REGRESSION(r127163): Respect clearance set on ancestors when placing floats
https://bugs.webkit.org/show_bug.cgi?id=119979

Reviewed by David Hyatt.

Source/WebCore:

If a float has a self-collapsing ancestor with clearance then it needs to respect
that clearance when placing itself on the line.

Test: fast/block/margin-collapse/self-collapsing-block-with-float-descendant.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::marginOffsetForSelfCollapsingBlock):
* rendering/RenderBlock.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
* rendering/RenderBox.h:
(WebCore::RenderBox::previousInFlowSiblingBox):

LayoutTests:

* fast/block/margin-collapse/self-collapsing-block-with-float-descendant-expected.html: Added.
* fast/block/margin-collapse/self-collapsing-block-with-float-descendant.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154399 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Allow opacity to apply to custom scrollbars
https://bugs.webkit.org/show_bug.cgi?id=120104

Source/WebCore:

Reviewed by David Hyatt.

Opacity was ignored custom scrollbar pseudoelements because custom scrollbar
renderers never create layers, and opacity is normally handled by the RenderLayer code.

Fix by having RenderScrollbarTheme and RenderScrollbarPart do the transparency
layers necessary for opacity. RenderScrollbarPart handles opacity for individual
parts.

Because ScrollbarThemeComposite::paint() renders the parts on after another (with
no nesting), opacity handling for the entire scrollbar needs special-casing.
This is done by willPaintScrollbar()/didPaintScrollbar() on the theme.
RenderScrollbarTheme consults the opacity the scrollbar (which we get from
the ScrollbarBGPart renderer) to decide whether to set up a transparency layer.

Test: scrollbars/scrollbar-parts-opacity.html

* platform/ScrollbarThemeComposite.cpp:
(WebCore::ScrollbarThemeComposite::paint):
* platform/ScrollbarThemeComposite.h:
(WebCore::ScrollbarThemeComposite::willPaintScrollbar):
(WebCore::ScrollbarThemeComposite::didPaintScrollbar):
* rendering/RenderScrollbar.cpp:
(WebCore::RenderScrollbar::opacity):
* rendering/RenderScrollbar.h:
* rendering/RenderScrollbarPart.cpp:
(WebCore::RenderScrollbarPart::paintIntoRect):
* rendering/RenderScrollbarTheme.cpp:
(WebCore::RenderScrollbarTheme::willPaintScrollbar):
(WebCore::RenderScrollbarTheme::didPaintScrollbar):
* rendering/RenderScrollbarTheme.h:

LayoutTests:

Reviewed by David Hyatt.

Ref test for custom scrollbars with opacity on the bar itself,
and on the thumb.

* scrollbars/scrollbar-parts-opacity-expected.html: Added.
* scrollbars/scrollbar-parts-opacity.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154400 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120118> Frame::animation() should return a reference.

Reviewed by Anders Carlsson.

Frame::m_animationController is never null.
Also changed RenderObject::animation() to return a reference since it's just a wrapper
around RenderObject::frame()->animation() with no null checking of frame().

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154401 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120099> Assertion failure in JSC::SlotVisitor::copyLater when marking DataView

Mark fast/canvas/webgl/array-message-passing.html as crashing on debug, for now.

* platform/mac/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154402 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should inline new typedArray()
https://bugs.webkit.org/show_bug.cgi?id=120022

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
Adds inlining of typed array allocations in the DFG. Any operation of the
form:
        
    new foo(blah)
        
or:
        
    foo(blah)
        
where 'foo' is a typed array constructor and 'blah' is exactly one argument,
is turned into the NewTypedArray intrinsic. Later, of child1 (i.e. 'blah')
is predicted integer, we generate inline code for an allocation. Otherwise
it turns into a call to an operation that behaves like the constructor would
if it was passed one argument (i.e. it may wrap a buffer or it may create a
copy or another array, or it may allocate an array of that length).

* bytecode/SpeculatedType.cpp:
(JSC::speculationFromTypedArrayType):
(JSC::speculationFromClassInfo):
* bytecode/SpeculatedType.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
* dfg/DFGCCallHelpers.h:
(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::putStructureStoreElimination):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasTypedArrayType):
(JSC::DFG::Node::typedArrayType):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
(JSC::DFG::newTypedArrayWithSize):
(JSC::DFG::newTypedArrayWithOneArgument):
* dfg/DFGOperations.h:
(JSC::DFG::operationNewTypedArrayWithSizeForType):
(JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_object):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_new_object):
* runtime/JSArray.h:
(JSC::JSArray::allocationSize):
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::allocationSize):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayView):
* runtime/JSObject.h:
(JSC::JSFinalObject::allocationSize):
* runtime/TypedArrayType.cpp:
(JSC::constructorClassInfoForType):
* runtime/TypedArrayType.h:
(JSC::indexToTypedArrayType):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/regress/Float64Array-alloc-long-lived-expected.txt: Added.
* fast/js/regress/Float64Array-alloc-long-lived.html: Added.
* fast/js/regress/Int16Array-alloc-long-lived-expected.txt: Added.
* fast/js/regress/Int16Array-alloc-long-lived.html: Added.
* fast/js/regress/Int8Array-alloc-long-lived-expected.txt: Added.
* fast/js/regress/Int8Array-alloc-long-lived.html: Added.
* fast/js/regress/script-tests/Float64Array-alloc-long-lived.js: Added.
* fast/js/regress/script-tests/Int16Array-alloc-long-lived.js: Added.
* fast/js/regress/script-tests/Int32Array-alloc-long-lived.js:
* fast/js/regress/script-tests/Int8Array-alloc-long-lived.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154403 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r154399): broke Mac ML debug WK1 tests > 50 crashes (Requested by thorton on #webkit).
https://bugs.webkit.org/show_bug.cgi?id=120129

Rolling out http://trac.webkit.org/changeset/154399.

* rendering/RenderBlock.cpp:
* rendering/RenderBlock.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
* rendering/RenderBox.h:

* fast/block/margin-collapse/self-collapsing-block-with-float-descendant-expected.html: Removed.
* fast/block/margin-collapse/self-collapsing-block-with-float-descendant.html: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154404 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=120127
Remove JSObject::propertyIsEnumerable

Reviewed by Sam Weinig.

This method is just a wart - it contains unnecessary const-casting, function call overhead, and LOC.

* runtime/JSObject.cpp:
* runtime/JSObject.h:
    - remove propertyIsEnumerable
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncPropertyIsEnumerable):
    - Move implementation here using getOwnPropertyDescriptor directly.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154405 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert http://trac.webkit.org/changeset/154022, as it failed to update
a variety of scripts that depended on the old format.

See https://bugs.webkit.org/show_bug.cgi?id=120131 for one such example.

* Scripts/prepare-ChangeLog:
(main):
(generateNewChangeLogs):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove incorrect ASSERT from CopyVisitor::visitItem

Rubber stamped by Filip Pizlo.

Source/JavaScriptCore: 

* heap/CopyVisitorInlines.h:
(JSC::CopyVisitor::visitItem):

LayoutTests: 

Added a new test that triggered the old ASSERT. It's a useful test to have because we create
TypedArrays with custom properties.

* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154407 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure in JSC::SlotVisitor::copyLater when marking JSDataView
https://bugs.webkit.org/show_bug.cgi?id=120099

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
JSDataView should not store the ArrayBuffer* in the butterfly indexing header, since
JSDataView may have ordinary JS indexed properties.

* runtime/ClassInfo.h:
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
(JSC::JSArrayBufferView::finishCreation):
* runtime/JSArrayBufferView.h:
(JSC::hasArrayBuffer):
* runtime/JSArrayBufferViewInlines.h:
(JSC::JSArrayBufferView::buffer):
(JSC::JSArrayBufferView::neuter):
(JSC::JSArrayBufferView::byteOffset):
* runtime/JSCell.cpp:
(JSC::JSCell::slowDownAndWasteMemory):
* runtime/JSCell.h:
* runtime/JSDataView.cpp:
(JSC::JSDataView::JSDataView):
(JSC::JSDataView::create):
(JSC::JSDataView::slowDownAndWasteMemory):
* runtime/JSDataView.h:
(JSC::JSDataView::buffer):
* runtime/JSGenericTypedArrayView.h:
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::::visitChildren):
(JSC::::slowDownAndWasteMemory):

LayoutTests: 

Reviewed by Mark Hahnenberg.

* fast/js/regress/ArrayBuffer-DataView-alloc-large-long-lived-expected.txt: Added.
* fast/js/regress/ArrayBuffer-DataView-alloc-large-long-lived.html: Added.
* fast/js/regress/ArrayBuffer-DataView-alloc-long-lived-expected.txt: Added.
* fast/js/regress/ArrayBuffer-DataView-alloc-long-lived.html: Added.
* fast/js/regress/DataView-custom-properties-expected.txt: Added.
* fast/js/regress/DataView-custom-properties.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-DataView-alloc-large-long-lived.js: Added.
* fast/js/regress/script-tests/ArrayBuffer-DataView-alloc-long-lived.js: Added.
* fast/js/regress/script-tests/DataView-custom-properties.js: Added.
* platform/mac/TestExpectations: 



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154408 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120132> Frame::navigationScheduler() should return a reference.

Reviewed by Anders Carlzon.

Frame::m_navigationScheduler is an inline member, not a pointer.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154409 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=111650
REGRESSION (r143931): set-cookie-on-redirect.html still breaking subsequent tests

Reviewed by Brady Eidson.

Work around <rdar://problem/10080130> by making the cookie persistent, session
cookies are deleted in a way that confuses some code paths in CFNetwork.

I'll unskip tests later, with another cookie reliability fix.

* http/tests/cookies/resources/set-cookie-on-redirect.php:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120134> [Tools] lldb_webkit.py helpers is incorrectly printing 8bit Strings

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-08-21
Reviewed by Benjamin Poulain.

WTFString moved the is8bit bit by one in r152201.

* lldb/lldb_webkit.py:
(WTFStringImplProvider.is_8bit):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154411 268f45cc-cd09-0410-ab3c-d52691b4dbfc
isReplacementObscured is wrong when the indicator is clipped by an iframe
https://bugs.webkit.org/show_bug.cgi?id=120031
<rdar://problem/14606819>

Reviewed by Simon Fraser.

Hit-test for plugin obscurity in the root document. To do this, we also need
to convert the indicator rectangle into root view coordinates before
hit testing its edges.

This resolves the case where an iframe which clips its content was reporting
the indicator as not obscured, despite the fact that it was obscured from the
point of view of the user.

Updated test plugins/unavailable-plugin-indicator-obscurity.html

* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::isReplacementObscured):

Update the unavailable plugin indicator test to also ensure that plugins are
correctly known to be obscured when contained within and clipped by an <iframe>.

* plugins/unavailable-plugin-indicator-obscurity-expected.txt:
* plugins/unavailable-plugin-indicator-obscurity.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
revalidateTiles and ensureTilesForRect can share a lot of code
https://bugs.webkit.org/show_bug.cgi?id=119282

Reviewed by Simon Fraser.

No new tests, just a refactoring.

The bodies of ensureTilesForRect and revalidateTiles are nearly equivalent.

* platform/graphics/ca/mac/TileController.h:
Add an enum, NewTileType, to note whether the tiles created by ensureTilesForRect will
be primary coverage tiles or secondary out-of-view tiles.

* platform/graphics/ca/mac/TileController.mm:
(WebCore::TileController::prepopulateRect):
Move the code to see if we already have the requisite tiles in the
primary coverage rect, as well as our call to updateTileCoverageMap,
out into prepopulateRect, to generalize ensureTilesForRect.

(WebCore::TileController::revalidateTiles):
Make use of ensureTilesForRect. The platformCALayerDidCreateTiles call will happen there, now.

(WebCore::TileController::ensureTilesForRect):
Make ensureTilesForRect return the rect that it created tiles for, and only put
tiles in a cohort if we're creating secondary tiles.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154413 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120115> SVG elements always have custom style resolve callbacks.

Reviewed by Antti Koivisto.

Simplify SVGElement construction by making them opt in to custom style resolve callbacks
by default, and removing the ability to pass a custom ConstructionType to some subclass
constructors.

* dom/Node.h:

    Add HasCustomStyleResolveCallbacksFlag to the CreateSVGElement mask.

* svg/SVGElement.cpp:
(WebCore::SVGElement::SVGElement):
* svg/SVGElement.h:
* svg/SVGGElement.cpp:
(WebCore::SVGGElement::SVGGElement):
* svg/SVGGElement.h:
* svg/SVGGraphicsElement.cpp:
(WebCore::SVGGraphicsElement::SVGGraphicsElement):
* svg/SVGGraphicsElement.h:
* svg/SVGImageElement.cpp:
(WebCore::SVGImageElement::SVGImageElement):
* svg/SVGStyledElement.cpp:
(WebCore::SVGStyledElement::SVGStyledElement):
* svg/SVGStyledElement.h:

    Remove calls to setHasCustomStyleResolveCallbacks() in SVGElement and subclasses.
    Also remove unnecessary ConstructionType argument from subclasses since nobody
    overrides it and everyone just uses CreateSVGElement.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
revalidateTiles and ensureTilesForRect can share a lot of code
https://bugs.webkit.org/show_bug.cgi?id=119282

Missed the review comments, whoops.

* platform/graphics/ca/mac/TileController.h:
* platform/graphics/ca/mac/TileController.mm:
(WebCore::TileController::prepopulateRect):
(WebCore::TileController::revalidateTiles):
(WebCore::TileController::ensureTilesForRect):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120137> Separating Win32 and Win64 builds.

Reviewed by Brent Fulgham.

Source/JavaScriptCore: 

* JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
* JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
Pass PlatformArchitecture as a command line parameter to bash scripts.
* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
* JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
* JavaScriptCore.vcxproj/build-generated-files.sh:
Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).

Source/WebCore: 

* WebCore.vcxproj/WebCoreGenerated.make:
* WebCore.vcxproj/WebCoreGeneratedWinCairo.make:
Pass PlatformArchitecture as a command line parameter to bash scripts
and use PlatformArchitecture to determine which directory to delete
while cleaning (obj32 or obj64).
* WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props:
Export PlatformArchitecture to be used by make and cmd scripts.
* WebCore.vcxproj/build-generated-files.sh:
Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
* WebCore.vcxproj/copyForwardingHeaders.cmd:
* WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
Use PlatformArchitecture to determine which directory to copy to (obj32 or obj64).

Source/WebKit: 

* WebKit.vcxproj/WebKit/WebKitPostBuild.cmd:
* WebKit.vcxproj/WebKitExportGenerator/WebKitExportGeneratorBuildCmd.cmd:
* WebKit.vcxproj/WebKitExportGenerator/WebKitExportGeneratorPostBuild.cmd:
* WebKit.vcxproj/WebKitExportGenerator/WebKitExportGeneratorPreBuild.cmd:
Use PlatformArchitecture to determine correct object directory (obj32 or obj64).

Source/WTF: 

* WTF.vcxproj/WTFGenerated.make:
Pass PlatformArchitecture as a command line parameter to bash scripts.
* WTF.vcxproj/build-generated-files.sh:
Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).

WebKitLibraries: 

* win/tools/vsprops/common.props:
Export PlatformArchitecture to be used by make and cmd scripts.
Use PlatformArchitecture to determine correct build directory
(lib32/bin32/obj32 or lib64/bin64/obj64).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/116901> ASSERTION FAILED: !m_visibleDescendantStatusDirty on twitter

Reviewed by Beth Dakin.

In order to make decisions about compositing, the m_hasVisibleDescendant bit on RenderLayers
needs to be up-to-date when RenderLayerCompositor::computeCompositingRequirements is recursing
over the RenderLayer tree.

However, was possible for computeCompositingRequirements() to hit a layer whose m_visibleDescendantStatusDirty
bit was set; we only clear this bit from collectLayers() (when updating z-order lists), and from styleChanged()
which requires that style changed on the layer itself.

Fix by always calling updateDescendantDependentFlags() from computeCompositingRequirements().

Wasn't able to easily get a reduced testcase.

* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::computeCompositingRequirements):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120123> [BlackBerry] Incorrect origin of indexOfTile in LayerTiler can cause unnecessary texture jobs and waste memory

Patch by Jacky Jiang <zhajiang@blackberry.com> on 2013-08-21
Reviewed by Yong Li.
Internally reviewed by Arvid Nilsson.

JIRA 481356
The origin of indexOfTile(origin) is incorrect in these two places. For
example, if the maxXMaxYCorner of the rect is (768, 768), there can be
three other redundant indexOfTile (0, 1), (1, 0), (1, 1) which can cause
unnecessary texture jobs and waste memory.
The origin should be the top left of the bottom right pixel of a rect.

* platform/graphics/blackberry/LayerTiler.cpp:
(WebCore::LayerTiler::updateTextureContentsIfNeeded):
(WebCore::LayerTiler::processTextureJob):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154418 268f45cc-cd09-0410-ab3c-d52691b4dbfc