[chromium] Unreviewed, updating some bug numbers in TestExpectations.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Enable VIDEO_TRACK
https://bugs.webkit.org/show_bug.cgi?id=96949

Reviewed by Antonio Gomes.

.:

Turn on VIDEO_TRACK feature.

* Source/cmake/OptionsBlackBerry.cmake:

Source/WebCore:

Turn on runtime feature for VIDEO_TRACK.

* bindings/generic/RuntimeEnabledFeatures.cpp:
(WebCore):

Tools:

* Scripts/webkitperl/FeatureList.pm:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128800 268f45cc-cd09-0410-ab3c-d52691b4dbfc
If a prototype has indexed setters and its instances have indexed storage, then all put_by_val's should have a bad time
https://bugs.webkit.org/show_bug.cgi?id=96596

Reviewed by Gavin Barraclough.

Source/JavaScriptCore: 

Added comprehensive support for accessors and read-only indexed properties on the
prototype chain. This is done without any performance regression on benchmarks that
we're aware of, by having the entire VM's strategy with respect to arrays tilted
heavily in favor of:
        
- The prototype chain of JSArrays never having any accessors or read-only indexed
  properties. If that changes, you're going to have a bad time.
        
- Prototypes of non-JSArray objects either having no indexed accessors or read-only
  indexed properties, or, having those indexed accessor thingies inserted before
  any instance object (i.e. object with that prototype as its prototype) is created.
  If you add indexed accessors or read-only indexed properties to an object that is
  already used as a prototype, you're going to have a bad time.
        
See below for the exact definition of having a bad time.
        
Put another way, "fair" uses of indexed accessors and read-only indexed properties
are:
        
- Put indexed accessors and read-only indexed properties on an object that is never
  used as a prototype. This will slow down accesses to that object, but will not
  have any effect on any other object.
        
- Put those indexed accessor thingies on an object before it is used as a prototype
  and then start instantiating objects that claim that object as their prototype.
  This will slightly slow down indexed stores to the instance objects, and greatly
  slow down all indexed accesses to the prototype, but will have no other effect.
        
In short, "fair" uses only affect the object itself and any instance objects. But
if you start using indexed accessors in more eclectic ways, you're going to have
a bad time.
        
Specifically, if an object that may be used as a prototype has an indexed accessor
added, the VM performs a whole-heap scan to find all objects that belong to the
same global object as the prototype you modified. If any of those objects has
indexed storage, their indexed storage is put into slow-put mode, just as if their
prototype chain had indexed accessors. This will happen even for objects that do
not currently have indexed accessors in their prototype chain. As well, all JSArray
allocations are caused to create arrays with slow-put storage, and all future
allocations of indexed storage for non-JSArray objects are also flipped to slow-put
mode. Note there are two aspects to having a bad time: (i) the whole-heap scan and
(ii) the poisoning of all indexed storage in the entire global object. (i) is
necessary for correctness. If we detect that an object that may be used as a
prototype has had an indexed accessor or indexed read-only property inserted into
it, then we need to ensure that henceforth all instances of that object inspect
the prototype chain whenever an indexed hole is stored to. But by default, indexed
stores do no such checking because doing so would be unnecessarily slow. So, we must
find all instances of the affected object and flip them into a different array
storage mode that omits all hole optimizations. Since prototypes never keep a list
of instance objects, the only way to find those objects is a whole-heap scan. But
(i) alone would be a potential disaster, if a program frequently allocated an
object without indexed accessors, then allocated a bunch of objects that used that
one as their prototype, and then added indexed accessors to the prototype. So, to
prevent massive heap scan storms in such awkward programs, having a bad time also
implies (ii): henceforth *all* objects belonging to that global object will use
slow put indexed storage, so that we don't ever have to scan the heap again. Note
that here we are using the global object as just an approximation of a program
module; it may be worth investigating in the future if other approximations can be
used instead.

* bytecode/ArrayProfile.h:
(JSC):
(JSC::arrayModeFromStructure):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::fromObserved):
(JSC::DFG::modeAlreadyChecked):
(JSC::DFG::modeToString):
* dfg/DFGArrayMode.h:
(DFG):
(JSC::DFG::isSlowPutAccess):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* jit/JIT.h:
* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateJSArray):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_array):
* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::finishCreation):
(JSC::arrayProtoFuncSort):
* runtime/IndexingType.h:
(JSC):
(JSC::hasIndexedProperties):
(JSC::hasIndexingHeader):
(JSC::hasArrayStorage):
(JSC::shouldUseSlowPut):
* runtime/JSArray.cpp:
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):
* runtime/JSArray.h:
(JSC::JSArray::createStructure):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::reset):
(JSC):
(JSC::JSGlobalObject::haveABadTime):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::addressOfArrayStructure):
(JSC::JSGlobalObject::havingABadTimeWatchpoint):
(JSC::JSGlobalObject::isHavingABadTime):
* runtime/JSObject.cpp:
(JSC::JSObject::visitButterfly):
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::put):
(JSC::JSObject::putByIndex):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::notifyPresenceOfIndexedAccessors):
(JSC):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
(JSC::JSObject::switchToSlowPutArrayStorage):
(JSC::JSObject::setPrototype):
(JSC::JSObject::resetInheritorID):
(JSC::JSObject::inheritorID):
(JSC::JSObject::allowsAccessFrom):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::unwrappedGlobalObject):
(JSC::JSObject::notifyUsedAsPrototype):
(JSC::JSObject::createInheritorID):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
(JSC::JSObject::attemptToInterceptPutByIndexOnHole):
(JSC::JSObject::putByIndexBeyondVectorLength):
(JSC::JSObject::putDirectIndexBeyondVectorLength):
(JSC::JSObject::getNewVectorLength):
(JSC::JSObject::getOwnPropertyDescriptor):
* runtime/JSObject.h:
(JSC::JSObject::mayBeUsedAsPrototype):
(JSObject):
(JSC::JSObject::mayInterceptIndexedAccesses):
(JSC::JSObject::getArrayLength):
(JSC::JSObject::getVectorLength):
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::completeInitialization):
(JSC::JSObject::inSparseIndexingMode):
(JSC::JSObject::arrayStorage):
(JSC::JSObject::arrayStorageOrNull):
(JSC::JSObject::ensureArrayStorage):
(JSC):
(JSC::JSValue::putByIndex):
* runtime/JSValue.cpp:
(JSC::JSValue::putToPrimitive):
(JSC::JSValue::putToPrimitiveByIndex):
(JSC):
* runtime/JSValue.h:
(JSValue):
* runtime/ObjectPrototype.cpp:
(JSC::ObjectPrototype::finishCreation):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayEntry::put):
(JSC):
* runtime/SparseArrayValueMap.h:
(JSC):
(SparseArrayEntry):
* runtime/Structure.cpp:
(JSC::Structure::anyObjectInChainMayInterceptIndexedAccesses):
(JSC):
(JSC::Structure::suggestedIndexingTransition):
* runtime/Structure.h:
(Structure):
(JSC::Structure::mayInterceptIndexedAccesses):
* runtime/StructureTransitionTable.h:
(JSC::newIndexingType):

LayoutTests: 

Removed failing expectation for primitive-property-access-edge-cases, and
added more tests to cover the numerical-setter-on-prototype cases.

* fast/js/array-bad-time-expected.txt: Added.
* fast/js/array-bad-time.html: Added.
* fast/js/array-slow-put-expected.txt: Added.
* fast/js/array-slow-put.html: Added.
* fast/js/cross-frame-bad-time-expected.txt: Added.
* fast/js/cross-frame-bad-time.html: Added.
* fast/js/jsc-test-list:
* fast/js/object-bad-time-expected.txt: Added.
* fast/js/object-bad-time.html: Added.
* fast/js/object-slow-put-expected.txt: Added.
* fast/js/object-slow-put.html: Added.
* fast/js/script-tests/array-bad-time.js: Added.
* fast/js/script-tests/array-slow-put.js: Added.
(foo):
* fast/js/script-tests/cross-frame-bad-time.js: Added.
(foo):
* fast/js/script-tests/object-bad-time.js: Added.
(Cons):
* fast/js/script-tests/object-slow-put.js: Added.
(Cons):
(foo):
* platform/mac/fast/js/primitive-property-access-edge-cases-expected.txt: Removed.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128802 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] WebCompositorOutputSurface software API
https://bugs.webkit.org/show_bug.cgi?id=96851

Reviewed by James Robinson.

This adds a software-based output option to
WebCompositorOutputSurface, for use with the new software compositor.
If returns a "tear-off" which provides a WebImage object that can be
written to or read.

* Platform.gypi:
* chromium/public/WebCompositorOutputSurface.h:
(WebKit):
(WebCompositorOutputSurface):
(WebKit::WebCompositorOutputSurface::surfaceSoftware):
* chromium/public/WebCompositorOutputSurfaceSoftware.h: Added.
(WebKit):
(WebCompositorOutputSurfaceSoftware):
(WebKit::WebCompositorOutputSurfaceSoftware::~WebCompositorOutputSurfaceSoftware):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128803 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make CSS.PrefixUsage histogram smaller to save memory
https://bugs.webkit.org/show_bug.cgi?id=96941

Reviewed by Ojan Vafai.

Each bucket costs about 12 bytes. This reduces the size of the histogram
from 600 to 384, which will save about 2.5k per renderer and browser
process.

In the long run, we could probably generate a table in makeprop.pl that
only has the webkit prefix values to save even more memory (there are
194 properties that start with -webkit).

No new tests, just refactoring.

* css/CSSParser.cpp:
(WebCore::cssPropertyID):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128804 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Add onSendFrameToParentCompositorAck to WebCompositorOutputSurfaceClient
https://bugs.webkit.org/show_bug.cgi?id=96850

Reviewed by James Robinson.

Hook for the WebCompositorOutputSurface::sendFrameToParent ack.
Also changes WebCompositorFrame from a class to a struct.

* chromium/public/WebCompositorOutputSurface.h:
(WebKit):
* chromium/public/WebCompositorOutputSurfaceClient.h:
(WebKit):
(WebCompositorOutputSurfaceClient):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128806 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-09-17  Nate Chapin  <japhet@chromium.org>

        Unreviewed, test expectations update.

        * platform/chromium/TestExpectations: Mark http/tests/inspector/network/network-xhr-replay.html as timing out on chromium win.




git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128808 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WIN] Use BString in favour of BSTR to improve memory management
https://bugs.webkit.org/show_bug.cgi?id=93128

Reviewed by Anders Carlsson.

BString automatically calls SysFreeString() in its destructor which helps
avoiding memory leaks. So it should be used instead of BSTR directly.
Add operator& to BString to allow its usage for out parameters too (like COMPtr).
This fixes already a few memory leaks in the existing code.

* platform/win/BString.cpp:
(WebCore::BString::~BString):
(WebCore::BString::adoptBSTR):
(WebCore::BString::clear):
(WebCore):
* platform/win/BString.h:
(BString):
(WebCore::BString::operator&):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128809 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=96945
REGRESSION (r128678): Several tests fail on WK2 bots 
(compositing/rtl/rtl-fixed-overflow.html, 
compositing/rtl/rtl-fixed.html, 
fast/regions/float-pushed-width-change.html, 
fast/repaint/fixed-move-after-keyboard-scroll.html)

Reviewed by Tim Horton.

These tests are failing after 
https://bugs.webkit.org/show_bug.cgi?id=96688 They are failing on WK2 
only because that change only forces compositing mode for fixed 
position elements in WK2, not WK1. 

This one is a ref test where the expectation used fixed positioning. 
We can avoid using fixed pos and avoid that fact that that creates a 
layer in WK2 and use absolute pos instead.
* fast/regions/float-pushed-width-change-expected.html:

These tests just need updated results in the mac-wk2 directory.
* platform/mac-wk2/compositing/rtl: Added.
* platform/mac-wk2/compositing/rtl/rtl-fixed-expected.txt: Added.
* platform/mac-wk2/compositing/rtl/rtl-fixed-overflow-expected.txt: Added.
* platform/mac-wk2/fast/repaint: Added.
* platform/mac-wk2/fast/repaint/fixed-move-after-keyboard-scroll-expected.png: Added.
* platform/mac-wk2/fast/repaint/fixed-move-after-keyboard-scroll-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128811 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r128809.
http://trac.webkit.org/changeset/128809
https://bugs.webkit.org/show_bug.cgi?id=96958

Broke the Windows build. (Requested by andersca on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-09-17

Source/WebCore:

* platform/win/BString.cpp:
(WebCore::BString::~BString):
(WebCore::BString::adoptBSTR):
* platform/win/BString.h:
(BString):

Source/WebKit/win:

* DefaultPolicyDelegate.cpp:
(DefaultPolicyDelegate::decidePolicyForNavigationAction):
(DefaultPolicyDelegate::decidePolicyForMIMEType):
(DefaultPolicyDelegate::unableToImplementPolicyWithError):
* MarshallingHelpers.cpp:
(MarshallingHelpers::KURLToBSTR):
(MarshallingHelpers::CFStringRefToBSTR):
(MarshallingHelpers::stringArrayToSafeArray):
(MarshallingHelpers::safeArrayToStringArray):
* WebCoreSupport/WebChromeClient.cpp:
(WebChromeClient::runJavaScriptPrompt):
* WebCoreSupport/WebEditorClient.cpp:
(WebEditorClient::checkGrammarOfString):
(WebEditorClient::getGuessesForWord):
* WebFrame.cpp:
(WebFrame::canProvideDocumentSource):
* WebHistory.cpp:
(WebHistory::removeItem):
(WebHistory::addItem):
* WebIconDatabase.cpp:
(WebIconDatabase::startUpIconDatabase):
* WebNotificationCenter.cpp:
(WebNotificationCenter::postNotification):
* WebPreferences.cpp:
(WebPreferences::setStringValue):
* WebView.cpp:
(PreferencesChangedOrRemovedObserver::onNotify):
(WebView::close):
(WebView::canShowMIMEType):
(WebView::initWithFrame):
(WebView::setApplicationNameForUserAgent):
(WebView::setCustomUserAgent):
(WebView::userAgentForURL):
(WebView::setCustomTextEncodingName):
(WebView::customTextEncodingName):
(WebView::setPreferences):
(WebView::searchFor):
(WebView::executeCoreCommandByName):
(WebView::markAllMatchesForText):
(WebView::setGroupName):
(WebView::registerURLSchemeAsLocal):
(WebView::replaceSelectionWithText):
(WebView::onNotify):
(WebView::notifyPreferencesChanged):
(WebView::MIMETypeForExtension):
(WebView::standardUserAgentWithApplicationName):
(WebView::addAdditionalPluginDirectory):
(WebView::registerEmbeddedViewMIMEType):
(toString):
(toKURL):
(WebView::addOriginAccessWhitelistEntry):
(WebView::removeOriginAccessWhitelistEntry):
(WebView::geolocationDidFailWithError):
(WebView::setDomainRelaxationForbiddenForURLScheme):
(WebView::setCompositionForTesting):
(WebView::confirmCompositionForTesting):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128812 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Delayed structure sweep can leak structures without bound
https://bugs.webkit.org/show_bug.cgi?id=96546

Reviewed by Gavin Barraclough.

This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
those objects with destructors and with immortal structures, and those objects with destructors that don't have 
immortal structures. All of the objects of the third type (destructors without immortal structures) now 
inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores 
the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.

Source/JavaScriptCore: 

* API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
(JSC):
(JSC::JSCallbackConstructor::JSCallbackConstructor):
* API/JSCallbackConstructor.h:
(JSCallbackConstructor):
* API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for 
JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
(JSC):
(JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add 
the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides 
to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
(JSC::::createStructure):
* API/JSCallbackObject.h:
(JSCallbackObject):
(JSC):
* API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
(OpaqueJSClass::prototype):
* API/JSObjectRef.cpp: Ditto.
(JSObjectMake):
(JSObjectGetPrivate):
(JSObjectSetPrivate):
(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):
* API/JSValueRef.cpp: Ditto.
(JSValueIsObjectOfClass):
* API/JSWeakObjectMapRefPrivate.cpp: Ditto.
* JSCTypedArrayStubs.h:
(JSC):
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
(JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
(JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
* heap/Heap.cpp:
(JSC):
* heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function 
since it's always safe to sweep Structures now.
(JSC::Heap::allocatorForObjectWithNormalDestructor): 
(JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
(Heap):
(JSC::Heap::allocateWithNormalDestructor):
(JSC):
(JSC::Heap::allocateWithImmortalStructureDestructor):
* heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the 
IncrementalSweeper since it's always safe to sweep Structures now.
(JSC::IncrementalSweeper::IncrementalSweeper):
(JSC::IncrementalSweeper::sweepNextBlock):
(JSC::IncrementalSweeper::startSweeping):
(JSC::IncrementalSweeper::willFinishSweeping):
(JSC):
* heap/IncrementalSweeper.h:
(IncrementalSweeper):
* heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add 
tracking of the specific destructor type of allocator. 
(JSC::MarkedAllocator::tryAllocateHelper):
(JSC::MarkedAllocator::allocateBlock):
* heap/MarkedAllocator.h:
(JSC::MarkedAllocator::destructorType):
(MarkedAllocator):
(JSC::MarkedAllocator::MarkedAllocator):
(JSC::MarkedAllocator::init):
* heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. 
We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
(JSC::MarkedBlock::create):
(JSC::MarkedBlock::MarkedBlock):
(JSC):
(JSC::MarkedBlock::specializedSweep):
(JSC::MarkedBlock::sweep):
(JSC::MarkedBlock::sweepHelper):
* heap/MarkedBlock.h:
(JSC):
(JSC::MarkedBlock::allocator):
(JSC::MarkedBlock::destructorType):
* heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
(JSC::MarkedSpace::MarkedSpace):
(JSC::MarkedSpace::resetAllocators):
(JSC::MarkedSpace::canonicalizeCellLivenessData):
(JSC::MarkedSpace::isPagedOut):
(JSC::MarkedSpace::freeBlock):
* heap/MarkedSpace.h:
(MarkedSpace):
(JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
(JSC::MarkedSpace::normalDestructorAllocatorFor):
(JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
(JSC::MarkedSpace::allocateWithNormalDestructor):
(JSC::MarkedSpace::forEachBlock):
* heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
* jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateBasicJSObject):
(JSC::JIT::emitAllocateJSFinalObject):
(JSC::JIT::emitAllocateJSArray):
* jsc.cpp: 
(GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from 
JSDestructibleObject.
* runtime/Arguments.cpp: Inherit from JSDestructibleObject.
(JSC):
* runtime/Arguments.h:
(Arguments):
(JSC::Arguments::Arguments):
* runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
(JSC):
* runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
(JSC):
* runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
(JSC):
(JSC::InternalFunction::InternalFunction):
* runtime/InternalFunction.h:
(InternalFunction):
* runtime/JSCell.h: Added the NEEDS_DESTRUCTOR  macro to make it easier for classes to indicate that instead of being 
allocated in a destructor MarkedAllocator that they will handle their destruction themselves through the 
use of a finalizer.
(JSC):
(HasImmortalStructure): New template to help us determine at compile-time if a particular class 
should be allocated in the immortal structure MarkedAllocator. The default value is false. In order 
to be allocated in the immortal structure allocator, classes must specialize this template. Also added 
a macro to make it easier for classes to specialize the template.
(JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
* runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be 
accessed safely when the object is being destroyed.
(JSC):
(JSDestructibleObject):
(JSC::JSDestructibleObject::classInfo):
(JSC::JSDestructibleObject::JSDestructibleObject):
(JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
* runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all 
of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
(JSC::JSGlobalObject::reset):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one 
for the m_rareData field when it's created.
(JSC::JSGlobalObject::create):
(JSC):
* runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
(JSGlobalThis):
(JSC::JSGlobalThis::JSGlobalThis):
* runtime/JSPropertyNameIterator.h: Has an immortal Structure.
(JSC):
* runtime/JSScope.cpp:
(JSC):
* runtime/JSString.h: Has an immortal Structure.
(JSC):
* runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
(JSWrapperObject):
(JSC::JSWrapperObject::JSWrapperObject):
* runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
(JSC):
* runtime/NameInstance.h: Inherit from JSDestructibleObject.
(NameInstance):
* runtime/RegExp.h: Has immortal Structure.
(JSC):
* runtime/RegExpObject.cpp: Inheritance cleanup.
(JSC):
* runtime/SparseArrayValueMap.h: Has immortal Structure.
(JSC):
* runtime/Structure.h: Has immortal Structure.
(JSC):
* runtime/StructureChain.h: Ditto.
(JSC):
* runtime/SymbolTable.h: Ditto.
(SharedSymbolTable):
(JSC):

Source/WebCore: 

No new tests.

* ForwardingHeaders/runtime/JSDestructableObject.h: Added.
* bindings/js/JSDOMWrapper.h: Inherits from JSDestructibleObject.
(JSDOMWrapper):
(WebCore::JSDOMWrapper::JSDOMWrapper):
* bindings/scripts/CodeGeneratorJS.pm: Add finalizers to anything that inherits from JSGlobalObject,
e.g. JSDOMWindow and JSWorkerContexts. For those classes we also need to use the NEEDS_DESTRUCTOR macro.
(GenerateHeader):
* bridge/objc/objc_runtime.h: Inherit from JSDestructibleObject.
(ObjcFallbackObjectImp):
* bridge/objc/objc_runtime.mm:
(Bindings):
(JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
* bridge/runtime_array.cpp: Use a finalizer so that JSArray isn't forced to inherit from JSDestructibleObject.
(JSC):
(JSC::RuntimeArray::destroy):
* bridge/runtime_array.h:
(JSC::RuntimeArray::create):
(JSC):
* bridge/runtime_object.cpp: Inherit from JSDestructibleObject.
(Bindings):
(JSC::Bindings::RuntimeObject::RuntimeObject):
* bridge/runtime_object.h:
(RuntimeObject):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128813 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fixing broken JSC ChangeLog

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128814 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix a broken assertion in offlineasm.

* offlineasm/armv7.rb:
* offlineasm/backends.rb:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128815 268f45cc-cd09-0410-ab3c-d52691b4dbfc
We don't have a bad enough time if an object's prototype chain crosses global objects
https://bugs.webkit.org/show_bug.cgi?id=96962

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

* runtime/JSGlobalObject.cpp:
(JSC):

LayoutTests: 

* fast/js/cross-frame-really-bad-time-expected.txt: Added.
* fast/js/cross-frame-really-bad-time-with-__proto__-expected.txt: Added.
* fast/js/cross-frame-really-bad-time-with-__proto__.html: Added.
* fast/js/cross-frame-really-bad-time.html: Added.
* fast/js/script-tests/cross-frame-really-bad-time-with-__proto__.js: Added.
(foo):
(evil):
(bar):
(done):
* fast/js/script-tests/cross-frame-really-bad-time.js: Added.
(Cons):
(foo):
(evil):
(bar):
(done):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128816 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Remove dysfunctional zoom blit in setViewportSize().
https://bugs.webkit.org/show_bug.cgi?id=96954
PR 178411

Reviewed by Antonio Gomes.

The blitContents() call removed by this patch used to
be part of scheduleZoomAboutPoint(). Its goal was to
display a preview of the zoomed contents, primarily
when auto-zoomed after rotation. Nested inside a pair
of screen suspend/resume calls, it has been a pointless
no-op for a while.

Antonio's recent change to remove scheduleZoomAboutPoint()
and call zoomAboutPoint() from setViewportSize() directly
(the only call site) obsoletes the call completely.
The zoomAboutPoint() call itself will cause a re-render
and blit right away, so we don't care about any preview.
zoomAboutPoint() will also take care of the necessary
screen/backingstore suspension.

The result is a vastly simplified block of code.

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::setViewportSize):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128817 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r128796.
http://trac.webkit.org/changeset/128796
https://bugs.webkit.org/show_bug.cgi?id=96966

It broke everything (Requested by Ossy_NIGHT on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-09-17

* wtf/OSAllocatorPosix.cpp:
(WTF::OSAllocator::reserveUncommitted):
(WTF::OSAllocator::reserveAndCommit):
(WTF::OSAllocator::commit):
(WTF::OSAllocator::decommit):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128818 268f45cc-cd09-0410-ab3c-d52691b4dbfc
The ThreadRescrictionVerifier should be more forcibly disabled on systems that use threads
https://bugs.webkit.org/show_bug.cgi?id=96957

Reviewed by Oliver Hunt.

* wtf/ThreadRestrictionVerifier.h:
(WTF):
(WTF::ThreadRestrictionVerifier::ThreadRestrictionVerifier):
(ThreadRestrictionVerifier):
(WTF::ThreadRestrictionVerifier::setMutexMode):
(WTF::ThreadRestrictionVerifier::setDispatchQueueMode):
(WTF::ThreadRestrictionVerifier::turnOffVerification):
(WTF::ThreadRestrictionVerifier::setShared):
(WTF::ThreadRestrictionVerifier::isSafeToUse):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128820 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Versioning.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128821 268f45cc-cd09-0410-ab3c-d52691b4dbfc
32-bit LLInt get_by_val does vector length checks incorrectly
https://bugs.webkit.org/show_bug.cgi?id=96893
<rdar://problem/12311678>

Reviewed by Mark Hahnenberg.

* llint/LowLevelInterpreter32_64.asm:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128822 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Move a FilterOperationsTest and WebInputEventConversionTest back to webkit_unittest_files variable
https://bugs.webkit.org/show_bug.cgi?id=96964

Patch by James Robinson <jamesr@chromium.org> on 2012-09-17
Reviewed by Adrienne Walker.

These targets are really webkit unit tests and shouldn't be guarded by use_libcc_for_compositor.

* WebKit.gypi:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128823 268f45cc-cd09-0410-ab3c-d52691b4dbfc