[Windows] Unreviewed test fix. Prevent crash when changing URL paths during testing.

A shared BSTR value (_bstr_t) was being reallocated outside the smart pointer, causing
it to be double-freed.

* WinLauncher/WinLauncher.cpp:
(EditProc): Be explicit about type passed to loadURL.
(loadURL): Create a shallow copy of the BSTR so we only allocate memory if needed. Use _bstr_t so
that reallocating the BSTR is done with the knowledge of the smart pointer.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
editing/execCommand/findString-diacriticals.html expects to fail
https://bugs.webkit.org/show_bug.cgi?id=122100

Patch by Robert Plociennik <r.plociennik@samsung.com> on 2013-09-30
Reviewed by Alexey Proskuryakov.

Since all major platforms pass editing/execCommand/findString-diacriticals.html,
the test now globally expects "PASS" instead of "FAIL" rendering the individual
platform expectation files obsolete.

* editing/execCommand/findString-diacriticals-expected.txt: "PASS" -> "FAIL"
* platform/efl/TestExpectations: EFL passes editing/execCommand/findString-diacriticals.
* platform/gtk/editing/execCommand/findString-diacriticals-expected.txt: Removed.
* platform/mac/editing/execCommand/findString-diacriticals-expected.txt: Removed.
* platform/qt/editing/execCommand/findString-diacriticals-expected.txt: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156663 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, roll back in r156546 with rebaselined tests.
https://bugs.webkit.org/show_bug.cgi?id=122111

Source/WebCore:

* Modules/mediacontrols/mediaControlsApple.js:
(Controller):
(Controller.prototype.addVideoListeners):
(Controller.prototype.removeVideoListeners):
(Controller.prototype.updateHasAudio):

LayoutTests:

* platform/mac/TestExpectations:
* platform/mac/fast/hidpi/video-controls-in-hidpi-expected.png:
* platform/mac/fast/hidpi/video-controls-in-hidpi-expected.txt:
* platform/mac/fast/layers/video-layer-expected.png:
* platform/mac/fast/layers/video-layer-expected.txt:
* platform/mac/media/media-controls-clone-expected.png:
* platform/mac/media/media-controls-clone-expected.txt:
* platform/mac/media/video-no-audio-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed build fix.

* WebCore.vcxproj/WebCore.vcxproj.filters: Correct malformed XML in project files.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156665 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the build when building against an SDK.

Xcode helpfully prepends $(SDKROOT) to the paths in FRAMEWORK_SEARCH_PATHS when generating
the compiler command lines. It can't know to do this for the system framework search paths
we add manually via OTHER_CFLAGS though, so we need to prefix them with $(SDKROOT) ourself.

Source/WebCore:

* Configurations/WebCore.xcconfig:

Source/WebKit/mac:

* Configurations/WebKit.xcconfig:

Source/WebKit2:

* Configurations/BaseTarget.xcconfig:

Tools:

* DumpRenderTree/mac/Configurations/BaseTarget.xcconfig:
* WebKitTestRunner/Configurations/BaseTarget.xcconfig:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156666 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win] Compile errors in WebKit (via peavo@outlook.com).
https://bugs.webkit.org/show_bug.cgi?id=122106

Reviewed by Darin Adler.

* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in: Add link
declarations missed in r156655.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass VM instead of JSGlobalObject to RegExp constructor.
<https://webkit.org/b/122113>

Reviewed by Darin Adler.

RegExps don't need anything from the global object during their
construction and only use it to get to the VM. Reduce loads by
simply passing the VM around instead.

JSC release binary size -= 120 bytes(!)


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156668 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Build fix after r156622. Build RenderLayerModelObject.cpp in a separate compilation unit
from the RenderLayerAllnOne file so that the scalar and vector destructors are visible to other
elements of WebCore during the build.

* WebCore.vcxproj/WebCore.vcxproj: Compile RenderLayerModelObject outside of the all-in-one file.
* WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
* rendering/RenderingAllInOne.cpp: Remove RenderLayerModelObject.cpp.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156669 268f45cc-cd09-0410-ab3c-d52691b4dbfc
NetworkResourceLoader.messages.in should be ENABLE(NETWORK_PROCESS) guarded
https://bugs.webkit.org/show_bug.cgi?id=122110

Reviewed by Darin Adler.

* NetworkProcess/NetworkResourceLoader.messages.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156670 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Win64 compile fix after r1256490.
https://bugs.webkit.org/show_bug.cgi?id=122117

Patch by Alex Christensen <alex.christensen@flexsim.com> on 2013-09-30
Reviewed by Michael Saboff.

* jit/JITStubsMSVC64.asm:
Implemented getHostCallReturnValue for Windows x86_64 processors.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156671 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: nodes can be dragged from the console log
https://bugs.webkit.org/show_bug.cgi?id=122105

Reviewed by Darin Adler.

Catch "dragstart" events targeting nodes hosted in a DOMTreeOutline within the console
log view and prevent the default logic to trigger so that these nodes can't be dragged
off the console as it wouldn't make sense to.

* UserInterface/DOMTreeOutline.js:
(WebInspector.DOMTreeOutline):
Create a class property to allow the CSS class name to be used in WebInspector.LogContentView.

* UserInterface/LogContentView.js:
(WebInspector.LogContentView):
(WebInspector.LogContentView.prototype._ondragstart):
Track the "dragstart" events in their capture phase such that, if the event target is
a DOM node hosted in a DOMTreeOutline, we can prevent the event from propagating and
cancel its default behavior such that no dragging at all is performed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Popover displaying "reasons for compositing" may remain on screen after selected layer is removed
https://bugs.webkit.org/show_bug.cgi?id=117575

Ensure the popover attached to the selected data grid node is updated when the
content or sort order of the Layer sidebar panel is updated.

Reviewed by Darin Adler.

* UserInterface/LayerTreeSidebarPanel.js:
(WebInspector.LayerTreeSidebarPanel.prototype._sortDataGrid):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed build fix for Win64.

* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:
Added correct 64-bit BitmapImage::create symbol.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: rows in the Layer sidebar panel may have the incorrect background color
https://bugs.webkit.org/show_bug.cgi?id=122108

Reviewed by Darin Adler.

The LayerTreeDataGrid is a custom DataGrid subclass which exposes a .setChildren() method
used to sort chidren without DOM order manipulation, for performance reason. However, since
the way the alternating background color is usually implemented is based on the built-in
CSS pseudo-classes working with DOM order, the background colors of nodes in the LayerTreeDataGrid
can be incorrect depending on the sort order and the number of nodes. To fix this, we now manually
set "even" and "odd" CSS classes on those nodes when they're sorted such that we have a chance
to style them as intended.

* UserInterface/LayerTreeDataGrid.js:
(WebInspector.LayerTreeDataGrid.prototype._updateChildren):
Check if the data grid node index is even or odd and reflect this via an exclusive "even"
or "odd" CSS class name.

* UserInterface/LayerTreeSidebarPanel.css:
(.layer-tree.panel .data-container tbody > tr.even):
(.layer-tree.panel .data-container tbody > tr.odd):
Apply alternating colors based on the exclusive "even" and "odd" CSS class names as applied in
WebInspector.LayerTreeDataGrid.prototype._updateChildren().


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove IDBTracing.h.
https://bugs.webkit.org/show_bug.cgi?id=122118

Reviewed by Alexey Proskuryakov.

Global replace of "IDB_TRACE" with "LOG(StorageAPI)", and remove all notions of this header.

* GNUmakefile.list.am:

* Modules/indexeddb/IDBCursor.cpp:
* Modules/indexeddb/IDBDatabase.cpp:
* Modules/indexeddb/IDBDatabaseBackendInterface.h:
* Modules/indexeddb/IDBFactory.cpp:
* Modules/indexeddb/IDBIndex.cpp:
* Modules/indexeddb/IDBObjectStore.cpp:
* Modules/indexeddb/IDBOpenDBRequest.cpp:
* Modules/indexeddb/IDBRequest.cpp:
* Modules/indexeddb/IDBTracing.h: Removed.
* Modules/indexeddb/IDBTransaction.cpp:
* Modules/indexeddb/leveldb/IDBBackingStoreLevelDB.cpp:
* Modules/indexeddb/leveldb/IDBCursorBackendLevelDB.cpp:
* Modules/indexeddb/leveldb/IDBDatabaseBackendLevelDB.cpp:
* Modules/indexeddb/leveldb/IDBFactoryBackendLevelDB.cpp:
* Modules/indexeddb/leveldb/IDBObjectStoreBackendLevelDB.cpp:
* Modules/indexeddb/leveldb/IDBTransactionBackendLevelDB.cpp:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/IDBBindingUtilities.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Get rid of the AlreadyInJSStack recoveries since they are totally redundant with the DisplacedInJSStack recoveries
https://bugs.webkit.org/show_bug.cgi?id=122065

Reviewed by Mark Hahnenberg.
        
This mostly just kills a bunch of code.
        
But incidentaly while killing that code, I uncovered a bug in our FTL OSR entrypoint
creation phase. The phase inserts a sequence of SetLocal(ExtractOSREntryLocal) nodes.
If we hoist some type check into the local, then we might inject a conversion node
between the ExtractOSREntryLocal and the SetLocal - for example we might put in a
Int32ToDouble node. But currently the FixupPhase will make all conversion nodes placed
on an edge of a SetLocal use forward exit. This then confuses the OSR exit machinery.
When OSR exit sees a forward exit, it tries to "roll forward" execution from the exiting
node to the first node that has a different CodeOrigin. This only works if the nodes
after the forward exit are MovHints or other tnings that the OSR exit compiler can
forward-execute. But here, it will see a bunch of SetLocal and ExtractOSREntryLocal
nodes for the same bytecode index. Two possible solutions exist. We could teach the
forward-execution logic how to deal with multiple SetLocals and ExtractOSREntryLocals.
This would be a lot of complexity; right now it just needs to deal with exactly one
SetLocal-like operation. The alternative is to make sure that the conversion node that
we inject ends up exiting *backward* rather than forward.
        
But making the conversion nodes exit backward is somewhat tricky. Before this patch,
conversion nodes always exit forward for SetLocals and backwards otherwise. It turns out
that the solution is to rationalize how we choose the speculation direciton for a
conversion node. The conversion node's speculation direction should be the same as the
speculation direction of the node for which it is doing a conversion. Since SetLocal's
already exit forward by default, this policy preserves our previous behavior. But it
also allows the OSR entrypoint creation phase to make its SetLocals exit backward
instead.
        
Of course, if the SetLocal(ExtractOSREntryLocal) sequences exit backward, then we need
to make sure that the OSR exit machine knows that the local variables are indeed live.
Consider that if we have:
        
    a: ExtractOSREntryLocal(loc1)
    b: SetLocal(@a, loc1)
    c: ExtractOSRentryLocal(loc2)
    d: SetLocal(@c, loc2)
        
Without additional magic, the exit at @b will think that loc2 is dead and the OSR exit
compiler will clobber loc2 with Undefined. So we need to make sure that we actually
emit code like:
        
    a: ExtractOSREntryLocal(loc1)
    b: ExtractOSREntryLocal(loc2)
    c: SetLocal(@a, loc1)
    d: SetLocal(@b, loc2)
    e: SetLocal(@a, loc1)
    f: SetLocal(@b, loc2)

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* bytecode/CodeOrigin.h:
* bytecode/ValueRecovery.cpp: Added.
(JSC::ValueRecovery::recover):
(JSC::ValueRecovery::dumpInContext):
(JSC::ValueRecovery::dump):
* bytecode/ValueRecovery.h:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
(JSC::DFG::FixupPhase::fixEdge):
* dfg/DFGJITCode.cpp:
(JSC::DFG::JITCode::reconstruct):
* dfg/DFGNode.h:
(JSC::DFG::Node::speculationDirection):
(JSC::DFG::Node::setSpeculationDirection):
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInlineStart):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
* dfg/DFGValueSource.h:
(JSC::DFG::ValueSource::valueRecovery):
* dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStream::reconstruct):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::speculateMachineInt):
* interpreter/Register.h:
(JSC::Register::unboxedStrictInt52):
* runtime/Arguments.cpp:
(JSC::Arguments::tearOff):
* runtime/Arguments.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove timeout from shouldBecome* functions in js-test-pre
https://bugs.webkit.org/show_bug.cgi?id=122121

Reviewed by Ryosuke Niwa.

Removed timeout. A 0.5 sec timeout never makes sense, and if something is stuck,
a test should just time out normally.

* resources/js-test-pre.js:
(_waitForCondition):
(shouldBecomeEqual):
(shouldBecomeEqualToString):
(shouldBecomeDifferent):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass VM instead of JSGlobalObject to MathObject constructor.
<https://webkit.org/b/122119>

Reviewed by Geoffrey Garen.

The MathObject constructor was only using the global object to get
to the VM. finishCreation() still uses it to set up functions.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156679 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass VM instead of ExecState to ObjectPrototype constructor.
<https://webkit.org/b/122116>

Reviewed by Geoffrey Garen.

The ObjectPrototype constructor was only using the ExecState to get
to the VM.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't attempt to destroy decoded frame if a BitmapImage doesn't have encoded raw data.
https://bugs.webkit.org/show_bug.cgi?id=122115

Patch by Yongjun Zhang <yongjun_zhang@apple.com> on 2013-09-30
Reviewed by Daniel Bates.

With BitmapImage::create(PassNativeImagePtr, ImageObserver*), a BitmapImage could be created by
passing a native image.  If this image is added to memory cache, we shouldn't attempt to destroy
its decoded frames since there is no encoded raw data and we won't be able to reconstruct the image again.

No new tests for now. Currently there isn't a code path to add to the memory cache a BitmapImage
that was created by adopting a native image. We'll add such a code path in a subsequent patch.

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::destroyDecodedDataIfNecessary):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156681 268f45cc-cd09-0410-ab3c-d52691b4dbfc