DFGStructureHoistingPhase SetLocal assumes StructureTransitionWatchpoint has a structure set
https://bugs.webkit.org/show_bug.cgi?id=97810

Reviewed by Mark Hahnenberg.

No tests because this can't happen in ToT: the structure check hoisting phase runs before any
CFA or folding, so the only StructureTransitionWatchpoints it will see are the ones inserted
by the parser. But the parser will only insert StructureTransitinWatchpoints on constants, which
will not be subject to SetLocals.

Still, it would be good to fix this in case things changed.

* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash re-entering Document layout with frame flattening enabled
https://bugs.webkit.org/show_bug.cgi?id=97841

Reviewed by Kenneth Rohde Christiansen.

Source/WebCore:

Walking up to parent FrameViews when doing a frame-flattening
layout should walk via the Frame tree, not the Widget hierarchy.
Walking via the Frame tree ensures that we don't walk up to the
root Frame when laying out a subframe that is in the page cache.
That's bad, because the root Frame is reused for the new
page, and laying it out from a frame in the page cache causes
re-entrant layout.

Test: plugins/frameset-with-plugin-frame.html

* page/FrameView.cpp:
(WebCore::FrameView::parentFrameView):

LayoutTests:

Test that navigates from one frameset to another frameset, where
one of the subframes contains a plugin.

* plugins/frameset-with-plugin-frame-expected.txt: Added.
* plugins/frameset-with-plugin-frame.html: Added.
* plugins/resources/frame-with-plugin-subframe.html: Added.
* plugins/resources/target-frameset-frame.html: Added.
* plugins/resources/target-frameset.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129944 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Chromium should respect 'text-rendering:geometricPrecision' by disabling hinting.
https://bugs.webkit.org/show_bug.cgi?id=97932

Patch by Ben Wagner <bungeman@chromium.org> on 2012-09-28
Reviewed by Stephen White.

When text-redering:geometricPrecision css property is present, the specification states that hinting should be disabled. This change does so.

This also provides users a more stable and sane means of achieving the result webkit-font-smoothing:antialiased has been providing by accident.
See http://crbug.com/152304 .

* platform/graphics/skia/FontSkia.cpp:
(WebCore::setupPaint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129945 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] WebFrameImpl::m_frame is redundant now that WebFrameImpl inherits from FrameDestructionObserver
https://bugs.webkit.org/show_bug.cgi?id=97934

Reviewed by James Robinson.

After http://trac.webkit.org/changeset/129910, WebFrameImpl inherits
from FrameDestructionObserver, which means it no longer need to manage
its own weak pointer to WebCore::Frame.

* src/FrameLoaderClientImpl.cpp:
(WebKit::FrameLoaderClientImpl::frameLoaderDestroyed):
* src/WebFrameImpl.cpp:
(WebKit::WebFrameImpl::WebFrameImpl):
(WebKit::WebFrameImpl::setWebCoreFrame):
* src/WebFrameImpl.h:
(WebKit::WebFrameImpl::frameView):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129947 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION in m_graph[tailNodeIndex].op() == Flush || m_graph[tailNodeIndex].op() == SetLocal on plus.google.com
https://bugs.webkit.org/show_bug.cgi?id=97656

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

There were two bugs here:
        
1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,
   rather than the last, of the GetLocals into the vars-at-tail table.
        
2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the
   vars-at-tail table, when for captured variables only the last of those should be.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getLocal):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests: 

* fast/js/dfg-redundant-load-of-captured-variable-proven-constant-expected.txt: Added.
* fast/js/dfg-redundant-load-of-captured-variable-proven-constant.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-redundant-load-of-captured-variable-proven-constant.js: Added.
(o.f):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129948 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Unreviewed rebaseline for svg/custom/clip-mask-negative-scale.svg

* platform/chromium-mac-snowleopard/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium-mac/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium-win/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium/svg/custom/clip-mask-negative-scale-expected.txt: Renamed from LayoutTests/platform/chromium-linux/svg/custom/clip-mask-negative-scale-expected.txt.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129949 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add canvas to set of elements that do not allow style sharing in order
to provoke RenderLayer creation
https://bugs.webkit.org/show_bug.cgi?id=97013

Unreviewed expectations update.

* platform/chromium-mac/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-mac/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-win/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-win/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-win/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-win/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mark this test as Missing since it has no png on any platform.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129951 268f45cc-cd09-0410-ab3c-d52691b4dbfc