Don't crash if we ask for fonts that don't exist.
https://bugs.webkit.org/show_bug.cgi?id=88106

Reviewed by Dan Bernstein.

RIM PR 161219

If the site doesn't ask for a reasonable font and the system doesn't
provide a good fallback, FontFallBackList::primaryFontData can be 0,
which can cause a crash.

* platform/graphics/skia/FontCacheSkia.cpp:
(WebCore::FontCache::getLastResortFallbackFont):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119340 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DOM string cache should hash pointers, not characters
https://bugs.webkit.org/show_bug.cgi?id=88175

Reviewed by Phil Pizlo and Sam Weinig.

../JavaScriptCore: 

* heap/Weak.h:
(JSC::weakAdd):
(JSC::weakRemove): Made these function templates slightly more generic
to accommodate new client types.

../WebCore: 

Dromaeo DOM Core reports no change.

http://trac.webkit.org/changeset/84934 accidentally changed from hashing
pointers to hashing characters, due to template defaults. Let's change back.

Hashing characters is not so good because:

(1) It's not memory-safe with HashMap::set(). HashMap::set() replaces
the value but not the key. Since our values own our keys, we need to
ensure object identity between key and value, or the key can be freed
prematurely. (This is impossible to demonstrate with our current
eager sweep behavior, but it shows up as crashes in layout tests if you
change to lazy sweep.)

(2) It's slower.

* bindings/js/DOMWrapperWorld.h:
(WebCore): Override the default hash, which hashes based on characters.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119341 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
https://bugs.webkit.org/show_bug.cgi?id=87929

Reviewed by Geoffrey Garen.
        
Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
        
This required a bunch of changes:
        
- The obvious change is making CSE essentially ignore whether or not the set of
  operations between the Flush and the SetLocal can exit, and instead focus on whether or
  not that set of operations can clobber the world or access local variables. This code
  is now refactored to return a set of flags indicating any of these events, and the CSE
  decides what to do based on those flags. If the set of operations is non-clobbering
  and non-accessing, then the Flush is turned into a Phantom on the child of the
  SetLocal. This expands the liveness of the relevant variable but virtually guarantees
  that it will be register allocated and not flushed to the stack. So, yeah, this patch
  is a lot of work to save a few stores to the stack.
        
- Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
  it was a no-op if you were holding onto a CFA abstract state. But this would make the
  CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
  constant folding phase into something more broad; it now fixes up
  CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
  no-ops.
        
- Arguments simplification was previously relying on this very strange PhantomArguments
  node, which had two different meanings: for normal execution it meant the empty value
  but for OSR exit it meant that the arguments should be reified. This produces problems
  when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
  triggering reification of arguments without having initialized the arguments registers
  to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
  namely, arguments reification on OSR exit. Hence, this patch changes arguments
  simplification to change SetLocal of CreateArguments on the arguments registers to be
  a SetLocal of Empty.
        
- Argument value recoveries were previously derived from the value source of the
  arguments at the InlineStart. But that relies on all SetLocals to arguments having
  been flushed. It's possible that we could have elided the SetLocal to the arguments
  at the callsite because there were subsequent SetLocals to the arguments inside of the
  callee, in which case the InlineStart would get the wrong information. Hence, this
  patch changes argument value recovery computation to operate over the ArgumentPositions
  directly.
        
- But that doesn't actually work, because previously, there was no way to link an
  InlineStart back to the corresponding ArgumentPositions, at least not without some
  ugliness. So this patch instates the rule that the m_argumentPositions vector consists
  of disjoint subsequences such that each subsequence corresponds to an inline callsite
  and can be identified by its first index, and within each subsequence are the
  ArgumentPositions of all of the arguments ordered by argument index. This required
  flipping the order in which ArgumentPositions are added to the vector, and giving
  InlineStart an operand that indicates the start of that inline callsite's
  ArgumentPosition subsequence.
        
- This patch also revealed a nasty bug in the reification of arguments in inline call
  frames on OSR exit. Since the reification was happening after the values of virtual
  registers were recovered, the value recoveries of the inline arguments were wrong.
  Hence using operationCreateInlinedArguments is wrong. For example a value recovery
  might say that you have to box a double, but if we had already boxed it then boxing
  it a second time will result in garbage. The specific case of this bug was this patch
  uncovered was that now it is possible for an inline call frame to not have any valid
  value recoveries for any inline arguments, if the optimization elides all argument
  flushes, while at the same time optimizing away arguments creation. Then OSR exit
  would try to recover the arguments using the inline call frame, which had bogus
  information, and humorous crashes would ensue. This patch fixes this issue by moving
  arguments reification to after call frame reification, so that arguments reification
  can always use operationCreateArguments instead of operationCreateInlinedArguments.
        
- This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
  broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
  but didn't know that there could alternatively be a Phantom in place of the Flush.
  This patch fixes that by augmenting the forward speculation check logic.
        
- Finally, in the process of having fun with all of the above, I realized that my DFG
  validation was not actually running on every phase like I had originally designed it
  to. In fact it was only running just after bytecode parsing. I initially tried to
  make it run in every phase but found that this causes some tests to timeout
  (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
  release mode validation never runs, (ii) in debug mode validation will run just
  after parsing and just before the backend, and (iii) it's possible with a simple
  switch to enable validation to run on every phase.
        
Luckily all of the above issues were already covered by the 77 or so DFG-specific
layout tests. Hence, this patch does not introduce any new tests despite being so
meaty.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGArgumentPosition.h:
(JSC::DFG::ArgumentPosition::prediction):
(JSC::DFG::ArgumentPosition::doubleFormatState):
(JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
(ArgumentPosition):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
(SetLocalStoreEliminationResult):
(JSC::DFG::CSEPhase::setLocalStoreElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCommon.h:
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::run):
* dfg/DFGDriver.cpp:
(JSC::DFG::compile):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::hasArgumentPositionStart):
(JSC::DFG::Node::argumentPositionStart):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGPhase.cpp:
(DFG):
* dfg/DFGPhase.h:
(Phase):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119342 268f45cc-cd09-0410-ab3c-d52691b4dbfc
If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
shouldn't revert all the way to GetById/GetByIdFlush
https://bugs.webkit.org/show_bug.cgi?id=88176

Reviewed by Geoffrey Garen.
        
Refactored the code so that the op_method_check case of the parser gracefully falls
through to all of the goodness of the normal op_get_by_id case.

* dfg/DFGByteCodeParser.cpp:
(ByteCodeParser):
(JSC::DFG::ByteCodeParser::handleGetById):
(DFG):
(JSC::DFG::ByteCodeParser::parseBlock):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119343 268f45cc-cd09-0410-ab3c-d52691b4dbfc
InjectedBundles' sandbox extensions don't do what we think they do
https://bugs.webkit.org/show_bug.cgi?id=88177

Reviewed by Anders Carlsson.

This cannot be tested with our current infrastructure (or any modifications of the
infrastructure I can think of) since it relies on the bundle being put outside
the build directory where WebKit is put.

* WebProcess/InjectedBundle/mac/InjectedBundleMac.cpp:
(WebKit::InjectedBundle::load):
Use SandboxExtension::consumePermanently() rather than consume(), otherwise,
nulling out the SandboxExtension a few lines later invalidates the extension
we just consumed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119344 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Ensure cpu_type_t is defined by including <mach/machine.h>
https://bugs.webkit.org/show_bug.cgi?id=88178

Reviewed by Anders Carlsson.

* Shared/Plugins/PluginModuleInfo.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119345 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unnecessary import of <Cocoa/Cocoa.h>
https://bugs.webkit.org/show_bug.cgi?id=88180

Reviewed by Sam Weinig.

* UIProcess/mac/WKFullKeyboardAccessWatcher.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119346 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove a duplicate INIT() from WebSystemInterface.mm
https://bugs.webkit.org/show_bug.cgi?id=88181

Reviewed by Anders Carlsson.

* WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
(InitWebCoreSystemInterface):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119347 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Windows build fix after r119330. Unnest the class for now.

* dom/SelectorQuery.cpp:
(WebCore::SelectorQueryCacheEntry::SelectorQueryCacheEntry):
(WebCore::SelectorQueryCache::add):
* dom/SelectorQuery.h:
(SelectorQueryCacheEntry):
(WebCore::SelectorQueryCacheEntry::selectorQuery):
(WebCore):
(SelectorQueryCache):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119348 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebKit2] Use USE(), ENABLE(), and HAVE() macros in more places
https://bugs.webkit.org/show_bug.cgi?id=88182

Reviewed by Sam Weinig.

Use USE(APPKIT):
* Shared/mac/NativeWebKeyboardEventMac.mm:
* Shared/mac/NativeWebMouseEventMac.mm:
* Shared/mac/NativeWebWheelEventMac.mm:
* Shared/mac/WebEventFactory.h:
* UIProcess/API/mac/WKTextInputWindowController.h:
* UIProcess/API/mac/WKTextInputWindowController.mm:
* UIProcess/PageClient.h:
* UIProcess/WebPageProxy.h:

Use ENABLE(NETSCAPE_PLUGIN_API):
* UIProcess/API/C/WKPluginSiteDataManager.cpp:
(WKPluginSiteDataManagerClearSiteData):
(WKPluginSiteDataManagerClearAllSiteData):

Use USE(AUTOCORRECTION_PANEL):
* UIProcess/API/mac/PageClientImpl.h:
* UIProcess/API/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::showCorrectionPanel):
(WebKit::PageClientImpl::dismissCorrectionPanel):
(WebKit::PageClientImpl::dismissCorrectionPanelSoon):
* UIProcess/mac/CorrectionPanel.mm:

Use HAVE(HOSTED_CORE_ANIMATION):
* UIProcess/mac/WebContextMac.mm:

Put ENABLE(FULLSCREEN_API) in the right place:
* UIProcess/mac/WebFullScreenManagerProxyMac.mm:

Remove unnecessary use of USE(APPKIT):
* UIProcess/mac/WebPageProxyMac.mm:

Use USE(SECURITY_FRAMEWORK):
* WebProcess/Authentication/mac/AuthenticationManager.mac.mm:

Use ENABLE(CONTEXT_MENUS):
* WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:

Use USE(SECURITY_FRAMEWORK):
* WebProcess/WebProcess.h:

Remove unnecessary use of USE(SECURITY_FRAMEWORK):
* WebProcess/mac/WebProcessMac.mm:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119349 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add back files inadvertently removed in r119323.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119350 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-06-02  Geoffrey Garen  <ggaren@apple.com>

        Try to fix the Windows build.

        * win/WebKit2.def:
        * win/WebKit2CFLite.def:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119351 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove the failing expectation on fast/forms/textarea-scrollbar-height.html since it has been passing.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119352 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVGImageCache leaks image data
https://bugs.webkit.org/show_bug.cgi?id=87792

Source/WebCore:

There are two functions to remove a client from a CachedImage:
- CachedResource::removeClient()
- CachedImage::removeClientForRenderer().
It's easy to make error to call the former which will leak the cached
image buffers in SVGImageCache.

This change combined the two by adding the virtual
CachedResource::didRemoveClient(). CachedImage will do SVGImageCache
cleanup in the function.

Reviewed by Nikolas Zimmermann.

Test: svg/as-image/svg-image-leak-cached-data.html

* loader/cache/CachedFont.h:
(WebCore::CachedFontClient::resourceClientType): Added 'const'.
* loader/cache/CachedImage.cpp:
(WebCore):
(WebCore::CachedImage::didRemoveClient): Removes the client from SVGImageCache.
(WebCore::CachedImage::lookupOrCreateImageForRenderer):
* loader/cache/CachedImage.h:
(CachedImage):
(WebCore::CachedImageClient::resourceClientType): Added 'const'.
* loader/cache/CachedRawResource.h:
(WebCore::CachedRawResourceClient::resourceClientType): Added 'const'.
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::removeClient): Added invocation of didRemoveClient().
* loader/cache/CachedResource.h:
(WebCore::CachedResource::didRemoveClient): Added for subclasses to do additional works.
* loader/cache/CachedResourceClient.h:
(WebCore::CachedResourceClient::resourceClientType): Added 'const'.
* loader/cache/CachedSVGDocument.h:
(WebCore::CachedSVGDocumentClient::resourceClientType): Added 'const'.
* loader/cache/CachedStyleSheetClient.h:
(WebCore::CachedStyleSheetClient::resourceClientType): Added 'const'.
* rendering/style/StyleCachedImage.cpp:
(WebCore::StyleCachedImage::removeClient):
* rendering/style/StyleCachedImageSet.cpp:
(WebCore::StyleCachedImageSet::removeClient):
* svg/graphics/SVGImageCache.cpp:
(WebCore::SVGImageCache::~SVGImageCache): Added checking for leaks.
(WebCore::SVGImageCache::removeClientFromCache):
(WebCore::SVGImageCache::setRequestedSizeAndScales):
(WebCore::SVGImageCache::requestedSizeAndScales):
(WebCore::SVGImageCache::lookupOrCreateBitmapImageForClient):
* svg/graphics/SVGImageCache.h:
(WebCore):
(SVGImageCache):

LayoutTests:

Reviewed by Nikolas Zimmermann.

New test case.

* svg/as-image/svg-image-leak-cached-data-expected.txt: Added.
* svg/as-image/svg-image-leak-cached-data.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119353 268f45cc-cd09-0410-ab3c-d52691b4dbfc
__ZNK7WebCore4Node27traverseNextAncestorSiblingEv should be exported even if ENABLE(FULLSCREEN_API) is false
https://bugs.webkit.org/show_bug.cgi?id=88184

Reviewed by Dan Bernstein.

Node::traverseNextAncestorSibling() is called in several inline
functions defined in ContainerNode.h (a private header), so its symbol
needs to be exported regardless of whether full-screen API is enabled.

* WebCore.exp.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119354 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] replace isScrollGestureEventType with isGestureEventType
https://bugs.webkit.org/show_bug.cgi?id=88097

This change replaces the unused and incorrect isScrollGestureEventType
method with a correct and useful isGestureEventType method.

Reviewed by Adam Barth.

* public/WebInputEvent.h:
(WebInputEvent):
(WebKit::WebInputEvent::isGestureEventType):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119355 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Add new gesture type (two finger tap) that triggers context menu.
https://bugs.webkit.org/show_bug.cgi?id=88173

Patch by Varun Jain <varunjain@google.com> on 2012-06-03
Reviewed by Adam Barth.

Source/WebCore:

Test: fast/events/touch/gesture/context-menu-on-two-finger-tap.html

* platform/PlatformEvent.h:

Source/WebKit/chromium:

* public/WebInputEvent.h:
* src/PageWidgetDelegate.cpp:
(WebKit::PageWidgetDelegate::handleInputEvent):
* src/WebInputEventConversion.cpp:
(WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
* src/WebPopupMenuImpl.cpp:
(WebKit::WebPopupMenuImpl::handleInputEvent):
* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::handleGestureEvent):

Tools:

* DumpRenderTree/chromium/EventSender.cpp:
(EventSender::EventSender):
(EventSender::gestureTwoFingerTap):
(EventSender::gestureEvent):
* DumpRenderTree/chromium/EventSender.h:
(EventSender):

LayoutTests:

* fast/events/touch/gesture/context-menu-on-two-finger-tap.html: Added.
* platform/chromium/fast/events/touch/gesture/context-menu-on-two-finger-tap-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119356 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Roll Chromium DEPS from r140000 to r140222.

* DEPS:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119357 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add ewk_custom_handler_private.h for ewk_custom_handler.cpp
https://bugs.webkit.org/show_bug.cgi?id=88163

Reviewed by Ryosuke Niwa.

EFL WK1 decided to divide up ewk_private.h into each file's XXX_private.h file
in order to maintain internal functions more easily. Bug 73176 is adding new
internal functions to ewk_custom_hanlder.cpp. So, ewk_custom_handler.cpp needs
to have _private.h file as well.

* WebCoreSupport/ChromeClientEfl.cpp:
* ewk/ewk_custom_handler.cpp:
* ewk/ewk_custom_handler_private.h: Added.
* ewk/ewk_view_private.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119358 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WheelEvent should inherit from MouseEvent
https://bugs.webkit.org/show_bug.cgi?id=76104

Reviewed by Kentaro Hara.

Source/WebCore:

The spec for WheelEvent is
<http://www.w3.org/TR/DOM-Level-3-Events/#webidl-events-WheelEvent>

Tests: fast/events/event-creation.html
       http://samples.msdn.microsoft.com/ietestcenter/dominheritance/showdominheritancetest.htm?Prototype_WheelEvent

* bindings/objc/PublicDOMInterfaces.h: Remove redundant MouseEvent API from WheelEvent
* bindings/scripts/CodeGeneratorObjC.pm: MouseEvents are Events
* dom/MouseEvent.h: Expose no-arg constructor to WheelEvent
* dom/WheelEvent.cpp:
(WebCore::WheelEvent::WheelEvent): Call MouseEvent superconstructor
* dom/WheelEvent.h: Extend MouseEvent
* dom/WheelEvent.idl: "

LayoutTests:

* fast/events/event-creation-expected.txt:
* fast/events/event-creation.html: Also check WheelEvent instanceof MouseEvent as well as UIEvent, Event


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119359 268f45cc-cd09-0410-ab3c-d52691b4dbfc