Iterating backwards over HTMLCollection is O(n^2)
https://bugs.webkit.org/show_bug.cgi?id=91306

Reviewed by Anders Carlsson.

Source/WebCore: 

Fixed the bug by introducing itemBefore that iterates nodes backwards to complement itemAfter.
Unfortunately, some HTML collections such as HTMLFormCollection and HTMLTableRowsCollection have
its own itemAfter function and writing an equivalent itemBefore is somewhat tricky. For now,
added a new boolean flag indicating whether a given HTML collection supports itemBefore or not,
and left those HTML collections that override itemAfter alone.

This also paves our way to share more code between DynamicNodeList and HTMLCollection.

Test: perf/htmlcollection-backwards-iteration.html

* dom/DynamicNodeList.h:
(WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Takes ItemBeforeSupportType.
(WebCore::DynamicNodeListCacheBase::supportsItemBefore): Added.
(DynamicNodeListCacheBase):
(WebCore::DynamicNodeListCacheBase::setItemCache): Replaced a FIXME by an assertion now that
we can.
* html/HTMLAllCollection.cpp:
(WebCore::HTMLAllCollection::HTMLAllCollection): Supports itemBefore since it doesn't override
itemAfter.
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::HTMLCollection):
(WebCore::HTMLCollection::create):
(WebCore::isAcceptableElement): Made it a static local function instead of a static member.
(WebCore::nextNode): Templatized.
(WebCore::itemBeforeOrAfter): Extracted from itemAfter and templatized.
(WebCore::HTMLCollection::itemBefore): Added.
(WebCore::HTMLCollection::itemAfter):
(WebCore::HTMLCollection::shouldSearchFromFirstItem): Added. Determines whether we should reset
the item cache to the first item. We obviously do if the cache is invalid. If the target offset
is after the cached offset, then we shouldn't go back regardless of availability of itemBefore.
Otherwise, we go back to the first item iff itemBefore is not available or the distance from
the cached offset to the target offset is greater than the target offset itself.
(WebCore::HTMLCollection::length):
(WebCore::HTMLCollection::item): Use the term "offset" to match the terminology elsewhere.
(WebCore::HTMLCollection::itemBeforeOrAfterCachedItem): Ditto. Also added the logic to iterate
nodes backwards using itemBefore. Once we're in this branch, we should always find a matching
item since the target offset was less than the cached offset, and offsets are non-negative.
If we had ever reached the end of the loop without finding an item, it indicates that the cache
has been invalid and we have some serious bug elsewhere.
* html/HTMLCollection.h:
(WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
(HTMLCollection):
* html/HTMLOptionsCollection.cpp:
(WebCore::HTMLOptionsCollection::HTMLOptionsCollection): Supports itemBefore since it doesn't
override itemAfter.
* html/HTMLFormCollection.cpp:
(WebCore::HTMLFormCollection::HTMLFormCollection): Doesn't support itemBefore as it overrides
itemAfter.
* html/HTMLNameCollection.cpp:
(WebCore::HTMLNameCollection::HTMLNameCollection): Ditto.
* html/HTMLPropertiesCollection.cpp:
(WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
* html/HTMLTableRowsCollection.cpp:
(WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):

LayoutTests: 

Add an asymptotic time complexity test.

* perf/htmlcollection-backwards-iteration-expected.txt: Added.
* perf/htmlcollection-backwards-iteration.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122660 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening, adding an image expectation for a test introduced
in r122651. Also creating platform-specific baselines for two File API tests
that behave differently because of function overloading problems but pass otherwise,
and skipping a test for correct viewport of sites with Mobile DTD which GTK port
does not (yet) support.

* platform/gtk/TestExpectations:
* platform/gtk/fast/files/create-blob-url-crash-expected.txt: Added.
* platform/gtk/fast/files/url-required-arguments-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122661 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening, marking http/tests/misc/webtiming-origins.html as flaky.

* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS 2.1 failure: vertical-align-boxes-001 fails
https://bugs.webkit.org/show_bug.cgi?id=90626

Reviewed by Eric Seidel.

Source/WebCore:

Tests: css2.1/20110323/vertical-align-boxes-001.htm

A percentage value vertical-align is always a percentage of the actual line-height rather than
the margin box per http://www.w3.org/TR/CSS21/visudet.html#propdef-vertical-align: 'Percentages:
refer to the 'line-height' of the element itself'.  Confusingly, RenderBox::lineheight() is a
shorthand into the dimensions of the margin box for replaced elements in the other vertical-align
cases, i.e. where it's the margin box that's relevant rather than the 'line-height'. So rather than patch RenderBox's
lineHeight() to somehow consider the percentage cases, just give percentage vertical-align the full computedLineHeight()
rather than lineHeight()'s margin box.

* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::verticalPositionForBox):

LayoutTests:

* css2.1/20110323/vertical-align-boxes-001-expected.html: Added.
* css2.1/20110323/vertical-align-boxes-001.htm: Added.
  This patch fixes the 'percentage' case in this test so that it calculates 50% of the
  line-height of 60px rather than 50% of the img's margin-box of -8px.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122663 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r122614.
http://trac.webkit.org/changeset/122614
https://bugs.webkit.org/show_bug.cgi?id=91317

Broke performance tests (Requested by rniwa on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-07-14

* bindings/v8/V8Binding.cpp:
(WebCore::StringCache::v8ExternalStringSlow):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Do not try to update the cache model for every WebPreferences change
https://bugs.webkit.org/show_bug.cgi?id=91302

Patch by Benjamin Poulain <bpoulain@apple.com> on 2012-07-13
Reviewed by Joseph Pecoraro.

Source/WebKit/mac: 

WebView was listening to any change on any WebPreferences in order to update the cache model. This is unneeded in most cases,
we can just listen to updates of the CacheModel property.

* WebView/WebPreferences.mm:
(-[WebPreferences initWithIdentifier:]):
(-[WebPreferences _postCacheModelChangedNotification]):
(-[WebPreferences setCacheModel:]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(+[WebView initialize]):
(+[WebView _cacheModelChangedNotification:]):

Tools: 

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/SetAndUpdateCacheModel.mm: Added.
(TestWebKitAPI):
(TestWebKitAPI::TEST):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122665 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Skip test added in r122663 on Qt and GTK

Unreviewed, gardening.

Qt has 1px difference tracked under
 https://bugs.webkit.org/show_bug.cgi?id=89597
Gtk has a platform-specific rendering issue with the test.
 https://bugs.webkit.org/show_bug.cgi?id=91319

* platform/gtk/TestExpectations:
* platform/qt/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122666 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r122665.
http://trac.webkit.org/changeset/122665
https://bugs.webkit.org/show_bug.cgi?id=91321

Broke Mac builds (Requested by rniwa on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-07-14

Source/WebKit/mac: 

* WebView/WebPreferences.mm:
(-[WebPreferences initWithIdentifier:]):
(-[WebPreferences setCacheModel:]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(+[WebView initialize]):
(+[WebView _preferencesChangedNotification:]):

Tools: 

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/SetAndUpdateCacheModel.mm: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Tests] Unskip not failing tests previously relying on LTC::nodesFromRect implementation
https://bugs.webkit.org/show_bug.cgi?id=46600

Reviewed by Ryosuke Niwa.

These tests no longer relies on LayoutTestController.nodesFromRect but on Internals, and should work
in all platforms.

* platform/chromium/TestExpectations:
* platform/win/Skipped:
* platform/wincairo/Skipped:
* platform/wk2/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122668 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, build fix.

* wtf/Assertions.cpp:
* wtf/Platform.h:
* wtf/unicode/icu/CollatorICU.cpp:
(WTF::Collator::userDefault):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122669 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make it explicit which code paths iOS should use when doing checks based on OS X versions.

Rubber-stamped by David Kilzer.

* WebCore.exp.in:
* accessibility/AccessibilityList.h:
* accessibility/AccessibilityTable.h:
* accessibility/mac/AXObjectCacheMac.mm:
* editing/mac/EditorMac.mm:
* loader/MainResourceLoader.cpp:
* loader/MainResourceLoader.h:
* page/AlternativeTextClient.h:
* page/mac/SettingsMac.mm:
* platform/LocalizedStrings.cpp:
* platform/MemoryPressureHandler.cpp:
* platform/audio/mac/AudioBusMac.mm:
* platform/graphics/Gradient.h:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
* platform/graphics/ca/GraphicsLayerCA.cpp:
* platform/graphics/ca/PlatformCALayer.h:
* platform/graphics/ca/mac/PlatformCALayerMac.mm:
* platform/graphics/ca/mac/TileCache.mm:
* platform/graphics/cg/GraphicsContextCG.cpp:
* platform/graphics/cg/ImageBufferCG.cpp:
* platform/graphics/cg/ImageBufferDataCG.h:
* platform/graphics/cg/ImageCG.cpp:
* platform/graphics/cg/ImageSourceCG.cpp:
* platform/graphics/cocoa/FontPlatformDataCocoa.mm:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
* platform/graphics/mac/ComplexTextController.cpp:
* platform/graphics/mac/ComplexTextControllerCoreText.mm:
* platform/graphics/mac/FontCacheMac.mm:
* platform/graphics/mac/FontCustomPlatformData.cpp:
* platform/graphics/mac/FontMac.mm:
* platform/graphics/mac/GraphicsContextMac.mm:
* platform/graphics/mac/SimpleFontDataMac.mm:
* platform/graphics/mac/WebLayer.h:
* platform/graphics/mac/WebLayer.mm:
* platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
* platform/mac/DisplaySleepDisabler.cpp:
* platform/mac/DisplaySleepDisabler.h:
* platform/mac/HTMLConverter.h:
* platform/mac/HTMLConverter.mm:
* platform/mac/MemoryPressureHandlerMac.mm:
* platform/mac/SharedTimerMac.mm:
* platform/mac/SuddenTermination.mm:
* platform/mac/WebFontCache.mm:
* platform/network/Credential.h:
* platform/network/ResourceHandle.h:
* platform/network/cf/DNSCFNet.cpp:
* platform/network/cf/ProxyServerCFNet.cpp:
* platform/network/cf/ResourceRequest.h:
* platform/network/cf/SocketStreamHandleCFNet.cpp:
* platform/network/mac/AuthenticationMac.mm:
* platform/network/mac/CookieStorageMac.mm:
* platform/network/mac/ResourceHandleMac.mm:
* platform/network/mac/ResourceRequestMac.mm:
* platform/network/mac/WebCoreURLResponse.mm:
* platform/text/TextChecking.h:
* platform/text/cf/HyphenationCF.cpp:
* platform/text/mac/HyphenationMac.mm:
* rendering/RenderLayerBacking.cpp:
* rendering/RenderLayerCompositor.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122670 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the Windows build.

* platform/network/cf/DNSCFNet.cpp: Fix the condition to take Windows in to account.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122671 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Accessing the last item in children should be a constant time operation
https://bugs.webkit.org/show_bug.cgi?id=91320

Reviewed by Ojan Vafai.

Source/WebCore: 

Traverse nodes from the last item when the target offset we're looking for is closer to the last item
than to the cached item. e.g. if the cached item was at offset 0 in the collection and length was 100,
we should not be looking for the item at offset 95 from the cached item.

Note that this trick can be only used in HTML collection that supports itemBefore and when the length
cache is available.

Also broke shouldSearchFromFirstItem into smaller logical pieces to clarify the intents.

Test: perf/htmlcollection-last-item.html

* html/HTMLCollection.cpp:
(WebCore):
(WebCore::HTMLCollection::isLastItemCloserThanLastOrCachedItem):
(WebCore::HTMLCollection::isFirstItemCloserThanCachedItem):
(WebCore::HTMLCollection::item):
* html/HTMLCollection.h:
(HTMLCollection):

LayoutTests: 

Added an asymptotic time complexity test.

* perf/htmlcollection-last-item-expected.txt: Added.
* perf/htmlcollection-last-item.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the Snow Leopard build.

* platform/LocalizedStrings.cpp:
(WebCore::contextMenuItemTagLookUpInDictionary): Fix a typo in the condition so that Snow Leopard
continues to take the expected path.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix Chromium Mac build failure after r122670.

* platform/graphics/mac/ComplexTextController.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Do not try to update the cache model for every WebPreferences change
https://bugs.webkit.org/show_bug.cgi?id=91302

Patch by Benjamin Poulain <bpoulain@apple.com> on 2012-07-14
Reviewed by Joseph Pecoraro.

Source/WebKit/mac: 

WebView was listening to any change on any WebPreferences in order to update the cache model. This is unneeded in most cases,
we can just listen to updates of the CacheModel property.

* WebView/WebPreferences.mm:
(-[WebPreferences initWithIdentifier:]):
(-[WebPreferences _postCacheModelChangedNotification]):
(-[WebPreferences setCacheModel:]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(+[WebView initialize]):
(+[WebView _cacheModelChangedNotification:]):

Tools: 

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/SetAndUpdateCacheModel.mm: Added.
(TestWebKitAPI):
(TestWebKitAPI::TEST):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Enable AVCF hardware video decoding
https://bugs.webkit.org/show_bug.cgi?id=90015
<rdar://problem/10770317>

Reviewed by Anders Carlsson.

Source/WebCore: 

* html/HTMLMediaElement.cpp:
(WebCore):
(WebCore::HTMLMediaElement::mediaPlayerGraphicsDeviceAdapter): New, return the client's graphics 
    device adapter.
* html/HTMLMediaElement.h:

* page/ChromeClient.h:
(WebCore::ChromeClient::graphicsDeviceAdapter): New.

* platform/graphics/MediaPlayer.cpp:
(WebCore::MediaPlayer::graphicsDeviceAdapter): New, ask the media element for the graphics
    device adapter.
* platform/graphics/MediaPlayer.h:

* platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Soft-link AVCFPlayerSetDirect3DDevice
    and AVCFPlayerEnableHardwareAcceleratedVideoDecoderKey.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: 
(WebCore::MediaPlayerPrivateAVFoundationCF::createAVAssetForURL): Pass the current d3d9
    device interface to the AVFWrapper.
(WebCore::AVFWrapper::createAssetForURL): If the d3d9 device implements IDirect3DDevice9Ex,
    tell the AVAsset to enable hardware video decoding.
(WebCore::AVFWrapper::createPlayer): Pass the d3d9 device to the player if it implements IDirect3DDevice9Ex.

* platform/graphics/ca/win/CACFLayerTreeHost.h:
(WebCore::CACFLayerTreeHost::graphicsDeviceAdapter): New, default implementation.

* platform/graphics/ca/win/LegacyCACFLayerTreeHost.h:
(WebCore::LegacyCACFLayerTreeHost::graphicsDeviceAdapter): New, default implementation.
* platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
(WebCore::WKCACFViewLayerTreeHost::graphicsDeviceAdapter): New.
* platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:

* platform/win/SoftLinking.h: Define SOFT_LINK_DLL_IMPORT_OPTIONAL, SOFT_LINK_LOADED_LIBRARY,
    and SOFT_LINK_VARIABLE_DLL_IMPORT_OPTIONAL.

Source/WebKit/win: 

* WebCoreSupport/WebChromeClient.cpp:
(WebChromeClient::graphicsDeviceAdapter): New, return the view's graphics adapter.
* WebCoreSupport/WebChromeClient.h:
(WebChromeClient):

* WebView.cpp:
(WebView::graphicsDeviceAdapter): New, return the layer tree host's graphics adapter.
* WebView.h:
(WebCore):
(WebView):

Source/WebKit2: 

* DerivedSources.make: Define HAVE_AVCF if necessary.

* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit):
(WebKit::WebChromeClient::graphicsDeviceAdapter): New, return the layer tree host's
    graphics adapter.
* WebProcess/WebCoreSupport/WebChromeClient.h:
(WebChromeClient):
* WebProcess/WebPage/LayerTreeHost.h:
(WebCore):
(LayerTreeHost):
(WebKit::LayerTreeHost::graphicsDeviceAdapter): New, default implementation.

* WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h:
(LayerTreeHostCAWin):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rationalize and optimize storage allocation
https://bugs.webkit.org/show_bug.cgi?id=91303

Reviewed by Oliver Hunt.

This implements a backwards bump allocator for copied space storage
allocation, shown in pseudo-code below:
        
    pointer bump(size) {
        pointer tmp = allocator->remaining;
        tmp -= size;
        if (tmp < 0)
            fail;
        allocator->remaining = tmp;
        return allocator->payloadEnd - tmp - size;
    }

The advantage of this allocator is that it:
        
- Only requires one comparison in the common case where size is known to
  not be huge, and this comparison can be done by checking the sign bit
  of the subtraction.
        
- Can be implemented even when only one register is available. This
  register is reused for both temporary storage during allocation and
  for the result.
        
- Preserves the behavior that memory in a block is filled in from lowest
  address to highest address, which allows for a cheap reallocation fast
  path.
        
- Is resilient against the block used for allocation being the last one
  in virtual memory, thereby otherwise leading to the risk of overflow
  in the bump pointer, despite only doing one branch.
        
In order to implement this allocator using the smallest possible chunk
of code, I refactored the copied space code so that all of the allocation
logic is in CopiedAllocator, and all of the state is in either
CopiedBlock or CopiedAllocator. This should make changing the allocation
fast path easier in the future.
        
In order to do this, I needed to add some new assembler support,
particularly for various forms of add(address, register) and negPtr().
        
This is performance neutral. The purpose of this change is to facilitate
further inlining of storage allocation without having to reserve
additional registers or emit too much code.

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::addPtr):
(MacroAssembler):
(JSC::MacroAssembler::negPtr):
* assembler/MacroAssemblerARMv7.h:
(MacroAssemblerARMv7):
(JSC::MacroAssemblerARMv7::add32):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::add32):
(MacroAssemblerX86):
* assembler/MacroAssemblerX86_64.h:
(MacroAssemblerX86_64):
(JSC::MacroAssemblerX86_64::addPtr):
(JSC::MacroAssemblerX86_64::negPtr):
* assembler/X86Assembler.h:
(X86Assembler):
(JSC::X86Assembler::addl_mr):
(JSC::X86Assembler::addq_mr):
(JSC::X86Assembler::negq_r):
* heap/CopiedAllocator.h:
(CopiedAllocator):
(JSC::CopiedAllocator::isValid):
(JSC::CopiedAllocator::CopiedAllocator):
(JSC::CopiedAllocator::tryAllocate):
(JSC):
(JSC::CopiedAllocator::tryReallocate):
(JSC::CopiedAllocator::forceAllocate):
(JSC::CopiedAllocator::resetCurrentBlock):
(JSC::CopiedAllocator::setCurrentBlock):
(JSC::CopiedAllocator::currentCapacity):
* heap/CopiedBlock.h:
(CopiedBlock):
(JSC::CopiedBlock::create):
(JSC::CopiedBlock::zeroFillWilderness):
(JSC::CopiedBlock::CopiedBlock):
(JSC::CopiedBlock::payloadEnd):
(JSC):
(JSC::CopiedBlock::payloadCapacity):
(JSC::CopiedBlock::data):
(JSC::CopiedBlock::dataEnd):
(JSC::CopiedBlock::dataSize):
(JSC::CopiedBlock::wilderness):
(JSC::CopiedBlock::wildernessEnd):
(JSC::CopiedBlock::wildernessSize):
(JSC::CopiedBlock::size):
* heap/CopiedSpace.cpp:
(JSC::CopiedSpace::tryAllocateSlowCase):
(JSC::CopiedSpace::tryAllocateOversize):
(JSC::CopiedSpace::tryReallocate):
(JSC::CopiedSpace::doneFillingBlock):
(JSC::CopiedSpace::doneCopying):
* heap/CopiedSpace.h:
(CopiedSpace):
* heap/CopiedSpaceInlineMethods.h:
(JSC::CopiedSpace::startedCopying):
(JSC::CopiedSpace::allocateBlockForCopyingPhase):
(JSC::CopiedSpace::allocateBlock):
(JSC::CopiedSpace::tryAllocate):
(JSC):
* heap/MarkStack.cpp:
(JSC::SlotVisitor::startCopying):
(JSC::SlotVisitor::allocateNewSpace):
(JSC::SlotVisitor::doneCopying):
* heap/SlotVisitor.h:
(JSC::SlotVisitor::SlotVisitor):
* jit/JIT.h:
* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateBasicStorage):
(JSC::JIT::emitAllocateJSArray):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG PutByVal opcodes should accept more than 3 operands
https://bugs.webkit.org/show_bug.cgi?id=91332

Reviewed by Oliver Hunt.

Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
4 or more operands in the future.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::byValIsPure):
(JSC::DFG::Graph::varArgNumChildren):
(Graph):
(JSC::DFG::Graph::numChildren):
(JSC::DFG::Graph::varArgChild):
(JSC::DFG::Graph::child):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Skip css2.1/20110323/vertical-align-boxes-001.htm
https://bugs.webkit.org/show_bug.cgi?id=91340

Unreviewed EFL gardening. Skipping new test introduced in
r122663 which is failing on EFL port.

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-07-15

* platform/efl/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122679 268f45cc-cd09-0410-ab3c-d52691b4dbfc