Patching of jumps to stubs should use jump replacement rather than branch destination overwrite
https://bugs.webkit.org/show_bug.cgi?id=101909

Reviewed by Geoffrey Garen.

This saves a few instructions in inline cases, on those architectures where it is
easy to figure out where to put the jump replacement. Sub-1% speed-up across the
board.

* assembler/MacroAssemblerARMv7.h:
(MacroAssemblerARMv7):
(JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranchPtrWithPatch):
(JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
(JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::canJumpReplacePatchableBranchPtrWithPatch):
(MacroAssemblerX86):
(JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatch):
(JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
(MacroAssemblerX86_64):
(JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatch):
(JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
* assembler/RepatchBuffer.h:
(JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatch):
(RepatchBuffer):
(JSC::RepatchBuffer::replaceWithJump):
(JSC::RepatchBuffer::revertJumpReplacementToPatchableBranchPtrWithPatch):
* assembler/X86Assembler.h:
(X86Assembler):
(JSC::X86Assembler::revertJumpTo_movq_i64r):
(JSC::X86Assembler::revertJumpTo_cmpl_im_force32):
(X86InstructionFormatter):
* bytecode/StructureStubInfo.h:
* dfg/DFGRepatch.cpp:
(JSC::DFG::replaceWithJump):
(DFG):
(JSC::DFG::tryCacheGetByID):
(JSC::DFG::tryBuildGetByIDList):
(JSC::DFG::tryBuildGetByIDProtoList):
(JSC::DFG::tryCachePutByID):
(JSC::DFG::dfgResetGetByID):
(JSC::DFG::dfgResetPutByID):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134332 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Ensure we only receive one KeyUp per key event
https://bugs.webkit.org/show_bug.cgi?id=101967

Patch by Nima Ghanavatian <nghanavatian@rim.com> on 2012-11-12
Reviewed by Rob Buis.

We are creating synthetic KeyUps too often, and get into trouble since IMF will send up a KeyUp on all key events.
Furthermore, these KeyUps can arrive both when we are composing and not. To bypass this check, we are storing the KeyDown
character and comparing against it on KeyUp.

Internally reviewed by Mike Fenton.

* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::InputHandler):
(BlackBerry::WebKit::InputHandler::handleKeyboardInput):
(BlackBerry::WebKit::InputHandler::insertText):
(BlackBerry::WebKit::InputHandler::setText):
* WebKitSupport/InputHandler.h:
(InputHandler):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134333 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix windowRect calculation for webplugin due to page scale factors
https://bugs.webkit.org/show_bug.cgi?id=100182

Patch by Min Qin <qinmin@chromium.org> on 2012-11-12
Reviewed by Adam Barth.

The current calculaton of windowRect in WebPluginContainerImpl is wrong. Even after some of our latest changes.
The problem is caused by page scale factor.
For example, windowToContents(IntPoint) will return an unscaled offset for an iframe, but will return a scaled offset for the main frame. So in order to obtain the correct window coordinate, we need to use contentsToWindow().
Since webview_plugin.cc is expecting window coordinates, we need to use contentsToWindow(IntRect) to calculate the windowRect so that the rect size can get correctly scaled.
It is difficult to write a test for this because it's pixel-based, and plugin placeholder is managed on the Chromium side (webview_plugin.cc).

* src/WebPluginContainerImpl.cpp:
(WebKit::WebPluginContainerImpl::paint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134334 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Convert some non-simple tests from setVersion to upgradeneeded
https://bugs.webkit.org/show_bug.cgi?id=101959

Reviewed by Tony Chang.

Ongoing work to remove calls to setVersion from our tests before
removing it from the IndexedDB API.

* storage/indexeddb/create-and-remove-object-store-expected.txt:
* storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt:
* storage/indexeddb/duplicates-expected.txt:
* storage/indexeddb/resources/create-and-remove-object-store.js:
  Create and delete were running between open and setVersion, which no
  longer makes sense.

* storage/indexeddb/resources/database-deletepending-flag.js:
  Use optional object parameter instead of optional version parameter.

* storage/indexeddb/resources/deletedatabase-delayed-by-open-and-versionchange.js:
  This used to call delete just after issuing setVersion but before
  receiving the corresponding success event.  Now it calls delete while
  in the upgradeneeded transaction, still causing the delete to be
  delayed by an in flight versionchange transaction.

* storage/indexeddb/resources/duplicates.js:
  Call indexedDBTest twice to rerun the tests with a different
  database.

* storage/indexeddb/resources/shared.js:
  Added a suffix option to support duplicates.js, switched to an
  optional object parameter.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134335 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Include child layers in the remote layer tree transaction
https://bugs.webkit.org/show_bug.cgi?id=102026

Reviewed by Andreas Kling.

* Shared/mac/RemoteLayerTreeTransaction.h:
* Shared/mac/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):
Encode and decode child layer IDs.

(WebKit::RemoteLayerTreeTransaction::layerPropertiesChanged):
Grab all child layer IDs and stick them in a vector.

(WebKit::dumpChangedLayers):
Dump child layer IDs as well.

* WebProcess/WebPage/mac/RemoteGraphicsLayer.h:
* WebProcess/WebPage/mac/RemoteGraphicsLayer.mm:
(WebKit::RemoteGraphicsLayer::setChildren):
(WebKit::RemoteGraphicsLayer::addChild):
(WebKit::RemoteGraphicsLayer::addChildAtIndex):
(WebKit::RemoteGraphicsLayer::addChildAbove):
(WebKit::RemoteGraphicsLayer::addChildBelow):
(WebKit::RemoteGraphicsLayer::replaceChild):
Call noteSublayersChanged.

(WebKit::RemoteGraphicsLayer::noteSublayersChanged):
Note that the Children property changed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134336 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Update BB10 form theme.
https://bugs.webkit.org/show_bug.cgi?id=100760

Patch by Tiancheng Jiang <tijiang@rim.com> on 2012-11-12
Reviewed by Rob Buis.

RIM PR 237003
Internally Reviewed by Eli Fidler.
Since we nolonger use small font for form controls, adjust paddingDivisor
ratio to decrease the padding value.

* platform/blackberry/RenderThemeBlackBerry.cpp:
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134338 268f45cc-cd09-0410-ab3c-d52691b4dbfc