Heap-use-after-free in WebCore::StyleResolver::loadPendingImage
https://bugs.webkit.org/show_bug.cgi?id=92606

Reviewed by Abhishek Arya.

Source/WebCore:

Changes StyleResolver's m_pendingImageProperties set to a map, such that for each property we keep
a RefPtr to the CSSValue used to set that property. This ensures that CSSValues are not freed before
they are needed by loadPendingImage.

Test: fast/css/variables/deferred-image-load-from-variable.html

* css/StyleResolver.cpp:
* css/StyleResolver.h:

LayoutTests:

Exercises the codepath where an image is loaded using a url specified via a variable.

* fast/css/variables/deferred-image-load-from-variable-expected.txt: Added.
* fast/css/variables/deferred-image-load-from-variable.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124258 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Prefer the Oracle Java plug-in over the Apple Java plug-in
https://bugs.webkit.org/show_bug.cgi?id=92780

Reviewed by Oliver Hunt.

* UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
(WebKit::findPluginWithBundleIdentifier):
Add a new helper for finding a plug-in with the given bundle identifier.

(WebKit::checkForPreferredPlugin):
Helper function for making sure that an old plug-in is never loaded if a new plug-in is found, and that the old plug-in
is removed from the list of loaded plug-ins if the new plug-in is found.

(WebKit::PluginInfoStore::shouldUsePlugin):
Prefer the Oracle Java plug-in over the Apple Java plug-in.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124259 268f45cc-cd09-0410-ab3c-d52691b4dbfc
StyleResolver::canShareStyleWithElement does not need to use getAttribute for classAttr in the non-SVG case
https://bugs.webkit.org/show_bug.cgi?id=92687

Reviewed by Antti Koivisto.

Previously 10% of samples in canShareStyleWithElement hit this line, after this change < 1% do.
This is a small speedup for the non-SVG case.  Since this call is made for every element
when style is resolved, any small speedup in this function matters on large documents.

* css/StyleResolver.cpp:
(WebCore::StyleResolver::collectMatchingRulesForList):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124260 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Maybe fix the Windows build.

* heap/HeapBlock.h:
(HeapBlock): WTF?



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124261 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Read tag names and attributes from the saved tokens in HTMLTreeBuilder::processEndTag(AtomicHTMLToken*)
https://bugs.webkit.org/show_bug.cgi?id=92715

Reviewed by Adam Barth.

This is a follow-up patch for r123577. Changed oneBelowTop to return HTMLStackItem*.

No new tests, covered by existing tests.

* html/parser/HTMLConstructionSite.h:
(WebCore::HTMLConstructionSite::oneBelowTop):
* html/parser/HTMLElementStack.cpp:
(WebCore::HTMLElementStack::oneBelowTop):
* html/parser/HTMLElementStack.h:
(HTMLElementStack):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124262 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix all the other builds I just broke. Maybe fix the Windows build.

* heap/HeapBlock.h:
(HeapBlock): WTF?



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124263 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Allow AudioDestination to support local/live audio input
https://bugs.webkit.org/show_bug.cgi?id=90318

Reviewed by Kenneth Russell.

Source/Platform:

* chromium/public/WebAudioDevice.h:
(WebKit::WebAudioDevice::RenderCallback::render):
(RenderCallback):

Source/WebCore:

* WebCore.gypi:
* WebCore.xcodeproj/project.pbxproj:
* GNUmakefile.list.am:
Add AudioIOCallback.h to make files.

* Modules/webaudio/AudioDestinationNode.h:
* Modules/webaudio/AudioDestinationNode.cpp:
(WebCore::AudioDestinationNode::render):
Change provideInput() method to render() to support optional audio input.

(AudioDestinationNode):
(WebCore::AudioDestinationNode::localAudioInputProvider):
Expose public access to an AudioSourceProvider for local/live audio input.

(LocalAudioInputProvider):
(WebCore::AudioDestinationNode::LocalAudioInputProvider::LocalAudioInputProvider):
(WebCore::AudioDestinationNode::LocalAudioInputProvider::set):
(WebCore::AudioDestinationNode::LocalAudioInputProvider::provideInput):
Add simple AudioSourceProvider implementation which dishes out a single AudioBus each
render quantum for optional local/live audio input.

* Modules/webaudio/OfflineAudioDestinationNode.h:
* Modules/webaudio/OfflineAudioDestinationNode.cpp:
(WebCore::OfflineAudioDestinationNode::startRendering):
(WebCore::OfflineAudioDestinationNode::offlineRenderEntry):
(WebCore::OfflineAudioDestinationNode::offlineRender):
Simple name change using "offline" prefix to avoid confusion with AudioDestinationNode::render() method (implementing AudioIOCallback)

* platform/audio/AudioDestination.h:
Switch create() method to take an AudioIOCallback instead of AudioSourceProvider.

* platform/audio/AudioIOCallback.h:
(WebCore::AudioIOCallback::~AudioIOCallback):
Add new AudioIOCallback interface for audio input/output.

* platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
(WebCore::AudioDestination::create):
(WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
* platform/audio/gstreamer/AudioDestinationGStreamer.h:
(AudioDestinationGStreamer):
(WebCore::AudioDestinationGStreamer::callback):
* platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
(_WebKitWebAudioSourcePrivate):
(webKitWebAudioSrcSetProperty):
(webKitWebAudioSrcLoop):
Small tweaks to AudioDestinationGStreamer implementation to account for switch to AudioIOCallback.

* platform/audio/mac/AudioDestinationMac.cpp:
(WebCore::AudioDestination::create):
(WebCore::AudioDestinationMac::AudioDestinationMac):
(WebCore::AudioDestinationMac::render):
* platform/audio/mac/AudioDestinationMac.h:
(AudioDestinationMac):
Small tweaks to AudioDestinationMac implementation to account for switch to AudioIOCallback.

Source/WebKit/chromium:

* src/AudioDestinationChromium.cpp:
(WebCore::AudioDestination::create):
(WebCore::AudioDestinationChromium::AudioDestinationChromium):
(WebCore::AudioDestinationChromium::provideInput):
(WebCore):
* src/AudioDestinationChromium.h:
(AudioDestinationChromium):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124264 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Structures should be swept after all other objects
https://bugs.webkit.org/show_bug.cgi?id=92679

Reviewed by Filip Pizlo.

In order to get rid of ClassInfo from our objects, we need to be able to safely get the 
ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the 
Structure, but currently it is not safe to do so because the order of destruction of objects 
is not guaranteed to sweep objects before their corresponding Structure. We can fix this by 
sweeping Structures after everything else.

* heap/Heap.cpp:
(JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is 
safe to sweep structures since we'll always do Structures last anyways due to the ordering of 
MarkedSpace::forEachBlock.
(JSC):
(JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out 
these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() 
calls during lastChanceToFinalize().
* heap/Heap.h:
(Heap):
* heap/HeapTimer.h:
(HeapTimer):
* heap/IncrementalSweeper.cpp:
(JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
the first time.
(JSC):
(JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we 
make our first pass. We now null out the slots as we sweep them so that we can quickly find the 
Structures during the second pass.
(JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
(JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify 
the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can 
assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock 
iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
(JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
* heap/IncrementalSweeper.h: Add declarations for new stuff.
(IncrementalSweeper):
* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and 
if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing 
the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that 
will sweep some number of other blocks in place of the current block to mitigate the cost of the floating 
Structure garbage.
(JSC::MarkedAllocator::addBlock):
* heap/MarkedAllocator.h:
(JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no 
longer valid to allocate from, so we set the current block to null.
* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
at an unsafe time.
* heap/MarkedSpace.cpp:
(JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
(JSC): 
* heap/MarkedSpace.h:
(JSC):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124265 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Maybe break the Windows build.

Reviewed by Anders Carlsson.

Formally objected to by Sam Weinig.

* heap/HeapBlock.h:
(HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124266 268f45cc-cd09-0410-ab3c-d52691b4dbfc
nrwt: rename worker.py to layout_test_runner.py
https://bugs.webkit.org/show_bug.cgi?id=92804

Reviewed by Ojan Vafai.

Home stretch of this round of manager refactoring ... I will be
moving all of the actual test-running code (which includes the
code that shards the tests for the workers) into a different
module, and it makes sense for that module to contain the actual
worker code, so I'm renaming worker.py to layout_test_runner.py.

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py: Renamed from Tools/Scripts/webkitpy/layout_tests/controllers/worker.py.
(Worker):
(Worker.__init__):
(Worker.__del__):
(Worker.start):
(Worker.handle):
(Worker._update_test_input):
(Worker._run_test):
(Worker.stop):
(Worker._timeout):
(Worker._kill_driver):
(Worker._run_test_with_timeout):
(Worker._clean_up_after_test):
(Worker._run_test_in_another_thread):
(Worker._run_test_in_another_thread.SingleTestThread):
(Worker._run_test_in_another_thread.SingleTestThread.__init__):
(Worker._run_test_in_another_thread.SingleTestThread.run):
(Worker._run_test_in_this_thread):
(Worker._run_single_test):
* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager._run_tests.worker_factory):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124267 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Stop masking 8 bits off of the visited link hash. We need all the bits!
https://bugs.webkit.org/show_bug.cgi?id=92799

Reviewed by Anders Carlsson.

Source/JavaScriptCore:

* runtime/Identifier.cpp:
(JSC::IdentifierCStringTranslator::hash):
(JSC::IdentifierLCharFromUCharTranslator::hash):
* runtime/Identifier.h:
(JSC::IdentifierCharBufferTranslator::hash):
Update for new function names.

Source/WebCore:

* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::urlHostHash):
* platform/network/blackberry/CredentialBackingStore.cpp:
(WebCore::hashCredentialInfo):
* plugins/blackberry/PluginPackageBlackBerry.cpp:
(WebCore::PluginPackage::hash):
Update for new function names.

Source/WTF:

* wtf/StringHasher.h:
(WTF::StringHasher::hashWithTop8BitsMasked):
(WTF::StringHasher::hash):
(StringHasher):
(WTF::StringHasher::computeHashAndMaskTop8Bits):
(WTF::StringHasher::hashMemory):
(WTF::StringHasher::avalancheBits):
Rename existing computeHash and hash functions to computeHashAndMaskTop8Bits
and hashWithTop8BitsMasked respectively. Add new computeHash and hash functions
that do the StringHash without the masking.

* wtf/text/AtomicString.cpp:
(WTF::CStringTranslator::hash):
(WTF::UCharBufferTranslator::hash):
(WTF::HashAndCharactersTranslator::hash):
(WTF::SubstringTranslator::hash):
(WTF::LCharBufferFromLiteralDataTranslator::hash):
(WTF::AtomicString::fromUTF8Internal):
* wtf/text/StringHash.h:
(WTF::CaseFoldingHash::hash):
* wtf/text/StringImpl.h:
(WTF::StringImpl::setHash):
* wtf/text/StringStatics.cpp:
(WTF::StringImpl::hashSlowCase):
* wtf/unicode/UTF8.cpp:
(WTF::Unicode::calculateStringHashAndLengthFromUTF8MaskingTop8Bits):
* wtf/unicode/UTF8.h:
Update for new function names.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124268 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] REGRESSION(r123644) Compositor HUD crashes immediately with --show-paint-rects
https://bugs.webkit.org/show_bug.cgi?id=92775

Reviewed by Adrienne Walker.

In r123644, the compositor HUD was turned into a normal layer. When the HUD is supposed to cover the entire
viewport - for instance if the showPlatformLayerTree or showDebugRects settings are true -
HeadsUpDisplayLayerChromium's constructor tries to size itself to its layerTreeHost()'s device viewport size.
Unfortunately, its layerTreeHost pointer is always nil in the constructor since the layer is not yet in the
tree. Additionally, this doesn't handle resize at all.

To fix this, this grabs the device viewport size and settings in a LayerChromium::update() OVERRIDE. Also
changes CCLayerTreeHost::willCommit to only reparent the HUD layer if needed instead of on every frame.

Tested manually, we don't have any layout tests for the debug HUD.

* platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp:
(WebCore::HeadsUpDisplayLayerChromium::create):
(WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
* platform/graphics/chromium/HeadsUpDisplayLayerChromium.h:
(HeadsUpDisplayLayerChromium):
* platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
(WebCore::CCLayerTreeHost::willCommit):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124269 268f45cc-cd09-0410-ab3c-d52691b4dbfc