[CTTE] RenderSVGTransformableContainer is never anonymous.
<https://webkit.org/b/121304>

Reviewed by Anders Carlsson.

This renderer is never anonymous. Tighten things up with a graphicsElement()
reference getter.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155707 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: AXPress does not work in SVG
https://bugs.webkit.org/show_bug.cgi?id=121248

Reviewed by Mario Sanchez Prada.

Source/WebCore: 

Implement accessKeyAction() on SVGElements, which is what accessibility code
uses in order to activate Elements.

Test: accessibility/svg-element-press.html

* svg/SVGElement.cpp:
(WebCore::SVGElement::accessKeyAction):
* svg/SVGElement.h:

LayoutTests: 

* accessibility/svg-element-press-expected.txt: Added.
* accessibility/svg-element-press.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155708 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove layering-violating Pasteboard::writeURL (for all platforms now)
https://bugs.webkit.org/show_bug.cgi?id=121306

Reviewed by Antti Koivisto.

* editing/Editor.cpp:
(WebCore::Editor::copyURL): Move the contents of the writeURLToPasteboard function
in here.

* editing/Editor.h: Removed Mac-specific writeURLToPasteboard, added private
Mac-specific fillInUserVisibleForm function for the one Mac-specific part of writing URLs.

* editing/efl/EditorEfl.cpp: Deleted Editor::writeURLToPasteboard.

* editing/mac/EditorMac.mm: Deleted Editor::writeURLToPasteboard, moving the code
into copyURL.
(WebCore::Editor::fillInUserVisibleForm): Added.

* page/DragController.cpp:
(WebCore::DragController::startDrag): Call copyURL instead of writeURL or
writeURLToPasteboard.

* platform/Pasteboard.h: Fixed up the PasteboardURL struct so it's suitable for
cross-platform use. Removed the writeURL function. Removed the Frame* argument from
the Windows-specific writeURLToDataObject function.

* platform/blackberry/PasteboardBlackBerry.cpp:
(WebCore::Pasteboard::write): Renamed/refactored from writeURL.
* platform/gtk/PasteboardGtk.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/nix/PasteboardNix.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/qt/PasteboardQt.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/win/PasteboardWin.cpp:
(WebCore::Pasteboard::writeURLToDataObject): Removed unused Frame* argument.
(WebCore::Pasteboard::write): Renamed/refactored from writeURL.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155709 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move LineLayoutState class to LineLayoutState.h
https://bugs.webkit.org/show_bug.cgi?id=121263

Reviewed by Ryosuke Niwa.

I added bitfields, reordered the members and a functions too.

No new tests, no behavior change.

* rendering/LineLayoutState.h: Added.
(WebCore::LineLayoutState::LineLayoutState):
(WebCore::LineLayoutState::markForFullLayout):
(WebCore::LineLayoutState::isFullLayout):
(WebCore::LineLayoutState::usesRepaintBounds):
(WebCore::LineLayoutState::setRepaintRange):
(WebCore::LineLayoutState::updateRepaintRangeFromBox):
(WebCore::LineLayoutState::endLineMatched):
(WebCore::LineLayoutState::setEndLineMatched):
(WebCore::LineLayoutState::checkForFloatsFromLastLine):
(WebCore::LineLayoutState::setCheckForFloatsFromLastLine):
(WebCore::LineLayoutState::lineInfo):
(WebCore::LineLayoutState::endLineLogicalTop):
(WebCore::LineLayoutState::setEndLineLogicalTop):
(WebCore::LineLayoutState::endLine):
(WebCore::LineLayoutState::setEndLine):
(WebCore::LineLayoutState::lastFloat):
(WebCore::LineLayoutState::setLastFloat):
(WebCore::LineLayoutState::floats):
(WebCore::LineLayoutState::floatIndex):
(WebCore::LineLayoutState::setFloatIndex):
(WebCore::LineLayoutState::adjustedLogicalLineTop):
(WebCore::LineLayoutState::setAdjustedLogicalLineTop):
(WebCore::LineLayoutState::flowThread):
(WebCore::LineLayoutState::setFlowThread):
* rendering/RenderBlockLineLayout.cpp: Remove LineLayoutState.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155710 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fourthTier: Change JSStack to grow from high to low addresses
https://bugs.webkit.org/show_bug.cgi?id=118758

Reviewed by Oliver Hunt.

Changed the JSC stack to grow down.  Effectively the JSC stack frame is flipped from
what it was.  See JSStack.h for the new offsets.  Changed JSStack begin() and end()
to be getBaseOfStack() and getLimitOfStack().  Most of the changes are address or offset
calculation changes.  Decoupled a local register ordinal (loop variable or array index)
from the offset into the callFrame using localToOperand() and the inverse operandToLocal().

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::trustedImm32ForShift):
(JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index
* assembler/X86Assembler.h:
(JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecode/CodeBlock.h:
(JSC::unmodifiedArgumentsRegister):
(JSC::CodeBlock::isCaptured):
* bytecode/CodeOrigin.h:
(JSC::CodeOrigin::stackOffset):
* bytecode/Operands.h:
(JSC::localToOperand):
(JSC::operandIsLocal):
(JSC::operandToLocal):
(JSC::operandIsArgument):
(JSC::operandToArgument):
(JSC::argumentToOperand):
* bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in
31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addVar):
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
(JSC::BytecodeGenerator::newRegister):
(JSC::BytecodeGenerator::emitNewArray):
* bytecompiler/BytecodeGenerator.h:
(JSC::CallArguments::registerOffset):
* bytecompiler/NodesCodegen.cpp:
(JSC::CallArguments::CallArguments):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileFunction):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOperations.cpp:
* dfg/DFGScoreBoard.h:
(JSC::DFG::ScoreBoard::allocate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callFrameSlot):
(JSC::DFG::SpeculativeJIT::argumentSlot):
(JSC::DFG::SpeculativeJIT::callFrameTagSlot):
(JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
(JSC::DFG::SpeculativeJIT::argumentTagSlot):
(JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::reportValidationContext):
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* heap/ConservativeRoots.cpp:
(JSC::ConservativeRoots::genericAddSpan):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::frameExtentInternal):
* interpreter/CallFrame.h:
(JSC::ExecState::init):
(JSC::ExecState::argumentOffset):
(JSC::ExecState::argumentOffsetIncludingThis):
(JSC::ExecState::argIndexForRegister):
* interpreter/Interpreter.cpp:
(JSC::loadVarargs):
(JSC::Interpreter::dumpRegisters):
* interpreter/JSStack.cpp:
(JSC::JSStack::JSStack):
(JSC::JSStack::~JSStack):
(JSC::JSStack::growSlowCase):
(JSC::JSStack::gatherConservativeRoots):
(JSC::JSStack::releaseExcessCapacity):
(JSC::JSStack::disableErrorStackReserve):
* interpreter/JSStack.h:
(JSC::JSStack::getBaseOfStack):
(JSC::JSStack::getLimitOfStack):
(JSC::JSStack::size):
(JSC::JSStack::end):
(JSC::JSStack::containsAddress):
(JSC::JSStack::lowAddress):
(JSC::JSStack::highAddress):
(JSC::JSStack::reservationEnd):
(JSC::JSStack::shrink):
(JSC::JSStack::grow):
* interpreter/JSStackInlines.h:
(JSC::JSStack::getTopOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
(JSC::JSStack::installTrapsAfterFrame):
* interpreter/StackVisitor.cpp:
(JSC::inlinedFrameOffset):
(JSC::StackVisitor::readInlinedFrame):
* jit/JIT.cpp:
(JSC::JIT::privateCompile):
* jit/JITCall.cpp:
(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_create_activation):
(JSC::JIT::emit_op_get_argument_by_val):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_get_argument_by_val):
* jit/JITStubs.cpp:
(JSC::throwExceptionFromOpCall):
(JSC::DEFINE_STUB_FUNCTION):
* jit/ThunkGenerators.cpp:
(JSC::arityFixup):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::genericCall):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArgList.cpp:
(JSC::ArgList::getSlice):
(JSC::MarkedArgumentBuffer::slowAppend):
* runtime/ArgList.h:
(JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::slotFor):
(JSC::MarkedArgumentBuffer::mallocBase):
(JSC::ArgList::at):
* runtime/Arguments.cpp:
(JSC::Arguments::tearOff):
* runtime/ArrayConstructor.cpp:
(JSC::constructArrayWithSizeQuirk):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/JSActivation.h:
(JSC::JSActivation::registersOffset):
(JSC::JSActivation::tearOff):
(JSC::JSActivation::isValidIndex):
* runtime/JSArray.h:
(JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::globalExec):
* runtime/JSGlobalObject.h:
(JSC::constructArrayNegativeIndexed):
* runtime/JSString.h:
* runtime/Operations.h:
(JSC::jsStringFromRegisterArray):
* runtime/SymbolTable.h:
(JSC::SharedSymbolTable::captureCount):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155711 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Scrolling and zooming is slow when Flash plugin visible
https://bugs.webkit.org/show_bug.cgi?id=120618

Reviewed by Anders Carlsson.
Internally reviewed by Jacky Jiang.

JIRA 490823
Compositing Flash plugin content triggered a workaround for a graphics
driver quirk. The workaround was actually related to WebGL, not Flash,
back when we used glCopyTexImage to implement WebGL double buffering
(see PR 148933 and 150228 for more details of the old implementation).

Originally, both WebGL and plugin layers added themselves to the
LayerRenderer::m_layersLockingTextureResources list. Now only plugin
layers use this list.
The glCopyTexImage code was removed long ago, and WebGL now uses the
EGLImage-based double buffering approach implemented in
EGLImageLayerWebKitThread and EGLImageLayerCompositingThreadClient.

Fixed by removing the now obsolete workaround, a call to "glFinish".
This considerably improves the frame rate of zooming and scrolling when
Flash content is visible.

Improvement in frame rate not appropriate to test using layout tests,
could easily result in flaky test.

* platform/graphics/blackberry/LayerRenderer.cpp:
(WebCore::LayerRenderer::compositeLayers):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155712 268f45cc-cd09-0410-ab3c-d52691b4dbfc