Make topCallFrame reliable.
https://bugs.webkit.org/show_bug.cgi?id=98928.

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

- VM entry points and the GC now uses topCallFrame.
- The callerFrame value in CallFrames are now always the previous
  frame on the stack, except for the first frame which has a
  callerFrame of 0 (not counting the HostCallFrameFlag).
  Hence, we can now traverse every frame on the stack all the way
  back to the first frame.
- GlobalExec's will no longer be used as the callerFrame values in
  call frames.
- Added fences and traps for debugging the JSStack in debug builds.

* bytecode/SamplingTool.h:
(SamplingTool):
(JSC::SamplingTool::CallRecord::CallRecord):
* dfg/DFGOperations.cpp:
- Fixed 2 DFG helper functions to flush topCallFrame as expected.
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::prepareForExternalCall):
* interpreter/CallFrame.h:
(JSC::ExecState::callerFrameNoFlags):
(ExecState):
(JSC::ExecState::argIndexForRegister):
(JSC::ExecState::getArgumentUnsafe):
* interpreter/CallFrameClosure.h:
(CallFrameClosure):
* interpreter/Interpreter.cpp:
(JSC):
(JSC::eval):
(JSC::Interpreter::Interpreter):
(JSC::Interpreter::throwException):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
(JSC::Interpreter::prepareForRepeatCall):
(JSC::Interpreter::endRepeatCall):
* interpreter/Interpreter.h:
(JSC):
(Interpreter):
* interpreter/JSStack.cpp:
(JSC::JSStack::JSStack):
(JSC::JSStack::gatherConservativeRoots):
(JSC::JSStack::disableErrorStackReserve):
* interpreter/JSStack.h:
(JSC):
(JSStack):
(JSC::JSStack::installFence):
(JSC::JSStack::validateFence):
(JSC::JSStack::installTrapsAfterFrame):
* interpreter/JSStackInlines.h: Added.
(JSC):
(JSC::JSStack::getTopOfFrame):
(JSC::JSStack::getTopOfStack):
(JSC::JSStack::getStartOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
(JSC::JSStack::generateFenceValue):
(JSC::JSStack::installFence):
(JSC::JSStack::validateFence):
(JSC::JSStack::installTrapsAfterFrame):
* jit/JITStubs.cpp:
(JSC::jitCompileFor):
(JSC::lazyLinkFor):
- Set frame->codeBlock to 0 for both the above because they are called
  with partially intitialized frames (cb uninitialized), but may
  trigger a GC.
(JSC::DEFINE_STUB_FUNCTION):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):

LayoutTests: 

- Re-baseline some tests to match the new stack dump results.

* http/tests/inspector/console-resource-errors-expected.txt:
* http/tests/inspector/stacktraces/csp-injected-content-warning-contains-stacktrace-expected.txt:
* http/tests/inspector/stacktraces/csp-inline-warning-contains-stacktrace-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132182 268f45cc-cd09-0410-ab3c-d52691b4dbfc
When blocking localStorage, Firefox throws a security exception on access, and maybe so should we
https://bugs.webkit.org/show_bug.cgi?id=63257

Patch by Dan Carney <dcarney@google.com> on 2012-10-23
Reviewed by Jochen Eisinger.

Source/WebCore:

Throw security exception when local storage is accessed
under certain circumstances to match firefox.

No new tests. Existing tests modified.

* bindings/js/JSStorageCustom.cpp:
(WebCore::JSStorage::canGetItemsForName):
(WebCore::JSStorage::nameGetter):
(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::getOwnPropertyNames):
* bindings/v8/custom/V8StorageCustom.cpp:
(WebCore):
(WebCore::setDOMException):
(WebCore::V8Storage::namedPropertyEnumerator):
(WebCore::storageGetter):
(WebCore::V8Storage::namedPropertyQuery):
(WebCore::storageDeleter):
* inspector/InspectorDOMStorageAgent.cpp:
(WebCore::InspectorDOMStorageAgent::getDOMStorageEntries):
(WebCore::InspectorDOMStorageAgent::removeDOMStorageItem):
* page/DOMWindow.cpp:
(WebCore::DOMWindow::sessionStorage):
(WebCore::DOMWindow::localStorage):
* storage/Storage.cpp:
* storage/Storage.h:
(WebCore):
(WebCore::Storage::length):
(WebCore::Storage::key):
(WebCore::Storage::getItem):
(WebCore::Storage::setItem):
(WebCore::Storage::removeItem):
(WebCore::Storage::clear):
(WebCore::Storage::contains):
* storage/Storage.idl:
* storage/StorageArea.h:
(StorageArea):
* storage/StorageAreaImpl.cpp:
(WebCore::StorageAreaImpl::canAccessStorage): Checks whether access to storage is a security violation.
(WebCore):
(WebCore::StorageAreaImpl::disabledByPrivateBrowsingInFrame):
(WebCore::StorageAreaImpl::length):
(WebCore::StorageAreaImpl::key):
(WebCore::StorageAreaImpl::getItem):
(WebCore::StorageAreaImpl::setItem):
(WebCore::StorageAreaImpl::removeItem):
(WebCore::StorageAreaImpl::clear):
(WebCore::StorageAreaImpl::contains):
* storage/StorageAreaImpl.h:
(StorageAreaImpl):

Source/WebKit/chromium:

Add security check and security check cache.

* src/StorageAreaProxy.cpp:
(WebCore::StorageAreaProxy::StorageAreaProxy):
(WebCore::StorageAreaProxy::length):
(WebCore::StorageAreaProxy::key):
(WebCore::StorageAreaProxy::getItem):
(WebCore::StorageAreaProxy::setItem):
(WebCore::StorageAreaProxy::removeItem):
(WebCore::StorageAreaProxy::clear):
(WebCore::StorageAreaProxy::contains):
(WebCore::StorageAreaProxy::canAccessStorage):
* src/StorageAreaProxy.h:
(StorageAreaProxy):
(WebCore::StorageAreaProxy::canAccessStorage):

LayoutTests:

Adjust tests to handle new exceptions.

* fast/storage/storage-detached-iframe-expected.txt:
* fast/storage/storage-detached-iframe.html:
* platform/chromium/permissionclient/storage-permission-expected.txt:
* platform/chromium/permissionclient/storage-permission.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132183 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] Compilation warning in GraphicsContext3DPrivate.cpp when AC is enabled
https://bugs.webkit.org/show_bug.cgi?id=99723

Patch by Sudarsana Nagineni <sudarsana.nagineni@intel.com> on 2012-10-23
Reviewed by Kenneth Rohde Christiansen.

Fix compilation warning in GraphicsContext3DPrivate.cpp when AC is
enabled.

No new tests, no change in behavior.

* platform/graphics/efl/GraphicsContext3DPrivate.cpp:
(WebCore::GraphicsContext3DPrivate::createSurface):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132184 268f45cc-cd09-0410-ab3c-d52691b4dbfc