Remove special-case flooring of baselinePosition for replaced elements in InlineFlowBox::placeBoxesInBlockDirection
https://bugs.webkit.org/show_bug.cgi?id=99376

Reviewed by Levi Weintraub.

Source/WebCore:

In r122769 (bug 91410) we added a special-case handling for
replaced elements in InlineFlowBox::placeBoxesInBlockDirection
to work around positioning issues in a couple of svg tests.
This was needed to compensate for a workaround in the table
painting code that was fixed in r131358 (bug 99364). As such the
special-case handling for replaced elements is no longer needed
in InlineFlowBox::placeBoxesInBlockDirection.

Furthermore this caused problems with caret repainting leaving
residual pixels which motivated this change.

No new tests, have not been able to write a repaint test to
demonstrate the caret repaint issue.

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::placeBoxesInBlockDirection):

LayoutTests:

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131503 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, try to fix the Apple Win build.

* win/WebKit2.def:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131504 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix crash in WebCore::MediaControlPanelElement::makeTransparent()
https://bugs.webkit.org/show_bug.cgi?id=97951

Reviewed by Simon Fraser.

No new tests as it's a speculative fix based on crash dump analysis.

Despite MediaControlPanelElement checking for document()->page() nullity in other places, it forgot one check in makeTransparent().

* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlPanelElement::makeTransparent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131505 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] accessibility/inline-continuations.html is failing
https://bugs.webkit.org/show_bug.cgi?id=98367

Unreviewed. Unskipped test, new port-specific expectations.

ATs for the GTK port are expecting only meaningful text objects, with
the text of spans getting folded into the parent object.

Patch by Joanmarie Diggs <jdiggs@igalia.com> on 2012-10-16

* platform/gtk/TestExpectations: Updated to unskip test.
* platform/gtk/accessibility/inline-continuations-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131506 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Unreviewed, try to fix the Apple Win build by forcing a rebuild of RenderingAllInOne.cpp.

* rendering/RenderingAllInOne.cpp:

Source/WebKit2: Unreviewed, revert previous WebKit2.def change. Exports shouldn't matter.

* win/WebKit2.def:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131507 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] add Mountain Lion baselines
https://bugs.webkit.org/show_bug.cgi?id=99505

Reviewed by Ojan Vafai.

This change adds a temporary 10.8/MountainLion-specific
expectations file for Chromium so that the bot can be green
while we are updating all the baselines and triaging failures.

Tools:

* Scripts/webkitpy/layout_tests/port/chromium_mac.py:
(ChromiumMacPort.expectations_files):
* Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
(ChromiumMacPortTest.test_ml_expectations):

LayoutTests:

* platform/chromium-mac-mountainlion/TestExpectations: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131508 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Accidental switch fall-through in DFG::FixupPhase
https://bugs.webkit.org/show_bug.cgi?id=96956
<rdar://problem/12313242>

Reviewed by Mark Hahnenberg.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131509 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] accessibility/radio-button-title-label.html is failing
https://bugs.webkit.org/show_bug.cgi?id=98374

Unreviewed. Unskipped test, new port-specific baseline.

New baseline for the GTK port. If there is a proper label tag, we
expect the widget to get its name/title from that label. The aria
labelledby property is exposed in addition to the label; not instead
of the label.

Patch by Joanmarie Diggs <jdiggs@igalia.com> on 2012-10-16

* platform/gtk/TestExpectations: Unskipped failing test.
* platform/gtk/accessibility/radio-button-title-label-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131510 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Inspector: Don't fire assert when inspecting an empty db
https://bugs.webkit.org/show_bug.cgi?id=99370

Reviewed by Vsevolod Vlasov.

* inspector/InspectorIndexedDBAgent.cpp:
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131511 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Some tests need rebaseline after r131497
https://bugs.webkit.org/show_bug.cgi?id=99511

Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131512 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] calculateInRegionScrollableAreasForPoint should use a ReadOnly HitTest
https://bugs.webkit.org/show_bug.cgi?id=99497

Patch by Mike Lattanzio <mlattanzio@rim.com> on 2012-10-16
Reviewed by Antonio Gomes.

Fix calculateInRegionScrollableAreasForPoint to use a ReadOnly
hit test to improve its performance.

* Api/InRegionScroller.cpp:
(BlackBerry::WebKit::InRegionScrollerPrivate::calculateInRegionScrollableAreasForPoint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131513 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a bug that we are using scaled damage rect for plugins inside an iframe
https://bugs.webkit.org/show_bug.cgi?id=99488

Patch by Min Qin <qinmin@chromium.org> on 2012-10-16
Reviewed by Adam Barth.

There is a bug with a previous webkit patch: https://bugs.webkit.org/show_bug.cgi?id=98468
In that patch, we incorrectly applied the main frame's scale factor to inner iframes.
However, the damageRect is not scaled inside an iFrame. So doing the intersect will retrieve wrong result here.
In WebPluginContainerImpl::calculateGeometry, the windowRect also does not apply main frame's scale factor.

* src/WebPluginContainerImpl.cpp:
(WebKit::WebPluginContainerImpl::paint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131514 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] REGRESSION(r131485): It broke the build
https://bugs.webkit.org/show_bug.cgi?id=99499

Unreviewed build (warning) fix.


* platform/graphics/texmap/TextureMapperShaderManager.cpp:
(WebCore::TextureMapperShaderProgram::getLocation):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131515 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Bytecode should not have responsibility for determining how to perform non-local resolves
https://bugs.webkit.org/show_bug.cgi?id=99349

Reviewed by Gavin Barraclough.

This patch removes lexical analysis from the bytecode generation.  This allows
us to delay lookup of a non-local variables until the lookup is actually necessary,
and simplifies a lot of the resolve logic in BytecodeGenerator.

Once a lookup is performed we cache the lookup information in a set of out-of-line
buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
etc, and allows the respective JITs to recreated optimal lookup code.

This is currently still a performance regression in LLInt, but most of the remaining
regression is caused by a lot of indirection that I'll remove in future work, as well
as some work necessary to allow LLInt to perform in line instruction repatching.
We will also want to improve the behaviour of the baseline JIT for some of the lookup
operations, however this patch was getting quite large already so I'm landing it now
that we've reached the bar of "performance-neutral".

* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::printStructures):
(JSC::CodeBlock::dump):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::visitStructures):
(JSC):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::shrinkToFit):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::addResolve):
(JSC::CodeBlock::addPutToBase):
(CodeBlock):
(JSC::CodeBlock::resolveOperations):
(JSC::CodeBlock::putToBaseOperation):
(JSC::CodeBlock::numberOfResolveOperations):
(JSC::CodeBlock::numberOfPutToBaseOperations):
(JSC::CodeBlock::addPropertyAccessInstruction):
(JSC::CodeBlock::globalObjectConstant):
(JSC::CodeBlock::setGlobalObjectConstant):
* bytecode/GlobalResolveInfo.h: Removed.
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
* bytecode/ResolveGlobalStatus.cpp:
(JSC::computeForStructure):
(JSC::ResolveGlobalStatus::computeFor):
* bytecode/ResolveGlobalStatus.h:
(JSC):
(ResolveGlobalStatus):
* bytecode/ResolveOperation.h: Added.
  The new types and logic we use to perform the cached lookups.
(JSC):
(ResolveOperation):
(JSC::ResolveOperation::getAndReturnScopedVar):
(JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
(JSC::ResolveOperation::getAndReturnGlobalVar):
(JSC::ResolveOperation::getAndReturnGlobalProperty):
(JSC::ResolveOperation::resolveFail):
(JSC::ResolveOperation::skipTopScopeNode):
(JSC::ResolveOperation::skipScopes):
(JSC::ResolveOperation::returnGlobalObjectAsBase):
(JSC::ResolveOperation::setBaseToGlobal):
(JSC::ResolveOperation::setBaseToUndefined):
(JSC::ResolveOperation::setBaseToScope):
(JSC::ResolveOperation::returnScopeAsBase):
(JSC::PutToBaseOperation::PutToBaseOperation):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::ResolveResult::checkValidity):
(JSC):
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::resolve):
(JSC::BytecodeGenerator::resolveConstDecl):
(JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
(JSC::BytecodeGenerator::emitResolve):
(JSC::BytecodeGenerator::emitResolveBase):
(JSC::BytecodeGenerator::emitResolveBaseForPut):
(JSC::BytecodeGenerator::emitResolveWithBaseForPut):
(JSC::BytecodeGenerator::emitResolveWithThis):
(JSC::BytecodeGenerator::emitGetLocalVar):
(JSC::BytecodeGenerator::emitInitGlobalConst):
(JSC::BytecodeGenerator::emitPutToBase):
* bytecompiler/BytecodeGenerator.h:
(JSC::ResolveResult::registerResolve):
(JSC::ResolveResult::dynamicResolve):
(ResolveResult):
(JSC::ResolveResult::ResolveResult):
(JSC):
(NonlocalResolveInfo):
(JSC::NonlocalResolveInfo::NonlocalResolveInfo):
(JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
(JSC::NonlocalResolveInfo::resolved):
(JSC::NonlocalResolveInfo::put):
(BytecodeGenerator):
(JSC::BytecodeGenerator::getResolveOperations):
(JSC::BytecodeGenerator::getResolveWithThisOperations):
(JSC::BytecodeGenerator::getResolveBaseOperations):
(JSC::BytecodeGenerator::getResolveBaseForPutOperations):
(JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
(JSC::BytecodeGenerator::getPutToBaseOperation):
* bytecompiler/NodesCodegen.cpp:
(JSC::ResolveNode::isPure):
(JSC::FunctionCallResolveNode::emitBytecode):
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(ByteCodeParser):
(InlineStackEntry):
(JSC::DFG::ByteCodeParser::handleGetByOffset):
(DFG):
(JSC::DFG::ByteCodeParser::parseResolveOperations):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileResolveOperations):
(DFG):
(JSC::DFG::canCompilePutToBaseOperation):
(JSC::DFG::canCompileOpcode):
(JSC::DFG::canInlineOpcode):
* dfg/DFGGraph.h:
(ResolveGlobalData):
(ResolveOperationData):
(DFG):
(PutToBaseOperationData):
(Graph):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::resolveOperationsDataIndex):
(Node):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::OSRExit):
* dfg/DFGOSRExit.h:
(OSRExit):
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCacheGetByID):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::resolveOperations):
(SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::putToBaseOperation):
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
(JIT):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_put_to_base):
(JSC):
(JSC::JIT::emit_resolve_operations):
(JSC::JIT::emitSlow_link_resolve_operations):
(JSC::JIT::emit_op_resolve):
(JSC::JIT::emitSlow_op_resolve):
(JSC::JIT::emit_op_resolve_base):
(JSC::JIT::emitSlow_op_resolve_base):
(JSC::JIT::emit_op_resolve_with_base):
(JSC::JIT::emitSlow_op_resolve_with_base):
(JSC::JIT::emit_op_resolve_with_this):
(JSC::JIT::emitSlow_op_resolve_with_this):
(JSC::JIT::emitSlow_op_put_to_base):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_put_to_base):
(JSC):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_init_global_const):
(JSC::JIT::emit_op_init_global_const_check):
(JSC::JIT::emitSlow_op_init_global_const_check):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_init_global_const):
(JSC::JIT::emit_op_init_global_const_check):
(JSC::JIT::emitSlow_op_init_global_const_check):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
(JSC):
* jit/JITStubs.h:
* llint/LLIntSlowPaths.cpp:
(LLInt):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LLIntSlowPaths.h:
(LLInt):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/JSScope.cpp:
(JSC::LookupResult::base):
(JSC::LookupResult::value):
(JSC::LookupResult::setBase):
(JSC::LookupResult::setValue):
(LookupResult):
(JSC):
(JSC::setPutPropertyAccessOffset):
(JSC::executeResolveOperations):
(JSC::JSScope::resolveContainingScopeInternal):
(JSC::JSScope::resolveContainingScope):
(JSC::JSScope::resolve):
(JSC::JSScope::resolveBase):
(JSC::JSScope::resolveWithBase):
(JSC::JSScope::resolveWithThis):
(JSC::JSScope::resolvePut):
(JSC::JSScope::resolveGlobal):
* runtime/JSScope.h:
(JSScope):
* runtime/JSVariableObject.cpp:
(JSC):
* runtime/JSVariableObject.h:
(JSVariableObject):
* runtime/Structure.h:
(JSC::Structure::propertyAccessesAreCacheable):
(Structure):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131516 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebaselines for r131503
https://bugs.webkit.org/show_bug.cgi?id=99516

Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131517 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Lint fixes for TestExpectations

Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131518 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, lint fixes for TestExpectations.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131519 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix lint error in chromium-android/TestExpectations.

* platform/chromium-android/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131520 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebaselines for r131503
https://bugs.webkit.org/show_bug.cgi?id=99516

Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131521 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: inspector/styles/styles-history.html is failing Text on win7
https://bugs.webkit.org/show_bug.cgi?id=99519

Unreviewed gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131522 268f45cc-cd09-0410-ab3c-d52691b4dbfc