Unreviewed. Fix Windows specific accessibility test results. 
Missed some new lines in http://trac.webkit.org/changeset/129255.

* platform/win/accessibility/aria-toggle-button-with-title-expected.txt:
* platform/win/accessibility/canvas-fallback-content-2-expected.txt:
* platform/win/accessibility/img-fallsback-to-title-expected.txt:
* platform/win/accessibility/svg-image-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129276 268f45cc-cd09-0410-ab3c-d52691b4dbfc
BiquadFilterNode must take audio-rate parameter changes into account
https://bugs.webkit.org/show_bug.cgi?id=97369

Reviewed by Kenneth Russell.

BiquadFilterNode is currently ignoring any timeline or audio-rate changes to its parameters.
We now check if any of its parameters have timeline or audio-rate changes and, if so, take
them into account.  Otherwise, we use ordinary parameter smoothing/de-zippering which is
the case when the parameters are adjusted, for example, from a knob or slider in the UI.

* Modules/webaudio/BiquadDSPKernel.cpp:
(WebCore::BiquadDSPKernel::updateCoefficientsIfNecessary):
* Modules/webaudio/BiquadProcessor.cpp:
(WebCore::BiquadProcessor::checkForDirtyCoefficients):
* Modules/webaudio/BiquadProcessor.h:
(WebCore::BiquadProcessor::hasSampleAccurateValues):
(BiquadProcessor):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129277 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fast/dom/Geolocation/disconnected-frame.html test asserts
https://bugs.webkit.org/show_bug.cgi?id=97376

Patch by Benjamin Poulain <bpoulain@apple.com> on 2012-09-21
Reviewed by Alexey Proskuryakov.

Source/WebKit2: 

In GeolocationPermissionRequestManager::cancelRequestForGeolocation, we access an iterator
after its value has been removed from the table.
There are two problems with that:
-The iterator is no longer valid after the container has been modified.
-If it was the last element, the table has been freed and the iterator points to deleted memory.

We solve the issue by keeping a copy of the ID. We could have inverted the order of the calls
but that would make the issue less visible for future change.

Testing covered by fast/dom/Geolocation/disconnected-frame.html.

* WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp:
(WebKit::GeolocationPermissionRequestManager::cancelRequestForGeolocation):

LayoutTests: 

* platform/wk2/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Skip this test because it relies on sandboxed-iframe-origin-add.html which was removed in http://trac.webkit.org/changeset/129262.

* platform/win/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129279 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Simplify and optimize ChildListMutationScope
https://bugs.webkit.org/show_bug.cgi?id=97352

Reviewed by Ryosuke Niwa.

ChildListMutationScope is one of the most complicated bits of
MutationObserver implementation. This patch aims to simplify it for
clarity and improve its performance (mostly by just doing less).

The big change is to remove the MutationAccumulatorRouter class,
replacing it with lifetime-management logic in ChildListMutationAccumulator
ChildListMutationScope is expected to call getOrCreate() in
its constructor, and each scope holds a RefPtr to the accumulator.
When the last scope holding such a RefPtr is destroyed,
ChildListMutationAccumulator's destructor enqueues the accumulated record.

This greatly reduces the number of lines of code, and condenses
two HashMaps into one. It also reduces hash lookups, which now
occur only on scope creation and when the refcount for a given
accumulator reaches 0 (previously, each childAdded and willRemoveChild
call could result in two hash lookups each).

There are some minor changes as well: the ChildListMutationAccumulator::clear()
method is gone, as it was doing more work than necessary;
DEFINE_STATIC_LOCAL is now used instead of hand-rolled static-management
code; ChildListMutationAccumulator::m_lastAdded is no longer a RefPtr, since it
always points at a Node that's already being ref'd by the accumulator.
Also various minor syntactic cleanups.

No new tests, no change in behavior.

* dom/ChildListMutationScope.cpp:
(WebCore::accumulatorMap): Reduced two maps to one, and manage its lifetime with DEFINE_STATIC_LOCAL.
(WebCore::ChildListMutationAccumulator::ChildListMutationAccumulator): Remove unnecessary call to clear() (which itself has been removed).
(WebCore::ChildListMutationAccumulator::~ChildListMutationAccumulator): Enqueue record if not empty at destruction, and have the accumulator
remove itself from the map.
(WebCore::ChildListMutationAccumulator::getOrCreate): Replaces half of MutationAccumulatorRouter's job.
(WebCore::ChildListMutationAccumulator::childAdded): Minor RefPtr usage improvements.
(WebCore::ChildListMutationAccumulator::isRemovedNodeInOrder): Simplify RefPtr syntax.
(WebCore::ChildListMutationAccumulator::willRemoveChild): Minor RefPtr usage improvements.
(WebCore::ChildListMutationAccumulator::enqueueMutationRecord): Replace call to clear() with clearing m_lastAdded,
since it's the only bit not cleared by the MutationRecord creation call. Also remove
isEmpty check and replace with asserts now that it's a private method.
(WebCore::ChildListMutationAccumulator::isEmpty): Added more assertions about emptiness.
* dom/ChildListMutationScope.h:
(WebCore):
(ChildListMutationAccumulator): Extract the inner class to make everything easier to read.
(WebCore::ChildListMutationScope::ChildListMutationScope): Store m_accumulator rather than m_target.
(WebCore::ChildListMutationScope::~ChildListMutationScope): ditto
(WebCore::ChildListMutationScope::childAdded): ditto
(WebCore::ChildListMutationScope::willRemoveChild): ditto
(ChildListMutationScope):
* html/HTMLElement.cpp: Remove unused ChildListMutationScope.h #include.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129280 268f45cc-cd09-0410-ab3c-d52691b4dbfc
instanceof should not get the prototype for non-default HasInstance
https://bugs.webkit.org/show_bug.cgi?id=68656

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

Instanceof is currently implemented as a sequance of three opcodes:
    check_has_instance
    get_by_id(prototype)
    op_instanceof
There are three interesting types of base value that instanceof can be applied to:
    (A) Objects supporting default instanceof behaviour (functions, other than those created with bind)
    (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions)
    (C) Values that do not respond to the [[HasInstance]] trap.
Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are
two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for
hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly,
this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec
violation.

The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving
op_instanceof to handle only cases (A).

* API/JSCallbackObject.h:
(JSCallbackObject):
* API/JSCallbackObjectFunctions.h:
(JSC::::customHasInstance):
* API/JSValueRef.cpp:
(JSValueIsInstanceOfConstructor):
    - renamed hasInstance to customHasInstance
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump):
    - added additional parameters to check_has_instance opcode
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
    - added additional parameters to check_has_instance opcode
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitCheckHasInstance):
    - added additional parameters to check_has_instance opcode
* bytecompiler/BytecodeGenerator.h:
(BytecodeGenerator):
    - added additional parameters to check_has_instance opcode
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
    - added additional parameters to check_has_instance opcode
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
    - added additional parameters to check_has_instance opcode
* interpreter/Interpreter.cpp:
(JSC::isInvalidParamForIn):
(JSC::Interpreter::privateExecute):
    - Add handling for non-default instanceof to op_check_has_instance
* jit/JITInlineMethods.h:
(JSC::JIT::emitArrayProfilingSiteForBytecodeIndex):
    - Fixed no-LLInt no_DFG build
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emitSlow_op_check_has_instance):
    - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
    - no need to check for ImplementsDefaultHasInstance.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emitSlow_op_check_has_instance):
    - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
    - no need to check for ImplementsDefaultHasInstance.
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h:
    - Add handling for non-default instanceof to op_check_has_instance
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
    - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
* runtime/ClassInfo.h:
(MethodTable):
(JSC):
    - renamed hasInstance to customHasInstance
* runtime/CommonSlowPaths.h:
(CommonSlowPaths):
    - removed opInstanceOfSlow (this was whittled down to one function call!)
* runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::customHasInstance):
* runtime/JSBoundFunction.h:
(JSBoundFunction):
    - renamed hasInstance to customHasInstance, reimplemented.
* runtime/JSCell.cpp:
(JSC::JSCell::customHasInstance):
* runtime/JSCell.h:
(JSCell):
* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):
(JSC):
(JSC::JSObject::defaultHasInstance):
* runtime/JSObject.h:
(JSObject):

LayoutTests: 

* fast/js/function-bind-expected.txt:
    - check in passing result.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed windows build fix.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129282 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Forward-declare WebSize as a struct
https://bugs.webkit.org/show_bug.cgi?id=97381

Reviewed by James Robinson.

The mismatched "class" forward-declaration for WebSize in this file
will cause a Clang error when it's included in Chromium.

* chromium/public/WebCompositorSoftwareOutputDevice.h:
(WebKit):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r129176): Incorrect line breaking when kerning occurs between a space and the following character
https://bugs.webkit.org/show_bug.cgi?id=97377

Reviewed by Enrica Casucci.

Source/WebCore: 

Test: fast/text/kerning-with-TextLayout.html

When kerning is enabled, the last character in a word may have its advance shortened because
of its trailing space. To account for that, words are measured along with the trailing space,
then the width of a space is subtracted from the result. This doesn’t work when the trailing
space itself has its advance shortened due to the character following it, which can happen
when using the TextLayout optimization. However, when the optimization is used, the advance
of the last character of the word is already adjusted for the trailing space, so there is no
need to measure with that space and subtract its advance.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::nextLineBreak): Changed to not use the trailingSpaceWidth
mechanism when TextLayout is being used.

LayoutTests: 

* fast/text/kerning-with-TextLayout-expected.html: Added.
* fast/text/kerning-with-TextLayout.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129284 268f45cc-cd09-0410-ab3c-d52691b4dbfc
nrwt: don't require additional-platform-directory to be an abspath or live under LayoutTests
https://bugs.webkit.org/show_bug.cgi?id=97380

Reviewed by Ojan Vafai.

There doesn't seem to be a good reason for this restriction and
it's useful to be able to point to directories outside the
checkout for results (e.g., for local failures due to a 10.7.4
install ;).

* Scripts/webkitpy/layout_tests/port/base.py:
(Port.relative_test_filename):
(Port.relative_perf_test_filename):
* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidDriver._command_from_driver_input):
* Scripts/webkitpy/layout_tests/run_webkit_tests.py:
(_set_up_derived_options):
* Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
(MainTest.test_additional_platform_directory):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129285 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix WebKit2 sandbox profile.

Instead of using #pragmas, just disable all warnings in DerivedSources.make. I suspect
that passing -traditional to the preprocessor disables support for #pragmas but I'm afraid
to change it to something else.

* DerivedSources.make:
* WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129286 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove redundant argument to op_instanceof
https://bugs.webkit.org/show_bug.cgi?id=97382

Reviewed by Geoff Garen.

No longer needed after my last change.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump):
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitInstanceOf):
* bytecompiler/BytecodeGenerator.h:
(BytecodeGenerator):
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove bogus assertions from ChildListMutationScope
https://bugs.webkit.org/show_bug.cgi?id=97372

Reviewed by Ryosuke Niwa.

Source/WebCore:

Some asserts (and their accompanying comment) were trying to enforce
proper usage of ChildListMutationScope from WebCore, but in the
presence of MutationEvents they could fail due to arbitrary script
execution.

This change gets rid of those asserts and adds tests exercising
the (pre-existing) codepaths for handling these out-of-order cases.
Without this patch, these tests ASSERT in debug builds.

Tests: fast/mutation/added-out-of-order.html
       fast/mutation/removed-out-of-order.html

* dom/ChildListMutationScope.cpp:
(WebCore::ChildListMutationAccumulator::childAdded):
(WebCore::ChildListMutationAccumulator::willRemoveChild):
* dom/ChildListMutationScope.h:
(WebCore):

LayoutTests:

* fast/mutation/added-out-of-order-expected.txt: Added.
* fast/mutation/added-out-of-order.html: Added.
* fast/mutation/removed-out-of-order-expected.txt: Added.
* fast/mutation/removed-out-of-order.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129288 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pedantic test in Mozilla's JavaScript test suite fails. function-001.js function-001-n.js
https://bugs.webkit.org/show_bug.cgi?id=27219

Reviewed by Sam Weinig.

These tests are just wrong.
See ECMA 262 A.5, FunctionDelcaration does not require a semicolon.

* tests/mozilla/expected.html:
* tests/mozilla/js1_2/function/function-001-n.js:
* tests/mozilla/js1_3/Script/function-001-n.js:
* tests/mozilla/js1_3/regress/function-001-n.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129289 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed windows build fix.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129290 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix typo in additional-platform-directory patch just landed
https://bugs.webkit.org/show_bug.cgi?id=97380

Unreviewed, build fix.

* Scripts/webkitpy/layout_tests/port/base.py:
(Port.relative_test_filename):
(Port.relative_perf_test_filename):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129291 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Eeeep - broke early boyer in bug#97382
https://bugs.webkit.org/show_bug.cgi?id=97383

Rubber stamped by Sam Weinig.

missed a child3 -> child2!

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOf):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129292 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebProcess XPC services need have their environment set without disrupting all other XPC services
https://bugs.webkit.org/show_bug.cgi?id=95161

Reviewed by Anders Carlsson.

Source/WebKit2:

Replace the WebKit2Service with two new XPC services, the WebProcessService, which is only used
when installed on the system, and the WebProcessServiceForWebKitDevelopment which is used at all
other times. We need both services because XPC can't in general be configured to have a custom
environment at runtime, and thus WebProcessServiceForWebKitDevelopment has the ability to re-exec
itself into a desired state. That capability is rather undesirable for installed usage, where we
don't want to allow arbitrary changes to the environment of the service, which would allow breaking
the App Sandbox.

* Configurations/WebProcessService.xcconfig: Copied from Source/WebKit2/Configurations/WebKit2Service.xcconfig.
* Configurations/WebProcessServiceForWebKitDevelopment.xcconfig: Renamed from Source/WebKit2/Configurations/WebKit2Service.xcconfig.
Add new configuration files.

* Platform/mac/WorkQueueMac.cpp:
(WorkQueue::registerMachPortEventHandler):
(WorkQueue::unregisterMachPortEventHandler):
Add helpful assertions. Without them, we confusingly crash a bit later in HashTable code.

* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::addDYLDEnvironmentAdditions):
Factor out environment additions to this helper function.

(WebKit::connectToWebProcessServiceForWebKitDevelopment):
(WebKit::createWebProcessServiceForWebKitDevelopment):
Add functionality to setup the webkit development service via re-exec.

(WebKit::createWebProcessService):
Add functionality to connect to the installed WebProcess service.

(WebKit::createProcess):
Factor out posix_spawn based launching into this helper function.

(WebKit::ProcessLauncher::launchProcess):
Call the correct process creation function based on launch data and install state.

* WebKit2.xcodeproj/project.pbxproj:
Add new files to the project.

* WebProcess/mac/WebProcessServiceEntryPoints.h: Renamed from Source/WebKit2/WebProcess/mac/WebProcessXPCServiceMain.h.
* WebProcess/mac/WebProcessServiceEntryPoints.mm: Renamed from Source/WebKit2/WebProcess/mac/WebProcessXPCServiceMain.mm.
(WebKit::WebProcessServiceEventHandler):
(WebProcessServiceMain):
(InitializeWebProcessForWebProcessServiceForWebKitDevelopment):
Rename to WebProcessServiceEntryPoints since this is now used for both the WebProcessService and the
WebProcessServiceForWebKitDevelopment.

* WebProcessService/Info.plist: Copied from Source/WebKit2/WebKit2Service/Info.plist.
* WebProcessService/WebProcessServiceMain.mm: Renamed from Source/WebKit2/WebKit2Service/MainMacService.mm.
Add main for the WebProcessService which just calls into the WebProcessServiceEntryPoints in WebKit2.framework.

* WebProcessServiceForWebKitDevelopment/Info.plist: Renamed from Source/WebKit2/WebKit2Service/Info.plist.
* WebProcessServiceForWebKitDevelopment/WebProcessServiceForWebKitDevelopmentMain.mm: Added.
Add main for the WebProcessServiceForWebKitDevelopment, which can't just call directly into WebProcessServiceEntryPoints
as the framework path might not be set up correctly. This is also where we re-exec ourselves when required.

Tools:

Remove setting the __XPC_* environment variables.

* Scripts/webkitdirs.pm:
(setUpGuardMallocIfNeeded):
(runMacWebKitApp):
(execMacWebKitAppForDebugging):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129293 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderMarquee causes ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()) : WebCore::FloatRect WebCore::RenderGeometryMap::absoluteRect(const WebCore::FloatRect &) const
https://bugs.webkit.org/show_bug.cgi?id=92464

Reviewed by Sam Weinig.

Marquees could cause an updateCompositingLayersAfterScroll() to be called when
we're in the middle of updating layer positions. updateCompositingLayersAfterScroll()
does a full RenderLayer tree walk, but its use of RenderGeomeryMap reveals that
it's using layers whose positions haven't been updated yet.

Fix by avoiding the updateCompositingLayersAfterScroll() if we're in the process
of updating a marquee when updating layer positions. We'll do a compositing update
soon anyway.

Tested by fast/events/tabindex-focus-blur-all.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::updateLayerPositions):
(WebCore::RenderLayer::updateLayerPositionsAfterScroll):
(WebCore::RenderLayer::scrollTo):
* rendering/RenderLayer.h:
(RenderLayer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129294 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the Lion and Snow Leopard builds.

* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::connectToWebProcessServiceForWebKitDevelopment):
(WebKit::createWebProcessServiceForWebKitDevelopment):
(WebKit::createWebProcessService):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129295 268f45cc-cd09-0410-ab3c-d52691b4dbfc