Array checks should use the structure, not the class info
https://bugs.webkit.org/show_bug.cgi?id=93150

Reviewed by Mark Hahnenberg.

This changes all array checks used in array accesses (get, put, get length,
push, pop) to use the structure, not the class info. Additionally, these
checks in the LLInt and baseline JIT record the structure in an ArrayProfile,
so that the DFG can know exactly what structure to check for.
        
* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* bytecode/ArrayProfile.cpp: Added.
(JSC):
(JSC::ArrayProfile::computeUpdatedPrediction):
* bytecode/ArrayProfile.h: Added.
(JSC):
(JSC::arrayModeFromStructure):
(ArrayProfile):
(JSC::ArrayProfile::ArrayProfile):
(JSC::ArrayProfile::bytecodeOffset):
(JSC::ArrayProfile::addressOfLastSeenStructure):
(JSC::ArrayProfile::observeStructure):
(JSC::ArrayProfile::expectedStructure):
(JSC::ArrayProfile::structureIsPolymorphic):
(JSC::ArrayProfile::hasDefiniteStructure):
(JSC::ArrayProfile::observedArrayModes):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dump):
(JSC::CodeBlock::getArrayProfile):
(JSC):
(JSC::CodeBlock::getOrAddArrayProfile):
(JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::executionEntryCount):
(JSC::CodeBlock::numberOfArrayProfiles):
(JSC::CodeBlock::arrayProfiles):
(JSC::CodeBlock::addArrayProfile):
(CodeBlock):
* bytecode/Instruction.h:
(JSC):
(JSC::Instruction::Instruction):
* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitGetArgumentByVal):
(JSC::BytecodeGenerator::emitGetByVal):
(JSC::BytecodeGenerator::emitPutByVal):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::initialize):
(JSC::DFG::AbstractState::execute):
* dfg/DFGAbstractValue.h:
(JSC::DFG::StructureAbstractValue::hasSingleton):
(StructureAbstractValue):
(JSC::DFG::StructureAbstractValue::singleton):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateArray):
(DFG):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::privateCompilePatchGetArrayLength):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::privateCompilePatchGetArrayLength):
* llint/LLIntOffsetsExtractor.cpp:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/Structure.h:
(Structure):
(JSC::Structure::classInfoOffset):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125637 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fast/events/overflow-scroll-fake-mouse-move.html and fast/events/frame-scroll-fake-mouse-move.html are failing in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=94045

Reviewed by Geoff Garen.

* DumpRenderTree/mac/DumpRenderTreeWindow.mm:
(-[DumpRenderTreeWindow _hasKeyAppearance]): Added. Returns [self isKeyWindow]. This is
needed now that WebView uses -_hasKeyAppearance instead of -isKeyWindow.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125638 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, build fix for !ENABLE(DFG_JIT)

* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::privateCompilePatchGetArrayLength):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::privateCompilePatchGetArrayLength):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Unreviewed. Add new test expectation for nested-rounded-corners.html.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125640 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Share common code between calendar picker and color suggestion picker
https://bugs.webkit.org/show_bug.cgi?id=93802

Reviewed by Kent Tamura.

.:

* ManualTests/forms/calendar-picker.html:
* ManualTests/forms/color-suggestion-picker.html:

Source/WebCore:

We want to share common code like utility functions between picker page popups.

No new tests because no behavior change. Covered by existing tests, color-suggestion-picker-appearance.html and calendar-picker-apeparance.html.

* Resources/pagepopups/calendarPicker.js:
(YearMonthController.prototype.attachTo):
(YearMonthController.prototype._showPopup):
* Resources/pagepopups/colorSuggestionPicker.js:
(handleMessage):
(handleArgumentsTimeout):
* Resources/pagepopups/pickerCommon.css: Added.
(body):
* Resources/pagepopups/pickerCommon.js: Added.
(createElement):
(resizeWindow):
(getScrollbarWidth):
* WebCore.gyp/WebCore.gyp: Add actions for pickerCommon.{css,js}
* html/shadow/CalendarPickerElement.cpp:
(WebCore::CalendarPickerElement::writeDocument):

Source/WebKit/chromium:

* src/ColorChooserUIController.cpp:
(WebKit::ColorChooserUIController::writeDocument):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125641 268f45cc-cd09-0410-ab3c-d52691b4dbfc