Race condition between GCThread and main thread during copying phase
https://bugs.webkit.org/show_bug.cgi?id=99641

Reviewed by Filip Pizlo.

When a GCThread returns from copyFromShared(), it then calls doneCopying(), which returns
its borrowed CopiedBlock to the CopiedSpace. This final block allows the CopiedSpace to
continue and finish the cleanup of the copying phase. However, the GCThread can loop back
around, see that m_currentPhase is still "Copy", and try to go through the copying phase again.
This can cause all sorts of issues. To fix this, we should add a cyclic barrier to GCThread::waitForNextPhase().

* heap/GCThread.cpp:
(JSC::GCThread::waitForNextPhase): All GCThreads will wait when they finish one iteration until the main thread
notifies them to move down to the second while loop, where they wait for the next GCPhase to start. They also
decrement the m_numberOfActiveGCThreads counter as they begin to wait for the next phase and increment it as
they enter the next phase. This allows the main thread to wait in endCurrentPhase() until all the threads have
finished the current phase and are waiting on the next phase to begin. Without the counter, there would be
no way to ensure that every thread was available for each GCPhase.
(JSC::GCThread::gcThreadMain): We now use the m_phaseLock to synchronize with the main thread when we're being created.
* heap/GCThreadSharedData.cpp:
(JSC::GCThreadSharedData::GCThreadSharedData): As we create each GCThread, we increment the m_numberOfActiveGCThreads
counter. When we are done creating the threads, we wait until they're all waiting for the next GCPhase. This prevents
us from leaving some GCThreads behind during the first GCPhase, which could hurt us on our very short-running
benchmarks (e.g. SunSpider).
(JSC::GCThreadSharedData::~GCThreadSharedData):
(JSC::GCThreadSharedData::startNextPhase): We atomically swap the two flags, m_gcThreadsShouldWait and m_currentPhase,
so that if the threads finish very quickly, they will wait until the main thread is ready to end the current phase.
(JSC::GCThreadSharedData::endCurrentPhase): Here atomically we swap the two flags again to allow the threads to
advance to waiting on the next GCPhase. We wait until all of the GCThreads have settled into the second wait loop
before allowing the main thread to continue. This prevents us from leaving one of the GCThreads stuck in the first
wait loop if we were to call startNextPhase() before it had time to wake up and move on to the second wait loop.
(JSC):
(JSC::GCThreadSharedData::didStartMarking): We now use startNextPhase() to properly swap the flags.
(JSC::GCThreadSharedData::didFinishMarking): Ditto for endCurrentPhase().
(JSC::GCThreadSharedData::didStartCopying): Ditto.
(JSC::GCThreadSharedData::didFinishCopying): Ditto.
* heap/GCThreadSharedData.h:
(GCThreadSharedData):
* heap/Heap.cpp:
(JSC::Heap::copyBackingStores): No reason to use the extra reference.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131791 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix.

* Scripts/webkit2/messages.py:
(message_to_struct_declaration):
(generate_messages_header):
* Scripts/webkit2/messages_unittest.py:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131792 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in InRegionScrollableArea constructor while loading page
https://bugs.webkit.org/show_bug.cgi?id=99733

Patch by John Griggs <jgriggs@rim.com> on 2012-10-18
Reviewed by Antonio Gomes.

Check scrollLayer and avoid constructing InRegionScrollableArea when it is NULL.

* Api/InRegionScroller.cpp:
(BlackBerry::WebKit::InRegionScrollerPrivate::calculateInRegionScrollableAreasForPoint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131793 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit Doesn't Recognize Content-Language HTTP Header
https://bugs.webkit.org/show_bug.cgi?id=97929

Patch by Brian White <bcwhite@chromium.org> on 2012-10-18
Reviewed by Alexey Proskuryakov.

The HTTP "Content-Language" header may be present and include the
language of the page contents (as opposed to an embedded meta tag).

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::didBeginDocument):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131794 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] GraphicsContext3D::m_renderStyle is not initialized
https://bugs.webkit.org/show_bug.cgi?id=99721

Patch by Yael Aharon <yael.aharon@intel.com> on 2012-10-18
Reviewed by Antonio Gomes.

Initialize GraphicsContext3D::m_renderStyle.

No new tests, no new functionality.

* platform/graphics/efl/GraphicsContext3DEfl.cpp:
(WebCore::GraphicsContext3D::GraphicsContext3D):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131796 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Teach prepare-ChangeLog how to handle non-function properties in JavaScript prototypes.

https://bugs.webkit.org/show_bug.cgi?id=99747

Reviewed by Joseph Pecoraro.

* Scripts/prepare-ChangeLog:
(get_function_line_ranges_for_javascript): Clear currentIdentifiers when comma is encountered
so it does not tack those identifiers onto the next changed function.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131798 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Add 10.8 bot into fallback path, make work with garden-o-matic
https://bugs.webkit.org/show_bug.cgi?id=99748

Reviewed by Ryosuke Niwa.

Subject pretty much says it all ...

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
* Scripts/webkitpy/layout_tests/port/builders.py:
* Scripts/webkitpy/layout_tests/port/chromium_mac.py:
(ChromiumMacPort):
* Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
(ChromiumMacPortTest.test_versions):
(ChromiumMacPortTest.test_baseline_path):
* Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
(TestRebaseline.test_baseline_directory):
(test_rebaseline_and_copy_test_with_lion_result):
(test_rebaseline_expectations):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
webkitpy: fix chromium bot configs in builders.py
https://bugs.webkit.org/show_bug.cgi?id=99638

Reviewed by Ojan Vafai.

Updating after the great bot-renaming and deleting a test case
that is no longer needed.

* Scripts/webkitpy/layout_tests/port/builders.py:
* Scripts/webkitpy/tool/servers/gardeningserver_unittest.py:
(BuildCoverageExtrapolatorTest.test_extrapolate):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131800 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Build fix after r131701 and r131777.

* WebKit.vcproj/WebKit.sln:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* win/WebKit2.def:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131801 268f45cc-cd09-0410-ab3c-d52691b4dbfc
PageViewportController::m_rawAttributes.devicePixelRatio is not initialized
https://bugs.webkit.org/show_bug.cgi?id=99751

Patch by Yael Aharon <yael.aharon@intel.com> on 2012-10-18
Reviewed by Antonio Gomes.

PageViewportController::m_rawAttributes.devicePixelRatio needs to be initialized.
Due to race condition, we could set the viewport attributes before the first layout.
If that happens, PageViewportController::m_rawAttributes.devicePixelRatio
is used without being initialized.

* UIProcess/PageViewportController.cpp:
(WebKit::PageViewportController::PageViewportController):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131802 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, update Qt expectations for slider tests.

fast/events/touch/touch-slider.html now has a specific bug number.
media/video-playing-and-pause.html is removed. I added it by accident
causing it to be run. Qt didn't run this test before my change.

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131803 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=99668
REGRESSION: Crash in 
WebCore::ScrollingStateScrollingNode::setNonFastScrollableRegion
-and corresponding-
<rdar://problem/12491901>

Reviewed by Simon Fraser.

http://trac.webkit.org/changeset/130783 changed the lifetime of the 
ScrollingStateTree's rootStateNode. Before that patch, the root state 
node was never destroyed. It was just constantly re-used for 
different RenderLayerBackings. This crash is just one of a few bugs 
that has occurred because of that change. I have fixed the other bugs 
individually, but I think that long-term, it is the safest solution 
to go back to the original ownership model.

So this patch ensures that the state tree will always have a root 
state node. Instead of destroying and re-creating the root node when 
it's scroll ID changes, we just update the ID.

attachToStateTree() now takes an additional ID representing the ID of 
the parent node.
* page/scrolling/ScrollingCoordinator.h:
(WebCore::ScrollingCoordinator::attachToStateTree):

Add a way to set the scrolling node ID.
* page/scrolling/ScrollingStateNode.h:
(WebCore::ScrollingStateNode::setScrollingNodeID):

This code that provided a way to mark all properties as having 
changed was added in http://trac.webkit.org/changeset/130989 as a way 
to ensure we would re-set ScrollingThread's nodes when we destroyed 
and re-created the rootStateNode. Now that we are no longer 
destroying and re-creating the rootStateNode, this code is no longer 
necessary.
* page/scrolling/ScrollingStateScrollingNode.cpp:
* page/scrolling/ScrollingStateScrollingNode.h:

create m_rootStateNode right in the ScrollingStateTree's constructor.
* page/scrolling/ScrollingStateTree.cpp:
(WebCore::ScrollingStateTree::ScrollingStateTree):

Don't let removeNode() destroy m_rootStateNode.
(WebCore::ScrollingStateTree::removeNode):

Also a part of r130989 that is no longer needed.
(WebCore::ScrollingStateTree::rootLayerDidChange():
* page/scrolling/ScrollingStateTree.h:
(WebCore::ScrollingStateTree::rootStateNode):
(ScrollingStateTree):
(WebCore::ScrollingStateTree::setRootStateNode):

attachToStateTree() now takes an additional ID representing the ID of 
the parent node.
* page/scrolling/mac/ScrollingCoordinatorMac.h:
(ScrollingCoordinatorMac):

We no longer need ScrollingStateTree::rootLayerDidChange()
* page/scrolling/mac/ScrollingCoordinatorMac.mm:
(WebCore::ScrollingCoordinatorMac::frameViewRootLayerDidChange):

Do not destroy and re-create the state node. Just update its ID. When 
we support child nodes soon, we will create them in this function.
(WebCore::ScrollingCoordinatorMac::attachToStateTree):

No need to null-check the rootStateNode.
(WebCore::ScrollingCoordinatorMac::clearStateTree):

Send 0 as the parent node ID to attachToStateTree() to represent the 
root node.
(WebCore::ScrollingCoordinatorMac::ensureRootStateNodeForFrameView):
* rendering/RenderLayerBacking.cpp:

RenderLayerBacking::attachToScrollingCoordinator() now takes a parent 
layer.
(WebCore::RenderLayerBacking::attachToScrollingCoordinator):
* rendering/RenderLayerBacking.h:
(RenderLayerBacking):

Since this is the root, send 0 to represent the parent layer.
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::updateBacking):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131804 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Handle if we fail to allocate nonPlatformCanvas in ImageBuffer constructor
https://bugs.webkit.org/show_bug.cgi?id=99752

Reviewed by Stephen White.

Current code does not check if we were able to allocate the pixels, but still returns the canvas.
However, the caller explicitly is checking for null on failure, so it will continue (and possibly
crash later on).
This change brings the nonPlatformCanvas behavior inline with createAcceleratedCanvas and
TryCreateBitmapCanvas, both of which are also called by ImageBuffer's constructor.

No new tests. Existing tests exercise ImageBuffer constructor.

* platform/graphics/skia/ImageBufferSkia.cpp:
(WebCore::createNonPlatformCanvas):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131805 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Replace uses of ArgumentEncoder/ArgumentDecoder with MessageEncoder/MessageDecoder
https://bugs.webkit.org/show_bug.cgi?id=99746

Reviewed by Andreas Kling.

Change all occurrences of ArgumentDecoder* to MessageDecoder& and all occurrences of ArgumentEncoder*
to ArgumentEncoder& in all the message receivers. This is the second step towards getting rid of MessageID.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131807 268f45cc-cd09-0410-ab3c-d52691b4dbfc