REGRESSION (r155536): Broken error recovery in @media at-rule
https://bugs.webkit.org/show_bug.cgi?id=125637

Patch by Martin Hodovan <mhodovan@inf.u-szeged.hu> on 2013-12-18
Reviewed by Darin Adler.

Source/WebCore:

Error recovery in @media is broken if any of its rules misses the opening '{'.
The problem is that when the parser recognises the mistake it removes only the last
WHITESPACE token instead of the whole selector and tries to recover the selector again.
it swallows everything until it finds the next opening bracket. thats why the '}' brackets
of both subrules and even the @media rule are ignored, and the whole @media will be
considered invalid. By joining the selector and its trailing whitespace the error recovery
ignores the bad selector only and keep the @media rule.

Test: fast/css/media-error-recovery.html

* css/CSSGrammar.y.in:

LayoutTests:

Test with broken @media rule.

* fast/css/media-error-recovery-expected.txt: Added.
* fast/css/media-error-recovery.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160779 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Some basic DebuggerAgent cleanup
https://bugs.webkit.org/show_bug.cgi?id=125901

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-12-18
Reviewed by Timothy Hatcher.

* inspector/InspectorDebuggerAgent.h:
Remove virtual from not really virtual method.

* inspector/InspectorDebuggerAgent.cpp:
(WebCore::InspectorDebuggerAgent::enable):
(WebCore::InspectorDebuggerAgent::disable):
Use member variable instead of private function.

(WebCore::InspectorDebuggerAgent::setPauseOnExceptions):
Inline the three lines from the private function.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
API to set a favicon
https://bugs.webkit.org/show_bug.cgi?id=125892

Patch by Conrad Shultz <conrad_shultz@apple.com> on 2013-12-18
Reviewed by Brian Weinstein.

* UIProcess/API/C/WKIconDatabase.cpp:
(WKIconDatabaseSetIconDataForIconURL):
Call WebIconDatabase::setIconDataForIconURL().

* UIProcess/API/C/WKIconDatabase.h:
Declare WKIconDatabaseSetIconDataForIconURL().

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160781 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AudioSessionManagerMac.cpp: kLowPowerVideoBufferSize unused before OS X 10.9
https://bugs.webkit.org/show_bug.cgi?id=125935

Patch by Conrad Shultz <conrad_shultz@apple.com> on 2013-12-18
Reviewed by Jer Noble.

* platform/audio/mac/AudioSessionManagerMac.cpp:
Add __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090 guard.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160782 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Flaky Test: media/video-buffered.html
https://bugs.webkit.org/show_bug.cgi?id=116277

* platform/mac/TestExpectations: Mark it as such.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160785 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Simplify bindings codegen for adding getOwnPropertySlot overrides
https://bugs.webkit.org/show_bug.cgi?id=125934

Reviewed by Alexey Proskuryakov.

Simple refactoring no change in behavior.

* bindings/scripts/CodeGeneratorJS.pm:
(InstanceOverridesGetOwnPropertySlot):
(PrototypeOverridesGetOwnPropertySlot):
(GenerateHeader):
(GenerateImplementation):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160786 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make WKObjectRegistry objects be per page
https://bugs.webkit.org/show_bug.cgi?id=125937

Reviewed by Andreas Kling.

Remove WKObjectRegistry from WKConnection. Also, add a C++ object that is in charge
of actually sending and receiving messages.

* DerivedSources.make:
* Shared/API/Cocoa/RemoteObjectRegistry.h: Added.
* Shared/API/Cocoa/RemoteObjectRegistry.messages.in: Added.
* Shared/API/Cocoa/RemoteObjectRegistry.mm: Added.
(WebKit::RemoteObjectRegistry::RemoteObjectRegistry):
(WebKit::RemoteObjectRegistry::~RemoteObjectRegistry):
(WebKit::RemoteObjectRegistry::sendInvocation):
(WebKit::RemoteObjectRegistry::invokeMethod):
* Shared/API/Cocoa/WKRemoteObjectRegistry.mm:
(-[WKRemoteObjectRegistry _initWithMessageSender:IPC::]):
(-[WKRemoteObjectRegistry _invalidate]):
(-[WKRemoteObjectRegistry _sendInvocation:interface:]):
(-[WKRemoteObjectRegistry WebKit::]):
(-[WKRemoteObjectRegistry _invokeMethod:]):
* Shared/API/Cocoa/WKRemoteObjectRegistryInternal.h:
* UIProcess/API/Cocoa/WKBrowsingContextController.mm:
(-[WKBrowsingContextController dealloc]):
(-[WKBrowsingContextController remoteObjectRegistry]):
* UIProcess/API/Cocoa/WKBrowsingContextControllerPrivate.h:
* UIProcess/API/Cocoa/WKConnection.h:
* UIProcess/API/Cocoa/WKConnection.mm:
(didReceiveMessage):
* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextController.mm:
(-[WKWebProcessPlugInBrowserContextController remoteObjectRegistry]):
* WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextControllerPrivate.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160787 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix 32-bit build.

* Shared/API/Cocoa/RemoteObjectRegistry.mm:
(WebKit::RemoteObjectRegistry::invokeMethod):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160788 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: make aria-hidden=false work with subtrees
https://bugs.webkit.org/show_bug.cgi?id=125592

Reviewed by Mario Sanchez Prada.

Source/WebCore: 

When a hidden object uses aria-hidden=false, that needs to apply to
the entire sub-tree (not just the object with aria-hidden on it as it does now).

Enabling this had the side effect of exposing non-rendered text nodes, so there's
some extra checks to ensure we don't include those elements in this cases.

Test: accessibility/aria-hidden-false-works-in-subtrees.html

* accessibility/AXObjectCache.cpp:
(WebCore::isNodeAriaVisible):
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::computeAccessibilityIsIgnored):

LayoutTests: 

* platform/mac/accessibility/aria-hidden-false-works-in-subtrees-expected.txt: Added.
* accessibility/aria-hidden-false-works-in-subtrees.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160789 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix page visibility api test, initialization in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=125933

Reviewed by Anders Carlsson.

The API test for page visibility is broken, fix this. This revealed a recent regression in WebKit2
(introduced in https://bugs.webkit.org/show_bug.cgi?id=123379), caused by a typo removing a '!'.

Source/WebKit2: 

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::setVisibilityState):
    - Fix regression, accidentally removed a '!'.

Tools: 

* TestWebKitAPI/Tests/mac/PageVisibilityStateWithWindowChanges.mm:
(TestWebKitAPI::TEST_F):
    - Running a test on WebKit1 twice is not the same as running it on WebKit2!



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160790 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Starting a momentum scroll while rubber banding can cause scrolling to jump back 
when the rubberband snaps
https://bugs.webkit.org/show_bug.cgi?id=119507
-and corresponding-
<rdar://problem/14655893>

Reviewed by Simon Fraser.

This line of code was added with the very first implementation of rubber-banding. 
As far as I can tell, it was always a belt-and-suspenders line of code that is a 
no-op in all normal rubber-banding. In this J-shaped scrolling case, this line of 
code is what causes the bug to occur because this line of code assumes that your 
rubber-band is always trying to take you back to the origin. 
* platform/mac/ScrollElasticityController.mm:
(WebCore::ScrollElasticityController::snapRubberBandTimerFired):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160791 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] Frequent ASSERT(hasOneRef()) in SharedBuffer::releasePurgeableBuffer
https://bugs.webkit.org/show_bug.cgi?id=125939

Reviewed by Simon Fraser.

r146082 fixed these assertions by not making a purgeable buffer if a SharedBuffer
has multiple refs, but the check was put in ResourceBuffer::createPurgeableBuffer
instead of down in SharedBuffer::createPurgeableBuffer.

This is fine for most WebKit ports, because ResourceBuffer::createPurgeableBuffer
is the only caller of SharedBuffer::createPurgeableBuffer, but causes trouble for
not-quite-yet-upstreamed iOS SharedBuffer code, which adds another caller
of SharedBuffer::createPurgeableBuffer.

Push the early-return down into SharedBuffer::createPurgeableBuffer to ensure
that all callers are protected from creating a purgeable buffer if the SharedBuffer
has previously been vended elsewhere.

No new tests, has no effect on the current Open Source tree.

* loader/ResourceBuffer.cpp:
(WebCore::ResourceBuffer::createPurgeableBuffer):
* platform/SharedBuffer.cpp:
(WebCore::SharedBuffer::createPurgeableBuffer):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160792 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refactor CodeGeneratorJS - Move attribute function creation out of getOwnPropertyName guard
https://bugs.webkit.org/show_bug.cgi?id=125940

Reviewed by Simon Fraser.

This is just a huge block move of code out from behind the
ImplementationOverridesGetOwnProperty guard.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160793 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove now useless test.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2ObjC/WKRemoteObjectRegistry.mm: Removed.
* TestWebKitAPI/Tests/mac/WKRemoteObjectRegistry_Bundle.mm: Removed.
* TestWebKitAPI/Tests/mac/WKRemoteObjectRegistry_Shared.h: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160794 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WKRemoteObjectRegistry should invoke invocations
https://bugs.webkit.org/show_bug.cgi?id=125945

Reviewed by Tim Horton.

* Shared/API/Cocoa/WKRemoteObjectRegistry.mm:
(-[WKRemoteObjectRegistry _invokeMessageWithInterfaceIdentifier:encodedInvocation:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160795 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should have a separate StoreBarrier node
https://bugs.webkit.org/show_bug.cgi?id=125530

Reviewed by Filip Pizlo.

Source/JavaScriptCore: 

This is in preparation for GenGC. We use a separate StoreBarrier node instead of making them implicitly 
part of other nodes so that it's easier to run analyses on them, e.g. for the StoreBarrierElisionPhase. 
They are inserted during the fixup phase. Initially they do not generate any code.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGAbstractHeap.h:
* dfg/DFGAbstractInterpreter.h:
(JSC::DFG::AbstractInterpreter::isKnownNotCell):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberizeForAllocation):
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants): Whenever we insert new nodes that require StoreBarriers,
we have to add those new StoreBarriers too. It's important to note that AllocatePropertyStorage and 
ReallocatePropertyStorage nodes require their StoreBarriers to come after them since they allocate first,
which could cause a GC, and then store the resulting buffer into their JSCell, which requires the barrier.
If we ever require that write barriers occur before stores, we'll have to split these nodes into 
AllocatePropertyStorage + StoreBarrier + PutPropertyStorage.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertStoreBarrier):
* dfg/DFGNode.h:
(JSC::DFG::Node::isStoreBarrier):
* dfg/DFGNodeType.h:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileStoreBarrier):
(JSC::DFG::SpeculativeJIT::genericWriteBarrier): The fast path write barrier check. It loads the 
byte that contains the mark bit of the object. 
(JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): If the fast path check fails we try to store the 
cell in the WriteBarrierBuffer so as to avoid frequently flushing all registers in order to make a C call.
(JSC::DFG::SpeculativeJIT::writeBarrier):
(JSC::DFG::SpeculativeJIT::osrWriteBarrier): More barebones version of the write barrier to be executed 
during an OSR exit into baseline code. We must do this so that the baseline JIT object and array profiles 
are properly cleared during GC.
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::writeBarrier):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::writeBarrier):
* dfg/DFGStoreBarrierElisionPhase.cpp: Added. New DFG phase that does block-local elision of redundant
StoreBarriers. Every time a StoreBarrier on a particular object is executed, a bit is set indicating that 
that object doesn't need any more StoreBarriers. 
(JSC::DFG::StoreBarrierElisionPhase::StoreBarrierElisionPhase):
(JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Nodes that could cause a GC reset the bits for all of the 
objects known in the current block. 
(JSC::DFG::StoreBarrierElisionPhase::allocatesFreshObject): A node that creates a new object automatically 
sets the bit for that object since if a GC occurred as the result of that object's allocation then that 
object would not need a barrier since it would be guaranteed to be a young generation object until the 
next GC point.
(JSC::DFG::StoreBarrierElisionPhase::noticeFreshObject):
(JSC::DFG::StoreBarrierElisionPhase::getBaseOfStore):
(JSC::DFG::StoreBarrierElisionPhase::shouldBeElided):
(JSC::DFG::StoreBarrierElisionPhase::elideBarrier):
(JSC::DFG::StoreBarrierElisionPhase::handleNode):
(JSC::DFG::StoreBarrierElisionPhase::handleBlock):
(JSC::DFG::StoreBarrierElisionPhase::run):
(JSC::DFG::performStoreBarrierElision):
* dfg/DFGStoreBarrierElisionPhase.h: Added.
* heap/Heap.cpp:
(JSC::Heap::Heap):
(JSC::Heap::flushWriteBarrierBuffer):
* heap/Heap.h:
(JSC::Heap::writeBarrier):
* heap/MarkedBlock.h:
(JSC::MarkedBlock::offsetOfMarks):
* heap/WriteBarrierBuffer.cpp: Added. The WriteBarrierBuffer buffers a set of JSCells that are awaiting 
a pending WriteBarrier. This buffer is used by the DFG to avoid the overhead of calling out to C repeatedly
to invoke a write barrier on a single JSCell. Instead the DFG has inline code to fill the WriteBarrier buffer
until its full, and then to call out to C to flush it. The WriteBarrierBuffer will also be flushed prior to 
each EdenCollection.
(JSC::WriteBarrierBuffer::WriteBarrierBuffer):
(JSC::WriteBarrierBuffer::~WriteBarrierBuffer):
(JSC::WriteBarrierBuffer::flush):
(JSC::WriteBarrierBuffer::reset):
(JSC::WriteBarrierBuffer::add):
* heap/WriteBarrierBuffer.h: Added.
(JSC::WriteBarrierBuffer::currentIndexOffset):
(JSC::WriteBarrierBuffer::capacityOffset):
(JSC::WriteBarrierBuffer::bufferOffset):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* runtime/VM.h:

Source/WTF: 

* wtf/Platform.h: Added an #define for ENABLE(GGC) which will be used for landing things related to GenGC.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160796 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][CMake] Remove binary size optimizations we do not use in the autotools build
https://bugs.webkit.org/show_bug.cgi?id=125947

Reviewed by Martin Robinson.

* Source/cmake/OptionsGTK.cmake: remove the relevant flags.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160797 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WinCairo] Preparation for GStreamer on Windows.
https://bugs.webkit.org/show_bug.cgi?id=125946

Patch by Alex Christensen <achristensen@webkit.org> on 2013-12-18
Reviewed by Brent Fulgham.

Source/WebCore:

* WebCore.vcxproj/WebCore.vcxproj:
Use new GStreamer property sheets for WinCairo.
* WebCore.vcxproj/WebCoreCairo.props:
Include GStreamer directory.

Source/WebKit:

* WebKit.vcxproj/WebKit/WebKit.vcxproj:
Use new GStreamer property sheets for WinCairo.
* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:
Fixed 64-bit symbols, added GStreamer symbol.

Source/WTF:

* WTF.vcxproj/WTF.vcxproj:
Use new GStreamer property sheets for WinCairo.

Tools:

* WinLauncher/WinLauncher.vcxproj/WinLauncherLib.vcxproj:
Use new GStreamer property sheets for WinCairo.
* win/DLLLauncher/DLLLauncherMain.cpp:
(modifyPath):
(wWinMain):
Prepend GStreamer bin directory to path if it exists.

WebKitLibraries:

* win/tools/vsprops/FeatureDefinesCairo.props:
Added ENABLE_MEDIA_CONTROLS_SCRIPT and ENABLE_VIDEO_TRACK for DerivedSources.make.
* win/tools/vsprops/GStreamer32.props: Added.
* win/tools/vsprops/GStreamer64.props: Added.
* win/tools/vsprops/GStreamerCommon.props: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160798 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][CMake] Use thin archives if building on Linux, only way to get non-shared-core debug builds
https://bugs.webkit.org/show_bug.cgi?id=125951

Reviewed by Martin Robinson.

* Source/cmake/OptionsGTK.cmake: append T for thin archives to the flags passed to ar,
also use u, which is used in the autotools build (it avoids adding a file twice).

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a simple stack abstraction for x86_64
https://bugs.webkit.org/show_bug.cgi?id=125908

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::addPtrNoFlags):
Add an explicit abstraction for the "lea" instruction. This is needed
by the experimental JIT to have add and substract without changing the flags.

This is useful for function calls to test the return value, restore the registers,
then branch on the flags from the return value.

Source/WebCore: 

StackAllocator provides an abstraction to make it hard to make mistakes and protects from obvious
issues at runtime.

The key roles of StackAllocators are:
-Provide the necessary stack alignment for function calls (only x86_64 stack for now).
-Provide ways to save registers on the stack, restore or discard them as needed.
-Crash at runtime if an operation would obviously cause a stack inconsistency.

The way simple inconsistencies are detected is through the StackReference object
returned whenever something is added on the stack.
The object keeps a reference to the offset of what has been pushed. When the StackReference
is used to recover the register, if the offset is different, there is a missmatch between
push() and pop() after the object was pushed.

* cssjit/StackAllocator.h: Added.
(WebCore::StackAllocator::StackReference::StackReference):
(WebCore::StackAllocator::StackReference::operator unsigned):
(WebCore::StackAllocator::StackAllocator):
(WebCore::StackAllocator::~StackAllocator):
(WebCore::StackAllocator::push):
(WebCore::StackAllocator::pop):

(WebCore::StackAllocator::alignStackPreFunctionCall):
(WebCore::StackAllocator::unalignStackPostFunctionCall):
Those helpers provide a simple way to have a valid stack prior to a function call.
Since StackAllocator knows the offset and the platform rules, it can adjust the stack
if needed for x86_64.

(WebCore::StackAllocator::discard): Discard a single register or the full stack.

(WebCore::StackAllocator::combine): combining stacks is the way to solve branches
where the stack is used differently in each case.
To do that, the stack is first copied to A and B. Each branch works on its own
StackAllocator copy, then the two copies are linked together to the original stack.

The copies ensure the local consistency in each branch, linking the copies ensure global
consistencies and that both branches end in the same stack state.

(WebCore::StackAllocator::offsetToStackReference): Helper function to access the stack by address
through its StackReference.

(WebCore::StackAllocator::reset):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@160800 268f45cc-cd09-0410-ab3c-d52691b4dbfc