Elements retained by AccessibilityImageMapLink leak
https://bugs.webkit.org/show_bug.cgi?id=120917

Reviewed by Chris Fleizach.

Merge https://chromium.googlesource.com/chromium/blink/+/df0bd288efe65e5e38425fbdcdfc68b5a2a79e42

Unfortunately, the test added by the Blink change doesn't reproduce a leak in WebKit.

* accessibility/AccessibilityImageMapLink.cpp:
(WebCore::AccessibilityImageMapLink::detachFromParent):
* accessibility/AccessibilityImageMapLink.h:
* accessibility/AccessibilityMockObject.h:
(WebCore::AccessibilityMockObject::detachFromParent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155234 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r155196.
http://trac.webkit.org/changeset/155196
https://bugs.webkit.org/show_bug.cgi?id=120919

Broke 16 tests on build.webkit.org (Requested by rniwa on
#webkit).

Patch by Commit Queue <commit-queue@webkit.org> on 2013-09-06

* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager._set_up_run):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Unreviewed gardening.

* platform/efl/TestExpectations: Removed passing test.
* platform/efl/svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
compositing/overlap-blending//children-opacity-huge.html and children-opacity-no-overlap.html are failing
https://bugs.webkit.org/show_bug.cgi?id=120922

Add the failing test expectations.

* platform/mac/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r155100): animations/cross-fade-background-image.html fails
https://bugs.webkit.org/show_bug.cgi?id=120923

Add the failing test expectation.

* platform/mac/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155238 268f45cc-cd09-0410-ab3c-d52691b4dbfc
jsc shell should destroy VM as a workaround for LLVM's exit-time destructors
https://bugs.webkit.org/show_bug.cgi?id=120921

Reviewed by Oliver Hunt.
        
LLVM's exit-time destructors will fire when we exit. If there is an on-going
FTL compile at exit, which will happen if the VM that triggered the compile
isn't shut down, then we will crash.
        
We should get rid of LLVM's exit-time destructors. But before we do that, we
should just do a clean VM shutdown to suppress spurious crashes. This will
help in expanding LLVM coverage for now.

* jsc.cpp:
(jscmain):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Interpolate between CSS filter() and cached images
https://bugs.webkit.org/show_bug.cgi?id=120602

Reviewed by Simon Fraser.

Source/WebCore:

Interpolate from a filter() image function to a url() image reference and
the other way around, if the input image on the filter function is the same
as the referenced image on url().

* page/animation/CSSPropertyAnimation.cpp: Replaced old
    filterBlend function with blendFilter function which is more generic
    and can be reused in multiple places.
(WebCore::blendFilterOperations):
(WebCore::blendFunc):
(WebCore::blendFilter):

LayoutTests:

Add aditional test for interpolation from url to a -webkit-filter function
and the other way around. Added an additional test to make sure that different
input images don't make start and end interpolate.

* fast/filter-image/filter-image-animation.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Lint JavaScript and CSS for minor issues
https://bugs.webkit.org/show_bug.cgi?id=120884

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-09-06
Reviewed by Timothy Hatcher.

JS, caught a bunch of missing semicolons but at least one possible
issue with duplicate object literal keys in CSSKeywordCompletions.

CSS, cause some duplicate properties, an invalid property value,
and some "0px" => "0" cleanup.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155241 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a new smart pointer type for fastMalloc'ed memory
https://bugs.webkit.org/show_bug.cgi?id=120911

Reviewed by Andreas Kling.

Source/WebCore:

Update for WTF changes.

* platform/network/cf/FormDataStreamCFNet.cpp:
(WebCore::advanceCurrentStream):

Source/WTF:

Due to an oversight on my part, Vector::releaseBuffer() currently returns an OwnPtr
which means that its data will be freed with operator delete instead of fastFree.

Fix this by introducing a new MllocPtr smart pointer class and change Vector::releaseBuffer() to return it instead.

* WTF.pro:
* WTF.vcxproj/WTF.vcxproj:
* WTF.vcxproj/WTF.vcxproj.filters:
* WTF.xcodeproj/project.pbxproj:
* wtf/CMakeLists.txt:
* wtf/FastAllocBase.h:
* wtf/MallocPtr.h: Added.
* wtf/Vector.h:
* wtf/text/StringBuffer.h:
* wtf/text/StringImpl.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155242 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL should support Call/Construct in the worst way possible
https://bugs.webkit.org/show_bug.cgi?id=120916

Reviewed by Oliver Hunt.
        
This adds support for Call/Construct by just calling out to C code that uses
the JSC::call/JSC::construct runtime functions for making calls. This is slow
and terrible, but it dramatically extends FTL coverage.
        
Supporting calls in a meaningful way meant also supporting
GlobalVarWatchpoint.
        
The extension of coverage helped to find a bunch of bugs:
        
- ObjectOrOtherUse was claimed to be supported in the FTL but speculate()
  didn't support it. That means that any node with an ObjectOrOtherUse edge
  that got DCE'd would cause the FTL to ICE.
        
- There was a bad fall-through compileCompareStrictEq() that led to ICE.
        
- The OSR exit reconstruction code was assuming it could do fast checks on
  node->child1() before even determining the type of node; that crashes if
  the node is HasVarArgs. Fixed by checking HasVarArgs first.
        
- The OSR exit compiler was using the wrong peekOffset for CArgumentGetter.
  The default is 1, which assumes that you didn't push anything onto the
  stack after getting called. The OSR exit thunks push FP, so the offset
  should be 2.
        
This passes stress tests and is probably huge performance regression if you
--useExperimentalFTL=true. The regression will be fixed in
https://bugs.webkit.org/show_bug.cgi?id=113621.

* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLIntrinsicRepository.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileGlobalVarWatchpoint):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Floats with shape-outside aren't painting in the correct order
https://bugs.webkit.org/show_bug.cgi?id=118492

Reviewed by Darin Adler.

Source/WebCore:

When removing the old positioning behavior, the code that makes a
float with shape-outside gain a layer was left behind. This patch
removes that, so now floats with shape-outside are painted just like
floats without shape-outside.

Also remove the isFloatingWithShapeOutside helper method because its
use is now somewhat redundant, and the check it does is now only
needed in one place.

Test: fast/shapes/shape-outside-floats/shape-outside-floats-not-a-layer.html

* rendering/RenderBox.h:
(WebCore::RenderBox::shapeOutsideInfo):
* rendering/RenderObject.h:
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::isEnabledFor):

LayoutTests:

Update tests to reflect correct painting order. Add a new test for the
correct painting behavior.

* csswg/submitted/shapes/shape-outside/shape-outside-floats-circle-000-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-circle-000.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-ellipse-000-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-ellipse-000.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-inset-rectangle-001-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-inset-rectangle-001.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-001-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-001.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-002-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-002.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-003-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-003.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-004-expected.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-004.html:
* csswg/submitted/shapes/shape-outside/shape-outside-floats-stacked-000.html:
* fast/shapes/shape-outside-floats/shape-outside-floats-not-a-layer-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-not-a-layer.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155244 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Bump the required Clang version to 3.2
https://bugs.webkit.org/show_bug.cgi?id=112537

Reviewed by Gustavo Noronha Silva.

* Source/autotools/CheckSystemAndBasicDependencies.m4: Require the Clang 3.2 stack
when the Clang compiler is specified.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155245 268f45cc-cd09-0410-ab3c-d52691b4dbfc