Merge remote-tracking branch 'origin/stable' into 5.3

Change-Id: I09992d60034fccf74c5f754ab88bebe8b8de5e45

5 files changed, 38 insertions, 8 deletions

diff --git a/Source/JavaScriptCore/assembler/MIPSAssembler.h b/Source/JavaScriptCore/assembler/MIPSAssembler.h
index 5f7b9b21a..03ef23ba7 100644
--- a/Source/JavaScriptCore/assembler/MIPSAssembler.h
+++ b/Source/JavaScriptCore/assembler/MIPSAssembler.h
@@ -529,6 +529,11 @@ public:
         emitInst(0x46200004 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
     }
 
+    void absd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200005 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
     void movd(FPRegisterID fd, FPRegisterID fs)
     {
         emitInst(0x46200006 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index e13ae7b34..669021965 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -621,9 +621,9 @@ public:
         m_assembler.sqrtd(dst, src);
     }
     
-    void absDouble(FPRegisterID, FPRegisterID)
+    void absDouble(FPRegisterID src, FPRegisterID dst)
     {
-        RELEASE_ASSERT_NOT_REACHED();
+        m_assembler.absd(dst, src);
     }
 
     ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
@@ -1188,7 +1188,15 @@ public:
         return false;
 #endif
     }
-    static bool supportsFloatingPointAbs() { return false; }
+
+    static bool supportsFloatingPointAbs()
+    {
+#if WTF_MIPS_DOUBLE_FLOAT
+        return true;
+#else
+        return false;
+#endif
+    }
 
     // Stack manipulation operations:
     //
@@ -2621,7 +2629,7 @@ public:
     {
         m_assembler.truncwd(fpTempRegister, src);
         m_assembler.mfc1(dest, fpTempRegister);
-        return branch32(branchType == BranchIfTruncateFailed ? Equal : NotEqual, dest, TrustedImm32(0));
+        return branch32(branchType == BranchIfTruncateFailed ? Equal : NotEqual, dest, TrustedImm32(0x7fffffff));
     }
 
     // Result is undefined if the value is outside of the integer range.
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 325a876a2..1348f94be 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -3051,7 +3051,13 @@ void SpeculativeJIT::compileSoftModulo(Node* node)
     FPRResult result(this);
     
     flushRegisters();
-    callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+    if (!nodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
+        // NegativeZero check will need op1GPR and fmod call is likely to clobber it.
+        m_jit.push(op1GPR);
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+        m_jit.pop(op1GPR);
+    } else
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
     
     FPRTemporary scratch(this);
     GPRTemporary intResult(this);
diff --git a/Source/WebCore/platform/graphics/WidthIterator.cpp b/Source/WebCore/platform/graphics/WidthIterator.cpp
index e8b620f8a..48a59a27c 100644
--- a/Source/WebCore/platform/graphics/WidthIterator.cpp
+++ b/Source/WebCore/platform/graphics/WidthIterator.cpp
@@ -124,9 +124,9 @@ static inline float applyFontTransforms(GlyphBuffer* glyphBuffer, bool ltr, int&
 #if ENABLE(SVG_FONTS)
     // We need to handle transforms on SVG fonts internally, since they are rendered internally.
     if (fontData->isSVGFont()) {
-        ASSERT(iterator.run().renderingContext());
+        // SVG font fallbacks doesn't work properly and will not have a renderingContext. see: textRunNeedsRenderingContext()
         // SVG font ligatures are handled during glyph selection, only kerning remaining.
-        if (typesettingFeatures & Kerning)
+        if (iterator.run().renderingContext() && (typesettingFeatures & Kerning))
             iterator.run().renderingContext()->applySVGKerning(fontData, iterator, glyphBuffer, lastGlyphCount);
     } else
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 55c0b6aca..4469fde58 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -38,6 +38,7 @@
 #include <wtf/TemporaryChange.h>
 
 #if PLATFORM(QT)
+#include <QPaintEngine>
 #include "NativeImageQt.h"
 #endif
 
@@ -908,7 +909,17 @@ void BitmapTextureGL::updateContents(Image* image, const IntRect& targetRect, co
     const char* imageData;
 
 #if PLATFORM(QT)
-    QImage qImage = frameImage->toImage();
+    QImage qImage;
+    QPaintEngine* paintEngine = frameImage->paintEngine();
+    if (paintEngine && paintEngine->type() == QPaintEngine::Raster) {
+        // QRasterPixmapData::toImage() will deep-copy the backing QImage if there's an active QPainter on it.
+        // For performance reasons, we don't want that here, so we temporarily redirect the paint engine.
+        QPaintDevice* currentPaintDevice = paintEngine->paintDevice();
+        paintEngine->setPaintDevice(0);
+        qImage = frameImage->toImage();
+        paintEngine->setPaintDevice(currentPaintDevice);
+    } else
+        qImage = frameImage->toImage();
     imageData = reinterpret_cast<const char*>(qImage.constBits());
     bytesPerLine = qImage.bytesPerLine();
 #elif USE(CAIRO)