2011-08-10 Julien Chaffraix Unreviewed (4 liners - Chromium only). Hack to remove the crash from: (properly solved on trunk) https://bugs.webkit.org/show_bug.cgi?id=62884 This is one of Chromium's top most crashers and merging the fix from the bug (r89445) did not help as it relies on other SVG changes being in. This change just mitigates the crash until it naturely gets resolved when we roll WebKit revision in Chromium. * rendering/svg/SVGTextRunRenderingContext.cpp: (WebCore::floatWidthOfSubStringUsingSVGFont): (WebCore::SVGTextRunRenderingContext::drawTextUsingSVGFont): Added 2 null-checks here. 2011-07-27 Kent Tamura REGRESSION: [Chromium/782] Speech icon should be on the left side for dir=rtl https://bugs.webkit.org/show_bug.cgi?id=65239 Reviewed by Ryosuke Niwa. * rendering/RenderTextControlSingleLine.cpp: (WebCore::RenderTextControlSingleLine::layout): For RTL, move the speech button to the left side and shift the inner text to the right by the width of the speech button and the spin button. 2011-07-19 Steve Lacey [chromium] Media player controls do not fade out. https://bugs.webkit.org/show_bug.cgi?id=64837 Media controls were not fading out when the mouse leaves the video due to underlying changes in webkit media controls. Fix was to copy missing code from MediaControlRootElement to MediaControlRootElementChromium. Reviewed by Dimitri Glazkov. * html/shadow/MediaControlRootElementChromium.cpp: (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium): (WebCore::MediaControlRootElementChromium::playbackProgressed): (WebCore::MediaControlRootElementChromium::containsRelatedTarget): (WebCore::MediaControlRootElementChromium::defaultEventHandler): * html/shadow/MediaControlRootElementChromium.h: 2011-07-19 Luke Macpherson Implement CSSPropertyCounterIncrement and CounterReset in CSSStyleApplyProperty. https://bugs.webkit.org/show_bug.cgi?id=64846 Reviewed by Dimitri Glazkov. No new tests / refactoring only. * css/CSSStyleApplyProperty.cpp: (WebCore::ApplyPropertyCounter Added class to handle counter properties. (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty): Initialize counter property handlers. * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): Remove old handlers. 2011-07-19 Kent Tamura REGRESSION(r89004): Video pauses and never resumes playing if scrubbed during playback. https://bugs.webkit.org/show_bug.cgi?id=64314 Reviewed by Sam Weinig. No new tests because it's hard to make a non-flaky test for this behavior. * html/RangeInputType.cpp: (WebCore::RangeInputType::handleMouseDownEvent): Don't call SliderThumbElement::dragFrom() for events on the thumb. * html/shadow/SliderThumbElement.cpp: (WebCore::SliderThumbElement::defaultEventHandler): Do not call setDefaultHandled() for mouse events in order to propagate them to ancestor elements. 2011-07-19 Matthew Delaney Add fast path for ImageBuffer::draw https://bugs.webkit.org/show_bug.cgi?id=64535 Reviewed by Simon Fraser. No new tests. This patch doesn't change behavior; current tests are sufficient. * platform/graphics/GraphicsContext.cpp: (WebCore::GraphicsContext::drawImage): Moved the main method version next to wrapper versions. * platform/graphics/ImageBuffer.h: 1) Added BackingStoreCopy enum for choosing to copy backing store or not in copyImage(). 2) Added copyNativeImage() behind USE(CG) - same as copyImage() but gives NativeImagePtr. * platform/graphics/cg/ImageBufferCG.cpp: Added new methods described above. * platform/graphics/GraphicsContext.h: Adding drawNativeImage() for fast draw path. * platform/graphics/cg/GraphicsContextCG.cpp: (WebCore::GraphicsContext::drawNativeImage): Added. Draws a nativeImagePtr into context. * platform/graphics/Image.h: Added imageWithColorSpace behind CG platform ifdef * platform/graphics/cg/ImageCG.cpp: (WebCore::BitmapImage::draw): Refactored out actual image drawing code into GraphicsContext, so that it can be used by more than just BitmapImage without having to copy code. (WebCore::Image::imageWithColorSpace): Made into an Image class function. Updated copyImage() to for BackingStoreCopy: * platform/graphics/qt/ImageBufferQt.cpp * platform/graphics/filters/FETile.cpp * platform/graphics/cairo/ImageBufferCairo.cpp * platform/graphics/skia/ImageBufferSkia.cpp * platform/graphics/wx/ImageBufferWx.cpp * platform/graphics/wince/ImageBufferWinCE.cpp * svg/SVGFEImageElement.cpp * svg/graphics/SVGImage.cpp * html/HTMLCanvasElement.cpp * html/canvas/WebGLRenderingContext.cpp * rendering/svg/RenderSVGResourcePattern.cpp 2011-07-19 Leo Yang SVG: Missing implementation of , and https://bugs.webkit.org/show_bug.cgi?id=60850 Reviewed by Nikolas Zimmermann. SVG spec: http://www.w3.org/TR/SVG/text.html#AlternateGlyphDefinitions. This patch is to implement SVG , and elements for alternative glyph features. NOTE: x, y, dx, dy, format and glyphRef attributes on are not honored yet, so neither are the reaction of dynamic change of them. They will be honored in separated patches. Test: svg/W3C-SVG-1.1/text-altglyph-01-b.svg With this patch this test works as expected. * CMakeLists.txt: * CodeGenerators.pri: * DerivedSources.cpp: * DerivedSources.make: * GNUmakefile.list.am: * WebCore.exp.in: * WebCore.gypi: * WebCore.pro: * WebCore.vcproj/WebCore.vcproj: * WebCore.xcodeproj/project.pbxproj: * bindings/objc/DOM.mm: (WebCore::createElementClassMap): * bindings/objc/DOMSVG.h: * page/DOMWindow.idl: * svg/SVGAllInOne.cpp: * svg/SVGAltGlyphDefElement.cpp: Added. (WebCore::SVGAltGlyphDefElement::SVGAltGlyphDefElement): (WebCore::SVGAltGlyphDefElement::create): (WebCore::SVGAltGlyphDefElement::hasValidGlyphElements): * svg/SVGAltGlyphDefElement.h: Added. * svg/SVGAltGlyphDefElement.idl: Added. * svg/SVGAltGlyphElement.cpp: (WebCore::SVGAltGlyphElement::hasValidGlyphElements): * svg/SVGAltGlyphElement.h: * svg/SVGAltGlyphItemElement.cpp: Added. (WebCore::SVGAltGlyphItemElement::SVGAltGlyphItemElement): (WebCore::SVGAltGlyphItemElement::create): (WebCore::SVGAltGlyphItemElement::hasValidGlyphElements): * svg/SVGAltGlyphItemElement.h: Added. * svg/SVGAltGlyphItemElement.idl: Added. * svg/SVGFontData.cpp: (WebCore::SVGFontData::applySVGGlyphSelection): * svg/SVGGlyphRefElement.cpp: Added. (WebCore::SVGGlyphRefElement::SVGGlyphRefElement): (WebCore::SVGGlyphRefElement::create): (WebCore::SVGGlyphRefElement::hasValidGlyphElement): (WebCore::SVGGlyphRefElement::parseMappedAttribute): (WebCore::SVGGlyphRefElement::glyphRef): (WebCore::SVGGlyphRefElement::setGlyphRef): (WebCore::SVGGlyphRefElement::setX): (WebCore::SVGGlyphRefElement::setY): (WebCore::SVGGlyphRefElement::setDx): (WebCore::SVGGlyphRefElement::setDy): * svg/SVGGlyphRefElement.h: Added. * svg/SVGGlyphRefElement.idl: Added. * svg/svgtags.in: 2011-07-19 Adam Roben Remove some unused code in FormDataStreamCFNet Rubber-stamped by Steve Falkenburg. * platform/network/cf/FormDataStreamCFNet.cpp: 2011-07-19 Simon Fraser REGRESSION (r91136-r91146): 40 tests failing on Windows 7 Release (Tests) https://bugs.webkit.org/show_bug.cgi?id=64808 Reviewed by Adam Roben. Initializing m_uncommittedChanges to a non-zero value caused the first call to noteLayerPropertyChanged() to not call m_client->notifySyncRequired(). This resulted in animations never getting committed on Windows, which broke a lot of tests. * platform/graphics/ca/GraphicsLayerCA.cpp: (WebCore::GraphicsLayerCA::GraphicsLayerCA): 2011-07-19 James Robinson [chromium] LayerRendererChromium shouldn't be a friend of RenderSurfaceChromium https://bugs.webkit.org/show_bug.cgi?id=64834 Reviewed by Kenneth Russell. Uses setters and getters to access RenderSurfaceChromium's private member variables instead of directly accessing them via a friend declaration. This cleans up a minor code smell and will be helpful for future refactoring. Refactor only, no change in behavior. Tested by compositing/ tests. * platform/graphics/chromium/LayerRendererChromium.cpp: (WebCore::LayerRendererChromium::updateLayers): (WebCore::LayerRendererChromium::paintLayerContents): (WebCore::LayerRendererChromium::drawLayers): (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces): (WebCore::LayerRendererChromium::updateCompositorResources): (WebCore::LayerRendererChromium::getOffscreenLayerTexture): (WebCore::LayerRendererChromium::copyOffscreenTextureToDisplay): (WebCore::LayerRendererChromium::useRenderSurface): (WebCore::LayerRendererChromium::drawLayer): (WebCore::LayerRendererChromium::setScissorToRect): * platform/graphics/chromium/RenderSurfaceChromium.cpp: (WebCore::RenderSurfaceChromium::clearLayerList): * platform/graphics/chromium/RenderSurfaceChromium.h: (WebCore::RenderSurfaceChromium::layerList): (WebCore::RenderSurfaceChromium::contentRect): (WebCore::RenderSurfaceChromium::setContentRect): (WebCore::RenderSurfaceChromium::drawOpacity): (WebCore::RenderSurfaceChromium::setDrawOpacity): (WebCore::RenderSurfaceChromium::drawTransform): (WebCore::RenderSurfaceChromium::setDrawTransform): (WebCore::RenderSurfaceChromium::maskLayer): (WebCore::RenderSurfaceChromium::setMaskLayer): (WebCore::RenderSurfaceChromium::originTransform): (WebCore::RenderSurfaceChromium::setOriginTransform): (WebCore::RenderSurfaceChromium::replicaDrawTransform): (WebCore::RenderSurfaceChromium::setReplicaDrawTransform): (WebCore::RenderSurfaceChromium::scissorRect): (WebCore::RenderSurfaceChromium::setScissorRect): (WebCore::RenderSurfaceChromium::skipsDraw): (WebCore::RenderSurfaceChromium::setSkipsDraw): (WebCore::RenderSurfaceChromium::contentsTexture): 2011-07-19 Jessie Berlin GTK + QT build fix. Rubber-stamped by Daniel Bates and Alexey Proskuryakov. * loader/ResourceLoader.cpp: (WebCore::ResourceLoader::willSendRequest): (WebCore::ResourceLoader::didSendData): (WebCore::ResourceLoader::didReceiveResponse): (WebCore::ResourceLoader::didReceiveData): (WebCore::ResourceLoader::didFinishLoading): (WebCore::ResourceLoader::didFail): (WebCore::ResourceLoader::wasBlocked): (WebCore::ResourceLoader::cannotShowURL): (WebCore::ResourceLoader::shouldUseCredentialStorage): (WebCore::ResourceLoader::willCacheResponse): 2011-07-19 Chris Rogers Fix web audio compile on mac port https://bugs.webkit.org/show_bug.cgi?id=64836 Unreviewed build fix. * bindings/js/JSAudioContextCustom.cpp: (WebCore::JSAudioContextConstructor::constructJSAudioContext): (WebCore::JSAudioContext::createBuffer): 2011-07-19 Jessie Berlin Work towards determining the cause of frequent crashes due to null frame below ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache. https://bugs.webkit.org/show_bug.cgi?id=62764 Reviewed by Alexey Proskuryakov. Make these unexpected cases crash in the WebKit nightlies so we can gather more information and potentially find a repro case. * loader/ResourceLoader.cpp: (WebCore::ResourceLoader::willSendRequest): (WebCore::ResourceLoader::didSendData): (WebCore::ResourceLoader::didReceiveResponse): (WebCore::ResourceLoader::didReceiveData): (WebCore::ResourceLoader::didFinishLoading): (WebCore::ResourceLoader::didFail): (WebCore::ResourceLoader::wasBlocked): (WebCore::ResourceLoader::cannotShowURL): (WebCore::ResourceLoader::shouldUseCredentialStorage): (WebCore::ResourceLoader::willCacheResponse): 2011-07-19 Dan Bernstein Nothing printed when specifying a very large maximum layout width https://bugs.webkit.org/show_bug.cgi?id=64831 Reviewed by Beth Dakin. I am not adding a test because the DumpRenderTree printing test machinery is based on PrintContext, which does not exercise the code path on which this bug lies. * page/FrameView.cpp: (WebCore::FrameView::forceLayoutForPagination): Fixed an integer overflow. 2011-07-19 Nate Chapin [V8] Wait until no v8 context is on the stack before cancelling pending indexed db transactions. https://bugs.webkit.org/show_bug.cgi?id=64552 Reviewed by Adam Barth. Test: storage/indexeddb/transaction-abort-with-js-recursion.html * bindings/v8/V8Proxy.cpp: (WebCore::V8Proxy::didLeaveScriptContext): 2011-07-19 MORITA Hajime Crash in CompositeEditCommand::replaceTextInNodePreservingMarkers. https://bugs.webkit.org/show_bug.cgi?id=64738 Reviewed by Ryosuke Niwa. Test: editing/undo/replace-text-in-node-preserving-markers-crash.html * editing/CompositeEditCommand.cpp: (WebCore::copyMarkers): (WebCore::CompositeEditCommand::replaceTextInNodePreservingMarkers): 2011-07-19 Mike West Sending a `Ping-From` header for cross-origin pings from non-HTTPS documents. https://bugs.webkit.org/show_bug.cgi?id=64789 Also a drive-by cleanup of whitespace. Reviewed by Nate Chapin. * loader/PingLoader.cpp: (WebCore::PingLoader::loadImage): (WebCore::PingLoader::sendPing): 2011-07-15 Luke Zarko Bring V8's SerializedScriptValue implementation up to date. https://bugs.webkit.org/show_bug.cgi?id=63481 Reviewed by David Levin. The HTML5 Structured Clone algorithm (http://www.whatwg.org/specs/web-apps/current-work/multipage/urls.html#safe-passing-of-structured-data) has been updated since the V8 version of SerializedScriptValue was first implemented. This patch aims to bring this implementation up to date. It: - Introduces the new HTML5 DOM error codes for TIMEOUT_ERR, INVALID_NODE_TYPE_ERR, DATA_CLONE_ERR - Handles cyclic structures and equality of reference preservation for cloned values - Allows DataViews to be constructed on the native side using the existing wrapper techniques - Amends tests and introduces new ones to check for correctness (the bulk of the patch) - Tolerates the old version of the serialized object format The patch permits the cloning of JavaScript typed arrays. This functionality is in active use already and was supported (somewhat inefficiently) by the existing code through an artifact of implementation. Tests: fast/dom/Window/window-postmessage-clone-deep-array.html fast/dom/Window/window-postmessage-clone-really-deep-array.html fast/dom/Window/window-postmessage-clone.html fast/canvas/webgl/array-message-passing.html * bindings/v8/SerializedScriptValue.cpp: (WebCore::V8ObjectMap::Writer::writeVersion): (WebCore::V8ObjectMap::Writer::writeArrayBuffer): (WebCore::V8ObjectMap::Writer::writeArrayBufferView): (WebCore::V8ObjectMap::Writer::writeObjectReference): (WebCore::V8ObjectMap::Writer::writeReferenceCount): (WebCore::V8ObjectMap::Writer::writeGenerateFreshObject): (WebCore::V8ObjectMap::Writer::writeGenerateFreshArray): (WebCore::V8ObjectMap::Writer::doWriteArrayBuffer): (WebCore::V8ObjectMap::Serializer::Serializer): (WebCore::V8ObjectMap::Serializer::serialize): (WebCore::V8ObjectMap::Serializer::StateBase::execDepth): (WebCore::V8ObjectMap::Serializer::AbstractObjectState::AbstractObjectState): (WebCore::V8ObjectMap::Serializer::AbstractObjectState::advance): (WebCore::V8ObjectMap::Serializer::AbstractObjectState::execDepth): (WebCore::V8ObjectMap::Serializer::execDepth): (WebCore::V8ObjectMap::Serializer::push): (WebCore::V8ObjectMap::Serializer::pop): (WebCore::V8ObjectMap::Serializer::handleError): (WebCore::V8ObjectMap::Serializer::writeAndGreyArrayBufferView): (WebCore::V8ObjectMap::Serializer::writeArrayBuffer): (WebCore::V8ObjectMap::Serializer::greyObject): (WebCore::V8ObjectMap::Serializer::doSerialize): (WebCore::V8ObjectMap::Reader::Reader): (WebCore::V8ObjectMap::Reader::read): (WebCore::V8ObjectMap::Reader::readVersion): (WebCore::V8ObjectMap::Reader::setVersion): (WebCore::V8ObjectMap::Reader::undoReadTag): (WebCore::V8ObjectMap::Reader::readArrayBufferViewSubTag): (WebCore::V8ObjectMap::Reader::doReadArrayBuffer): (WebCore::V8ObjectMap::Reader::readArrayBuffer): (WebCore::V8ObjectMap::Reader::readArrayBufferView): (WebCore::V8ObjectMap::Deserializer::Deserializer): (WebCore::V8ObjectMap::Deserializer::deserialize): (WebCore::V8ObjectMap::Deserializer::newArray): (WebCore::V8ObjectMap::Deserializer::consumeTopOfStack): (WebCore::V8ObjectMap::Deserializer::completeArray): (WebCore::V8ObjectMap::Deserializer::newObject): (WebCore::V8ObjectMap::Deserializer::completeObject): (WebCore::V8ObjectMap::Deserializer::completeSparseArray): (WebCore::V8ObjectMap::Deserializer::pushObjectReference): (WebCore::V8ObjectMap::Deserializer::tryGetObjectFromObjectReference): (WebCore::V8ObjectMap::Deserializer::objectReferenceCount): (WebCore::V8ObjectMap::Deserializer::openComposite): (WebCore::V8ObjectMap::Deserializer::closeComposite): (WebCore::SerializedScriptValue::SerializedScriptValue): * bindings/v8/V8Binding.cpp: (WebCore::isHostObject): * bindings/v8/V8Binding.h: * bindings/v8/custom/V8DataViewCustom.cpp: (WebCore::V8DataView::constructorCallback): * dom/DOMCoreException.idl: * dom/ExceptionCode.cpp: * dom/ExceptionCode.h: * html/canvas/ArrayBuffer.cpp: (WebCore::ArrayBuffer::create): * html/canvas/ArrayBuffer.h: * html/canvas/DataView.cpp: (WebCore::DataView::create): * html/canvas/DataView.h: 2011-07-19 Simon Fraser Possible recursion in GraphicsLayerCA::updateGeometry() https://bugs.webkit.org/show_bug.cgi?id=64815 Reviewed by Sam Weinig. It was possible to recurse via updateGeometry/swapFromOrToTiledLayer/ updateContentsScale because updateGeometry() and updateContentsScale() used different sizes; updateGeometry() used the scaled size, while updateContentsScale() used the unscaled size. Always use the unscaled size; the scaled size will be at most a couple of pixels bigger, and our threshold is not close to the max texture size limit, so using the slightly smaller size is OK. Test: compositing/scaling/tiled-layer-recursion.html * platform/graphics/ca/GraphicsLayerCA.cpp: (WebCore::GraphicsLayerCA::updateGeometry): (WebCore::GraphicsLayerCA::updateLayerDrawsContent): (WebCore::GraphicsLayerCA::updateContentsScale): (WebCore::GraphicsLayerCA::requiresTiledLayer): * platform/graphics/ca/GraphicsLayerCA.h: 2011-07-19 Mihnea Ovidenie [CSSRegions]Parse -webkit-region-overflow property https://bugs.webkit.org/show_bug.cgi?id=64444 Reviewed by David Hyatt. Test: fast/regions/webkit-region-overflow-parsing.html * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): * css/CSSPrimitiveValueMappings.h: (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): (WebCore::CSSPrimitiveValue::operator RegionOverflow): * css/CSSPropertyNames.in: * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): * css/CSSValueKeywords.in: * rendering/style/RenderStyle.cpp: (WebCore::RenderStyle::diff): * rendering/style/RenderStyle.h: (WebCore::InheritedFlags::regionOverflow): (WebCore::InheritedFlags::setRegionOverflow): (WebCore::InheritedFlags::initialRegionOverflow): * rendering/style/RenderStyleConstants.h: * rendering/style/StyleRareNonInheritedData.cpp: (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData): (WebCore::StyleRareNonInheritedData::operator==): * rendering/style/StyleRareNonInheritedData.h: 2011-07-19 Mihnea Ovidenie hover then un-hover makes state change https://bugs.webkit.org/show_bug.cgi?id=56401 When a 'before' pseudo-element is re-added, we should check whether the insertion point is an anonymous block with inline children. If it is, then we should change the insertion point to the first child of the anonymous block, otherwise the 'before' pseudo-element ends up in a different block. Reviewed by David Hyatt. Test: fast/dynamic/hover-before-position-after-style-change.html * rendering/RenderObjectChildList.cpp: (WebCore::RenderObjectChildList::updateBeforeAfterContent): 2011-07-19 Luke Macpherson Implement CSSPropertyWebkitPerspectiveOrigin in CSSStyleApplyProperty. https://bugs.webkit.org/show_bug.cgi?id=64784 Reviewed by Simon Fraser. No new tests / refactoring. * css/CSSStyleApplyProperty.cpp: (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty): * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): 2011-07-19 Chris Rogers Implement WaveShaperNode for Web Audio API https://bugs.webkit.org/show_bug.cgi?id=64644 Reviewed by Kenneth Russell. No new tests since audio API is not yet implemented. * DerivedSources.make: * WebCore.gypi: * WebCore.xcodeproj/project.pbxproj: * bindings/js/JSWaveShaperNodeCustom.cpp: Added. (WebCore::JSWaveShaperNode::setCurve): * webaudio/AudioContext.cpp: (WebCore::AudioContext::createWaveShaper): * webaudio/AudioContext.h: * webaudio/AudioContext.idl: * webaudio/AudioNode.h: * webaudio/WaveShaperDSPKernel.cpp: Added. (WebCore::WaveShaperDSPKernel::process): * webaudio/WaveShaperDSPKernel.h: Added. (WebCore::WaveShaperDSPKernel::WaveShaperDSPKernel): (WebCore::WaveShaperDSPKernel::reset): (WebCore::WaveShaperDSPKernel::waveShaperProcessor): * webaudio/WaveShaperNode.cpp: Added. (WebCore::WaveShaperNode::WaveShaperNode): (WebCore::WaveShaperNode::setCurve): (WebCore::WaveShaperNode::curve): * webaudio/WaveShaperNode.h: Added. (WebCore::WaveShaperNode::create): (WebCore::WaveShaperNode::waveShaperProcessor): * webaudio/WaveShaperNode.idl: Added. * webaudio/WaveShaperProcessor.cpp: Added. (WebCore::WaveShaperProcessor::WaveShaperProcessor): (WebCore::WaveShaperProcessor::~WaveShaperProcessor): (WebCore::WaveShaperProcessor::createKernel): (WebCore::WaveShaperProcessor::setCurve): (WebCore::WaveShaperProcessor::process): * webaudio/WaveShaperProcessor.h: Added. (WebCore::WaveShaperProcessor::curve): 2011-07-19 Robert Hogan REGRESSION: Incorrect layout at recline-online.com https://bugs.webkit.org/show_bug.cgi?id=64030 Reviewed by David Hyatt. http://trac.webkit.org/changeset/68362 dropped the check for cases where the render box is floating or inline. When the box is left or right aligned it is considered to be floating and needs to its margins set appropriately. Test: fast/table/align-right-within-left-aligned-div.html created by Dominic Cooney * rendering/RenderBox.cpp: (WebCore::RenderBox::computeInlineDirectionMargins): 2011-07-19 Abhishek Arya Crash when removing unrenderered nodes in replacement fragment. https://bugs.webkit.org/show_bug.cgi?id=64801 Reviewed by Ryosuke Niwa. Test: editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplacementFragment::removeUnrenderedNodes): 2011-07-19 Rob Buis https://bugs.webkit.org/show_bug.cgi?id=64673 REGRESSION (Safari 5.0.5 - ToT): crash in SVG test http://dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObjectApproved/styling-pres-02-f.html Reviewed by Nikolas Zimmermann. Prevent calling back to the owning SVGTRefElement upon handling DOMSubtreeModified events. Test: svg/W3C-SVG-1.1-SE/styling-pres-02-f.svg * svg/SVGTRefElement.cpp: (WebCore::SubtreeModificationEventListener::handleEvent): 2011-07-19 Tony Chang use more specific types in CSSFlexValue https://bugs.webkit.org/show_bug.cgi?id=64763 Reviewed by Ojan Vafai. No new tests because no change in functionality. * css/CSSFlexValue.h: (WebCore::CSSFlexValue::create): (WebCore::CSSFlexValue::isFlexValue): Make it possible to tell if we're a flex value or not. Will be needed when we're copying values to RenderStyle. (WebCore::CSSFlexValue::positiveFlex): Use floats for positive and negative flex because in the render code, we use floats. (WebCore::CSSFlexValue::negativeFlex): Add accessors for these since we'll need it when reading the flex values. (WebCore::CSSFlexValue::preferredSize): (WebCore::CSSFlexValue::CSSFlexValue): * css/CSSParser.cpp: (WebCore::CSSParser::parseValidPrimitive): Make the type more specific. (WebCore::CSSParser::parseFlex): * css/CSSParser.h: * css/CSSValue.h: (WebCore::CSSValue::isFlexValue): 2011-07-19 Chris Fleizach If the control associated with a