ASSERTION FAILED: bitwise_cast<WriteBarrier<Unknown>*>(callFrame) == m_registers in jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-capture-throw-exception.js.layout-dfg-eager-no-cjit
https://bugs.webkit.org/show_bug.cgi?id=122418

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

This is pretty awesome. With stack compression, Arguments created in the DFG will point
their m_registers pointers into a different slab of stack than they would have in byte
code.

Hence OSR exit must repoint any Arguments objects' m_registers pointers. It previously
neglected to do so. This patch fixes that.
        
Fixing this unveiled another bug: the stack reversal broke the reification of inlined
phantom arguments.
        
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::reifyInlinedCallFrames):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
(JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* runtime/Arguments.h:
(JSC::Arguments::offsetOfNumArguments):
(JSC::Arguments::offsetOfRegisters):
(JSC::Arguments::offsetOfSlowArgumentData):
(JSC::Arguments::offsetOfOverrodeLength):

LayoutTests: 

* js/script-tests/dfg-arguments-osr-exit-multiple-blocks-before-exit.js:
* js/script-tests/dfg-arguments-osr-exit-multiple-blocks.js:
* js/script-tests/dfg-arguments-osr-exit.js:
* js/script-tests/dfg-inline-arguments-capture-throw-exception.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157035 268f45cc-cd09-0410-ab3c-d52691b4dbfc
run-jsc-stress-tests shouldn't print its goofy progress meter when running on the bots
https://bugs.webkit.org/show_bug.cgi?id=122437

Reviewed by Antoine Quint.

* Scripts/run-jsc-stress-tests:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157036 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Fails to build with jhbuild with newer system glib
https://bugs.webkit.org/show_bug.cgi?id=122132

Patch by Gustavo Noronha Silva <gustavo.noronha@collabora.com> on 2013-10-07
Reviewed by Martin Robinson.

Newer glib includes new symbols that some system libraries which we depend on, such as pango, have
started relying on. glib is not a dependency that should change test results, and is provided in
jhbuild with the intention of supporting the other bits that do, so using a newer stable release
should not be an issue.

* gtk/jhbuild.modules:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157037 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Facebook wrapped a file upload button in an unfocusable ARIA button, which doesn't work with AXPress.
https://bugs.webkit.org/show_bug.cgi?id=122252

Reviewed by Mario Sanchez Prada.

Source/WebCore:

When an author uses a control-type ARIA role (like button), but then hides a native control-type inside,
AXPress needs to operate on the inside node if possible.

Test: accessibility/axpress-on-aria-button.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::isNodeActionElement):
(WebCore::nativeActionElement):
(WebCore::AccessibilityNodeObject::actionElement):

LayoutTests:

* accessibility/axpress-on-aria-button-expected.txt: Added.
* accessibility/axpress-on-aria-button.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157038 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed buildfix for GCC 4.6.

Changed override to OVERRIDE and final to FINAL.

* page/PageSerializer.cpp:
* workers/AbstractWorker.h:
* workers/SharedWorker.h:
* workers/Worker.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157039 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] webkit_dom_html_style_element_{s,g}et_scoped was removed
https://bugs.webkit.org/show_bug.cgi?id=122446

Reviewed by Martin Robinson.

Added skeleton functions warning of removed functionality for
the <style scoped> GObject DOM binding.

* bindings/gobject/WebKitDOMCustom.cpp:
* bindings/gobject/WebKitDOMCustom.h:
* bindings/gobject/WebKitDOMCustom.symbols:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
URLMediaStream is unguarded by ENABLE(MEDIA_STREAM)
https://bugs.webkit.org/show_bug.cgi?id=122444

Reviewed by Martin Robinson.

* Modules/mediastream/URLMediaStream.cpp: Added missing
conditional guards.
* Modules/mediastream/URLMediaStream.h: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157041 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] UserMediaClientGtk needs API update
https://bugs.webkit.org/show_bug.cgi?id=122324

Reviewed by Martin Robinson.

Update UserMediaClientGtk API after changes made in the parent
class in r156473.

* WebCoreSupport/UserMediaClientGtk.cpp:
(WebKit::UserMediaClientGtk::requestPermission):
(WebKit::UserMediaClientGtk::cancelRequest):
* WebCoreSupport/UserMediaClientGtk.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157042 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Trap 5 (most likely int $3) in jsc-layout-tests.yaml/js/script-tests/integer-division-neg2tothe32-by-neg1.js.layout-dfg-eager-no-cjit
https://bugs.webkit.org/show_bug.cgi?id=122420

Source/JavaScriptCore: 

Reviewed by Michael Saboff.
        
For the (-2^31/-1)|0 case, we were returning the left operand (i.e. -2^31) but we were
failing to account for the possibility that this operand has high-bit garbage and
int32Result() requires that the high bits are zero.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithDiv):

LayoutTests: 

Reviewed by Michael Saboff.

* js/script-tests/integer-division-neg2tothe32-by-neg1.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157043 268f45cc-cd09-0410-ab3c-d52691b4dbfc