[chromium] Fix Renderer4.CompositorThreadImplDrawDelay histogram.
https://bugs.webkit.org/show_bug.cgi?id=93159

Patch by Dave Tu <dtu@chromium.org> on 2012-08-03
Reviewed by Adrienne Walker.

The histogram is using the frame number instead of the frame time by mistake.

* platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
(WebCore::CCFrameRateCounter::markBeginningOfFrame):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
https://bugs.webkit.org/show_bug.cgi?id=92691

Reviewed by Mark Hahnenberg.

The state of the stubs was changing after we determined the type (by virtue of the slow path
function that was called), since the get or put (in this case put) could cause arbitrary
side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
function to determine what to do, but an easier fix for now is to have the slow path give up
if its assumptions were invalidated by a side effect.

* dfg/DFGOperations.cpp:
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Convert HTML parser to handle 8-bit resources without converting to UChar*
https://bugs.webkit.org/show_bug.cgi?id=90321

Reviewed by Adam Barth.

Source/WebCore: 

No new tests, no new functionality therefore covered by existing tests.

Changed the parsing of HTML to handle 8-bit strings without converting the 
whole string to 16-bits.  Primary change was to use the appropriate 
character pointer type (LChar* or UChar*) depending on the source string.
This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
and advanceAndUpdateLineNumber() methods have been refactored into a
state machine managed pair of function pointers.  The possible functions
have not only the 8 and 16 bitness factored out, they also have the 
"exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
This change also has improvements over http://trac.webkit.org/changeset/123679.
The most prominent change was to inline the 8 bit paths for both advance()
and advanceAndUpdateLineNumber().
This provides a net speed-up even with the 8/16 bit testing.
Other changes involve using String methods to access and compare with the
source data.

* html/FTPDirectoryDocument.cpp:
(WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
instead of SegmentedString '*' operator.
* html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
SegmentedString '*' operator.
* html/parser/HTMLParserIdioms.cpp:
(WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
* html/parser/HTMLSourceTracker.cpp:
(WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
SegmentedString '*' operator.
* loader/cache/CachedScript.cpp:
(WebCore::CachedScript::script): Updated to use new String::dataSize() method.
* platform/text/SegmentedString.cpp:
(WebCore::SegmentedString::SegmentedString):
(WebCore::SegmentedString::operator=):
(WebCore::SegmentedString::clear):
(WebCore::SegmentedString::append):
(WebCore::SegmentedString::prepend):
(WebCore::SegmentedString::advanceSubstring):
(WebCore::SegmentedString::advance):
(WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
(WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
(WebCore::SegmentedString::advanceAndUpdateLineNumber8): Fast path
advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
(WebCore::SegmentedString::advanceAndUpdateLineNumber16): Fast path
advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
(WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
8 and 16 bit advance.
(WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
advanceAndUpdateLineNumber function for both 8 and 16 bit data.
(WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
(WebCore::SegmentedString::updateSlowCaseFunctionPointers): Set advance function
pointers to slow case functions.
* platform/text/SegmentedString.h:
(WebCore::SegmentedSubstring::SegmentedSubstring):
(WebCore::SegmentedSubstring::clear):
(SegmentedSubstring):
(WebCore::SegmentedSubstring::is8Bit): New getter.
(WebCore::SegmentedSubstring::appendTo):
(WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
(WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
that pre-increments the 8 bit pointer and returns the next character.
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
that pre-increments the 16 bit pointer and returns the next character.
(WebCore::SegmentedSubstring::currentSubString):
(WebCore::SegmentedSubstring::getCurrentChar):
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
(WebCore::SegmentedString::SegmentedString):
(WebCore::SegmentedString::push):
(WebCore::SegmentedString::isEmpty):
(WebCore::SegmentedString::lookAhead):
(WebCore::SegmentedString::lookAheadIgnoringCase):
(WebCore::SegmentedString::advance): Wrapper that contains 8 bit fast path
or calls via member function point to approriate advance() flavor.
(WebCore::SegmentedString::advanceAndUpdateLineNumber): Wrapper that
contains 8 bit fast path or calls via member function point to approriate
advance() flavor.
(WebCore::SegmentedString::advanceAndASSERT):
(WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
(WebCore::SegmentedString::advancePastNonNewline):
(WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
(WebCore::SegmentedString::currentChar):
(WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
change to slow case functions when only one character left.
(WebCore::SegmentedString::updateAdvanceFunctionPointers): Select appropriate
advance functions based on current substring.
(WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
(WebCore::SegmentedString::lookAheadSlowCase):
* xml/parser/CharacterReferenceParserInlineMethods.h:
(WebCore::consumeCharacterReference): Changed to use currentChar() instead of
SegmentedString '*' operator.
* xml/parser/MarkupTokenizerBase.h:
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
currentChar() instead of SegmentedString '*' operator.
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

Source/WTF: 

* wtf/text/WTFString.h:
(WTF::String::dataSize): New method to return the number of bytes 
the string requires.  This replaces a harcoded calculation based on
length and sizeof(UChar).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124679 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use testRunner instead of layoutTestController in fast/scrolling through fast/xsl tests
https://bugs.webkit.org/show_bug.cgi?id=92947

Reviewed by Kent Tamura.

* fast/scrolling/resources/scrollable-area.js:
* fast/selectors/empty-element-made-non-empty.html:
* fast/selectors/querySelector-in-range-crash.html:
* fast/selectors/selection-window-inactive.html:
* fast/selectors/style-sharing-adjacent-selector.html:
* fast/selectors/style-sharing-last-child.html:
* fast/spatial-navigation/:
* fast/storage/storage-detached-iframe.html:
* fast/sub-pixel/client-width-height-snapping.html:
* fast/sub-pixel/float-containing-block-with-margin.html:
* fast/sub-pixel/table-rows-have-stable-height.html:
* fast/table/:
* fast/text/:
* fast/tokenizer/:
* fast/transforms/container-transform-crash.html:
* fast/transforms/matrix-with-zoom.html:
* fast/transforms/scrollIntoView-transformed.html:
* fast/transforms/selection-bounds-in-transformed-view.html:
* fast/transforms/topmost-becomes-bottomost-for-scrolling.html:
* fast/transforms/transform-hit-test-flipped.html:
* fast/transforms/transform-inside-overflow-scroll.html:
* fast/url/degenerate-file-base.html:
* fast/viewport/:
* fast/workers/:
* fast/writing-mode/auto-margins-across-boundaries.html:
* fast/writing-mode/block-formatting-context.html:
* fast/writing-mode/broken-ideographic-font.html:
* fast/writing-mode/display-mutation.html:
* fast/writing-mode/flipped-blocks-hit-test-overflow.html:
* fast/writing-mode/flipped-blocks-text-map-local-to-container.html:
* fast/writing-mode/japanese-rl-text-with-broken-font.html:
* fast/writing-mode/overhanging-float-legend-crash.html:
* fast/writing-mode/percentage-padding.html:
* fast/writing-mode/positionForPoint.html:
* fast/writing-mode/relative-positioning-percentages.html:
* fast/writing-mode/table-hit-test.html:
* fast/xmlhttprequest/null-document-xmlhttprequest-open.html:
* fast/xmlhttprequest/resources/xmlhttprequest-no-file-access-real.html:
* fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html:
* fast/xmlhttprequest/xmlhttprequest-bad-mimetype.html:
* fast/xmlhttprequest/xmlhttprequest-gc.html:
* fast/xmlhttprequest/xmlhttprequest-get.xhtml:
* fast/xmlhttprequest/xmlhttprequest-html-response-encoding.html:
* fast/xmlhttprequest/xmlhttprequest-invalid-values.html:
* fast/xmlhttprequest/xmlhttprequest-missing-file-exception.html:
* fast/xmlhttprequest/xmlhttprequest-no-file-access.html:
* fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html:
* fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html:
* fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-abort.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-arraybuffer.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-document.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-text.html:
* fast/xpath/4XPath/Borrowed/namespace-nodes.html:
* fast/xpath/ancestor-axis.html:
* fast/xpath/complex-id.html:
* fast/xpath/empty-string-substring.html:
* fast/xpath/ensure-null-namespace.xhtml:
* fast/xpath/id-path.html:
* fast/xpath/id-simple.html:
* fast/xpath/implicit-node-args.html:
* fast/xpath/name-null-namespace.html:
* fast/xpath/namespace-vs-predicate.xhtml:
* fast/xpath/nan-to-boolean.html:
* fast/xpath/nodeset-duplicates.html:
* fast/xpath/nsresolver-bad-object.xhtml:
* fast/xpath/nsresolver-exception.xhtml:
* fast/xpath/nsresolver-function.xhtml:
* fast/xpath/nsresolver-object.xhtml:
* fast/xpath/preceding-axis.xhtml:
* fast/xpath/text-nodes.html:
* fast/xpath/union-context-node.xhtml:
* fast/xpath/xpath-detached-iframe-resolver-crash.html:
* fast/xpath/xpath-empty-string.html:
* fast/xpath/xpath-functional-test.html:
* fast/xpath/xpath-iterator-result-should-mark-its-nodeset.html:
* fast/xpath/xpath-other-nodeset-result-should-mark-its-nodeset.html:
* fast/xpath/xpath-result-eventlistener-crash.html:
* fast/xpath/xpath-snapshot-result-should-mark-its-nodeset.html:
* fast/xsl/default-html.html:
* fast/xsl/exslt-node-set.xsl:
* fast/xsl/extra-lf-at-end.html:
* fast/xsl/import-non-document-node.xhtml:
* fast/xsl/mozilla-tests.xsl:
* fast/xsl/nbsp-in-stylesheet.html:
* fast/xsl/resources/dtd-in-source-document.xsl:
* fast/xsl/resources/import-after-comment-transform.xsl:
* fast/xsl/resources/to-html.xsl:
* fast/xsl/resources/xslt-entity-enc.xsl:
* fast/xsl/resources/xslt-nested-stylesheets1.xsl:
* fast/xsl/resources/xslt-recursion-chain1.xsl:
* fast/xsl/resources/xslt-second-level-import.xsl:
* fast/xsl/sort-locale.xsl:
* fast/xsl/sort-unicode.xsl:
* fast/xsl/subframe-location.html:
* fast/xsl/transform-xhr-doc.xhtml:
* fast/xsl/transformToFragment-XML-declaration.html:
* fast/xsl/utf8-chunks.xsl:
* fast/xsl/xslt-bad-import-uri.html:
* fast/xsl/xslt-doc-enc.xsl:
* fast/xsl/xslt-doc-noenc.xsl:
* fast/xsl/xslt-fragment-in-empty-doc.html:
* fast/xsl/xslt-processor.html:
* fast/xsl/xslt-string-parameters.html:
* fast/xsl/xslt-text.html:
* fast/xsl/xslt-transform-to-fragment-crash.html:
* fast/xsl/xslt-url.xsl:
* platform/chromium-linux/fast/text/chromium-linux-text-subpixel-positioning.html:
* platform/chromium-linux/fast/text/international/arabic-vertical-offset.html:
* platform/chromium-linux/fast/text/international/draw-complex-text-from-to.html:
* platform/chromium/fast/text/chromium-mac-duplicate-ime-composition.html:
* platform/chromium/fast/text/font-linux-normalize.html:
* platform/chromium/fast/text/international/complex-text-rectangle.html:
* platform/mac/fast/text/attributed-substring-from-range-001.html:
* platform/mac/fast/text/attributed-substring-from-range-002.html:
* platform/mac/fast/text/attributed-substring-from-range-in-textfield.html:
* platform/mac/fast/text/attributed-substring-from-range.html:
* platform/mac/fast/text/core-text-fallback-to-unknown-font.html:
* platform/mac/fast/text/justified-text-rect.html:
* platform/mac/fast/text/myanmar-shaping.html:
* platform/mac/fast/text/thai-combining-mark-positioning.html:
* platform/mac/fast/text/webfont-after-tiny-monospace-text.html:
* platform/qt/fast/spatial-navigation/resources/ensure-scrolls-with-scrollbars-disabled-by-webkit.html:
* platform/qt/fast/spatial-navigation/snav-ensure-scrolls-with-scrollbars-disabled-by-webkit.html:
* platform/win/fast/text/uniscribe-item-boundary-crash.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[SVG] Tref target event listener cleanup
https://bugs.webkit.org/show_bug.cgi?id=93004

Reviewed by Abhishek Arya.

Source/WebCore:

Currently SVGTRefElement allocates event listeners dynamically as it attaches to its
targets. Synchronizing the lifetime of the target listener vs. the tref element is
error prone, as various events can stack and trigger nested handlers.

In order to reduce complexity and address a couple of outstanding issues, this patch
changes the way event listeners are allocated: only one target listener is created
for the lifetime of the SVGTRefElement, and gets reused if the target element changes.

Test: svg/custom/tref-nested-events-crash.svg

* dom/EventListener.h:
Added new <tref> target event listener type.
* svg/SVGTRefElement.cpp:
(WebCore):
(WebCore::SVGTRefTargetEventListener::create):
(WebCore::SVGTRefTargetEventListener::cast):
(SVGTRefTargetEventListener):
(WebCore::SVGTRefTargetEventListener::isAttached):
(WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener):
(WebCore::SVGTRefTargetEventListener::attach):
(WebCore::SVGTRefTargetEventListener::detach):
(WebCore::SVGTRefTargetEventListener::operator==):
(WebCore::SVGTRefTargetEventListener::handleEvent):
No need to check m_trefElement anymore - the listener is allocated for the whole element
lifetime, detached when the element is removed and deallocated when the element is
destroyed.
(WebCore::SVGTRefElement::SVGTRefElement):
Allocate one target listener per element, at construction time.
(WebCore::SVGTRefElement::~SVGTRefElement):
Detach the listener if necessary.
(WebCore::SVGTRefElement::detachTarget):
Check whether the element is still in document after updating the text (may have been
removed by event handlers).
(WebCore::SVGTRefElement::buildPendingResource):
Attach the event listener before updating the text content to avoid racing with event
handlers (which can remove the element).
(WebCore::SVGTRefElement::removedFrom):
* svg/SVGTRefElement.h:
(WebCore):
(SVGTRefElement):

LayoutTests:

* svg/custom/tref-nested-events-crash-expected.txt: Added.
* svg/custom/tref-nested-events-crash.svg: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Cross-thread-copy a couple more recently added ResourceResponse data members, apparently
these got missed when they were added. And fix a bug with how the m_remoteIPAddress
data member is handled, an isolatedCopy() is needed for thread safety.
https://bugs.webkit.org/show_bug.cgi?id=93158

Reviewed by David Levin.

No new tests, minor cleanup.

* platform/network/chromium/ResourceResponse.cpp:
(WebCore::ResourceResponse::doPlatformCopyData): make deep copies
(WebCore::ResourceResponse::doPlatformAdopt): take ownership of them
* platform/network/chromium/ResourceResponse.h:
(ResourceResponse):
(CrossThreadResourceResponseData):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124682 268f45cc-cd09-0410-ab3c-d52691b4dbfc