fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=94538

Reviewed by Mark Hahnenberg.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126082 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move mainWorldContext() from V8Proxy to ScriptController
https://bugs.webkit.org/show_bug.cgi?id=94453

Reviewed by Adam Barth.

This patch moves mainWorldContext() from V8Proxy to ScriptController.
In addition, this patch removes dependency on V8Proxy from WorldContextHandle.

No tests. No change in behavior.

Source/WebCore:

* bindings/v8/DOMTransaction.cpp:
(WebCore::DOMTransaction::callFunction):
* bindings/v8/NPV8Object.cpp:
(WebCore::toV8Context):
* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::evaluate):
(WebCore::ScriptController::mainWorldContext):
(WebCore):
(WebCore::ScriptController::bindToWindowObject):
(WebCore::createScriptObject):
(WebCore::ScriptController::createScriptObjectForPluginElement):
* bindings/v8/ScriptController.h:
(ScriptController):
* bindings/v8/ScriptState.cpp:
(WebCore::mainWorldScriptState):
* bindings/v8/V8LazyEventListener.cpp:
(WebCore::V8LazyEventListener::prepareListenerObject):
* bindings/v8/V8Proxy.cpp:
(WebCore::V8Proxy::context):
(WebCore::toV8Context):
* bindings/v8/V8Proxy.h:
(V8Proxy):
* bindings/v8/WorldContextHandle.cpp:
(WebCore::WorldContextHandle::adjustedContext):
* bindings/v8/WorldContextHandle.h:
(WebCore):
(WorldContextHandle):

Source/WebKit/chromium:

* src/WebFrameImpl.cpp:
(WebKit::WebFrameImpl::mainWorldScriptContext):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126083 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS Masking and CSS Filters applied in wrong order
https://bugs.webkit.org/show_bug.cgi?id=94354

Reviewed by Dean Jackson.

Source/WebCore:

According to the Filter Effects spec, the order should be first filters, then masking and clipping.
Changed the order on applying the different effects in RenderLayer.

Test: css3/filters/filter-mask-clip-order.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::paintLayerContents): First filter, then mask and clip the content.

LayoutTests:

The test checks the correct order on applying CSS Masking, Filter Effects and CSS Clipping.
According to the Filter Effects spec, the order should be first filters, then masking and clipping.

* css3/filters/filter-mask-clip-order-expected.html: Added.
* css3/filters/filter-mask-clip-order.html: Added.
* css3/filters/resources/mask.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move clearForClose() and clearForNavigation() from V8Proxy to ScriptController
https://bugs.webkit.org/show_bug.cgi?id=94459

Reviewed by Adam Barth.

To kill V8Proxy, we can move clearForClose() and
clearForNavigation() from V8Proxy to ScriptController.

No tests. No change in behavior.

Source/WebCore:

* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::~ScriptController):
(WebCore::ScriptController::resetIsolatedWorlds):
(WebCore):
(WebCore::ScriptController::clearForClose):
(WebCore::ScriptController::clearForNavigation):
(WebCore::ScriptController::clearWindowShell):
* bindings/v8/ScriptController.h:
(ScriptController):
* bindings/v8/V8Proxy.cpp:
(WebCore::V8Proxy::~V8Proxy):
(WebCore::V8Proxy::handleOutOfMemory):
* bindings/v8/V8Proxy.h:
(V8Proxy):

Source/WebKit/chromium:

* src/FrameLoaderClientImpl.cpp:
(WebKit::FrameLoaderClientImpl::detachedFromParent3):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126086 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2d.imageData.object.wrap.html has wrong expectations
https://bugs.webkit.org/show_bug.cgi?id=94089

Patch by Dominik Röttsches <dominik.rottsches@intel.com> on 2012-08-20
Reviewed by Kenneth Rohde Christiansen.

Updating and renaming the test to match new version in W3C approved tests.

* canvas/philip/tests/2d.imageData.object.clamp-expected.txt: Renamed from LayoutTests/canvas/philip/tests/2d.imageData.object.wrap-expected.txt.
* canvas/philip/tests/2d.imageData.object.clamp.html: Renamed from LayoutTests/canvas/philip/tests/2d.imageData.object.wrap.html.
* platform/chromium/TestExpectations: Unskipping.
* platform/efl/Skipped: Unskipping.
* platform/gtk/TestExpectations: Unskipping.
* platform/mac/Skipped: Unskipping.
* platform/qt/Skipped: Unskipping.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126087 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebGL] OES_vertex_array_object is not correctly un/binding or deleting
https://bugs.webkit.org/show_bug.cgi?id=94029

Reviewed by Ken Russell.

When the currently bound vertex array is deleted, the specification says that
the default object should be bound in its place. Also, binding a null object
as a vertex array was not actually clearing the bound object at the GL layer.
And lastly, it should not be possible to bind a deleted vertex array.

The test case for this is the public Khronos WebGL conformance suite, in particular:
conformance/extensions/oes-vertex-array-object.html

* html/canvas/OESVertexArrayObject.cpp:
(WebCore::OESVertexArrayObject::deleteVertexArrayOES): Check if the deleted array is
currently bound, and if so, unbind it.
(WebCore::OESVertexArrayObject::bindVertexArrayOES): Make sure never to bind an
array that has been marked as deleted.
* platform/graphics/opengl/Extensions3DOpenGL.cpp:
(WebCore::Extensions3DOpenGL::bindVertexArrayOES): Remove the null check on bind. We
do need to call glBindVertexArrayAPPLE with a null value in order to clear it.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126088 268f45cc-cd09-0410-ab3c-d52691b4dbfc