Windows Fibers can corrupt the cached StackBounds
https://bugs.webkit.org/show_bug.cgi?id=102411

Reviewed by Geoffrey Garen.

Windows has support for something called fibers, which are like lightweight versions of 
threads. Multiple fibers can run within the context of a single thread and they have access 
to the same thread local storage but have different stacks. If we create a new JSGlobalContext 
on one fiber, then switch to another fiber and create a JSGlobalContext there, we will call 
initializeThreading() once for each new JSGlobalContext created. However, since these fibers 
are technically running inside the same thread, they will clobber each other's wtfThreadData(), 
which is stored using thread local storage. This can lead to corruption of the WTFThreadData 
structure for the fibers other than the last one to create a new JSGlobalContext, including 
the StackBounds data structure which is used during conservative scanning, among other things. 
This can lead to crashes during garbage collection on Windows if fibers are used.

A quick fix would be to always get a fresh StackBounds data structure when asking for it 
instead of using the cached version from the thread local storage. There is a larger problem 
in that these fibers can corrupt other WebKit data that uses thread local storage. We'll leave 
those theoretical fixes for future theoretical bugs.

* wtf/WTFThreadData.h:
(WTF::WTFThreadData::stack): We now refresh the m_stackBounds field whenever somebody asks for 
the StackBounds.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134797 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Correct syntax of old-style IDL files
https://bugs.webkit.org/show_bug.cgi?id=102335

Reviewed by Adam Barth.

Recently tasak@ corrected an IDL syntax of almost all IDL files.
We should correct the rest of them.

No tests. No change in behavior.

* html/canvas/OESElementIndexUint.idl:
* page/PerformanceMark.idl:
* page/PerformanceMeasure.idl:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134798 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r134649 and r134665.
http://trac.webkit.org/changeset/134649
http://trac.webkit.org/changeset/134665
https://bugs.webkit.org/show_bug.cgi?id=102413

Broke a ton of downstream chromium tests (Requested by japhet
on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-11-15

Source/WebCore:

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::DocumentLoader):
(WebCore::DocumentLoader::~DocumentLoader):
(WebCore::DocumentLoader::finishedLoading):
(WebCore::DocumentLoader::clearMainResourceLoader):
(WebCore::DocumentLoader::isLoadingInAPISense):
(WebCore::DocumentLoader::documentURL):
(WebCore::DocumentLoader::isLoadingMainResource):
(WebCore::DocumentLoader::startLoadingMainResource):
* loader/DocumentLoader.h:
(DocumentLoader):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::FrameLoader):
(WebCore::FrameLoader::init):
* loader/FrameLoaderStateMachine.cpp:
(WebCore::FrameLoaderStateMachine::FrameLoaderStateMachine):
* loader/FrameLoaderStateMachine.h:
* loader/MainResourceLoader.cpp:
(WebCore::shouldLoadAsEmptyDocument):
(WebCore):
(WebCore::MainResourceLoader::continueAfterContentPolicy):
(WebCore::MainResourceLoader::didReceiveResponse):
(WebCore::MainResourceLoader::didFinishLoading):
(WebCore::MainResourceLoader::handleEmptyLoad):
(WebCore::MainResourceLoader::loadNow):
(WebCore::MainResourceLoader::load):
* loader/MainResourceLoader.h:
(MainResourceLoader):

Tools:

* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::updateForCommittedLoad):

LayoutTests:

* http/tests/inspector/network/network-iframe-load-and-delete.html:
* http/tests/loading/redirect-methods-expected.txt:
* http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt:
* http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt:
* http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MediaStream API: Update RTCPeerConnection states to match the latest editors draft
https://bugs.webkit.org/show_bug.cgi?id=102382

Reviewed by Adam Barth.

Source/Platform:

Adding a callback for the new RTCPeerConnection::iceGatheringState.

* chromium/public/WebRTCPeerConnectionHandlerClient.h:
(WebKit::WebRTCPeerConnectionHandlerClient::didChangeICEGatheringState):

Source/WebCore:

Updating readyState & iceState, and adding iceGatheringState.
Also safeguarding the event timer callback.

Patch covered by existing tests.

* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::RTCPeerConnection):
(WebCore::RTCPeerConnection::createOffer):
(WebCore::RTCPeerConnection::createAnswer):
(WebCore::RTCPeerConnection::setLocalDescription):
(WebCore::RTCPeerConnection::localDescription):
(WebCore::RTCPeerConnection::setRemoteDescription):
(WebCore::RTCPeerConnection::remoteDescription):
(WebCore::RTCPeerConnection::updateIce):
(WebCore::RTCPeerConnection::addIceCandidate):
(WebCore::RTCPeerConnection::readyState):
(WebCore::RTCPeerConnection::iceGatheringState):
(WebCore):
(WebCore::RTCPeerConnection::iceState):
(WebCore::RTCPeerConnection::addStream):
(WebCore::RTCPeerConnection::close):
(WebCore::RTCPeerConnection::didChangeIceGatheringState):
(WebCore::RTCPeerConnection::stop):
(WebCore::RTCPeerConnection::changeReadyState):
(WebCore::RTCPeerConnection::scheduledEventTimerFired):
* Modules/mediastream/RTCPeerConnection.h:
(RTCPeerConnection):
* Modules/mediastream/RTCPeerConnection.idl:
* dom/EventNames.h:
(WebCore):
* platform/mediastream/RTCPeerConnectionHandlerClient.h:
(RTCPeerConnectionHandlerClient):
* platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp:
(WebCore::RTCPeerConnectionHandlerChromium::didChangeICEGatheringState):
(WebCore):
* platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h:
(RTCPeerConnectionHandlerChromium):

Source/WebKit/chromium:

Updating readyState & iceState, and adding iceGatheringState.

* src/AssertMatchingEnums.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@134800 268f45cc-cd09-0410-ab3c-d52691b4dbfc