GC race condition in OpaqueJSClass::prototype
https://bugs.webkit.org/show_bug.cgi?id=86034

Reviewed by Filip Pizlo.

The bug here is basically:
    if (weakref) weakref->method()
where a GC may occur between the if & the method call.

* API/JSClassRef.cpp:
(OpaqueJSClass::prototype):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116575 268f45cc-cd09-0410-ab3c-d52691b4dbfc
GC race condition in OpaqueJSClass::prototype
https://bugs.webkit.org/show_bug.cgi?id=86034

Build fix.

* API/JSClassRef.cpp:
(OpaqueJSClass::prototype):
    - Eeeep, landed bad version of patch!



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116578 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Speed up some parts of TileCache drawing
https://bugs.webkit.org/show_bug.cgi?id=86033
<rdar://problem/10919373>

Reviewed by Sam Weinig.

* platform/graphics/ca/mac/TileCache.mm:
(WebCore::TileCache::tileCoverageRect):
If we can't have scrollbars, there's not much need to extend the tile coverage rect outside of the visible rect, since it's
unlikely that we'll do any form of scrolling here.

(WebCore::TileCache::revalidateTiles):
Don't update the tile layer frame if it's big enough to contain the tile size. Also, if there are no new tiles created,
don't call platformCALayerDidCreateTiles since that will trigger an extra layer flush.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116579 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Fix issue where V8BindingPerContextData could keep the context object alive
https://bugs.webkit.org/show_bug.cgi?id=86036

Reviewed by Kentaro Hara.

This is a partial revert of http://trac.webkit.org/changeset/114320/. This keeps
the layout tests that were introduced since it turns out that
http://trac.webkit.org/changeset/114989 fixes the tests too.

Covered by: http/tests/security/isolatedWorld/context-destroy.html

* bindings/v8/V8IsolatedContext.cpp:
(WebCore::V8IsolatedContext::destroy):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116580 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] LayoutTestController should use ENABLE guards for some features
https://bugs.webkit.org/show_bug.cgi?id=86030

Reviewed by Eric Seidel.

These features are disabled on OS(ANDROID) and so shouldn't be compiled
when the feature is off.

* DumpRenderTree/chromium/LayoutTestController.cpp:
(LayoutTestController::LayoutTestController):
* DumpRenderTree/chromium/LayoutTestController.h:
(LayoutTestController):
* DumpRenderTree/chromium/TestShell.h:
(TestShell):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116581 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r116573.
http://trac.webkit.org/changeset/116573
https://bugs.webkit.org/show_bug.cgi?id=86038

Broke the Chromium Mac compile (Requested by ojan_gardening on
#webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-05-09

* public/WebPlugin.h:
(WebPlugin):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116582 268f45cc-cd09-0410-ab3c-d52691b4dbfc
It should be possible to get useful debug logging from the JIT memory allocator
https://bugs.webkit.org/show_bug.cgi?id=86042

Reviewed by Geoff Garen.

Source/JavaScriptCore: 

* jit/ExecutableAllocator.h:

Source/WTF: 

* wtf/MetaAllocator.cpp:
(WTF::MetaAllocator::findAndRemoveFreeSpace):
(WTF::MetaAllocator::addFreeSpace):
(WTF::MetaAllocator::dumpProfile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116583 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Subresources loaded after a reload completes shouldn't be revalidated.
https://bugs.webkit.org/show_bug.cgi?id=84614

Source/WebCore:

Based on patch by Darin Fisher.

Reviewed by Darin Fisher.

Tests: http/tests/cache/loaded-from-cache-after-reload-within-iframe.html
       http/tests/cache/loaded-from-cache-after-reload.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::checkLoadCompleteForThisFrame): Reset m_loadType after the load completes.

LayoutTests:

Tests by Darin Fisher.

Reviewed by Darin Fisher.

* http/tests/cache/loaded-from-cache-after-reload-expected.txt: Added.
* http/tests/cache/loaded-from-cache-after-reload-within-iframe-expected.txt: Added.
* http/tests/cache/loaded-from-cache-after-reload-within-iframe.html: Added.
* http/tests/cache/loaded-from-cache-after-reload.html: Added.
* http/tests/cache/resources/loaded-from-cache-after-reload-within-iframe-subframe.html: Added.
* http/tests/cache/resources/random-cached.cgi: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116584 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Cairo] GLContextGLX releases the context with an uninitialized display
https://bugs.webkit.org/show_bug.cgi?id=86039

Patch by Martin Robinson <mrobinson@igalia.com> on 2012-05-09
Reviewed by Philippe Normand.

No new tests. This does not change behavior on most machines, but has
the potential to prevent a pretty nasty crash on others.

Use the shared display to release GLX contexts instead of the uninitialized
m_display member.

* platform/graphics/glx/GLContextGLX.cpp:
(WebCore::GLContextGLX::~GLContextGLX): Release the display with the shared
display.
* platform/graphics/glx/GLContextGLX.h:
(GLContextGLX): Remove the m_display member.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Build fix after r116464.

`ulong' is a type defined by glibc, so it is not very
portable. Use `unsigned long' instead.

* DumpRenderTree/efl/EventSender.cpp:
(DelayedEvent::DelayedEvent):
(DelayedEvent):
(leapForwardCallback):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116586 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Don't draw when canDraw() is false
https://bugs.webkit.org/show_bug.cgi?id=85829

Reviewed by Adrienne Walker.

Source/WebCore:

This is based on the work of Daniel Sievers in bug
https://bugs.webkit.org/show_bug.cgi?id=82680. When canDraw() is false,
we should not call drawLayers() or prepareToDraw() in both Single- and
Multi-Threaded mode.

drawLayers() is crashing in single threaded mode, and this attempts to
prevent it from being called with invalid state. While making it behave
properly in single-threaded mode, it seems appropriate to unrevert the
parts of 82680 that made threaded mode behave similarly appropriately.

A single-threaded test is not included since LTHTests is unable to run
in single-threaded mode at this time (pending work from Ian Vollick). So
we test in threaded mode only with a note to include a single thread
version.

Tests: CCLayerTreeHostTestCanDrawBlocksDrawing.runMultiThread

* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
(WebCore::CCLayerTreeHostImpl::prepareToDraw):
(WebCore::CCLayerTreeHostImpl::drawLayers):
* platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
(WebCore::CCSingleThreadProxy::doComposite):
* platform/graphics/chromium/cc/CCThreadProxy.cpp:
(WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):

Source/WebKit/chromium:

* tests/CCLayerTreeHostImplTest.cpp:
(WebKitTests::CCLayerTreeHostImplTest::CCLayerTreeHostImplTest):
(WebKitTests::TEST_F):
* tests/CCLayerTreeHostTest.cpp:
(WTF):
(CCLayerTreeHostTestCanDrawBlocksDrawing):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::CCLayerTreeHostTestCanDrawBlocksDrawing):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::beginTest):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::commitCompleteOnCCThread):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::drawLayersOnCCThread):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::didCommitAndDrawFrame):
(WTF::CCLayerTreeHostTestCanDrawBlocksDrawing::afterTest):
(WTF::TEST_F):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Android needs to swizzle pixel dumps in order to get the same hash as other platforms
https://bugs.webkit.org/show_bug.cgi?id=86040

Reviewed by Kent Tamura.

* DumpRenderTree/chromium/TestShell.cpp:
(TestShell::dumpImage):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116588 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] MockWebSpeechInputController.cpp should be guarded by ENABLE(INPUT_SPEECH)
https://bugs.webkit.org/show_bug.cgi?id=86041

Reviewed by Eric Seidel.

* DumpRenderTree/chromium/MockWebSpeechInputController.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116589 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Android's DRT doesn't want to build WebUserMediaClientMock
https://bugs.webkit.org/show_bug.cgi?id=86045

Reviewed by Eric Seidel.

* DumpRenderTree/DumpRenderTree.gypi:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116590 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix clang build of MarkupTokenBase.h
Merge remote-tracking branch 'upstream/master' into mdv