Remove use of ClassInfo in SpeculativeJIT::emitBranch
https://bugs.webkit.org/show_bug.cgi?id=95623

Reviewed by Filip Pizlo.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127343 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. CSS_VARIABLES are not enabled on Windows. Adding Windows specific results.

* platform/win/fast/css/variables: Added.
* platform/win/fast/css/variables/build-supports-variables-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127344 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.

    Shrink activation objects by half
    https://bugs.webkit.org/show_bug.cgi?id=95591

    Reviewed by Sam Weinig.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_resolve_global_dynamic):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/JSActivation.cpp:
(JSC::JSActivation::JSActivation):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
* runtime/JSGlobalData.h:
(JSGlobalData):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::withScopeStructure):
(JSC::JSGlobalObject::strictEvalActivationStructure):
(JSC::JSGlobalObject::activationStructure):
(JSC::JSGlobalObject::nameScopeStructure):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127345 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make computeBlockDirectionMargins const
https://bugs.webkit.org/show_bug.cgi?id=95595

Reviewed by Ojan Vafai.

This is a step in making computeLogicalHeight const.
Refactor RenderBox::computeBlockDirectionMargins and make it const.
Add a helper method computeAndSetBlockDirectionMargins for the callers outside of
computeLogicalHeight that are calling this.

No new tests, this is already covered by tests in fast/writing-mode and fast/multicol.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::marginBeforeEstimateForChild): Switch to computeAndSetBlockDirectionMargins
(WebCore::RenderBlock::layoutBlockChild): Switch to computeAndSetBlockDirectionMargins
(WebCore::RenderBlock::insertFloatingObject): Switch to computeAndSetBlockDirectionMargins
* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeLogicalHeight): Use const version and fill in a MarginValues struct (to be merged in the next patch).
(WebCore::RenderBox::computeBlockDirectionMargins): Pass in out params.
(WebCore):
(WebCore::RenderBox::computeAndSetBlockDirectionMargins): Does the same as the old computeBlockDirectionMargins.
* rendering/RenderBox.h:
(RenderBox):
* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Switch to computeAndSetBlockDirectionMargins
(WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Switch to computeAndSetBlockDirectionMargins
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::layout): Switch to computeAndSetBlockDirectionMargins


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127346 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: fast/loader/document-destruction-within-unload.html causes assertion failures on mac and qt.
https://bugs.webkit.org/show_bug.cgi?id=66783

Reviewed by Darin Adler.

This was a not-quite-regression from trac.webkit.org/changeset/93521, in that we hit asserts
in a case where we previously were use-after-freeing. Tweak how we handle cases where a Document
is cleared from within an unload handler.

No new tests, fixing fast/loader/document-destruction-within-unload.html on mac and qt.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::setDocumentLoader): Instead of trying to reattach a partially removed
    DocumentLoader if it is detached before being fully added, leave the old one in place, completed.
(WebCore::FrameLoader::transitionToCommitted):

LayoutTests: Unskip fast/loader/document-destruction-within-unload.html
on mac and qt.
https://bugs.webkit.org/show_bug.cgi?id=66783

Reviewed by Darin Adler.

* platform/mac/Skipped:
* platform/qt/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127347 268f45cc-cd09-0410-ab3c-d52691b4dbfc