ThreadRestrictionVerifier should be opt-in, not opt-out
https://bugs.webkit.org/show_bug.cgi?id=94761

Reviewed by Mark Hahnenberg.

../JavaScriptCore: 

Removed explicit calls to disable the verifier, since it's off by default now.

* parser/SourceProvider.h:
(JSC::SourceProvider::SourceProvider):
(SourceProvider):
* runtime/SymbolTable.h:
(JSC::SharedSymbolTable::SharedSymbolTable):

../WTF: 

WebKit's JavaScript engine supports use on multiple threads, so default-on
is not appropriate for most of our objects, and it causes lots of suprious
assertions.

* wtf/MetaAllocator.cpp:
(WTF::MetaAllocatorHandle::MetaAllocatorHandle): No need to turn off
explicitly, since it's off by default now.

* wtf/ThreadRestrictionVerifier.h:
(WTF::ThreadRestrictionVerifier::ThreadRestrictionVerifier): Turn off by default.

(WTF::ThreadRestrictionVerifier::setMutexMode):
(WTF::ThreadRestrictionVerifier::setDispatchQueueMode):
(WTF::ThreadRestrictionVerifier::turnOffVerification): These assertions
about state transitions were inconsistent with each other, and impossible
to maintain with default off, so I removed them.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126379 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix typos in r126374
https://bugs.webkit.org/show_bug.cgi?id=94665
Unreviewed, build fix.

Fix two issues that snuck in, one that caused a crash if there
were no baselines to optimize and one that occurred as a result
of failing to rename a variable when I changed the recursion to
a loop in the previous patch.

* Scripts/webkitpy/common/checkout/baselineoptimizer.py:
(BaselineOptimizer._optimize_by_pushing_results_up):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126380 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: tests for injection/extraction of idb keys
https://bugs.webkit.org/show_bug.cgi?id=94653

Patch by Alec Flett <alecflett@chromium.org> on 2012-08-22
Reviewed by Tony Chang.

Added unit tests for key injection/extraction using
SerializedScriptValue. These were moved from chromium, now
that all uses of the API are through WebKit.

* tests/IDBKeyPathTest.cpp:
(WebCore):
(WebCore::TEST):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed Chromium gardening. Optimized baselines from yesterday
with dpranke's new algorithm in webkit-patch optimize-baselines
from r126374 and r126380.

* platform/chromium-linux/fast/canvas/canvas-scale-shadowBlur-expected.txt: Removed.
* platform/chromium-linux/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Removed.
* platform/chromium-linux/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Removed.
* platform/chromium-linux/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Removed.
* platform/chromium-mac-snowleopard/fast/canvas/canvas-scale-shadowBlur-expected.txt: Removed.
* platform/chromium-mac-snowleopard/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Removed.
* platform/chromium-mac-snowleopard/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Removed.
* platform/chromium-mac-snowleopard/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Removed.
* platform/chromium-mac/fast/canvas/canvas-scale-shadowBlur-expected.txt: Removed.
* platform/chromium-mac/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Removed.
* platform/chromium-mac/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Removed.
* platform/chromium-mac/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Removed.
* platform/chromium-win-xp/fast/canvas/canvas-scale-shadowBlur-expected.txt: Removed.
* platform/chromium-win-xp/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Removed.
* platform/chromium-win-xp/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Removed.
* platform/chromium-win-xp/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Removed.
* platform/chromium-win/fast/canvas/canvas-scale-shadowBlur-expected.txt: Removed.
* platform/chromium-win/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Removed.
* platform/chromium-win/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Removed.
* platform/chromium-win/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Removed.
* platform/chromium/fast/canvas/canvas-scale-shadowBlur-expected.txt: Renamed from LayoutTests/platform/chromium-linux-x86/fast/canvas/canvas-scale-shadowBlur-expected.txt.
* platform/chromium/fast/canvas/canvas-scale-strokePath-shadow-expected.txt: Renamed from LayoutTests/platform/chromium-linux-x86/fast/canvas/canvas-scale-strokePath-shadow-expected.txt.
* platform/chromium/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt: Renamed from LayoutTests/platform/chromium-linux-x86/fast/canvas/canvas-strokePath-gradient-shadow-expected.txt.
* platform/chromium/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt: Renamed from LayoutTests/platform/chromium-linux-x86/fast/canvas/canvas-strokeRect-gradient-shadow-expected.txt.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126382 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Consider replacing return type of Clipboard::types() from HashSet<String> to Vector<String>.
https://bugs.webkit.org/show_bug.cgi?id=82888

Patch by Vineet Chaudhary <rgf748@motorola.com> on 2012-08-22
Reviewed by Kentaro Hara.

As part of removing custom bindings of types Array Clipboard::types() needs to return
Vector<String> than HashSet<String>

No new tests. Exixting test should pass with this change as no behavoural changes.

* bindings/js/JSClipboardCustom.cpp: Replace data type from HashSet<> to Vector<>.
(WebCore::JSClipboard::types):
* bindings/v8/custom/V8ClipboardCustom.cpp: Ditto.
(WebCore::V8Clipboard::typesAccessorGetter):
* dom/Clipboard.h: Ditto.
(Clipboard):
* platform/blackberry/ClipboardBlackBerry.cpp: Ditto.
(WebCore::ClipboardBlackBerry::types):
* platform/blackberry/ClipboardBlackBerry.h: Ditto.
(ClipboardBlackBerry):
* platform/chromium/ChromiumDataObject.cpp: Ditto.
(WebCore::ChromiumDataObject::types):
* platform/chromium/ChromiumDataObject.h: Ditto.
(ChromiumDataObject):
* platform/chromium/ClipboardChromium.cpp: Ditto.
(WebCore::ClipboardChromium::types):
* platform/chromium/ClipboardChromium.h: Ditto.
(ClipboardChromium):
* platform/efl/ClipboardEfl.cpp: Ditto.
(WebCore::ClipboardEfl::types):
* platform/efl/ClipboardEfl.h: Ditto.
(ClipboardEfl):
* platform/gtk/ClipboardGtk.cpp: Ditto.
(WebCore::ClipboardGtk::types):
* platform/gtk/ClipboardGtk.h: Ditto.
(ClipboardGtk):
* platform/mac/ClipboardMac.h: Ditto.
(ClipboardMac):
* platform/mac/ClipboardMac.mm: Ditto.
(WebCore::addHTMLClipboardTypesForCocoaType):
(WebCore::ClipboardMac::types):
* platform/qt/ClipboardQt.cpp: Ditto.
(WebCore::ClipboardQt::types):
* platform/qt/ClipboardQt.h: Ditto.
(ClipboardQt):
* platform/win/ClipboardWin.cpp: Ditto.
(WebCore::addMimeTypesForFormat):
(WebCore::ClipboardWin::types):
* platform/win/ClipboardWin.h: Ditto.
(ClipboardWin):
* platform/wx/ClipboardWx.cpp: Ditto.
(WebCore::ClipboardWx::types):
* platform/wx/ClipboardWx.h: Ditto.
(ClipboardWx):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126383 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed update of my email.

* Scripts/webkitpy/common/config/committers.py:
* Scripts/webkitpy/common/config/watchlist:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126386 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Array accesses should remember what kind of array they are predicted to access
https://bugs.webkit.org/show_bug.cgi?id=94448

Reviewed by Gavin Barraclough.

Introduced the notion of DFG::Array::Mode, stored in node.arrayMode(), which allows nodes
to remember how they decided to access arrays. This permits the bytecode parser to "lock in"
the mode of access if it has profiling at its disposal, and it also allows the prediction
propagator to do a fixup of the array mode later in the optimization fixpoint.
        
This patch adds a healthy amount of new capability (specifically the ability of the parser
to lock in an array mode regardless of type predictions) and it also blows away a lot of
messy code.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGArrayMode.cpp: Added.
(DFG):
(JSC::DFG::fromObserved):
(JSC::DFG::refineArrayMode):
(JSC::DFG::modeAlreadyChecked):
(JSC::DFG::modeToString):
* dfg/DFGArrayMode.h: Added.
(DFG):
(JSC::DFG::canCSEStorage):
(JSC::DFG::modeForPut):
(JSC::DFG::modesCompatibleForStorageLoad):
(JSC::DFG::modeSupportsLength):
* dfg/DFGByteCodeParser.cpp:
(ByteCodeParser):
(JSC::DFG::ByteCodeParser::getArrayModeWithoutOSRExit):
(JSC::DFG::ByteCodeParser::getArrayMode):
(JSC::DFG::ByteCodeParser::handleIntrinsic):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::checkStructureLoadElimination):
(JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
(JSC::DFG::CSEPhase::getByOffsetLoadElimination):
(JSC::DFG::CSEPhase::putByOffsetStoreElimination):
(JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::byValIsPure):
(JSC::DFG::Graph::clobbersWorld):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasArrayMode):
(Node):
(JSC::DFG::Node::arrayMode):
(JSC::DFG::Node::setArrayMode):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
(DFG):
(JSC::DFG::SpeculativeJIT::speculateArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126387 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move evaluate() from V8Proxy to ScriptController
https://bugs.webkit.org/show_bug.cgi?id=94768

Reviewed by Adam Barth.

To kill V8Proxy, we can move evaluate() from V8Proxy to ScriptController.

- Renamed evaluate() to compileAndRunScript() to avoid name conflict
with existing ScriptController::evaluate().

- Removed toV8Proxy() from NPV8Object, as it is no longer used.

No tests. No change in behavior.

* bindings/v8/NPV8Object.cpp:
(_NPN_EvaluateHelper):
* bindings/v8/ScheduledAction.cpp:
(WebCore::ScheduledAction::execute):
* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::compileAndRunScript):
(WebCore):
(WebCore::ScriptController::evaluate):
(WebCore::ScriptController::evaluateInIsolatedWorld):
* bindings/v8/ScriptController.h:
(ScriptController):
* bindings/v8/V8Proxy.cpp:
* bindings/v8/V8Proxy.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126388 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move m_isolatedWorlds and m_isolatedWorldSecurityOrigins from V8Proxy to ScriptController
https://bugs.webkit.org/show_bug.cgi?id=94770

Reviewed by Adam Barth.

Now m_isolatedWorlds and m_isolatedWorldSecurityOrigins of V8Proxy
are used by ScriptController only. We can move them to ScriptController.

No tests. No change in behavior.

* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::resetIsolatedWorlds):
(WebCore::ScriptController::evaluateInIsolatedWorld):
(WebCore::ScriptController::setIsolatedWorldSecurityOrigin):
(WebCore::ScriptController::collectIsolatedContexts):
* bindings/v8/ScriptController.h:
(ScriptController):
* bindings/v8/V8Proxy.h:
(V8Proxy):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r126383.
http://trac.webkit.org/changeset/126383
https://bugs.webkit.org/show_bug.cgi?id=82888

Chromium win build crash

* bindings/js/JSClipboardCustom.cpp:
(WebCore::JSClipboard::types):
* bindings/v8/custom/V8ClipboardCustom.cpp:
(WebCore::V8Clipboard::typesAccessorGetter):
* dom/Clipboard.h:
(Clipboard):
* platform/blackberry/ClipboardBlackBerry.cpp:
(WebCore::ClipboardBlackBerry::types):
* platform/blackberry/ClipboardBlackBerry.h:
(ClipboardBlackBerry):
* platform/chromium/ChromiumDataObject.cpp:
(WebCore::ChromiumDataObject::types):
* platform/chromium/ChromiumDataObject.h:
(ChromiumDataObject):
* platform/chromium/ClipboardChromium.cpp:
(WebCore::ClipboardChromium::types):
* platform/chromium/ClipboardChromium.h:
(ClipboardChromium):
* platform/efl/ClipboardEfl.cpp:
(WebCore::ClipboardEfl::types):
* platform/efl/ClipboardEfl.h:
(ClipboardEfl):
* platform/gtk/ClipboardGtk.cpp:
(WebCore::ClipboardGtk::types):
* platform/gtk/ClipboardGtk.h:
(ClipboardGtk):
* platform/mac/ClipboardMac.h:
(ClipboardMac):
* platform/mac/ClipboardMac.mm:
(WebCore::addHTMLClipboardTypesForCocoaType):
(WebCore::ClipboardMac::types):
* platform/qt/ClipboardQt.cpp:
(WebCore::ClipboardQt::types):
* platform/qt/ClipboardQt.h:
(ClipboardQt):
* platform/win/ClipboardWin.cpp:
(WebCore::addMimeTypesForFormat):
(WebCore::ClipboardWin::types):
* platform/win/ClipboardWin.h:
(ClipboardWin):
* platform/wx/ClipboardWx.cpp:
(WebCore::ClipboardWx::types):
* platform/wx/ClipboardWx.h:
(ClipboardWx):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126390 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Focusable elements without a role should not be ignored
https://bugs.webkit.org/show_bug.cgi?id=94302

Reviewed by Chris Fleizach.

Source/WebCore:

Changes the accessibility logic so that a generic element that's focusable is
not ignored for accessibility, and returns its inner text as its title. That way
if you Tab to the element, a reasonable accessibility notification is generated.

One exception is the body element, because focusing the body is equivalent to
blurring the current focused element and does not result in a "focus" accessibility
notification.

Also fixes logic that determined if an element was contentEditable by making
sure it catches the case with no attribute value (e.g. <div contentEditable>),
which also implies contentEditable=true according to the spec.

Test: accessibility/focusable-div.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore):
(WebCore::nodeHasContentEditableAttributeSet):
(WebCore::AccessibilityRenderObject::title):
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):

LayoutTests:

Adds a new test to make sure that a generic focusable element (like a div with tabindex=0)
can get focus and return an appropriate title, just like a form control or element with
an ARIA role.

Modifies three existing tests that were previously assuming that a focusable node
with no role would be ignored for accessibility ("accessibilityIsIgnored").

* accessibility/editable-webarea-context-menu-point.html:
* accessibility/focusable-div-expected.txt: Added.
* accessibility/focusable-div.html: Added.
* accessibility/table-detection.html:
* platform/mac/accessibility/listbox-hit-test.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126391 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement UndoManager's item() method
https://bugs.webkit.org/show_bug.cgi?id=94671

Patch by Sukolsak Sakshuwong <sukolsak@google.com> on 2012-08-22
Reviewed by Ryosuke Niwa.

Source/WebCore:

This patch implements UndoManager's item() method and its V8 custom binding.
We need to use custom binding here because we need to return user objects
that are stored in a hidden property of DOMTransaction wrappers, not returning
the wrappers themselves.

Test: editing/undomanager/undomanager-item.html

* bindings/js/JSUndoManagerCustom.cpp:
(WebCore::JSUndoManager::item):
(WebCore):
* bindings/v8/DOMTransaction.cpp:
(WebCore::DOMTransaction::data):
(WebCore):
(WebCore::DOMTransaction::setData):
(WebCore::DOMTransaction::getFunction):
* bindings/v8/DOMTransaction.h:
* bindings/v8/custom/V8UndoManagerCustom.cpp:
(WebCore::V8UndoManager::transactCallback):
(WebCore::V8UndoManager::itemCallback):
(WebCore):
* editing/UndoManager.cpp:
(WebCore::UndoManager::item):
(WebCore):
* editing/UndoManager.h:
(UndoManager):
* editing/UndoManager.idl:

LayoutTests:

* editing/undomanager/undomanager-item-expected.txt: Added.
* editing/undomanager/undomanager-item.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126392 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Remove V8Proxy from CodeGeneratorV8.pm
https://bugs.webkit.org/show_bug.cgi?id=94773

Reviewed by Adam Barth.

To kill V8Proxy, we can remove V8Proxy uses from CodeGeneratorV8.pm.

No tests. No change in behavior.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateToV8Converters):
* bindings/scripts/test/V8/V8Float64Array.cpp:
(WebCore::V8Float64Array::wrapSlow):
* bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
(WebCore::V8TestActiveDOMObject::wrapSlow):
* bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
(WebCore::V8TestCustomNamedGetter::wrapSlow):
* bindings/scripts/test/V8/V8TestEventConstructor.cpp:
(WebCore::V8TestEventConstructor::wrapSlow):
* bindings/scripts/test/V8/V8TestEventTarget.cpp:
(WebCore::V8TestEventTarget::wrapSlow):
* bindings/scripts/test/V8/V8TestException.cpp:
(WebCore::V8TestException::wrapSlow):
* bindings/scripts/test/V8/V8TestInterface.cpp:
(WebCore::V8TestInterface::wrapSlow):
* bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
(WebCore::V8TestMediaQueryListListener::wrapSlow):
* bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
(WebCore::V8TestNamedConstructor::wrapSlow):
* bindings/scripts/test/V8/V8TestNode.cpp:
(WebCore::V8TestNode::wrapSlow):
* bindings/scripts/test/V8/V8TestObj.cpp:
(WebCore::V8TestObj::wrapSlow):
* bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
(WebCore::V8TestSerializedScriptValueInterface::wrapSlow):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126393 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed Chromium gardeing.

* platform/chromium-mac-snowleopard/media/track/track-cue-rendering-horizontal-expected.png: Added.
* platform/chromium-mac-snowleopard/media/track/track-cue-rendering-horizontal-expected.txt: Added.
* platform/chromium-mac-snowleopard/media/track/track-cue-rendering-vertical-expected.png: Added.
* platform/chromium-mac-snowleopard/media/track/track-cue-rendering-vertical-expected.txt: Added.
* platform/chromium-mac/media/track/track-cue-rendering-horizontal-expected.png: Added.
* platform/chromium-mac/media/track/track-cue-rendering-horizontal-expected.txt: Added.
* platform/chromium-mac/media/track/track-cue-rendering-vertical-expected.png: Added.
* platform/chromium-mac/media/track/track-cue-rendering-vertical-expected.txt: Added.
* platform/chromium-win-xp/media/track/track-cue-rendering-horizontal-expected.png: Added.
* platform/chromium-win-xp/media/track/track-cue-rendering-horizontal-expected.txt: Added.
* platform/chromium-win-xp/media/track/track-cue-rendering-vertical-expected.png: Added.
* platform/chromium-win-xp/media/track/track-cue-rendering-vertical-expected.txt: Added.
* platform/chromium-win/media/track/track-cue-rendering-horizontal-expected.png: Added.
* platform/chromium-win/media/track/track-cue-rendering-horizontal-expected.txt: Added.
* platform/chromium-win/media/track/track-cue-rendering-vertical-expected.png: Added.
* platform/chromium-win/media/track/track-cue-rendering-vertical-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126394 268f45cc-cd09-0410-ab3c-d52691b4dbfc