Unreviewed, rolling out r121145.
http://trac.webkit.org/changeset/121145
https://bugs.webkit.org/show_bug.cgi?id=89847

Had an objection for the change.

Source/WebCore:

* html/FormController.cpp:
(WebCore):
(WebCore::FormControlState::serializeTo):
(WebCore::FormControlState::deserialize):
(WebCore::formStateSignature):
(WebCore::FormController::formElementsState):
(WebCore::FormController::setStateForNewFormElements):
* html/FormController.h:
(FormControlState):
* html/shadow/CalendarPickerElement.cpp:
(WebCore::addJavaScriptString):

Source/WTF:

* wtf/text/StringBuilder.h:

LayoutTests:

* fast/forms/state-restore-broken-state-expected.txt:
* fast/forms/state-restore-various-values-expected.txt: Removed.
* fast/forms/state-restore-various-values.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121207 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/html/FormController.cpp b/Source/WebCore/html/FormController.cpp
index 84f44ee..31c7763 100644
--- a/Source/WebCore/html/FormController.cpp
+++ b/Source/WebCore/html/FormController.cpp
@@ -22,7 +22,6 @@
 #include "FormController.h"
 
 #include "HTMLFormControlElementWithState.h"
-#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -31,61 +30,38 @@
 // ----------------------------------------------------------------------------
 
 // Serilized form of FormControlState:
+//  (',' means strings around it are separated in stateVector.)
 //
 // SerializedControlState ::= SkipState | RestoreState
-// SkipState ::= ''
-// RestoreState ::= (',' EscapedValue )+
-// EscapedValue ::= ('\\' | '\,' | [^\,])+
+// SkipState ::= '0'
+// RestoreState ::= UnsignedNumber, ControlValue+
+// UnsignedNumber ::= [0-9]+
+// ControlValue ::= arbitrary string
+//
+// RestoreState has a sequence of ControlValues. The length of the
+// sequence is represented by UnsignedNumber.
 
-String FormControlState::serialize() const
+void FormControlState::serializeTo(Vector<String>& stateVector) const
 {
     ASSERT(!isFailure());
-    if (!m_values.size())
-        return emptyString();
-
-    size_t enoughSize = 0;
+    stateVector.append(String::number(m_values.size()));
     for (size_t i = 0; i < m_values.size(); ++i)
-        enoughSize += 1 + m_values[i].length() * 2;
-    StringBuilder builder;
-    builder.reserveCapacity(enoughSize);
-    for (size_t i = 0; i < m_values.size(); ++i) {
-        builder.append(',');
-        builder.appendEscaped(m_values[i], '\\', ',');
-    }
-    return builder.toString();
+        stateVector.append(m_values[i].isNull() ? emptyString() : m_values[i]);
 }
 
-FormControlState FormControlState::deserialize(const String& escaped)
+FormControlState FormControlState::deserialize(const Vector<String>& stateVector, size_t& index)
 {
-    if (!escaped.length())
-        return FormControlState();
-    if (escaped[0] != ',')
+    if (index >= stateVector.size())
         return FormControlState(TypeFailure);
-
-    size_t valueSize = 1;
-    for (unsigned i = 1; i < escaped.length(); ++i) {
-        if (escaped[i] == '\\') {
-            if (++i >= escaped.length())
-                return FormControlState(TypeFailure);
-        } else if (escaped[i] == ',')
-            valueSize++;
-    }
-
+    size_t valueSize = stateVector[index++].toUInt();
+    if (!valueSize)
+        return FormControlState();
+    if (index + valueSize > stateVector.size())
+        return FormControlState(TypeFailure);
     FormControlState state;
     state.m_values.reserveCapacity(valueSize);
-    StringBuilder builder;
-    for (unsigned i = 1; i < escaped.length(); ++i) {
-        if (escaped[i] == '\\') {
-            if (++i >= escaped.length())
-                return FormControlState(TypeFailure);
-            builder.append(escaped[i]);
-        } else if (escaped[i] == ',') {
-            state.append(builder.toString());
-            builder.clear();
-        } else
-            builder.append(escaped[i]);
-    }
-    state.append(builder.toString());
+    for (size_t i = 0; i < valueSize; ++i)
+        state.append(stateVector[index++]);
     return state;
 }
 
@@ -105,14 +81,14 @@
     // In the legacy version of serialized state, the first item was a name
     // attribute value of a form control. The following string literal should
     // contain some characters which are rarely used for name attribute values.
-    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 4 \n\r=&"));
+    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 3 \n\r=&"));
     return signature;
 }
 
 Vector<String> FormController::formElementsState() const
 {
     Vector<String> stateVector;
-    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3 + 1);
+    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 4 + 1);
     stateVector.append(formStateSignature());
     typedef FormElementListHashSet::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
@@ -122,7 +98,7 @@
             continue;
         stateVector.append(elementWithState->name().string());
         stateVector.append(elementWithState->formControlType().string());
-        stateVector.append(elementWithState->saveFormControlState().serialize());
+        elementWithState->saveFormControlState().serializeTo(stateVector);
     }
     return stateVector;
 }
@@ -137,15 +113,14 @@
     typedef FormElementStateMap::iterator Iterator;
     m_formElementsWithState.clear();
 
-    if (stateVector.size() < 1 || stateVector[0] != formStateSignature())
-        return;
-    if ((stateVector.size() - 1) % 3)
+    size_t i = 0;
+    if (stateVector.size() < 1 || stateVector[i++] != formStateSignature())
         return;
 
-    for (size_t i = 1; i < stateVector.size(); i += 3) {
-        AtomicString name = stateVector[i];
-        AtomicString type = stateVector[i + 1];
-        FormControlState state = FormControlState::deserialize(stateVector[i + 2]);
+    while (i + 2 < stateVector.size()) {
+        AtomicString name = stateVector[i++];
+        AtomicString type = stateVector[i++];
+        FormControlState state = FormControlState::deserialize(stateVector, i);
         if (type.isEmpty() || type.impl()->find(isNotFormControlTypeCharacter) != notFound || state.isFailure())
             break;
 
@@ -159,6 +134,8 @@
             m_stateForNewFormElements.set(key, stateList);
         }
     }
+    if (i != stateVector.size())
+        m_stateForNewFormElements.clear();
 }
 
 bool FormController::hasStateForNewFormElements() const