Workaround for MSVC 2012 64 bit optimizer bug.

Having optimization turned on for the VS 2012 build causes a crash
in RenderTableSection::paintObject. The workaround for this is to
turn optimization off for this method until a fix in the compiler
has been provided.

This is tracked in bug https://bugs.webkit.org/show_bug.cgi?id=112900
for the upstream version of WebKit.

Please be aware that this is a work around for QtWebKit and did not go
through the WebKit review process and is therefore not part of WebKit
trunk as of now.

Task-number: QTBUG-30117
Change-Id: I76139eaa4c0f07de2d90d197c0b07ef4a576e585
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Flash objects won't load until scrolling page

https://bugs.webkit.org/show_bug.cgi?id=110149

Reviewed by Simon Hausmann.

Revert r134222. The issue from bug 101836 is no longer reproducable,
and the fix was causing flash objects to not load properly.

* plugins/PluginPackage.cpp:
(WebCore::PluginPackage::determineQuirks):

Change-Id: If204d409a6d425022a4f7d21135803bb6f4c309d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144191 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
QML WebView asserts when double clicking a link https://bugs.webkit.org/show_bug.cgi?id=113329

Remove an erroneous assert which is no longer valid if
mouse gestures are enabled.

Task-number: QTBUG-30288
Change-Id: I3c5dc65d55790b1e97924fe674d26e9587557d92
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Fails to start QtWebProcess.exe if installed in a path containing spaces https://bugs.webkit.org/show_bug.cgi?id=113328

We use QProcess::start() with a commandline string to start the web process
and the string is treated by QProcess as a whitespace delimeted list of the
command and the arguments, thus we have to escape the path to the web process
binary so that if the path contains spaces we still run the appropriate command.

* UIProcess/Launcher/qt/ProcessLauncherQt.cpp:
(WebKit::ProcessLauncher::launchProcess):

Task-number: QTBUG-30249
Change-Id: Ic72cc58d57201381e0b269ff26edf97fea998bbe
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled

https://bugs.webkit.org/show_bug.cgi?id=108991

Reviewed by Oliver Hunt.

Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
may step on calleeGPR is it happen to be nonArgGPR2.

* dfg/DFGRepatch.cpp:
(JSC::DFG::dfgLinkClosureCall):

Change-Id: I2d27a111ae1edbfea9335f3a06c5cc53e065a673
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141951 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
ASSERTION FAILED: m_repaintRect == renderer()->clippedOverflowRectForRepaint(renderer()->containerForRepaint()) after r135816
https://bugs.webkit.org/show_bug.cgi?id=103432

Remove optimization added in r99752 that attempted to avoid clip rect
updates for table cells. As the assertions show, this optimization
is not always correct, so remove it. Bug 108272 tracks adding it back in.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::updateLayerPositionsAfterScroll): Remove m_canSkipRepaintRectsUpdateOnScroll
check when updating clip rects.
* rendering/RenderLayer.h: Remove the m_canSkipRepaintRectsUpdateOnScroll bit.

Task-number: QTBUG-29214
Change-Id: I453ad4db59218631e236e938c2392a444840df64
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Reviewed-by: Jonathan Liu <net147@gmail.com>
Merge remote-tracking branch 'origin/release' into stable

Change-Id: If3305d4a24584f4289f840e60a2362220d005013
[Qt] Disable media support using QuickTime if deployment target != SDK

We link to a single libWebKitSystemInterface static lib, so unless the
deployment target matches the SDK let's not pretend like we'll be able
to run on anything lower than the SDK version.

Reviewed by Simon Hausmann.

* qmake/mkspecs/features/features.prf:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147540 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: Ic75a470d7d69a7b372113a81f488047d10d94b75
Reviewed-by: Eike Ziller <eike.ziller@digia.com>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@digia.com>
[Qt] Update QMAKE_MAC_SDK check for Qt 5.1

Relies on QMAKE_MAC_SDK_VERSION set in features.prf

Reviewed by Simon Hausmann.

* WebCore.pri:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147541 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: Ib353877af777065a6ab48b8cad157c8eed2e9030
Reviewed-by: Eike Ziller <eike.ziller@digia.com>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@digia.com>
DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1

https://bugs.webkit.org/show_bug.cgi?id=106978

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Changed the numerator equal to -2^31 check to just return if we expect an integer
result, since the check is after we have determined that the denominator is -1.
The int result of -2^31 / -1 is -2^31, so just return the numerator as the result.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):

LayoutTests:

Added a new DFG check for -2^31 / -1 when we expect and integer result.

* fast/js/integer-division-neg2tothe32-by-neg1-expected.txt:
* fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js:
(myDivExpectingInt):

Change-Id: Ifd8dd24e75e60520a140c09948dd3ab49aaa3fa8
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139835 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Dont use a node reference after appending to the graph.

https://bugs.webkit.org/show_bug.cgi?id=103305
<rdar://problem/12753096>

Reviewed by Mark Hahnenberg.

* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):

Change-Id: I48ebd652e936ca5781fd6d1bab2df012b2027c34
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139264 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
If array allocation profiling causes a new_array to allocate double arrays, then the holes should end up being correctly initialized

https://bugs.webkit.org/show_bug.cgi?id=106363

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

* runtime/JSArray.h:
(JSC::JSArray::tryCreateUninitialized):

LayoutTests:

* fast/js/jsc-test-list:
* fast/js/new-array-double-with-holes-expected.txt: Added.
* fast/js/new-array-double-with-holes.html: Added.
* fast/js/script-tests/new-array-double-with-holes.js: Added.
(foo):

Change-Id: Iad48b7dd0e71bcbe8557fd6f19487fcd9eeed585
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Yarr JIT isn't big endian compatible

https://bugs.webkit.org/show_bug.cgi?id=102897

Patch by Tobias Netzel <tobias.netzel@googlemail.com> on 2013-01-22
Reviewed by Oliver Hunt.

This patch was tested in the current mozilla codebase only and has passed the regexp tests there.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):

Change-Id: I1eb463aa79a7976a87d1f36a6c0123b058c3ec87
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140438 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
r134080 causes heap problem on linux systems where PAGESIZE != 4096

https://bugs.webkit.org/show_bug.cgi?id=102828

Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-01-18
Reviewed by Mark Hahnenberg.

Make MarkStackSegment::blockSize as the capacity of segments of a MarkStackArray.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
* heap/MarkStack.cpp:
(JSC):
(JSC::MarkStackArray::MarkStackArray):
(JSC::MarkStackArray::expand):
(JSC::MarkStackArray::donateSomeCellsTo):
(JSC::MarkStackArray::stealSomeCellsFrom):
* heap/MarkStack.h:
(JSC::MarkStackSegment::data):
(CapacityFromSize):
(MarkStackArray):
* heap/MarkStackInlines.h:
(JSC::MarkStackArray::setTopForFullSegment):
(JSC::MarkStackArray::append):
(JSC::MarkStackArray::isEmpty):
(JSC::MarkStackArray::size):
* runtime/Options.h:
(JSC):

Change-Id: I4663100b6b8b054bed03c0c6eb01bb9274a1b264
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140195 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Fix up of ArithDiv nodes for non-x86 CPUs is broken

https://bugs.webkit.org/show_bug.cgi?id=107309

Reviewed by  Filip Pizlo.

Changed the logic so that we insert an Int32ToDouble node when the existing edge is not SpecDouble.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixDoubleEdge):

Change-Id: I8e73ad242feb65c143857d3a4190e095aa5e9d06
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140201 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly

https://bugs.webkit.org/show_bug.cgi?id=107321

Reviewed by  Filip Pizlo.

Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
an ArithDiv node with integer inputs and output for platforms that don't have integer division.
Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
without any further checks.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(FixupPhase):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):

Change-Id: Ic79f2823a7cfb9ce52bb935536972f48508579fd
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140203 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Change set r140201 broke editing/selection/move-by-word-visually-multi-line.html

https://bugs.webkit.org/show_bug.cgi?id=107340

Reviewed by Filip Pizlo.

Due to the change landed in r140201, more nodes might end up
generating Int32ToDouble nodes.  Therefore, changed the JSVALUE64
constant path of compileInt32ToDouble() to use the more
restrictive isInt32Constant() check on the input.  This check was
the same as the existing ASSERT() so the ASSERT was eliminated.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):

Change-Id: I8e9f3858414e37f5b8232a58d8f6f9dada755343
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140221 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
JSC asserting with long parameter list functions in debug mode on ARM traditional

https://bugs.webkit.org/show_bug.cgi?id=109565

Reviewed by Zoltan Herczeg.

Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.

* jit/JIT.h:

Change-Id: I593f09494314a36cb50f2511908f6243fd43f902
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142616 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
WeakSet::removeAllocator leaks WeakBlocks

https://bugs.webkit.org/show_bug.cgi?id=110228

Reviewed by Geoffrey Garen.

We need to return the WeakBlock to the BlockAllocator after the call to WeakBlock::destroy.

* heap/WeakSet.cpp:
(JSC::WeakSet::removeAllocator):

Change-Id: Iba6cff23e3d8b7a544a825dd1e435cf986b0d35f
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143351 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Revert an accidentally changed line of EventHander::handleMousePressEvent(PlatformMouseEvent&) in r135650.

https://bugs.webkit.org/show_bug.cgi?id=108165

Reviewed by Hajime Morita.

No new tests.

* page/EventHandler.cpp:
(WebCore::EventHandler::handleMousePressEvent):

Change-Id: If76f50f49965e6b950aa398238965fc541f6c795
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141088 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>