memory-instrumentation-cached-images.html is crashing
https://bugs.webkit.org/show_bug.cgi?id=101103

Unreviewed.

Restore code deleted in http://trac.webkit.org/changeset/133331.

* bindings/v8/IntrusiveDOMWrapperMap.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133354 268f45cc-cd09-0410-ab3c-d52691b4dbfc
report-blocked-uri-cross-origin.html is failing
https://bugs.webkit.org/show_bug.cgi?id=101096

Reviewed by Adam Barth.

Don't actually create a report file during the syntax-only test for when
the report directive comes before the mode directive in an X-XSS-Protection
header. Thus, we avoid having to clean it up later.

* http/tests/security/xssAuditor/resources/echo-intertag.pl:
* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133356 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JIT::privateCompileGetByVal should use MacroAssemblerCodePtr::createFromExecutableAddress like JIT::privateCompilePutByVal
https://bugs.webkit.org/show_bug.cgi?id=101109

Reviewed by Gavin Barraclough.

This fixes crashes on ARMv7 resulting from the return address already being tagged with the THUMB2 bit.

* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompileGetByVal):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133357 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MarkedBlocks should use something other than the mark bits to indicate liveness for newly allocated objects
https://bugs.webkit.org/show_bug.cgi?id=100877

Reviewed by Filip Pizlo.

Currently when we canonicalize cell liveness data in MarkedBlocks, we set the mark bit for every cell in the
block except for those in the free list. This allows us to consider objects that were allocated since the
previous collection to be considered live until they have a chance to be properly marked by the collector.

If we want to use the mark bits to signify other types of information, e.g. using sticky mark bits for generational
collection, we will have to keep track of newly allocated objects in a different fashion when we canonicalize cell liveness.

One method would be to allocate a separate set of bits while canonicalizing liveness data. These bits would
track the newly allocated objects in the block separately from those objects who had already been marked. We would
then check these bits, along with the mark bits, when determining liveness.

* heap/Heap.h:
(Heap):
(JSC::Heap::isLive): We now check for the presence of the newlyAllocated Bitmap.
(JSC):
* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::specializedSweep): We clear the newlyAllocated Bitmap if we're creating a free list. This
will happen if we canonicalize liveness data for some other reason than collection (e.g. forEachCell) and
then start allocating again.
(JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor):
(SetNewlyAllocatedFunctor):
(JSC::SetNewlyAllocatedFunctor::operator()): We set the newlyAllocated bits for all the objects
that aren't already marked. We undo the bits for the objects in the free list later in canonicalizeCellLivenessData.
(JSC::MarkedBlock::canonicalizeCellLivenessData): We should never have a FreeListed block with a newlyAllocated Bitmap.
We allocate the new Bitmap, set the bits for all the objects that aren't already marked, and then unset all of the
bits for the items currently in the FreeList.
* heap/MarkedBlock.h:
(JSC::MarkedBlock::clearMarks): We clear the newlyAllocated bitmap if it exists because at this point we don't need it
any more.
(JSC::MarkedBlock::isEmpty): If we have some objects that are newlyAllocated, we are not empty.
(JSC::MarkedBlock::isNewlyAllocated):
(JSC):
(JSC::MarkedBlock::setNewlyAllocated):
(JSC::MarkedBlock::clearNewlyAllocated):
(JSC::MarkedBlock::isLive): We now check the newlyAllocated Bitmap, if it exists, when determining liveness of a cell in
a block that is Marked.
* heap/WeakBlock.cpp:
(JSC::WeakBlock::visit): We need to make sure we don't finalize objects that are in the newlyAllocated Bitmap.
(JSC::WeakBlock::reap): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133358 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JIT::privateCompileGetByVal should use the uint8ClampedArrayDescriptor for compiling accesses to Uint8ClampedArrays
https://bugs.webkit.org/show_bug.cgi?id=101112

Reviewed by Gavin Barraclough.

The only reason why the code was wrong to use uint8ArrayDescriptor instead is that if we're just using
Uint8ClampedArrays then the descriptor for Uint8Array may not have been initialized.

* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompileGetByVal):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133359 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. Mark video-media-source-state-changes.html as flaky.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133360 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG::SpeculativeJIT::typedArrayDescriptor should use the Float64Array descriptor for Float64Arrays
https://bugs.webkit.org/show_bug.cgi?id=101114

Reviewed by Gavin Barraclough.

As in https://bugs.webkit.org/show_bug.cgi?id=101112, this was only wrong when Float64Array descriptors
hadn't been initialized yet. That happens rarely, but when it does happen, we would crash.
        
This would also become much more wrong if we ever put type size info (num bytes, etc) in the descriptor
and used that directly. So it's good to fix it.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::typedArrayDescriptor):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reduce redundant code in SimpleFontData[platform]
https://bugs.webkit.org/show_bug.cgi?id=97245

Reviewed by Eric Seidel.

Move duplicated code out of platform specific files and into the common file.
This represents all of the methods in SimpleFontData that do not have genuine
platform specific code.

No new tests because there is no change at all in the functionality.

* platform/graphics/SimpleFontData.cpp:
(WebCore):
(WebCore::SimpleFontData::smallCapsFontData): Implementation from platform files.
(WebCore::SimpleFontData::emphasisMarkFontData): Implementation from platform files.
* platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
(WebCore): Removed common code.
* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore): Removed common code.
* platform/graphics/mac/SimpleFontDataMac.mm:
(WebCore): Removed common code.
* platform/graphics/pango/SimpleFontDataPango.cpp:
(WebCore): Removed common code.
* platform/graphics/qt/SimpleFontDataQt.cpp:
(WebCore): Removed common code.
* platform/graphics/skia/SimpleFontDataSkia.cpp:
(WebCore): Removed common code.
* platform/graphics/win/SimpleFontDataWin.cpp:
(WebCore): Removed common code.
* platform/graphics/wince/SimpleFontDataWinCE.cpp:
(WebCore): Removed common code.
* platform/graphics/wx/SimpleFontDataWx.cpp:
(WebCore): Removed common code.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133362 268f45cc-cd09-0410-ab3c-d52691b4dbfc