lucas Forschler Merged 93459 2011-08-19 Jeff Miller MediaPlayerPrivateAVFoundationCF should use AVCFURLAssetCopyAudiovisualMIMETypes() to get list of supported MIME types https://bugs.webkit.org/show_bug.cgi?id=66612 Reviewed by Darin Adler. No new tests, should be covered by existing media tests. * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Added AVCFURLAssetCopyAudiovisualMIMETypes(). * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: (WebCore::mimeTypeCache): Use AVCFURLAssetCopyAudiovisualMIMETypes() to build the cache of supported MIME types. 2011-08-29 Lucas Forschler Merged 93900 2011-08-26 Darin Adler [Mac] Use the progress cursor instead of the wristwatch for CSS "wait" cursor https://bugs.webkit.org/show_bug.cgi?id=67049 Reviewed by Beth Dakin. * platform/mac/CursorMac.mm: (WebCore::Cursor::ensurePlatformCursor): Use BusyButClickable cursor for wait as well as for Progress. 2011-08-29 Lucas Forschler Merged 93878 2011-08-26 Eric Carlson