Fix browser rendering issue: pure color tiles are rendered black

The “pure color tile” optimization finds the pure-color tiles and
then draws the tiles simply with the color (otherwise the texture).

But the RGBA color pointer type is char, which may overflow when
the value is larger than 127. In such case, the tiles in question
are rendered black, because of the wrong color. This bug is fixed
by defining the pointer as unsigned char.

Change-Id: I5c7214423fa6961e707bde72f0e18c610374745d
Author: Yuyang Du <yuyang.du@intel.com>
Signed-off-by: Yuyang Du <yuyang.du@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Fix memory leak caused by CSSRuleList wrapper

Accessing cssrulelist in javascript will create a new
CSSRuleList object and wrapper JS object. The wrapper
JS object will be added into hidden array in parent JS
object which is alive during the whole execution. Thus
memory leak happens (CSSRuleList in webkit, wrapper object
and weak global handle in v8).

Cherry pick 2 patches from upstream solves the problem:

http://trac.webkit.org/changeset/90949

This patch changes hidden reference from array to named
property. So new wrapper will replace old wrappper. But the
memory leak still exists because the CSSRuleList wrapper
will be added into an object group of current document. So
they will still be alive during execution.

http://trac.webkit.org/changeset/91256

This patch avoids to adding CSSRuleList wrapper into document
object group. Combined with the first patch, it can resolve
the memory leak problem.

Change-Id: Icb523db52963726f27b6c02596822cfb6e8d5049
Author: Vitaly Repeshko <vitalyr@chromium.org>
Signed-off-by: Xi Qian <xi.qian@intel.com>
Signed-off-by: Shuo Gao <shuo.gao@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Author-tracking-BZ: 32630
Crash on Orange media portal

Visit orange.deezer.com, press tab marked "My Music".
Browser crashes every time.

Pressing the button will trigger a re-layout of the page.
This in turn will cause some rendering nodes of type
RenderLayer to be removed from the rendering tree.
When such a node is removed, it is important to also
update certain lists in ancestor nodes that may hold references
to this node. A node that may hold such a reference is
identified as being a "stacking context".

However, in Android, when the symbol ENABLE_COMPOSITED_FIXED_ELEMENTS
is defined, the definition of what is a stacking context
is expanded. In this case, a node that is a stacking context
and holds references to descendants, changes one of the conditions
that form part of Android's expanded stacking context definition.
So, now it is no longer a stacking context, but the reference list
is not deleted/updated. When the descendant node is removed a
search for an ancestral stacking context is made, but it will
not find this node since it is no longer a stacking context.

The solution is to make sure that the list of references is
updated/cleared whenever the node changes a condition that
may cause its status as a stacking context to also change.

Change-Id: If5a7b63715020bc3d23749a7c09003a86d90e28d
Remove inconsistency between HistoryItem writing/reading

Fixes inconsistent writing of HistoryItem formData
for the case when formData is not null,
but it gets flattened and saved as empty string.
FormData identifier also gets written in that case,
which creates problem on HistoryItem reading,
when parser does not expect to meet form identifier
after it reads zero as FormData size.

Change-Id: I77cf00b5b2a0f2a7cf4355d1bc1b8d4830ac1afb
Merge remote-tracking branch 'cm/jellybean' into v880