Unreviewed.

* Target.pri: Adding missing DFG files to the Qt build.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153369 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(FTL): Crash in sh4 baseline JIT.
https://bugs.webkit.org/show_bug.cgi?id=119138

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-07-26
Reviewed by Csaba Osztrogonác.

This crash is due to incomplete report of r150146 and r148474.

* jit/JITStubsSH4.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(FTL): Fix lots of crashes in sh4 baseline JIT.
https://bugs.webkit.org/show_bug.cgi?id=119148

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-07-26
Reviewed by Csaba Osztrogonác.

* jit/JSInterfaceJIT.h: "secondArgumentRegister" is wrong for sh4.
* llint/LowLevelInterpreter32_64.asm: "move t0, a0" is missing
in nativeCallTrampoline for sh4. Reuse MIPS implementation to avoid
code duplication.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153371 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] LayerTiler fails to render layer after waking up
https://bugs.webkit.org/show_bug.cgi?id=119146

Reviewed by George Staikos.

When the application is backgrounded, all tiles are freed up to
release memory back to the system. We also mark the contents as dirty
in LayerTiler::deleteTextures() so tiles will be repopulated when
waking up again.

The problem was caused by an optimization to avoid re-rendering tiles
repeatedly until the UI thread catches up with the fact that we have
indeed rendered those tiles (which will happen when the UI thread next
composites a frame).

When contents are dirty, we're not supposed to perform this
optimization (i.e. we're not supposed to skip rendering) because the
appearance of the layer has changed, so we do need to render those
tiles. Unfortunately, the code that was supposed to forget the list of
tiles rendered was in a conditional, "if (frontVisibility)", which
happened to be false sometimes when the app woke up again. So we ended
up perpetually skipping those render jobs, and the UI thread kept
yelling at us to render them.

Fixed by unconditionally dropping the list of tiles rendered when
contents are dirty.

This can't be detected without pixel tests, which BB DRT currently
doesn't support.

JIRA 452460

* platform/graphics/blackberry/LayerTiler.cpp:
(WebCore::LayerVisibility::clearTilesRendered):
(WebCore::LayerTiler::updateTextureContentsIfNeeded):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153372 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed gardening.

* WebCore.vcxproj/WebCore.vcxproj: Add missing header file to ease code viewing.
* WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Setting a large numeric property on an object causes it to allocate a huge backing store
https://bugs.webkit.org/show_bug.cgi?id=118914

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

There are two distinct actions that we're trying to optimize for:

new Array(100000);

and:

a = [];
a[100000] = 42;
        
In the first case, the programmer has indicated that they expect this Array to be very big, 
so they should get a contiguous array up until some threshold, above which we perform density 
calculations to see if it is indeed dense enough to warrant being contiguous.
        
In the second case, the programmer hasn't indicated anything about the size of the Array, so 
we should be more conservative and assume it should be sparse until we've proven otherwise.
        
Currently both of those cases are handled by MIN_SPARSE_ARRAY_INDEX. We should distinguish 
between them for the purposes of not over-allocating large backing stores like we see on 
http://www.peekanalytics.com/burgerjoints/
        
The way that we'll do this is to keep the MIN_SPARSE_ARRAY_INDEX for the first case, and 
introduce a new heuristic for the second case. If we are putting to an index above a certain 
threshold (say, 1000) and it is beyond the length of the array, then we will use a sparse 
map instead. So for example, in the second case above the empty array has a blank indexing 
type and a length of 0. We put-by-val to an index > 1000 and > a.length, so we'll use a sparse map.

This fix is ~800x speedup on the accompanying regression test :-o

* runtime/ArrayConventions.h:
(JSC::indexIsSufficientlyBeyondLengthForSparseMap):
* runtime/JSObject.cpp:
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::putByIndexBeyondVectorLength):
(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):

LayoutTests: 

Added new regression test for put-by-val-ing to a blank indexing type with a large index.
This fix is ~800x speedup on this regression test :-o

* fast/js/regress/put-by-val-large-index-blank-indexing-type.html: Added.
* fast/js/regress/script-tests/put-by-val-large-index-blank-indexing-type.js: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153374 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[mips] Fix LLINT build for mips backend
https://bugs.webkit.org/show_bug.cgi?id=119152

Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-07-26
Reviewed by Oliver Hunt.

* offlineasm/mips.rb:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153375 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WKTR should know about the JSC extensions to testRunner
https://bugs.webkit.org/show_bug.cgi?id=119154

Reviewed by Mark Hahnenberg and Geoffrey Garen.
        
This makes some fast/js tests pass.

* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::numberOfDFGCompiles):
(WTR::TestRunner::neverInlineFunction):
* WebKitTestRunner/InjectedBundle/TestRunner.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153376 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Remove workarounds now that rdar://problem/14390466 is fixed.
https://bugs.webkit.org/show_bug.cgi?id=119150

Reviewed by Anders Carlsson.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::createPlayer): Remove workaround to add legible output
after player is created.
(WebCore::AVFWrapper::createPlayerItem): Remove workaround to delay adding
legible output until player is created.
(WebCore::AVFWrapper::platformLayer): Get rid of unused temporary.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153377 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a mode where autosizing fixes the FrameView height to at least the WKView height
https://bugs.webkit.org/show_bug.cgi?id=119104
<rdar://problem/14549021>

Reviewed by Anders Carlsson.

* WebCore.exp.in: Export FrameView::setAutoSizeFixedMinimumHeight.
* page/FrameView.cpp:
(WebCore::FrameView::FrameView):
Initialize m_autoSizeFixedMinimumHeight to 0.

(WebCore::FrameView::autoSizeIfEnabled):
Increase the FrameView height to m_autoSizeFixedMinimumHeight if necessary,
and do another layout. Store the computed intrinsic content size.

(WebCore::FrameView::setAutoSizeFixedMinimumHeight): Added.

* page/FrameView.h:
(WebCore::FrameView::autoSizingIntrinsicContentSize): Added.

* Shared/WebPageCreationParameters.cpp:
(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):
* Shared/WebPageCreationParameters.h:
Add autoSizingShouldExpandToViewHeight parameter.

* UIProcess/API/mac/WKView.mm:
(-[WKView minimumWidthForAutoLayout]):
(-[WKView setMinimumWidthForAutoLayout:]):
Un-deprecate these as they're still useful if not sending a height.

(-[WKView shouldExpandToViewHeightForAutoLayout]):
(-[WKView setShouldExpandToViewHeightForAutoLayout:]):
* UIProcess/API/mac/WKViewPrivate.h:
New property, forward to WebPageProxy.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::WebPageProxy):
(WebKit::WebPageProxy::creationParameters):
(WebKit::WebPageProxy::setAutoSizingShouldExpandToViewHeight):
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::autoSizingShouldExpandToViewHeight):
New property, forward to WebPage.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::transitionToCommittedForNewPage):
If enabled, update the FrameView's autoSizeFixedMinimumHeight.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage):
(WebKit::WebPage::setAutoSizingShouldExpandToViewHeight):
* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::autoSizingShouldExpandToViewHeight):
New property; if enabled, set FrameView's autoSizeFixedMinimumHeight,
otherwise reset it to 0.

* WebProcess/WebPage/WebPage.messages.in:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
(WebKit::TiledCoreAnimationDrawingArea::updateIntrinsicContentSizeTimerFired):
(WebKit::TiledCoreAnimationDrawingArea::updateGeometry):
Retrieve intrinsic content size explicitly from the FrameView, as
it may not have used it as its final contentsSize if
autoSizeFixedMinimumHeight is set.

Set the WebPage's size in case the load is committed so that the
WebFrameLoaderClient doesn't reset us to the wrong size.

Update autoSizeFixedMinimumHeight if enabled when the view size changes.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153378 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add another method that we need to set aside subviews for
https://bugs.webkit.org/show_bug.cgi?id=119157
<rdar://problem/14554723>

Reviewed by Beth Dakin.

* WebView/WebHTMLView.mm:
(-[WebHTMLView _recursive:displayRectIgnoringOpacity:inContext:topView:]):
(-[WebHTMLView _recursive:displayRectIgnoringOpacity:inGraphicsContext:CGContext:topView:shouldChangeFontReferenceColor:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153379 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Apply FINAL to the RenderObject hierarchy.
<http://webkit.org/b/115977>

Mostly from Blink r148795 by <cevans@chromium.org>
<http://src.chromium.org/viewvc/blink?view=revision&revision=148795>

* rendering/: Beat things with the FINAL stick.
* WebCore.exp.in: Export a now-needed symbol.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153380 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: Crash when opening a message on Gmail
https://bugs.webkit.org/show_bug.cgi?id=119105

Source/JavaScriptCore: 

Reviewed by Oliver Hunt and Mark Hahnenberg.
        
- GetById patching in the DFG needs to be more disciplined about how it derives the
  slow path.
        
- Fix some dumping code thread safety issues.

* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::dump):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* dfg/DFGRepatch.cpp:
(JSC::DFG::getPolymorphicStructureList):
(JSC::DFG::tryBuildGetByIDList):

LayoutTests: 

Reviewed by Oliver Hunt and Mark Hahnenberg.

* fast/js/dfg-get-by-id-unset-then-proto-less-warmup.html: Added.
* fast/js/dfg-get-by-id-unset-then-proto-more-warmup.html: Added.
* fast/js/dfg-get-by-id-unset-then-proto.html: Added.
* fast/js/jsc-test-list
* fast/js/script-tests/dfg-get-by-id-unset-then-proto-less-warmup.js: Added.
(foo):
(Blah):
* fast/js/script-tests/dfg-get-by-id-unset-then-proto-more-warmup.js: Added.
(foo):
(Blah):
* fast/js/script-tests/dfg-get-by-id-unset-then-proto.js: Added.
(foo):
(Blah):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed build fix.

Correct build when targeting a release that does not have the AVCF
Legible Output infrastructure.

* platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Exclude
a soft-link target when the API doesn't exist.
* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
Correct include options for non-Legible Output supporting environments.
(WebCore::MediaPlayerPrivateAVFoundationCF::processLegacyClosedCaptionsTracks):
Prevent build failure when building with legacy caption support.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153382 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(FTL?): Crashes in plugin tests
https://bugs.webkit.org/show_bug.cgi?id=119141

Reviewed by Michael Saboff.

Source/JavaScriptCore:

Re-export getStackTrace

* interpreter/Interpreter.h:

Source/WebCore:

Getting the correct semantics to appease the inspector is fairly
awful with the iterator system.  For the time being lets just revert
to requesting a full stack trace as we did in the past.

* bindings/js/ScriptCallStackFactory.cpp:
(WebCore::createScriptCallStack):

LayoutTests:

Bring back plugin tests

* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153383 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed build fix.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::createMetadataKeyNames): Do not include Media Selection
synbols when building without Media Selection API.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Added module definition file for building libEGL.
https://bugs.webkit.org/show_bug.cgi?id=119162

Reviewed by Brent Fulgham.

* ANGLE.vcxproj/libEGLCommon.props: Added reference to libEGL.def.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153385 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] New positioning model: support for polygon shape-outside
https://bugs.webkit.org/show_bug.cgi?id=118085

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-07-26
Reviewed by Dirk Schulze.

Update polygon tests to work for new positioning model and migrate
them to be W3C spec tests. Thus, they have been imported from the
CSSWG repository now.

* TestExpectations: Remove skip for replaced test.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-000-expected.html: Added.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-000.html: Added.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-001-expected.html: Added.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-001.html: Added.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-002-expected.html: Added.
* csswg/submitted/shapes/shape-outside/shape-outside-floats-polygon-002.html: Added.
* csswg/submitted/shapes/shape-outside/w3c-import.log:
* fast/shapes/shape-outside-floats/shape-outside-floats-simple-polygon-expected.html: Removed.
* fast/shapes/shape-outside-floats/shape-outside-floats-simple-polygon.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153386 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERT failure in wtf/CheckedBoolean.h line 43 on Windows
https://bugs.webkit.org/show_bug.cgi?id=119170

Reviewed by Michael Saboff.

Added a copy constructor to CheckedBoolean.

* wtf/CheckedBoolean.h:
(CheckedBoolean::CheckedBoolean):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153387 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Allow new transitions to run even when controller is suspended
https://bugs.webkit.org/show_bug.cgi?id=119171
<rdar://problem/14511404>

Reviewed by Simon Fraser.

Source/WebCore:

Expose a new property on AnimationController that allows newly created
animations to run even if the controller says it is suspended. See WebKit
ChangeLog for more details.

Test: transitions/created-while-suspended.html

* WebCore.exp.in: Export the new methods so WebView can use them.
* page/animation/AnimationController.cpp:
(WebCore::AnimationControllerPrivate::AnimationControllerPrivate): Initialize new flag to false.
(WebCore::AnimationControllerPrivate::startAnimationsIfNotSuspended): Check new flag is not true.
(WebCore::AnimationControllerPrivate::setAllowsNewAnimationsWhileSuspended): Expose setter.
(WebCore::AnimationController::allowsNewAnimationsWhileSuspended): "Public" getter.
(WebCore::AnimationController::setAllowsNewAnimationsWhileSuspended): "Public" setter.
* page/animation/AnimationController.h:
* page/animation/AnimationControllerPrivate.h:
(WebCore::AnimationControllerPrivate::allowsNewAnimationsWhileSuspended):
* page/animation/CompositeAnimation.cpp:
(WebCore::CompositeAnimation::CompositeAnimation): Only suspend if new flag is false. Everything else
relies on the m_suspended flag, so the real code change is this one line.

Source/WebKit/mac:

Expose a new SPI on WebView that triggers the (buggy) old behaviour
for animations, such that any newly created animations will start even
when the document is supposedly suspended. It turns out that client content was
unknowingly relying on this behaviour - e.g. suspending a view, loading a
bunch of new content, bringing the view on screen and then unsuspending. In this
situation, we were not running CSS transitions, because the page was suspended.
However, JS was still triggering them, and content was expecting a transitionEnd event.

* WebView/WebView.mm:
(-[WebView allowsNewCSSAnimationsWhileSuspended]): Calls into AnimationController.
(-[WebView setAllowsNewCSSAnimationsWhileSuspended:]): Ditto.
* WebView/WebViewPrivate.h: New methods listed above.

LayoutTests:

This is actually a test to make sure this fix didn't break anything. There is no
way to trigger the new behaviour from the test system (or from Safari).

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153396 268f45cc-cd09-0410-ab3c-d52691b4dbfc