[V8] Replace SetGlobalGCPrologueCallback() with AddGCPrologueCallback()
https://bugs.webkit.org/show_bug.cgi?id=100140

Reviewed by Adam Barth.

SetGlobalGCPrologueCallback() and SetGlobalGCEpilogueCallback()
are deprecated (See http://code.google.com/codesearch#OAMlx_jo-ck/src/v8/include/v8.h&exact_package=chromium&q=v8.h&type=cs&l=3149)
Instead we should use AddGCPrologueCallback()
and AddGCEpilogueCallback().

No tests. No change in behavior.

* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::initializeV8IfNeeded):
* bindings/v8/V8GCController.cpp:
(WebCore::V8GCController::gcPrologue):
(WebCore):
(WebCore::V8GCController::minorGCPrologue):
(WebCore::V8GCController::majorGCPrologue):
(WebCore::V8GCController::gcEpilogue):
(WebCore::V8GCController::minorGCEpilogue):
(WebCore::V8GCController::majorGCEpilogue):
* bindings/v8/V8GCController.h:
(V8GCController):
* bindings/v8/WorkerContextExecutionProxy.cpp:
(WebCore::WorkerContextExecutionProxy::initIsolate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Regression(r132143): Assertion hit in JSC::Interpreter::StackPolicy::StackPolicy(JSC::Interpreter&, const WTF::StackBounds&)
https://bugs.webkit.org/show_bug.cgi?id=100109

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-10-23
Reviewed by Oliver Hunt.

Fix possible integer overflow in StackPolicy constructor by
using size_t type instead of int for stack sizes. The value
returned by StackBounds::size() is of type size_t but was
assigned to an int, which may overflow.

* interpreter/Interpreter.cpp:
(JSC):
(JSC::Interpreter::StackPolicy::StackPolicy):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132244 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] ScriptWrappable should hold the wrapper handle directly (Dromaeo/dom-modify and dom-traverse get ~2.5% faster)
https://bugs.webkit.org/show_bug.cgi?id=97974

Reviewed by Eric Seidel.

Previously, we stored a pointer to a handle to a wrapper in Node. That
is an extra layer of indirection that slows down finding the wrapper
for the node. A handle is just a pointer, so we might as we just store
the handle in the Node directly. That speeds up dom-modify and
dom-traverse by about 2.5%.

This change also lets us get rid of the ChunkedTable we were using to
store all the wrappers because they're now stored in the Nodes
directly.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateHeader):
* bindings/v8/IntrusiveDOMWrapperMap.h:
(WebCore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
(WebCore::IntrusiveDOMWrapperMap::get):
(WebCore::IntrusiveDOMWrapperMap::set):
(WebCore::IntrusiveDOMWrapperMap::contains):
(WebCore::IntrusiveDOMWrapperMap::visit):
(WebCore::IntrusiveDOMWrapperMap::removeIfPresent):
(WebCore::IntrusiveDOMWrapperMap::clear):
* bindings/v8/ScriptWrappable.h:
(WebCore::ScriptWrappable::ScriptWrappable):
(WebCore::ScriptWrappable::wrapper):
(WebCore::ScriptWrappable::setWrapper):
(WebCore::ScriptWrappable::disposeWrapper):
(WebCore::ScriptWrappable::reportMemoryUsage):
(ScriptWrappable):
* bindings/v8/V8DOMWrapper.h:
(WebCore::V8DOMWrapper::getCachedWrapper):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132245 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Possible assertion hit in WebCore::HTMLSelectElement::updateListBoxSelection()
https://bugs.webkit.org/show_bug.cgi?id=99967

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-10-23
Reviewed by Tony Chang.

Source/WebCore:

Fix assertion hit in WebCore::HTMLSelectElement::updateListBoxSelection() when
pressing the left mouse button outside a multiselect and then moving the cursor
over the multiselect element while holding the button down.

The issue is that the HTMLSelectElement handler for the mouse move event does
not check if there is a selection before trying to extend the selection.

Test: fast/dom/HTMLSelectElement/select-selectedIndex-noAnchorIndex-crash.html

* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::listBoxDefaultEventHandler):

LayoutTests:

Added layout test to reproduce an assertion hit in
WebCore::HTMLSelectElement::updateListBoxSelection() when pressing the left
button outside a multiselect and then moving the mouse over the multiselect
element while holding the button down.

* fast/dom/HTMLSelectElement/select-selectedIndex-noAnchorIndex-crash-expected.txt: Added.
* fast/dom/HTMLSelectElement/select-selectedIndex-noAnchorIndex-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132246 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WIN7] Skip fast/media/mq-resolution.html.
https://bugs.webkit.org/show_bug.cgi?id=100143.

Patch by Yael Aharon <yael.aharon@intel.com> on 2012-10-23
Reviewed by Kenneth Rohde Christiansen.

The feature is not yet implemented.

* platform/win/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132248 268f45cc-cd09-0410-ab3c-d52691b4dbfc