[Qt] Fix minor memory leak in slot execution

Reviewed by Allan Sandfeld Jensen.

Don't leak the "length" string when executing a slot in JavaScript.

* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::QtConnectionObject::execute):

Change-Id: I7e7cd3c0bbe18e5345d9f024a95284c2c8ef09e9
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Potential use-after-free with an event fired at a HTMLMediaElement which is currently being deleted

https://bugs.webkit.org/show_bug.cgi?id=117466

Reviewed by Oliver Hunt.

Merge https://chromium.googlesource.com/chromium/blink/+/f4200a0093b3d9376f703961615359ec7fb712b4

If an event is created using as target an HTMLMediaElement which is
currently being deleted it becomes a heap-use-after free situation.

The GenericEventQueue instance is already owned by the HTMLMediaElement,
and there already is an underlying mechanism to set the target of the
event to NULL, if their target is owner of the queue.

In order to avoid creating this reference in the first place, we enqueue
the event with a NULL target to defer the refcount increment until the
timer for dispatching the event happens (which won't happen at all if
garbage collection is already destroying the objects).

Source/WebCore:

Test: media/track/media-element-enqueue-event-crash.html

* dom/GenericEventQueue.cpp:
(WebCore::GenericEventQueue::enqueueEvent): Don't ASSERT if the event has no target.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement): Close the event queue so it won't try to
    dispatch any pending events.
(WebCore::HTMLMediaElement::scheduleEvent): Don't set the event target, it will happen just
    prior to event dispatch.
(WebCore::HTMLMediaElement::stop): Close the event queue.

Change-Id: I2b17e9080516036d2a271b204d0925a1a3fb2930
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
If ImageLoader's loadEventSender or errorEventSender fires after document is detached, the document will be leaked.

https://bugs.webkit.org/show_bug.cgi?id=106394

Patch by Yongjun Zhang <yongjun_zhang@apple.com> on 2013-01-09
Reviewed by Alexey Proskuryakov.

ImageLoader's loadEventSender and errorEventSender schedule event dispatching in separate timers and refs
the Element in updatedHasPendingEvent.  If the Document is detached before either eventSender dispatches,
we would leak the Document since we bail out early in dispatchPendingLoadEvent or dispatchPendingErrorEvent,
without deref-ing the Element itself.

No new tests.  Verified manually by using heap tool to count the living HTMLDocuments.

* loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingLoadEvent): also call updatedHasPendingEvent to deref the Element if
            the document is detached.
(WebCore::ImageLoader::dispatchPendingErrorEvent): ditto.

Change-Id: Ie1102e0659bf37f4cf0002ce1d2ee259c6840921
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139209 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[WK1] NPStream::headers not initialized

https://bugs.webkit.org/show_bug.cgi?id=119574

Reviewed by Alexey Proskuryakov.

Initialize the header field. According to user feedback that should solve some
cases of random crashes when loading plugins on Mac and Windows.

* plugins/PluginStream.cpp:
(WebCore::PluginStream::PluginStream):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153828 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Task-number: QTBUG-32181
Change-Id: I9ae19b54a1b08615a24a782137285ae4be5ac915
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
[Qt] Images are down-scaled badly

https://bugs.webkit.org/show_bug.cgi?id=119263

Reviewed by Jocelyn Turcotte.

QPainter only does bilinear filtering, which means it will downscaling beyond
0.5x will start skipping pixel and start to degrade the end result. Scaling in
QImage and QPixmap however uses a better but much more expensive sampling that
counts all pixels.

To get the high quality downscaling we must therefore prescale the images before
painting them. To avoid a performance impact on repeated paints the prescaled
image are saved in the QPixmapCache.

* platform/graphics/qt/ImageQt.cpp:
(WebCore::BitmapImage::draw):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153522 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Task-number: QTBUG-30155
Change-Id: I8b07de1d7415bc4e2dea565df92739e3ff2014b4
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] REGRESSION(r) Two pixel result fail after r153522

https://bugs.webkit.org/show_bug.cgi?id=119392

Reviewed by Jocelyn Turcotte.

Consider scaling transform on the painter to determine final destination size.

Covered by existing tests.

* platform/graphics/qt/ImageQt.cpp:
(WebCore::prescaleImageIfRequired):
(WebCore::BitmapImage::draw):

Change-Id: I631e0925abaf814c95f709c18919f127c8b41503
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153790 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Merge remote-tracking branch 'origin/release' into stable

Change-Id: I8b40ab3b0302d45a96c64cf3af34725749f00878
Merge remote-tracking branch 'origin/stable' into dev

Change-Id: If43a2a4465fc0f236eb3d20d2dc2e2de81955531