DFG should inline code blocks that use new_array_buffer
https://bugs.webkit.org/show_bug.cgi?id=98996

Reviewed by Geoffrey Garen.

This adds plumbing to drop in constant buffers from the inlinees to the inliner.
It's smart about not duplicating buffers needlessly but doesn't try to completely
hash-cons them, either.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::numberOfConstantBuffers):
(JSC::CodeBlock::addConstantBuffer):
(JSC::CodeBlock::constantBufferAsVector):
(JSC::CodeBlock::constantBuffer):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(ConstantBufferKey):
(JSC::DFG::ConstantBufferKey::ConstantBufferKey):
(JSC::DFG::ConstantBufferKey::operator==):
(JSC::DFG::ConstantBufferKey::hash):
(JSC::DFG::ConstantBufferKey::isHashTableDeletedValue):
(JSC::DFG::ConstantBufferKey::codeBlock):
(JSC::DFG::ConstantBufferKey::index):
(DFG):
(JSC::DFG::ConstantBufferKeyHash::hash):
(JSC::DFG::ConstantBufferKeyHash::equal):
(ConstantBufferKeyHash):
(WTF):
(ByteCodeParser):
(InlineStackEntry):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCapabilities.h:
(JSC::DFG::canInlineOpcode):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131087 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removed ASSERT_CLASS_FITS_IN_CELL
https://bugs.webkit.org/show_bug.cgi?id=97634

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

Our collector now supports arbitrarily sized objects, so the ASSERT is not needed.

* API/JSCallbackFunction.cpp:
* API/JSCallbackObject.cpp:
* heap/MarkedSpace.h:
* jsc.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanConstructor.cpp:
* runtime/BooleanObject.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/Error.cpp:
* runtime/ErrorConstructor.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/FunctionConstructor.cpp:
* runtime/FunctionPrototype.cpp:
* runtime/InternalFunction.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSBoundFunction.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalThis.cpp:
* runtime/JSNameScope.cpp:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/JSPropertyNameIterator.cpp:
* runtime/JSScope.cpp:
* runtime/JSWithScope.cpp:
* runtime/JSWrapperObject.cpp:
* runtime/MathObject.cpp:
* runtime/NameConstructor.cpp:
* runtime/NamePrototype.cpp:
* runtime/NativeErrorConstructor.cpp:
* runtime/NativeErrorPrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberObject.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
* runtime/ObjectPrototype.cpp:
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
* runtime/StringPrototype.cpp:
* testRegExp.cpp: Removed the ASSERT.

Source/WebCore: 

* bindings/js/JSDOMWindowShell.cpp:
(WebCore):
* bindings/js/JSImageConstructor.cpp:
(WebCore):
* bindings/js/JSNodeFilterCondition.cpp:
(WebCore):
* bindings/js/JSWorkerContextBase.cpp:
(WebCore):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSFloat64Array.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore):
* bridge/runtime_method.cpp:
(JSC):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131088 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Enable RUNTIME_HEURISTICS all the time, for easier testing
https://bugs.webkit.org/show_bug.cgi?id=99090

Reviewed by Filip Pizlo.

I find myself using this a lot, and there doesn't seem to be an obvious
reason to compile it out, since it only runs once at startup.

* runtime/Options.cpp:
(JSC::overrideOptionWithHeuristic):
(JSC::Options::initialize):
* runtime/Options.h: Removed the #ifdef.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] WTR needs an implementation of setAsynchronousSpellCheckingEnabled
https://bugs.webkit.org/show_bug.cgi?id=81042

Unreviewed, skipped a test that requires setAsynchronousSpellCheckingEnabled

* platform/wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] WebProcess keeps on waiting for UIProcess
https://bugs.webkit.org/show_bug.cgi?id=97646

Patch by Regina Chung <heejin.r.chung@samsung.com> on 2012-10-11
Reviewed by Kenneth Rohde Christiansen.

Set LayerTreeRenderer to active so UIProcess can send RenderNextFrame message to WebProcess
after accelerated compositing(AC) mode is entered, so WebProcess can start flushing changes to UIProcess.

* UIProcess/API/efl/EflViewportHandler.cpp: Added API for setting LayerTreeRenderer's active state.
(WebKit::EflViewportHandler::setActive):
(WebKit):
* UIProcess/API/efl/EflViewportHandler.h:
(EflViewportHandler):
* UIProcess/API/efl/ewk_view.cpp: Sets LayerTreeRenderer's active status to true after entering AC mode.
(ewk_view_accelerated_compositing_mode_enter):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled DEPS.

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-10-11

* DEPS:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removed some more static assumptions about inline object capacity
https://bugs.webkit.org/show_bug.cgi?id=98603

Reviewed by Filip Pizlo.

* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Use JSObject::allocationSize()
for a little more flexibility. We still pass it a constant inline capacity
because the JIT doesn't have a strategy for selecting a size class based
on non-constant capacity yet. "INLINE_STORAGE_CAPACITY" is a marker for
code that makes static assumptions about object size.

* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateBasicJSObject):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm: Ditto for the rest of our many execution engines.

* runtime/JSObject.h:
(JSC::JSObject::allocationSize):
(JSC::JSFinalObject::finishCreation):
(JSC::JSFinalObject::create): New helper function for computing object
size dynamically, since we plan to have objects of different sizes.

(JSC::JSFinalObject::JSFinalObject): Note that our m_inlineStorage used
to auto-generate an implicit C++ constructor with default null initialization.
This memory is not observed in its uninitialized state, and our LLInt and
JIT allocators do not initialize it, so I did not add any explicit code
to do so, now that the implicit code is gone.

(JSC::JSObject::offsetOfInlineStorage): Changed the math here to match
inlineStorageUnsafe(), since we can rely on an explicit data member anymore.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebaseline these tests after v8-i18n roll.

* platform/chromium/fast/js/kde/StringObject-expected.txt:
* platform/chromium/fast/js/kde/function_length-expected.txt: Added.
* platform/chromium/fast/js/kde/inbuilt_function_tostring-expected.txt: Added.
* platform/chromium/fast/js/string-prototype-properties-expected.txt:
* platform/chromium/inspector-protocol/runtime-getProperties-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Improve the comment describing mainWorldScriptContext
https://bugs.webkit.org/show_bug.cgi?id=99092

Reviewed by James Robinson.

* public/WebFrame.h:
(WebFrame):
    - Add some more text about what this API does so that folks who
      call it know what they need to worry about.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: IDL types defined in spec should be visible to scripts
https://bugs.webkit.org/show_bug.cgi?id=99093

Reviewed by Adam Barth.

Source/WebCore:

Interfaces defined in the spec WebIDL, such as IDBCursorWithValue, should be exposed
to scripts as properties of the global object. A few types were missing - add them.

Test: storage/indexeddb/interfaces.html

* Modules/indexeddb/DOMWindowIndexedDatabase.idl:
* Modules/indexeddb/WorkerContextIndexedDatabase.idl:

LayoutTests:

Verify that interfaces defined in the IDB spec's WebIDL are present on the
global object.

* storage/indexeddb/interfaces-expected.txt: Added.
* storage/indexeddb/interfaces.html: Added.
* storage/indexeddb/resources/interfaces.js: Added.
* storage/indexeddb/resources/shared.js: Remove assertion redundant with this test.
(test):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
UInt32ToNumber and OSR exit should be aware of copy propagation and correctly recover both versions of a variable that was subject to a UInt32ToNumber cast
https://bugs.webkit.org/show_bug.cgi?id=99100
<rdar://problem/12480955>

Reviewed by Michael Saboff and Mark Hahnenberg.

Source/JavaScriptCore: 

Fixed by forcing UInt32ToNumber to use a different register. This "undoes" the copy propagation that we
would have been doing, since it has no performance effect in this case and has the benefit of making the
OSR exit compiler a lot simpler.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):

LayoutTests: 

* fast/js/dfg-uint32-to-number-in-middle-of-copy-propagation-expected.txt: Added.
* fast/js/dfg-uint32-to-number-in-middle-of-copy-propagation.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-uint32-to-number-in-middle-of-copy-propagation.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
One more baseline tweak after v8-i18n roll.

* platform/chromium/fast/js/date-proto-generic-invocation-expected.txt: Replaced.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131098 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium-Android] Exception when the layout test driver is stopped
https://bugs.webkit.org/show_bug.cgi?id=99084

Reviewed by Dirk Pranke.

On chromium-android, the process is killed directly in ServerProcess.stop() as the pipes are closed first.
Should not try to read data from the pipes after the process is killed.

* Scripts/webkitpy/layout_tests/port/server_process.py:
(ServerProcess.stop): Don't read data after the process is killed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131099 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shaders] Implement all composite operators except destination and lighter.
https://bugs.webkit.org/show_bug.cgi?id=97859

Patch by Huang Dongsung <luxtella@company100.net> on 2012-10-11
Reviewed by Dean Jackson.

Source/WebCore:

Add expressions for all composite operators except destination and
lighter. The expressions are lifted directly from the CSS Compositing
and Blending spec [1]. WebKit adds these compositing expressions to the
author's shader.

[1]: https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#advancedcompositing

Test: css3/filters/custom/custom-filter-composite-operators.html

* platform/graphics/filters/CustomFilterValidatedProgram.cpp:
(WebCore::CustomFilterValidatedProgram::compositeFunctionString):

LayoutTests:

Add test to check that the DOM element texture composites correctly with the css_MixColor
variable from the author's shader for each composite operator.

* css3/filters/custom/custom-filter-composite-operators-expected.png: Added.
* css3/filters/custom/custom-filter-composite-operators-expected.txt: Added.
* css3/filters/custom/custom-filter-composite-operators.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131100 268f45cc-cd09-0410-ab3c-d52691b4dbfc
test-webkitpy runs individual tests twice
https://bugs.webkit.org/show_bug.cgi?id=99098

Reviewed by Adam Barth.

If you were to run 'test-webkitpy webkitpy.test.main_unittests.TesterTests.test_no_tests_found',
it would actually run the test twice. This fixes that.

* Scripts/webkitpy/test/main.py:
(Tester._parse_args):
(Tester._test_names):
* Scripts/webkitpy/test/main_unittest.py:
(TesterTest.test_no_tests_found):
(TesterTest):
(TesterTest.test_individual_names_are_not_run_twice):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131101 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CMAKE] Do not add include dirs twice
https://bugs.webkit.org/show_bug.cgi?id=99099

Reviewed by Yong Li.

Do not add WebCore_INCLUDE_DIRECTORIES to WebCoreTestSupport_INCLUDE_DIRECTORIES, the includes_directory
call does this for us.

* CMakeLists.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131102 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shaders] Make custom filters use a premultiplied buffer.
https://bugs.webkit.org/show_bug.cgi?id=98396

Patch by Huang Dongsung <luxtella@company100.net> on 2012-10-11
Reviewed by Dean Jackson.

Source/WebCore:

Currently, a GLSL css_Composite function returns a premultiplied color, so
FECustomFilter must make a premultiplied buffer in the case when an author is
using the CSS mix function.

In addition, there are two performance benefits when FECustomFilter uses a premultiplied buffer.
1. FilterEffect::asImageBuffer is faster.
2. In the future when Accelerated Compositing implementations use
FECustomFilter, they do not need to convert an unmultiplied buffer to a
premultiplied buffer.

Test: css3/filters/custom/custom-filter-composite-fractional-source-alpha.html

* platform/graphics/filters/FECustomFilter.cpp:
(WebCore::FECustomFilter::applyShader):

LayoutTests:

Add test to check that the DOM element texture composites correctly
when source alpha is a fractional value.

* css3/filters/custom/custom-filter-composite-fractional-source-alpha-expected.html: Added.
* css3/filters/custom/custom-filter-composite-fractional-source-alpha.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131103 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ElementAttributeData shouldn't be managing Element's callbacks.
<http://webkit.org/b/98987>

Reviewed by Anders Carlsson.

Dispatch the following attribute-related Element callbacks from within Element
instead of ElementAttributeData. Also made them private.

    - willModifyAttribute
    - didModifyAttribute
    - didAddAttribute
    - didRemoveAttribute

No behavior change, just making ElementAttributeData a bit dumber (a good thing.)

* dom/Element.cpp:
(WebCore::Element::detachAttribute):
(WebCore::Element::removeAttribute):
(WebCore::Element::setAttributeInternal):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::addAttributeInternal):
* dom/Element.h:
* dom/ElementAttributeData.cpp:
(WebCore::ElementAttributeData::addAttribute):
(WebCore::ElementAttributeData::removeAttribute):
* dom/ElementAttributeData.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131104 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebGL] [Mac] only the mapped symbol for the first element of a uniform/attribute array is stored.
https://bugs.webkit.org/show_bug.cgi?id=98966

Reviewed by Dean Jackson.

We currently do not add name/mappedName symbol pairs for each element of a uniform/attribute array.
This is because we only add a number of symbols equal to how many symbols the shader compiler tells us there are.
The shader compiler treats an array as a single uniform. We need to be adding in symbols to the map for each element of the array ourselves.
The mappedName of each array element is the same between elements except for the "[index]" at the end so this is easy to do.

Tested using Khronos WebGL conformance suite:
conformance/glsl/misc/glsl-long-variable-names.html

* platform/graphics/ANGLEWebKitBridge.cpp:
(WebCore::getSymbolInfo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131105 268f45cc-cd09-0410-ab3c-d52691b4dbfc
unprefix window.performance.webkitNow()
https://bugs.webkit.org/show_bug.cgi?id=88278

Reviewed by Tony Gentilcore.

PerformanceTests:

* resources/runner.js: Bind to proper object to avoid invalid invocation errors.

Source/WebCore:

Test: fast/dom/Window/window-properties-performance.html
      fast/performance/performance-now-timestamps.html

* page/Performance.cpp:
(WebCore::Performance::now):
* page/Performance.h:
(Performance):
* page/Performance.idl:

LayoutTests:

* fast/dom/Window/window-properties-performance-expected.txt:
* fast/performance/performance-now-timestamps-expected.txt:
* fast/performance/script-tests/performance-now-timestamps.js:
* platform/chromium/TestExpectations: Remove skipped expectation.
* platform/efl/TestExpectations:
* platform/efl/fast/dom/Window/window-properties-performance-expected.txt:
* platform/gtk/TestExpectations:
* platform/qt/TestExpectations:
* platform/qt/fast/dom/Window/window-properties-performance-expected.txt:
* resources/magnitude-perf.js:
(Magnitude._runIteration):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131106 268f45cc-cd09-0410-ab3c-d52691b4dbfc