Rewrite multithreaded filter job dispatching
https://bugs.webkit.org/show_bug.cgi?id=97500

Reviewed by Dean Jackson.

Source/WebCore:

This patch solves the problem of splitting up images into subregions for multithreaded
filters. This fixes the way we partition the image array into equal-sized chunks.
If we have an array of length N and want to split it into K chunks, we calculate:
  int jobSize = N / K; // integer division, so this is floored
  int jobSizeExtra = N % K; // modulus produces the remainder
We then split the array into jobSizeExtra number of jobs with size jobSize + 1
and (K - jobSizeExtra) number of jobs with size jobSize. This pattern
is used in each of the 5 filters in this patch.

This patch primarily fixes an error in FEMorphology::platformApply where
the image array was partitioned into (1 + (N / K)) pieces with the last job
taking the remainder. Unfortunately, this can cause overruns in the 2nd-to-last job.
Consider N = 2373 and K = 64 jobs. Job 0 would take indices 0...38, job 1 would take
38...76, etc. Unfortunately the 62nd job takes 2356...2394 which overruns.

To prevent similar issues elsewhere this patch updates all of the filters
to use the same pattern as FEMorphology.

Test: svg/filters/feMorphology-crash.html

* platform/graphics/filters/FEConvolveMatrix.cpp:
(WebCore::FEConvolveMatrix::platformApplySoftware):
* platform/graphics/filters/FEGaussianBlur.cpp:
(WebCore::FEGaussianBlur::platformApply):
* platform/graphics/filters/FELighting.cpp:
(WebCore::FELighting::platformApplyGeneric):
* platform/graphics/filters/FEMorphology.cpp:
(WebCore::FEMorphology::platformApply):

    Some special care is taken for Gaussian Blur because there is an
    extraHeight parameter for sampling outside the image's dimensions.
    This means we use the same partitioning algorithm but add
    extraHeight padding on the lower and upper bounds.

* platform/graphics/filters/FETurbulence.cpp:
(WebCore::FETurbulence::platformApplySoftware):

LayoutTests:

Add test that shows the morphology filter no longer crashes.
Note: this is only reliably reproducable when run with libgmalloc.

* svg/filters/feMorphology-crash-expected.txt: Added.
* svg/filters/feMorphology-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129796 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Unskip a couple of passing tests.

* platform/efl/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129797 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix issue with ClassList which was hitting an assert in debug mode
https://bugs.webkit.org/show_bug.cgi?id=97820

Reviewed by Ojan Vafai.

http://trac.webkit.org/changeset/129779 hit asserts in debug mode when trying to use fastGetAttribute on an SVG element.

No new tests. No change in behavior.

* bindings/v8/V8Binding.h:
(WebCore::toNativeArguments):
* html/ClassList.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129798 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium][Mac] Move Mac-specific theme functions out of PlatformSupport
https://bugs.webkit.org/show_bug.cgi?id=97817

Reviewed by Adam Barth.

Part of a refactoring series. See tracking bug 82948. We're calling WebThemeEngine directly now instead of proxying through PlatformSupport.

Source/WebCore:

* platform/chromium/PlatformSupport.h:
(PlatformSupport):
* platform/chromium/ScrollbarThemeChromiumMac.mm:
(WebCore::scrollbarStateToThemeState):
(WebCore):
(WebCore::ScrollbarThemeChromiumMac::paint):

Source/WebKit/chromium:

* src/AssertMatchingEnums.cpp:
* src/PlatformSupport.cpp:
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
platform/chromium/fast/forms/date/date-suggestion-picker-appearance-rtl.html is flaky on Mac debug
and is passing on all the other bots.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129800 268f45cc-cd09-0410-ab3c-d52691b4dbfc