REGRESSION(SUBPIXEL_LAYOUT) Composited layers can cause one pixel shifts
https://bugs.webkit.org/show_bug.cgi?id=115304

Reviewed by David Hyatt.

Source/WebCore:

Accelerated layers can cause blocks at subpixel offsets to shift because
accumulated subpixel offsets are lost between each layers.

To solve this layer bounds are now calculated in LayoutUnits, and their
subpixel offset saved so it can be used to ensure correct pixel-snapping
during painting.

Test: fast/sub-pixel/sub-pixel-composited-layers.html

* WebCore.exp.in:
* inspector/InspectorLayerTreeAgent.cpp:
(WebCore::InspectorLayerTreeAgent::buildObjectForLayer):
* platform/graphics/LayoutPoint.h:
(WebCore::LayoutPoint::fraction):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::setupClipPath):
(WebCore::RenderLayer::setupFilters):
(WebCore::RenderLayer::paintLayerContents):
(WebCore::RenderLayer::calculateLayerBounds):
* rendering/RenderLayer.h:
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateCompositedBounds):
(WebCore::RenderLayerBacking::updateAfterWidgetResize):
(WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
(WebCore::RenderLayerBacking::resetContentsRect):
(WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
(WebCore::RenderLayerBacking::contentsBox):
(WebCore::RenderLayerBacking::backgroundBox):
(WebCore::RenderLayerBacking::paintIntoLayer):
(WebCore::RenderLayerBacking::paintContents):
(WebCore::RenderLayerBacking::compositedBounds):
(WebCore::RenderLayerBacking::setCompositedBounds):
* rendering/RenderLayerBacking.h:
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::logLayerInfo):
(WebCore::RenderLayerCompositor::calculateCompositedBounds):
* rendering/RenderLayerCompositor.h:
* rendering/RenderTreeAsText.cpp:
(WebCore::operator<<):
* rendering/RenderTreeAsText.h:

LayoutTests:

* fast/sub-pixel/sub-pixel-composited-layers-expected.html: Added.
* fast/sub-pixel/sub-pixel-composited-layers.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154009 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build.

* WebCore.exp.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154010 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Harden executeConstruct against incorrect return types from host functions
https://bugs.webkit.org/show_bug.cgi?id=119757

Reviewed by Mark Hahnenberg.

Add logic to guard against bogus return types.  There doesn't seem to be any
class in webkit that does this wrong, but the typed array stubs in debug JSC
do exhibit this bad behaviour.

* interpreter/Interpreter.cpp:
(JSC::Interpreter::executeConstruct):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154011 268f45cc-cd09-0410-ab3c-d52691b4dbfc
NodeList.item() does not behave according to specification
https://bugs.webkit.org/show_bug.cgi?id=119722

Reviewed by Darin Adler.

Source/WebCore:

Make NodeList.item() indexed getter behave according to specification:
http://dom.spec.whatwg.org/#nodelist

Namely, we no longer throw if the index is negative (meaning the
[IsIndex] extended attribute is dropped) and the argument is now
mandatory.

This behavior is consistent with both IE10 and Firefox and since
recently Blink.

Test: fast/dom/nodelist-item-parameter.html

* dom/NodeList.idl:

LayoutTests:

Add a layout test to check that the NodeList.item() indexed getter's
argument is properly validated. Also, update the following test case now
that the argument is mandatory:
fast/dom/non-numeric-values-numeric-parameters.html

* fast/dom/nodelist-item-parameter-expected.txt: Added.
* fast/dom/nodelist-item-parameter.html: Added.
* fast/dom/non-numeric-values-numeric-parameters-expected.txt:
* fast/dom/script-tests/non-numeric-values-numeric-parameters.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154012 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Section's collapsed borders painted in wrong place in rtl tables
https://bugs.webkit.org/show_bug.cgi?id=119691

Reviewed by Darin Adler.

Source/WebCore:

Table row-groups can be RTL too, so look to the section rather than the
table when deciding the direction of a row. The section will inherit the
table's direction if it doesn't override it.

Test: fast/table/paint-collapsed-borders-rtl-section.html

* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::hasStartBorderAdjoiningTable):
(WebCore::RenderTableCell::hasEndBorderAdjoiningTable):

LayoutTests:

* fast/table/paint-collapsed-borders-rtl-section-expected.html: Added.
* fast/table/paint-collapsed-borders-rtl-section.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154013 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Closing inspector window crashes wk
https://bugs.webkit.org/show_bug.cgi?id=110865

Reviewed by Carlos Garcia Campos.

The previous fix for the inspector window crash breaks some unit
tests. This one goes back to the original code and only moves the
actual deletion of priv->corePage to the end of the function.

* webkit/webkitwebview.cpp:
(webkit_web_view_dispose):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154014 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Various media tests spew "CGContextScaleCTM: invalid context 0x0" errors
https://bugs.webkit.org/show_bug.cgi?id=119490

New versions of WKSI that fix a bug that caused spew about null CGContexts,
and update WebKitSystemInterface.h.

* WebKitSystemInterface.h:
* libWebKitSystemInterfaceLion.a:
* libWebKitSystemInterfaceMountainLion.a:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154015 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[sh4] Prepare baseline JIT for DFG_JIT implementation.
https://bugs.webkit.org/show_bug.cgi?id=119758

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-08-13
Reviewed by Oliver Hunt.

* assembler/MacroAssemblerSH4.h:
    - Introduce a loadEffectiveAddress function to avoid code duplication.
    - Add ASSERTs and clean code.
* assembler/SH4Assembler.h:
    - Prepare DFG_JIT implementation.
    - Add ASSERTs.
* jit/JITStubs.cpp:
    - Add SH4 specific call for assertions.
* jit/JITStubs.h:
    - Cosmetic change.
* jit/JITStubsSH4.h:
    - Use constants to be more flexible with sh4 JIT stack frame.
* jit/JSInterfaceJIT.h:
    - Cosmetic change.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154016 268f45cc-cd09-0410-ab3c-d52691b4dbfc