IndexedDB: Enforce unsigned long/unsigned long long ranges
https://bugs.webkit.org/show_bug.cgi?id=99637

Reviewed by Tony Chang.

Source/WebCore:

The IndexedDB spec has [EnforceRange] specified on unsigned long and unsigned long long
arguments, which requires the implementation to throw TypeError for negative values or
values that exceed 2^53-1 (maximum JS number that behaves like an integer) - and 0 is
specifically forbidden by the APIs as well.

A more correct fix in the binding layer is in webkit.org/b/96798 but we can temporarily
address this in the implementation.

Also refactor to prevent IDBFactory.open(name, -1) from triggering an internal code path.

Tests: storage/indexeddb/cursor-advance.html
       storage/indexeddb/intversion-bad-parameters.html
       storage/indexeddb/intversion-encoding.html

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::advance): Validate argument range.
* Modules/indexeddb/IDBCursor.h:
(IDBCursor):
* Modules/indexeddb/IDBCursor.idl: Drop "unsigned" qualifier as the binding code is
not yet doing the correct validation.
* Modules/indexeddb/IDBFactory.cpp: Refactor to prevent open(name, -1)
(WebCore):
(WebCore::IDBFactory::open): Validate the int version here, then pass to...
(WebCore::IDBFactory::openInternal): ... this method.
* Modules/indexeddb/IDBFactory.h:
(IDBFactory):
* Modules/indexeddb/IDBFactory.idl: Drop "unsigned" qualifier; meaningless to binding
code right now, can be re-added once webkit.org/b/96798 lands.

LayoutTests:

Additional edge case tests and updated expectations.

* storage/indexeddb/cursor-advance-expected.txt:
* storage/indexeddb/intversion-bad-parameters-expected.txt:
* storage/indexeddb/intversion-encoding-expected.txt:
* storage/indexeddb/resources/cursor-advance.js:
(testBadAdvance.advanceBadly):
(testBadAdvance):
* storage/indexeddb/resources/intversion-bad-parameters.js:
(deleteSuccess):
* storage/indexeddb/resources/intversion-encoding.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131658 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Clean up Vector.h
https://bugs.webkit.org/show_bug.cgi?id=99622

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

Fix fallout from removing std::max and std::min using declarations.

* runtime/StringPrototype.cpp:
(JSC::jsSpliceSubstrings):
(JSC::jsSpliceSubstringsWithSeparators):
(JSC::stringProtoFuncIndexOf):
* yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):

Source/WebCore:

Fix fallout from removing std::max and std::min using declarations.

* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::currentAge):

Source/WTF:

Remove unused member functions from Vector and get rid of the std::max and std::min using declarations
(as per the WebKit coding style guidelines).

* WTF.xcodeproj/project.pbxproj:
Turns out StreamBuffer.h was never added to the Xcode project; add it. Also go ahead and sort the project file.

* wtf/Deque.h:
(WTF::::expandCapacity):
* wtf/StreamBuffer.h:
(WTF::StreamBuffer::append):
Add std:: prefixes to max and min.

* wtf/Vector.h:
Remove VectorBase::bufferSlot(), VectorReverseProxy and add std:: prefixes where needed.

Tools:

Remove ReversedProxy test.

* TestWebKitAPI/Tests/WTF/Vector.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131659 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move ResourceRequest construction out of SubresourceLoader
https://bugs.webkit.org/show_bug.cgi?id=99627

Reviewed by Adam Barth.

CachedResource::load() fills out a bunch of http headers.
SubresourceLoader::create() adds a bunch more. Merge them.
Note that this merge requires a bit more care in CachedRawResource::canReuse(),
because more headers are set directly on CachedResource::m_resourceRequest, rather
than on a copy of it.

No new tests, no functionality change intended.

* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::create):
* loader/cache/CachedRawResource.cpp:
(WebCore::shouldIgnoreHeaderForCacheReuse):
(WebCore):
(WebCore::CachedRawResource::canReuse):
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::failBeforeStarting):
(WebCore):
(WebCore::CachedResource::addAdditionalRequestHeaders):
(WebCore::CachedResource::load):
* loader/cache/CachedResource.h:
(CachedResource):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131660 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Explicitly send null/undefined/integers to frontend IDBCallbacks
https://bugs.webkit.org/show_bug.cgi?id=99619

Reviewed by Adam Barth.

Source/WebCore:

Rather than pass SerializedScriptValue tokens from the backend,
send explicit null, (as onSuccess(static_cast<SerializedScriptValue*>(0)))
undefined, (as onSucess()), and integers (as onSuccess(long long))

This reduces backend dependency on things that might require a JS
interpreter on the backend.

No new tests, this is a refactor and existing tests cover
correctness. Tests that might fail include:

Test: storage/indexeddb/index-count.html
Test: storage/indexeddb/objectstore-count.html
Test: storage/indexeddb/database-basics.html

* Modules/indexeddb/IDBCallbacks.h:
(IDBCallbacks):
* Modules/indexeddb/IDBCursorBackendImpl.cpp:
(WebCore::IDBCursorBackendImpl::advanceInternal):
(WebCore::IDBCursorBackendImpl::continueFunctionInternal):
(WebCore::IDBCursorBackendImpl::prefetchContinueInternal):
* Modules/indexeddb/IDBCursorBackendImpl.h:
(WebCore::IDBCursorBackendImpl::value):
* Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
(WebCore::IDBDatabaseBackendImpl::deleteDatabase):
* Modules/indexeddb/IDBIndex.cpp:
* Modules/indexeddb/IDBIndexBackendImpl.cpp:
(WebCore::IDBIndexBackendImpl::openCursorInternal):
(WebCore::IDBIndexBackendImpl::countInternal):
(WebCore::IDBIndexBackendImpl::getInternal):
* Modules/indexeddb/IDBObjectStore.cpp:
* Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
(WebCore::IDBObjectStoreBackendImpl::getInternal):
(WebCore::IDBObjectStoreBackendImpl::deleteInternal):
(WebCore::IDBObjectStoreBackendImpl::clearInternal):
(WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
(WebCore::IDBObjectStoreBackendImpl::countInternal):
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::onSuccess):
(WebCore):
* Modules/indexeddb/IDBRequest.h:
* Modules/indexeddb/IDBTransaction.cpp:
* Modules/indexeddb/IDBTransactionBackendImpl.cpp:
* Modules/indexeddb/IDBTransactionBackendImpl.h:
* Modules/indexeddb/IDBTransactionBackendInterface.h:
* bindings/v8/IDBBindingUtilities.cpp:
(WebCore::deserializeIDBValue):
* inspector/InspectorIndexedDBAgent.cpp:
(WebCore):

Source/WebKit/chromium:

Hook up new undefined/integer-based onSuccess handlers.

* src/IDBCallbacksProxy.cpp:
(WebKit::IDBCallbacksProxy::onSuccess):
(WebKit):
* src/IDBCallbacksProxy.h:
(IDBCallbacksProxy):
* src/WebIDBCallbacksImpl.cpp:
(WebKit::WebIDBCallbacksImpl::onSuccess):
(WebKit):
* src/WebIDBCallbacksImpl.h:
(WebIDBCallbacksImpl):
* tests/IDBAbortOnCorruptTest.cpp:
* tests/IDBDatabaseBackendTest.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131661 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r130826 or r130828): Twitter top bar is dysfunctional
https://bugs.webkit.org/show_bug.cgi?id=99577
<rdar://problem/12518883>

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

It turns out that it's a good idea to maintain the invariants of your object model, such as that
elements past publicLength should have the hole value.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests: 

* fast/js/dfg-array-pop-value-clearing-expected.txt: Added.
* fast/js/dfg-array-pop-value-clearing.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-array-pop-value-clearing.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Certain SVG content freezes QtWebKit
https://bugs.webkit.org/show_bug.cgi?id=97258

Reviewed by Simon Hausmann.

Source/WebCore:

Ensure dashpattern is well-formed by avoiding divisions by zero.

Test: svg/stroke/zero-width-hang.html

* platform/graphics/qt/GraphicsContextQt.cpp:
(WebCore::GraphicsContext::setLineDash):

LayoutTests:

* svg/stroke/zero-width-hang-expected.txt: Added.
* svg/stroke/zero-width-hang.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131663 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled DEPS.

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-10-17

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderLayer subtrees without any self-painting layer shouldn't be walked during hit testing
https://bugs.webkit.org/show_bug.cgi?id=89393

Reviewed by Eric Seidel.

Performance optimization, covered by existing tests.

Bug 88888 added an peformance optimization for painting. As hit testing is very similar to
painting, it would benefit from the same optimization.

On http://dglazkov.github.com/performance-tests/biggrid.html, with a 10,000 * 100 tables,
it reduces the time to select some text inside a cell from 1-2 seconds to a usable time
(I didn't measure the exact timing).

Note that as in bug 88888, the multi-column code is not covered by this optimization.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hitTest):
This is the entrance to the hit testing code so we check if we can bail out early.

(WebCore::RenderLayer::hitTestList):
If we have no self-painting descendant layers, we can bail out.

(WebCore::RenderLayer::hitTestContents):
(WebCore::RenderLayer::hitTestLayer):
hitTest should filter the layers that call these functions. Added some ASSERT to
make sure we don't mistakenly call them when could avoid it.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131665 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use virtual dispatch to create ContentData renderers
https://bugs.webkit.org/show_bug.cgi?id=99646

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-10-17
Reviewed by Eric Seidel.

ContentData are conceptually very similar to Nodes and we can use
the same createRenderer pattern on them to simplify creating
renderers for generated content. Now each ContentData class knows
how to create its own renderer.

Previously we switched over the StyleContentType which required a
case for CONTENT_NONE and made the code look like it could return
null, but this case is actually impossible because no ContentData
class ever has a type of CONTENT_NONE and no null checks are really
needed.

This is the final step in removing dependence on StyleContentType.

No new tests needed, this is just a refactor.

* rendering/RenderObjectChildList.cpp: Remove createRendererForBeforeAfterContent.
(WebCore::RenderObjectChildList::updateBeforeAfterContent):
* rendering/style/ContentData.cpp:
(WebCore::ImageContentData::createRenderer):
(WebCore):
(WebCore::TextContentData::createRenderer):
(WebCore::CounterContentData::createRenderer):
(WebCore::QuoteContentData::createRenderer):
* rendering/style/ContentData.h: Added a new virtual method createRenderer.
(WebCore):
(ContentData):
(ImageContentData):
(TextContentData):
(CounterContentData):
(QuoteContentData):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131666 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix after r131651.

* fast/harness/perftests/runs-per-second-iterations.html:
* fast/harness/perftests/runs-per-second-log.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131667 268f45cc-cd09-0410-ab3c-d52691b4dbfc