Need to check if some HTML child elements are HTMLUnknownElement

Based on upstream fix http://trac.webkit.org/changeset/156953

The check for whether an element is an HTMLAudioElement or not was
incomplete. An element can have the 'audio' tag-name but still be
another element if media elements have been disabled. In this
case it will be an HTMLUnknownElement.

Task-number: QTBUG-41360
Change-Id: I6a3e366b9dc268b0dbebe5880ba68945bcb42a27
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Prevent display of infinite media slider track.

When the duration received is zero but buffering already started,
the computed size for the rendering is infinite.

Change-Id: I9b9d8f42b6dbff792f89ac7d7e28991187762a1c
Reviewed-by: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Avoid crashing when QtQuick destroys our SG node and GL context

Keep the layers on the UI process but make sure that the backing
stores are destroyed both on the UI and Web processes.

Add a check for m_isPurging in CoordinatedGraphicsLayer::removeTile
to make sure that we don't tell the UI process to remove tiles that
it purged itself, in a similar way to what we do in
CompositingCoordinator::removeUpdateAtlas.

Also make sure that we wait for the next m_isWaitingForRenderer
after we've purged the backing stores in CoordinatedLayerTreeHost
to wait for a QtWebPageSGNode to be available like we do right after
a page's construction and avoid sending update that would be
ignored by an unactive CoordinatedGraphicsScene.

Task-number: QTBUG-40734
Change-Id: I059f1de2ce2a8d9d70ab2cd8c3252a469ebf036e
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Incorrect behavior on emscripten-compiled cube2hash

https://bugs.webkit.org/show_bug.cgi?id=120033

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar
then we should bail attempts to CSE.

* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::scopedVarLoadElimination):
(JSC::DFG::CSEPhase::scopedVarStoreElimination):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154344 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Task-number: QTBUG-41500
Change-Id: Ia6bd7b09b20a99d5f4b5a14bf58737bc4b8c6a2b
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
REGRESSION: Crash when opening Facebook.com

https://bugs.webkit.org/show_bug.cgi?id=119155

Reviewed by Andreas Kling.

Scope nodes are always objects, so we should be using SpecObjectOther
rather than SpecCellOther.  Marking Scopes as CellOther leads to a
contradiction in the CFA, resulting in bogus codegen.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

Change-Id: Ic083c04b9351c904ea4b5ee41bcc98c7d66d757d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
REGRESSION: `if (false === (true && undefined)) console.log("wrong!");` logs "wrong!", shouldn't!

https://bugs.webkit.org/show_bug.cgi?id=123179

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

* parser/NodeConstructors.h:
(JSC::LogicalOpNode::LogicalOpNode):
* parser/ResultType.h:
(JSC::ResultType::forLogicalOp): Don't assume that && produces a boolean.
This is JavaScript (aka Sparta).

LayoutTests:

* js/dom/branch-fold-correctness.html: Added a test for this case.

Change-Id: I72f81f31d88dee306428dd5eab9d40fcec009042
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157830 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Detect PowerPC little-endian architecture

Change-Id: I868224d189fc34af2517bfbb8931591e30dcbaa0
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
<https://webkit.org/b/120079> Flattening a dictionary can cause CopiedSpace corruption

Reviewed by Oliver Hunt.

When we flatten an object in dictionary mode, we compact its properties. If the object
had out-of-line storage in the form of a Butterfly prior to this compaction, and after
compaction its properties fit inline, the object's Structure "forgets" that the object
has a non-zero Butterfly pointer. During GC, we check the Butterfly and reportLiveBytes
with bytes = 0, which causes all sorts of badness in CopiedSpace.

Instead, after we flatten a dictionary, if properties fit inline we should clear the
Butterfly pointer so that the GC doesn't get confused later.

This patch does this clearing, and it also adds JSObject::checkStructure, which overrides
JSCell::checkStructure to add an ASSERT that makes sure that the Structure being assigned
agrees with the whether or not the object has a Butterfly. Also added an ASSERT to check
that the number of bytes reported to SlotVisitor::copyLater is non-zero.

* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::copyLater):
* runtime/JSObject.cpp:
(JSC::JSObject::notifyPresenceOfIndexedAccessors):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::genericConvertDoubleToContiguous):
(JSC::JSObject::switchToSlowPutArrayStorage):
(JSC::JSObject::setPrototype):
(JSC::JSObject::putDirectAccessor):
(JSC::JSObject::seal):
(JSC::JSObject::freeze):
(JSC::JSObject::preventExtensions):
(JSC::JSObject::reifyStaticFunctionsForDelete):
(JSC::JSObject::removeDirect):
* runtime/JSObject.h:
(JSC::JSObject::setButterfly):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::setStructure):
(JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
* runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):

Change-Id: Idfd8c22555f4373c1104316ff1ee28f5f84ef083
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154366 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Implement ICU availability check in qtwebkit

Since commit bded052aad125 in qtbase configure.exe do not check for
ICU anymore by default: ICU is not strictly needed for most of Qt,
and can be replaced by native Windows API.

Anyhow, this effectively also disabled compilation of qtwebkit, that
relies on the configure.exe check for ICU. Instead qtwebkit now
explicitly checks for ICU on it's own, ignoring the logic in
configure.exe.

Task-number: QTBUG-41579
Change-Id: Ic09658a0bd8acb06ad3e0ed5f9dbe4cdcbfc6d56
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@digia.com>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
DFG 32Bit: Crash loading "Classic" site @ translate.google.com

https://bugs.webkit.org/show_bug.cgi?id=120015

Reviewed by Sam Weinig.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being
DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in
all versions of fillSpeculateBoolean().

Change-Id: I4de21707f00c1538b82b9bee6b2acc2903611983
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
(un)shiftCountWithAnyIndexingType will start over in the middle of copying if it sees a hole

https://bugs.webkit.org/show_bug.cgi?id=121717

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

This bug caused the array to become corrupted. We now check for holes before we start moving things,
and start moving things only once we've determined that there are none.

* runtime/JSArray.cpp:
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):

Change-Id: I9948bfa2c9b4a345076f7f2b4e50a566f521b6fe
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156214 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Support DynamicGL builds

Move the choice of OpenGL ES/2 vs OpenGL codepath to runtime. To fully
support this the WebCore OpenGL shims are also replaced with Qt's
QOpenGLFunctions.

GraphicsContext3DOpenGL.cpp and Extensions3DOpenGL.cpp have been
modified to now also be able to handle OpenGL ES/2 on Qt.

Note: GraphicsContext3DOpenGL.cpp and GraphicsContext3DOpenGLCommon.cpp
are now Qt port only, but since this is not meant for upstreaming this
should not cause any significant issues.

Change-Id: I9f205d2a7bc5704496232085d7f0811aeec2434a
Reviewed-by: Zeno Albisser <zeno.albisser@digia.com>
Fix rare build regression in WebKit2

We must ensure derived sources are build before any normal sources are
since they depend on headers generated.

This was accidently removed when fixing non production-build builds.

Task-number: QTBUG-41693
Change-Id: I33788b508545eb14acbbee08c2579673f5b6adc5
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix noicu build of GLX graphics surface

We were incorrectly using the ICU define 'TRUE' instead of the OpenGL
define 'GL_TRUE'.

Task-number: QTBUG-41771
Change-Id: I4902d44f830cf702a53bc470f07f4f6b4542cc55
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix valgrind warning about uninitialized access

A default cache-entry has a null String and an uninitialized key. We
should therefore only try to use the key if the String is not null.

Change-Id: Icd6819b96b9b650305cf0611b6b2978c07dc9196
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix assertion in PerformanceTiming

We get negative values in monotonic increasing time because we forget
to initialize the start time.

Change-Id: I292792f8f996025e7f0254bb90391b7af6873877
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Merge remote-tracking branch 'origin/5.4' into dev

Change-Id: Ie2225337cb5eef39035146827484496a6b3690b3