REGRESSION (r123848): Heap-use-after-free in WebCore::CachedResource::didAddClient.
https://bugs.webkit.org/show_bug.cgi?id=93632
-and corresponding-
<http://crbug.com/140656>

Patch by Huang Dongsung <luxtella@company100.net> on 2012-08-10
Reviewed by Antti Koivisto.

CachedCSSStyleSheet::didAddClient() calls CachedStyleSheetClient::setCSSStyleSheet
and HTMLLnkElement can be CachedStyleSheetClient.
HTMLLinkElement::setCSSStyleSheet may cause scripts to be executed, which could
destroy the HTMLLinkElement instance. After calliing
CachedStyleSheetClient::setCSSStyleSheet, using the CachedStyleSheetClient
instance can cause Heap-use-after-free.

r115625 prevents HTMLLinkElement from being destroyed during
HTMLLinkElement::setCSSStyleSheet, but r115625 doesn't prevent HTMLLinkElement
from being destroyed after HTMLLinkElement::setCSSStyleSheet.

So this patch calls CachedResource::didAddClient() before calling
setCSSStyleSheet() to make sure its client is not destroyed.

No new tests. it's covered by fast/css/cached-sheet-restore-crash.html.

* loader/cache/CachedCSSStyleSheet.cpp:
(WebCore::CachedCSSStyleSheet::didAddClient):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125292 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove custom bindings from WaveShaperNode.
https://bugs.webkit.org/show_bug.cgi?id=93613

Patch by Vineet Chaudhary <rgf748@motorola.com> on 2012-08-10
Reviewed by Kentaro Hara.

We should remove custom bindings as CodeGenerator uses UNUSED_PARAM macro.

TestObj.idl
No behavioural changes.
All tests under webaudio/* should behave same.

* GNUmakefile.list.am: Removed JSWaveShaperNodeCustom.cpp from builds.
* Modules/webaudio/WaveShaperNode.idl: Removed [JSCustomSetter].
* UseJSC.cmake: Removed JSWaveShaperNodeCustom.cpp from builds.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* bindings/js/JSWaveShaperNodeCustom.cpp: Removed.
* bindings/scripts/CodeGeneratorCPP.pm:
(SkipAttribute): Skip TypedArray attribute.
* bindings/scripts/CodeGeneratorGObject.pm:
(SkipAttribute): Skip TypedArray attribute.
* bindings/scripts/CodeGeneratorObjC.pm:
(SkipAttribute): Skip TypedArray attribute.
* bindings/scripts/test/JS/JSTestObj.cpp: Bindings tests.
(WebCore::jsTestObjTypedArrayAttr):
(WebCore::setJSTestObjReflectedCustomURLAttr):
(WebCore::setJSTestObjTypedArrayAttr):
* bindings/scripts/test/JS/JSTestObj.h:
* bindings/scripts/test/TestObj.idl: Test.
* bindings/scripts/test/V8/V8TestObj.cpp: Bindings tests.
(WebCore::TestObjV8Internal::typedArrayAttrAttrGetter):
(TestObjV8Internal):
(WebCore::TestObjV8Internal::typedArrayAttrAttrSetter):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125293 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS: Shrink RuleData by storing selector as index rather than pointer.
<http://webkit.org/b/93712>

Reviewed by Antti Koivisto.

Pack the selector's index in the rule in the RuleData bitfield, effectively
shrinking each RuleData by 8 bytes.

* css/CSSSelectorList.h:
(WebCore::CSSSelectorList::selectorAt):
(WebCore::CSSSelectorList::indexOfNextSelectorAfter):

    Add helpers to CSSSelectorList to iterate by index.

* css/StyleResolver.cpp:
(RuleData):
(WebCore::RuleData::selector):
(WebCore::RuleData::selectorIndex):
(SameSizeAsRuleData):
(RuleSet):
(WebCore::makeRuleSet):
(WebCore::StyleResolver::collectMatchingRulesForList):
* css/StyleResolver.h:
(WebCore::StyleResolver::RuleFeature::RuleFeature):
(RuleFeature):

    Store selector indices instead of CSSSelector* pointers.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125294 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static
https://bugs.webkit.org/show_bug.cgi?id=93615

Reviewed by Adam Barth.

Per the discussion in bug 93239,

(1) Rename V8ConfigureDOMAttributesAndMethods to V8DOMConfiguration.
(2) Introduce V8DOMConfiguration class and make batchConfigureXXX() methods static.

No tests. No change in behavior.

* UseV8.cmake:
* WebCore.gypi:
* bindings/scripts/CodeGeneratorV8.pm:
(GenerateImplementation):
* bindings/scripts/test/V8/V8Float64Array.cpp:
(WebCore):
(WebCore::ConfigureV8Float64ArrayTemplate):
* bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
(WebCore):
(WebCore::ConfigureV8TestActiveDOMObjectTemplate):
* bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
(WebCore):
(WebCore::ConfigureV8TestCustomNamedGetterTemplate):
* bindings/scripts/test/V8/V8TestEventConstructor.cpp:
(WebCore):
(WebCore::ConfigureV8TestEventConstructorTemplate):
* bindings/scripts/test/V8/V8TestEventTarget.cpp:
(WebCore):
(WebCore::ConfigureV8TestEventTargetTemplate):
* bindings/scripts/test/V8/V8TestException.cpp:
(WebCore):
(WebCore::ConfigureV8TestExceptionTemplate):
* bindings/scripts/test/V8/V8TestInterface.cpp:
(WebCore):
(WebCore::ConfigureV8TestInterfaceTemplate):
* bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
(WebCore):
(WebCore::ConfigureV8TestMediaQueryListListenerTemplate):
* bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
(WebCore::ConfigureV8TestNamedConstructorTemplate):
* bindings/scripts/test/V8/V8TestNode.cpp:
(WebCore::ConfigureV8TestNodeTemplate):
* bindings/scripts/test/V8/V8TestObj.cpp:
(WebCore):
(WebCore::ConfigureV8TestObjTemplate):
(WebCore::V8TestObj::installPerContextProperties):
* bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
(WebCore):
(WebCore::ConfigureV8TestSerializedScriptValueInterfaceTemplate):
* bindings/v8/V8Binding.h:
* bindings/v8/V8ConfigureDOMAttributesAndMethods.h: Removed.
* bindings/v8/V8DOMConfiguration.cpp: Renamed from Source/WebCore/bindings/v8/V8ConfigureDOMAttributesAndMethods.cpp.
(WebCore):
(WebCore::V8DOMConfiguration::batchConfigureAttributes):
(WebCore::V8DOMConfiguration::batchConfigureConstants):
(WebCore::V8DOMConfiguration::batchConfigureCallbacks):
(WebCore::V8DOMConfiguration::configureTemplate):
* bindings/v8/V8DOMConfiguration.h: Added.
(WebCore):
(V8DOMConfiguration):
(BatchedAttribute):
(WebCore::V8DOMConfiguration::configureAttribute):
(BatchedConstant):
(BatchedCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125295 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Enable es5_readonly
https://bugs.webkit.org/show_bug.cgi?id=91031

Reviewed by Adam Barth.

This turns on the es5_readonly flag for V8. This makes V8 match the ES5 spec regarding
non writable properties on the prototype chain. JSC already behaves the right so this
just makes V8 behave the same.

Source/WebCore:

Updated test expectations.

* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::initContextIfNeeded):
* bindings/v8/WorkerContextExecutionProxy.cpp:
(WebCore::WorkerContextExecutionProxy::initIsolate):

LayoutTests:

* platform/chromium/media/network-no-source-const-shadow-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125296 268f45cc-cd09-0410-ab3c-d52691b4dbfc