Merge WebKit at branches/chromium/742 r88085: Initial merge by git.

Change-Id: I0501b484b9528e31b0026e5ad64416dd6541cdde

26 files changed, 138 insertions, 120 deletions

diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index aff2981..98244b9 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -100,7 +100,11 @@ void ContentLayerChromium::paintContentsIfDirty(const IntRect& targetSurfaceRect
     IntRect layerRect = visibleLayerRect(targetSurfaceRect);
     if (layerRect.isEmpty())
         return;
-    m_tiler->invalidateRect(enclosingIntRect(m_dirtyRect));
+
+    IntRect dirty = enclosingIntRect(m_dirtyRect);
+    dirty.intersect(layerBounds());
+    m_tiler->invalidateRect(dirty);
+
     m_tiler->update(painter, layerRect);
     m_dirtyRect = FloatRect();
 }
@@ -182,7 +186,6 @@ void ContentLayerChromium::draw(const IntRect& targetSurfaceRect)
     IntRect layerRect = visibleLayerRect(targetSurfaceRect);
     if (!layerRect.isEmpty())
         m_tiler->draw(layerRect, transform, ccLayerImpl()->drawOpacity());
-    m_tiler->unreserveTextures();
 }
 
 void ContentLayerChromium::createTilerIfNeeded()
@@ -215,11 +218,6 @@ void ContentLayerChromium::bindContentsTexture()
     texture->bindTexture();
 }
 
-void ContentLayerChromium::unreserveContentsTexture()
-{
-    m_tiler->unreserveTextures();
-}
-
 void ContentLayerChromium::setIsMask(bool isMask)
 {
     setTilingOption(isMask ? NeverTile : AutoTile);
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index c0cf582..ab5485f 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -55,7 +55,6 @@ public:
     virtual void paintContentsIfDirty(const IntRect& targetSurfaceRect);
     virtual void updateCompositorResources();
     virtual void setIsMask(bool);
-    virtual void unreserveContentsTexture();
     virtual void bindContentsTexture();
 
     virtual void draw(const IntRect& targetSurfaceRect);
diff --git a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index ac1e1af..5ca1414 100644
--- a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -454,25 +454,8 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
     // Skip 100% transparent text; no need to draw anything.
     if (!alpha && graphicsContext->platformContext()->getStrokeStyle() == NoStroke && !graphicsContext->hasShadow())
         return;
-    if (!alpha || windowsCanHandleDrawTextShadow(graphicsContext) || !windowsCanHandleTextDrawingWithoutShadow(graphicsContext)) {
-        drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
-        return;
-    }
-    // Draw in two passes: skia for the shadow, GDI for foreground text
-    // pass1: shadow (will use skia)
-    graphicsContext->save();
-    graphicsContext->setFillColor(Color::transparent, graphicsContext->fillColorSpace());
-    drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
-    graphicsContext->restore();
-    // pass2: foreground text (will use GDI)
-    FloatSize shadowOffset;
-    float shadowBlur;
-    Color shadowColor;
-    ColorSpace shadowColorSpace;
-    graphicsContext->getShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
-    graphicsContext->setShadow(shadowOffset, shadowBlur, Color::transparent, shadowColorSpace);
+
     drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
-    graphicsContext->setShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
 }
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run,
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index d72fb1e..b0b7053 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -74,19 +74,19 @@ void ImageLayerChromium::paintContentsIfDirty(const IntRect&)
 
     if (!m_dirtyRect.isEmpty()) {
         m_decodedImage.updateFromImage(m_contents->nativeImageForCurrentFrame());
+        updateLayerSize(m_decodedImage.size());
+        IntRect paintRect(IntPoint(0, 0), m_decodedImage.size());
+        if (!m_dirtyRect.isEmpty()) {
+            m_tiler->invalidateRect(paintRect);
+            m_dirtyRect = IntRect();
+        }
     }
 }
 
 void ImageLayerChromium::updateCompositorResources()
 {
-    updateLayerSize(m_decodedImage.size());
-
     IntRect paintRect(IntPoint(0, 0), m_decodedImage.size());
-    if (!m_dirtyRect.isEmpty()) {
-        m_tiler->invalidateRect(paintRect);
-        m_dirtyRect = IntRect();
-    }
-    m_tiler->updateFromPixels(paintRect, m_decodedImage.pixels());
+    m_tiler->updateFromPixels(paintRect, paintRect, m_decodedImage.pixels());
 }
 
 IntRect ImageLayerChromium::layerBounds() const
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 27a67e9..e62b674 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -171,7 +171,6 @@ void LayerRendererChromium::drawRootLayer()
 
     m_rootLayerContentTiler->uploadCanvas();
     m_rootLayerContentTiler->draw(m_viewportVisibleRect, scroll, 1.0f);
-    m_rootLayerContentTiler->unreserveTextures();
 }
 
 void LayerRendererChromium::setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition)
@@ -235,6 +234,8 @@ void LayerRendererChromium::updateAndDrawLayers()
 
     drawLayers(renderSurfaceLayerList);
 
+    m_textureManager->unprotectAllTextures();
+
     // After drawLayers:
     if (hardwareCompositing() && m_contextSupportsLatch) {
         Extensions3DChromium* parentExt = static_cast<Extensions3DChromium*>(m_context->getExtensions());
@@ -282,7 +283,7 @@ void LayerRendererChromium::updateLayers(LayerList& renderSurfaceLayerList)
     // concept of a large content layer.
     updatePropertiesAndRenderSurfaces(m_rootLayer.get(), identityMatrix, renderSurfaceLayerList, m_defaultRenderSurface->m_layerList);
 
-    paintContentsRecursive(m_rootLayer.get());
+    paintLayerContents(renderSurfaceLayerList);
 
     // FIXME: Before updateCompositorResourcesRecursive, when the compositor runs in
     // its own thread, and when the copyTexImage2D bug is fixed, insert
@@ -328,6 +329,46 @@ void LayerRendererChromium::updateLayers(LayerList& renderSurfaceLayerList)
     }
 }
 
+void LayerRendererChromium::paintLayerContents(const LayerList& renderSurfaceLayerList)
+{
+    for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
+        RenderSurfaceChromium* renderSurface = renderSurfaceLayer->renderSurface();
+        ASSERT(renderSurface);
+
+        // Render surfaces whose drawable area has zero width or height
+        // will have no layers associated with them and should be skipped.
+        if (!renderSurface->m_layerList.size())
+            continue;
+
+        LayerList& layerList = renderSurface->m_layerList;
+        ASSERT(layerList.size());
+        for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex) {
+            CCLayerImpl* ccLayerImpl = layerList[layerIndex].get();
+
+            // Layers that start a new render surface will be painted when the render
+            // surface's list is processed.
+            if (ccLayerImpl->renderSurface() && ccLayerImpl->renderSurface() != renderSurface)
+                continue;
+
+            LayerChromium* layer = ccLayerImpl->owner();
+            if (layer->bounds().isEmpty())
+                continue;
+
+            const IntRect targetSurfaceRect = layer->ccLayerImpl()->scissorRect();
+
+            if (layer->drawsContent())
+                layer->paintContentsIfDirty(targetSurfaceRect);
+            if (layer->maskLayer() && layer->maskLayer()->drawsContent())
+                layer->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
+            if (layer->replicaLayer() && layer->replicaLayer()->drawsContent())
+                layer->replicaLayer()->paintContentsIfDirty(targetSurfaceRect);
+            if (layer->replicaLayer() && layer->replicaLayer()->maskLayer() && layer->replicaLayer()->maskLayer()->drawsContent())
+                layer->replicaLayer()->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
+        }
+    }
+}
+
 void LayerRendererChromium::drawLayers(const LayerList& renderSurfaceLayerList)
 {
     TRACE_EVENT("LayerRendererChromium::drawLayers", this, 0);
@@ -761,27 +802,6 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         std::stable_sort(&descendants.at(thisLayerIndex), descendants.end(), compareLayerZ);
 }
 
-void LayerRendererChromium::paintContentsRecursive(LayerChromium* layer)
-{
-    const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
-    for (size_t i = 0; i < sublayers.size(); ++i)
-        paintContentsRecursive(sublayers[i].get());
-
-    if (layer->bounds().isEmpty())
-        return;
-
-    const IntRect targetSurfaceRect = layer->ccLayerImpl()->scissorRect();
-
-    if (layer->drawsContent())
-        layer->paintContentsIfDirty(targetSurfaceRect);
-    if (layer->maskLayer() && layer->maskLayer()->drawsContent())
-        layer->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
-    if (layer->replicaLayer() && layer->replicaLayer()->drawsContent())
-        layer->replicaLayer()->paintContentsIfDirty(targetSurfaceRect);
-    if (layer->replicaLayer() && layer->replicaLayer()->maskLayer() && layer->replicaLayer()->maskLayer()->drawsContent())
-        layer->replicaLayer()->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
-}
-
 void LayerRendererChromium::updateCompositorResourcesRecursive(LayerChromium* layer)
 {
     const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
@@ -985,6 +1005,7 @@ bool LayerRendererChromium::initializeSharedObjects()
 
     m_sharedGeometry = adoptPtr(new GeometryBinding(m_context.get()));
     m_borderProgram = adoptPtr(new LayerChromium::BorderProgram(m_context.get()));
+    m_headsUpDisplayProgram = adoptPtr(new CCHeadsUpDisplay::Program(m_context.get()));
     m_canvasLayerProgram = adoptPtr(new CCCanvasLayerImpl::Program(m_context.get()));
     m_videoLayerRGBAProgram = adoptPtr(new CCVideoLayerImpl::RGBAProgram(m_context.get()));
     m_videoLayerYUVProgram = adoptPtr(new CCVideoLayerImpl::YUVProgram(m_context.get()));
@@ -995,6 +1016,7 @@ bool LayerRendererChromium::initializeSharedObjects()
 
     if (!m_sharedGeometry->initialized() || !m_borderProgram->initialized()
         || !m_canvasLayerProgram->initialized()
+        || !m_headsUpDisplayProgram->initialized()
         || !m_videoLayerRGBAProgram->initialized() || !m_videoLayerYUVProgram->initialized()
         || !m_pluginLayerProgram->initialized() || !m_renderSurfaceProgram->initialized()
         || !m_renderSurfaceMaskProgram->initialized() || !m_tilerProgram->initialized()) {
@@ -1014,6 +1036,7 @@ void LayerRendererChromium::cleanupSharedObjects()
     m_sharedGeometry.clear();
     m_borderProgram.clear();
     m_canvasLayerProgram.clear();
+    m_headsUpDisplayProgram.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
     m_pluginLayerProgram.clear();
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 813eb46..b373c59 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -110,6 +110,7 @@ public:
 
     const GeometryBinding* sharedGeometry() const { return m_sharedGeometry.get(); }
     const LayerChromium::BorderProgram* borderProgram() const { return m_borderProgram.get(); }
+    const CCHeadsUpDisplay::Program* headsUpDisplayProgram() const { return m_headsUpDisplayProgram.get(); }
     const RenderSurfaceChromium::Program* renderSurfaceProgram() const { return m_renderSurfaceProgram.get(); }
     const RenderSurfaceChromium::MaskProgram* renderSurfaceMaskProgram() const { return m_renderSurfaceMaskProgram.get(); }
     const LayerTilerChromium::Program* tilerProgram() const { return m_tilerProgram.get(); }
@@ -143,7 +144,7 @@ private:
     void updateRootLayerContents();
     void updatePropertiesAndRenderSurfaces(LayerChromium*, const TransformationMatrix& parentMatrix, LayerList& renderSurfaceLayerList, LayerList& layers);
 
-    void paintContentsRecursive(LayerChromium*);
+    void paintLayerContents(const LayerList&);
     void updateCompositorResourcesRecursive(LayerChromium*);
 
     void drawLayers(const LayerList& renderSurfaceLayerList);
@@ -205,6 +206,7 @@ private:
     // we cannot store these values in static variables.
     OwnPtr<GeometryBinding> m_sharedGeometry;
     OwnPtr<LayerChromium::BorderProgram> m_borderProgram;
+    OwnPtr<CCHeadsUpDisplay::Program> m_headsUpDisplayProgram;
     OwnPtr<RenderSurfaceChromium::Program> m_renderSurfaceProgram;
     OwnPtr<RenderSurfaceChromium::MaskProgram> m_renderSurfaceMaskProgram;
     OwnPtr<LayerTilerChromium::Program> m_tilerProgram;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp b/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
index 23cb4b3..39402f6 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTexture.cpp
@@ -71,12 +71,6 @@ bool LayerTexture::reserve(const IntSize& size, unsigned format)
     return m_textureId;
 }
 
-void LayerTexture::unreserve()
-{
-    if (m_token)
-        m_textureManager->unprotectTexture(m_token);
-}
-
 void LayerTexture::bindTexture()
 {
     ASSERT(m_textureManager->hasTexture(m_token));
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTexture.h b/Source/WebCore/platform/graphics/chromium/LayerTexture.h
index b60dff2..2d43b34 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTexture.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTexture.h
@@ -49,7 +49,6 @@ public:
 
     bool isValid(const IntSize&, unsigned format);
     bool reserve(const IntSize&, unsigned format);
-    void unreserve();
     bool isReserved()
     {
         ASSERT(m_textureManager);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
index 54c6ac2..5c2375e 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
@@ -60,6 +60,13 @@ LayerTilerChromium::LayerTilerChromium(LayerRendererChromium* layerRenderer, con
     setTileSize(tileSize);
 }
 
+void LayerTilerChromium::setLayerRenderer(LayerRendererChromium* layerRenderer)
+{
+    if (m_layerRenderer != layerRenderer)
+        reset();
+    m_layerRenderer = layerRenderer;
+}
+
 LayerTilerChromium::~LayerTilerChromium()
 {
     reset();
@@ -252,10 +259,14 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
         }
     }
 
-    if (dirtyLayerRect.isEmpty())
-        return;
+    // Due to borders, when the paint rect is extended to tile boundaries, it
+    // may end up overlapping more tiles than the original content rect. Record
+    // that original rect so we don't upload more tiles than necessary.
+    m_updateRect = contentRect;
 
     m_paintRect = layerRectToContentRect(dirtyLayerRect);
+    if (dirtyLayerRect.isEmpty())
+        return;
 
     m_canvas.resize(m_paintRect.size());
 
@@ -276,11 +287,11 @@ void LayerTilerChromium::uploadCanvas()
     PlatformCanvas::AutoLocker locker(&m_canvas);
     {
         TRACE_EVENT("LayerTilerChromium::updateFromPixels", this, 0);
-        updateFromPixels(m_paintRect, locker.pixels());
+        updateFromPixels(m_updateRect, m_paintRect, locker.pixels());
     }
 }
 
-void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_t* paintPixels)
+void LayerTilerChromium::updateFromPixels(const IntRect& contentRect, const IntRect& paintRect, const uint8_t* paintPixels)
 {
     // Painting could cause compositing to get turned off, which may cause the tiler to become invalidated mid-update.
     if (!m_tilingData.totalSizeX() || !m_tilingData.totalSizeY())
@@ -289,7 +300,7 @@ void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_
     GraphicsContext3D* context = layerRendererContext();
 
     int left, top, right, bottom;
-    contentRectToTileIndices(paintRect, left, top, right, bottom);
+    contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             Tile* tile = tileAt(i, j);
@@ -407,16 +418,6 @@ void LayerTilerChromium::draw(const IntRect& contentRect, const TransformationMa
     }
 }
 
-void LayerTilerChromium::unreserveTextures()
-{
-    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
-        Tile* tile = iter->second.get();
-        if (!tile)
-            continue;
-        tile->texture()->unreserve();
-    }
-}
-
 void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
index 111dd7e..1650c86 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
@@ -68,20 +68,16 @@ public:
     void uploadCanvas();
 
     // Reserve and upload tile textures from an externally painted buffer.
-    void updateFromPixels(const IntRect& paintRect, const uint8_t* pixels);
+    void updateFromPixels(const IntRect& contentRect, const IntRect& paintRect, const uint8_t* pixels);
 
     // Draw all tiles that intersect with the content rect.
     void draw(const IntRect& contentRect, const TransformationMatrix&, float opacity);
 
-    // If uploadCanvas/updateFromPixels is called, this must be called after
-    // draw() to unreserve any textures that were reserved prior to uploading.
-    void unreserveTextures();
-
     // Set position of this tiled layer in content space.
     void setLayerPosition(const IntPoint& position);
     // Change the tile size.  This may invalidate all the existing tiles.
     void setTileSize(const IntSize& size);
-    void setLayerRenderer(LayerRendererChromium* layerRenderer) { m_layerRenderer = layerRenderer; }
+    void setLayerRenderer(LayerRendererChromium*);
 
     bool skipsDraw() const { return m_skipsDraw; }
 
@@ -161,7 +157,9 @@ private:
     // Tightly packed set of unused tiles.
     Vector<RefPtr<Tile> > m_unusedTiles;
 
+    // State held between update and uploadCanvas.
     IntRect m_paintRect;
+    IntRect m_updateRect;
     PlatformCanvas m_canvas;
 
     // Cache a tile-sized pixel buffer to draw into.
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index c93ef3f..31249ae 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -136,11 +136,6 @@ void RenderSurfaceChromium::drawSurface(CCLayerImpl* maskLayer, const Transforma
     LayerChromium::drawTexturedQuad(layerRenderer()->context(), layerRenderer()->projectionMatrix(), drawTransform,
                                         m_contentRect.width(), m_contentRect.height(), m_drawOpacity,
                                         shaderMatrixLocation, shaderAlphaLocation);
-
-    m_contentsTexture->unreserve();
-
-    if (maskLayer)
-        maskLayer->unreserveContentsTexture();
 }
 
 void RenderSurfaceChromium::draw(const IntRect&)
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
index 13cdb89..e98a701 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
@@ -84,17 +84,10 @@ void TextureManager::protectTexture(TextureToken token)
     m_textures.add(token, info);
 }
 
-void TextureManager::unprotectTexture(TextureToken token)
+void TextureManager::unprotectAllTextures()
 {
-    TextureMap::iterator it = m_textures.find(token);
-    if (it != m_textures.end()) {
-        TextureInfo info = it->second;
-        if (info.isProtected) {
-            info.isProtected = false;
-            m_textures.remove(it);
-            m_textures.add(token, info);
-        }
-    }
+    for (TextureMap::iterator it = m_textures.begin(); it != m_textures.end(); ++it)
+        it->second.isProtected = false;
 }
 
 bool TextureManager::reduceMemoryToLimit(size_t limit)
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.h b/Source/WebCore/platform/graphics/chromium/TextureManager.h
index 83104a9..a90b8b2 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.h
@@ -52,7 +52,7 @@ public:
     unsigned requestTexture(TextureToken, IntSize, unsigned textureFormat, bool* newTexture = 0);
 
     void protectTexture(TextureToken);
-    void unprotectTexture(TextureToken);
+    void unprotectAllTextures();
     bool isProtected(TextureToken);
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index d22b098..cb2874d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -32,6 +32,7 @@
 #include "FontDescription.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
+#include "LayerRendererChromium.h"
 #include "LayerTexture.h"
 #include "TextRun.h"
 #include "TextStream.h"
@@ -109,7 +110,7 @@ void CCHeadsUpDisplay::draw()
     }
 
     // Draw the HUD onto the default render surface.
-    const LayerTilerChromium::Program* program = m_layerRenderer->tilerProgram();
+    const Program* program = m_layerRenderer->headsUpDisplayProgram();
     ASSERT(program && program->initialized());
     GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
     m_hudTexture->bindTexture();
@@ -122,8 +123,6 @@ void CCHeadsUpDisplay::draw()
                                     matrix, hudSize.width(), hudSize.height(),
                                     1.0f, program->vertexShader().matrixLocation(),
                                     program->fragmentShader().alphaLocation());
-
-    m_hudTexture->unreserve();
 }
 
 void CCHeadsUpDisplay::drawHudContents(GraphicsContext* ctx, const IntSize& hudSize)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index 09f198a..fc68f1d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -28,13 +28,15 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "Font.h"
-#include "LayerRendererChromium.h"
-
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
 
 namespace WebCore {
 
 class GeometryBinding;
 class GraphicsContext3D;
+class LayerRendererChromium;
+class LayerTexture;
 
 // Class that handles drawing of composited render layers using GL.
 class CCHeadsUpDisplay {
@@ -58,6 +60,8 @@ public:
     bool enabled() const { return m_showPlatformLayerTree || m_showFPSCounter; }
     void draw();
 
+    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderBGRATexAlpha> Program;
+
 private:
     explicit CCHeadsUpDisplay(LayerRendererChromium* owner);
     void drawHudContents(GraphicsContext*, const IntSize& hudSize);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 649f4dd..9b6bc42 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -51,6 +51,7 @@ public:
     // When this class gets subclasses, remember to add 'virtual' here.
     virtual ~CCLayerImpl();
     void resetOwner() { m_owner = 0; }
+    LayerChromium* owner() const { return m_owner; }
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index eead000..5afbb43 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -187,7 +187,7 @@ void FEComposite::determineAbsolutePaintRect()
     case FECOMPOSITE_OPERATOR_ARITHMETIC:
         // Arithmetic may influnce the compele filter primitive region. So we can't
         // optimize the paint region here.
-        setAbsolutePaintRect(maxEffectRect());
+        setAbsolutePaintRect(enclosingIntRect(maxEffectRect()));
         return;
     default:
         // Take the union of both input effects.
diff --git a/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h b/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
index 5dc8873..940aa92 100644
--- a/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
+++ b/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
@@ -75,7 +75,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h b/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
index 9b7dda8..fd80458 100644
--- a/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
+++ b/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
@@ -53,7 +53,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEFlood.h b/Source/WebCore/platform/graphics/filters/FEFlood.h
index cac4153..497ca24 100644
--- a/Source/WebCore/platform/graphics/filters/FEFlood.h
+++ b/Source/WebCore/platform/graphics/filters/FEFlood.h
@@ -42,7 +42,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.h b/Source/WebCore/platform/graphics/filters/FELighting.h
index 3dc46e9..501339c 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.h
+++ b/Source/WebCore/platform/graphics/filters/FELighting.h
@@ -43,7 +43,7 @@ class FELighting : public FilterEffect {
 public:
     virtual void apply();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
 protected:
     enum LightingType {
diff --git a/Source/WebCore/platform/graphics/filters/FETile.h b/Source/WebCore/platform/graphics/filters/FETile.h
index 9b02b4c..72e7e60 100644
--- a/Source/WebCore/platform/graphics/filters/FETile.h
+++ b/Source/WebCore/platform/graphics/filters/FETile.h
@@ -35,7 +35,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual FilterEffectType filterEffectType() const { return FilterEffectTypeTile; }
 
diff --git a/Source/WebCore/platform/graphics/filters/FETurbulence.h b/Source/WebCore/platform/graphics/filters/FETurbulence.h
index dfeb220..f03afc4 100644
--- a/Source/WebCore/platform/graphics/filters/FETurbulence.h
+++ b/Source/WebCore/platform/graphics/filters/FETurbulence.h
@@ -61,7 +61,7 @@ public:
     virtual void apply();
     virtual void dump();
     
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index f07d00c..6e5422e 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -46,6 +46,14 @@ FilterEffect::~FilterEffect()
 {
 }
 
+inline bool isFilterSizeValid(IntRect rect)
+{
+    if (rect.width() < 0 || rect.width() > kMaxFilterSize
+        || rect.height() < 0 || rect.height() > kMaxFilterSize)
+        return false;
+    return true;
+}
+
 void FilterEffect::determineAbsolutePaintRect()
 {
     m_absolutePaintRect = IntRect();
@@ -54,7 +62,7 @@ void FilterEffect::determineAbsolutePaintRect()
         m_absolutePaintRect.unite(m_inputEffects.at(i)->absolutePaintRect());
     
     // SVG specification wants us to clip to primitive subregion.
-    m_absolutePaintRect.intersect(m_maxEffectRect);
+    m_absolutePaintRect.intersect(enclosingIntRect(m_maxEffectRect));
 }
 
 IntRect FilterEffect::requestedRegionOfInputImageData(const IntRect& effectRect) const
@@ -104,6 +112,7 @@ ImageBuffer* FilterEffect::asImageBuffer()
 
 PassRefPtr<ByteArray> FilterEffect::asUnmultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyUnmultipliedImage(imageData.get(), rect);
     return imageData.release();
@@ -111,6 +120,7 @@ PassRefPtr<ByteArray> FilterEffect::asUnmultipliedImage(const IntRect& rect)
 
 PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyPremultipliedImage(imageData.get(), rect);
     return imageData.release();
@@ -118,10 +128,14 @@ PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 
 inline void FilterEffect::copyImageBytes(ByteArray* source, ByteArray* destination, const IntRect& rect)
 {
-    // Copy the necessary lines.
-    if (rect.x() < 0 || rect.y() < 0 || rect.maxY() > m_absolutePaintRect.width() || rect.maxY() > m_absolutePaintRect.height())
+    // Initialize the destination to transparent black, if not entirely covered by the source.
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > m_absolutePaintRect.width() || rect.maxY() > m_absolutePaintRect.height())
         memset(destination->data(), 0, destination->length());
 
+    // Early return if the rect does not intersect with the source.
+    if (rect.maxX() <= 0 || rect.maxY() <= 0 || rect.x() >= m_absolutePaintRect.width() || rect.y() >= m_absolutePaintRect.height())
+        return;
+
     int xOrigin = rect.x();
     int xDest = 0;
     if (xOrigin < 0) {
@@ -165,6 +179,7 @@ void FilterEffect::copyUnmultipliedImage(ByteArray* destination, const IntRect&
         if (m_imageBufferResult)
             m_unmultipliedImageResult = m_imageBufferResult->getUnmultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_unmultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_premultipliedImageResult->data();
             unsigned char* destinationComponent = m_unmultipliedImageResult->data();
@@ -198,6 +213,7 @@ void FilterEffect::copyPremultipliedImage(ByteArray* destination, const IntRect&
         if (m_imageBufferResult)
             m_premultipliedImageResult = m_imageBufferResult->getPremultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_premultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_unmultipliedImageResult->data();
             unsigned char* destinationComponent = m_premultipliedImageResult->data();
@@ -234,6 +250,8 @@ ByteArray* FilterEffect::createUnmultipliedImageResult()
 {
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())
         return 0;
@@ -245,6 +263,8 @@ ByteArray* FilterEffect::createPremultipliedImageResult()
 {
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())
         return 0;
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 2de8ac5..74fdc29 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -32,6 +32,8 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
+static const float kMaxFilterSize = 5000.0f;
+
 namespace WebCore {
 
 class Filter;
@@ -74,8 +76,8 @@ public:
     IntRect absolutePaintRect() const { return m_absolutePaintRect; }
     void setAbsolutePaintRect(const IntRect& absolutePaintRect) { m_absolutePaintRect = absolutePaintRect; }
 
-    IntRect maxEffectRect() const { return m_maxEffectRect; }
-    void setMaxEffectRect(const IntRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
+    FloatRect maxEffectRect() const { return m_maxEffectRect; }
+    void setMaxEffectRect(const FloatRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
 
     virtual void apply() = 0;
     virtual void dump() = 0;
@@ -128,7 +130,7 @@ private:
     
     // The maximum size of a filter primitive. In SVG this is the primitive subregion in absolute coordinate space.
     // The absolute paint rect should never be bigger than m_maxEffectRect.
-    IntRect m_maxEffectRect;
+    FloatRect m_maxEffectRect;
     Filter* m_filter;
 
 private:
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index f285c9b..d967791 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -1047,6 +1047,7 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     double blur = blurFloat;
 
     uint32_t mfFlags = SkBlurMaskFilter::kHighQuality_BlurFlag;
+    SkXfermode::Mode colorMode = SkXfermode::kSrc_Mode;
 
     if (m_state.shadowsIgnoreTransforms)  {
         // Currently only the GraphicsContext associated with the
@@ -1055,6 +1056,12 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
         // with a CanvasRenderingContext.
         mfFlags |= SkBlurMaskFilter::kIgnoreTransform_BlurFlag;
 
+        // CSS wants us to ignore the original's alpha, but Canvas wants us to
+        // modulate with it. Using shadowsIgnoreTransforms to tell us that we're
+        // in a Canvas, we change the colormode to kDst_Mode, so we don't overwrite
+        // it with our layer's (default opaque-black) color.
+        colorMode = SkXfermode::kDst_Mode;
+
         // CG uses natural orientation for Y axis, but the HTML5 canvas spec
         // does not.
         // So we now flip the height since it was flipped in
@@ -1082,7 +1089,7 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
 
     info.fPaintBits |= SkLayerDrawLooper::kMaskFilter_Bit; // our blur
     info.fPaintBits |= SkLayerDrawLooper::kColorFilter_Bit;
-    info.fColorMode = SkXfermode::kDst_Mode;
+    info.fColorMode = colorMode;
     info.fOffset.set(width, height);
     info.fPostTranslate = m_state.shadowsIgnoreTransforms;