REGRESSION(r157408): Crashes in RenderFullScreen::wrapRenderer().

Unreviewed crash fix for these two tests:

- fullscreen/full-screen-restrictions.html
- fullscreen/empty-anonymous-block-continuation-crash.html

* rendering/RenderFullScreen.cpp:
(RenderFullScreen::wrapRenderer):

    Get the RenderArena from Document like we did before this patch.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CTTE: NamedNodeMap always has a corresponding Element.
<https://webkit.org/b/122769>

Reviewed by Anders Carlsson.

Made NamedNodeMap::m_element a reference and remove an assertion
that it's never null.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
window.crypto doesn't preserve custom properties
https://bugs.webkit.org/show_bug.cgi?id=122770

Reviewed by Mark Hahnenberg.

Source/WebCore: 

Test: security/crypto-gc.html

Generate isReachableFromOpaqueRoots that makes Crypto live as long as the document
lives (because that's when it's observable through window object).

* page/Crypto.cpp:
(WebCore::Crypto::Crypto):
(WebCore::Crypto::~Crypto):
(WebCore::Crypto::document):
* page/Crypto.h:
(WebCore::Crypto::create):
Made Crypto a ContextDestructionObserver, so that it can report its document to bindings.
Removed ScriptWrappable, because it seems to have served no purpose in this class.

* page/Crypto.idl: Added GenerateIsReachable. Removed ImplementationLacksVTable,
because the class now has a vtable, and can be checked for bindings integrity.

* page/DOMWindow.cpp: (WebCore::DOMWindow::crypto): Pass a document when creating
crypto.

LayoutTests: 

* security/crypto-gc-expected.txt: Added.
* security/crypto-gc.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[cmake] MediaControlsApple is used only by Efl port and is on CMakeLists.txt
https://bugs.webkit.org/show_bug.cgi?id=122772

Reviewed by Anders Carlsson.

* CMakeLists.txt: Removed MediaControlsApple.cpp
* PlatformEfl.cmake: Added MediaControlsApple.cpp


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157418 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Virtualize PlatformCALayer
https://bugs.webkit.org/show_bug.cgi?id=122672

Reviewed by Anders Carlsson.

No new tests, just a refactoring.

* WebCore.exp.in:
setGeometryFlipped is on PlatformCALayerMac now.

* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
Add PlatformCALayer.cpp, PlatformCALayerWin.h, and let VS do its
thing with some other files.

* WebCore.xcodeproj/project.pbxproj:
Add PlatformCALayer.cpp and PlatformCALayerMac.h.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::platformLayer):
Make a PlatformCALayerWin explicitly.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::createPlatformCALayer):
Added. Decide whether to make a PlatformCALayer{Mac, Win} based on the platform.
Later, we will decide between other subclasses based on other things.

(WebCore::GraphicsLayerCA::filtersCanBeComposited):
Do the same thing for filtersCanBeComposited.

(WebCore::GraphicsLayerCA::GraphicsLayerCA):
(WebCore::GraphicsLayerCA::setContentsToSolidColor):
(WebCore::GraphicsLayerCA::setContentsToMedia):
(WebCore::GraphicsLayerCA::setContentsToCanvas):
(WebCore::GraphicsLayerCA::recursiveCommitChanges):
(WebCore::GraphicsLayerCA::ensureStructuralLayer):
(WebCore::GraphicsLayerCA::updateContentsImage):
(WebCore::GraphicsLayerCA::updateContentsRects):
(WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
Use createPlatformCALayer instead of PlatformCALayer::create.

* platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
For now, use the PlatformCALayerMac version of filtersCanBeComposited,
since this code is heavily tied to having CALayers in the Web process.

* platform/graphics/ca/GraphicsLayerCA.h:
Include PlatformCALayer.h here so we can get the LayerType enum.
(NOTE-to-be-removed: if there's a better way to do this, I'm open to
suggestions; I couldn't puzzle out nested 'enum class' stuff).

Add the createPlatformCALayers.

* platform/graphics/ca/PlatformCAAnimation.h:
Friend the subclasses too.

* platform/graphics/ca/PlatformCALayer.cpp: Added.
(WebCore::PlatformCALayer::~PlatformCALayer):
Pull the shared part of the PlatformCALayer destructor out.

* platform/graphics/ca/PlatformCALayer.h:
(WebCore::PlatformCALayer::platformLayer):
(WebCore::PlatformCALayer::setOwner):
(WebCore::PlatformCALayer::PlatformCALayer):
Virtualize all the things. Move platform specific members to their new subclasses.

* platform/graphics/ca/mac/PlatformCALayerMac.h: Added.
* platform/graphics/ca/mac/PlatformCALayerMac.mm:
Move the PLATFORM(MAC) implementations from PlatformCALayer to PlatformCALayerMac.

(PlatformCALayer::platformCALayer):
The platformCALayer lookup function is static on PlatformCALayer, so it can't
be moved to the subclasses. It might be a good idea in the future to move towards
a platform-independent mechanism for looking up PlatformCALayers from PlatformLayers,
and to avoid needing to do this as often as we do now.

* platform/graphics/ca/win/CACFLayerTreeHost.cpp:
(WebCore::CACFLayerTreeHost::CACFLayerTreeHost):
* platform/graphics/ca/win/PlatformCALayerWin.cpp:
Move the PLATFORM(WIN) implementations from PlatformCALayer to PlatformCALayerWin.

(PlatformCALayerWin::create):
(PlatformCALayer::platformCALayer):

* platform/graphics/ca/win/PlatformCALayerWin.h: Added.

* platform/graphics/win/GraphicsContext3DWin.cpp:
(WebCore::GraphicsContext3D::GraphicsContext3D):
* platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
(WebCore::MediaPlayerPrivateQuickTimeVisualContext::createLayerForMovie):
Include PlatformCALayerWin.h and explicitly make PlatformCALayerWins here.

* FullscreenVideoController.cpp:
(FullscreenVideoController::FullscreenVideoController):
Include PlatformCALayerWin.h and explicitly make PlatformCALayerWins here.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157419 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Separate out array iteration intrinsics
https://bugs.webkit.org/show_bug.cgi?id=122656

Reviewed by Michael Saboff.

Separate out the intrinsics for key and values iteration
of arrays.

This requires moving moving array iteration into the iterator
instance, rather than the prototype, but this is essentially
unobservable so we'll live with it for now.

* jit/ThunkGenerators.cpp:
(JSC::arrayIteratorNextThunkGenerator):
(JSC::arrayIteratorNextKeyThunkGenerator):
(JSC::arrayIteratorNextValueThunkGenerator):
* jit/ThunkGenerators.h:
* runtime/ArrayIteratorPrototype.cpp:
(JSC::ArrayIteratorPrototype::finishCreation):
* runtime/Intrinsic.h:
* runtime/JSArrayIterator.cpp:
(JSC::JSArrayIterator::finishCreation):
(JSC::createIteratorResult):
(JSC::arrayIteratorNext):
(JSC::arrayIteratorNextKey):
(JSC::arrayIteratorNextValue):
(JSC::arrayIteratorNextGeneric):
* runtime/VM.cpp:
(JSC::thunkGeneratorForIntrinsic):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix the paths so that the test passes.

* js/regress/put-by-id.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157421 268f45cc-cd09-0410-ab3c-d52691b4dbfc
COLLECT_ON_EVERY_ALLOCATION causes assertion failures
https://bugs.webkit.org/show_bug.cgi?id=122652

Reviewed by Filip Pizlo.

COLLECT_ON_EVERY_ALLOCATION wasn't accounting for the new GC deferral mechanism,
so we would end up ASSERTing during garbage collection.

* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::allocateSlowCase):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157422 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=122774.
<rdar://problem/6138855>.

Reviewed by Brent Fulgham.

Add a field to keep track of hovered over index.
Use index to determine whether or not to use the existing selected index on the mouse down event.

* platform/win/PopupMenuWin.cpp:
(WebCore::PopupMenuWin::PopupMenuWin):
(WebCore::PopupMenuWin::show):
(WebCore::PopupMenuWin::wndProc):
* platform/win/PopupMenuWin.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157423 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r157413.
http://trac.webkit.org/changeset/157413
https://bugs.webkit.org/show_bug.cgi?id=122779

Appears to have caused frequent crashes (Requested by ap on
#webkit).

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.cpp: Removed.
* heap/DeferGC.h:
* jit/JITStubs.cpp:
(JSC::tryCacheGetByID):
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/Structure.cpp:
(JSC::Structure::materializePropertyMap):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
* runtime/Structure.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157424 268f45cc-cd09-0410-ab3c-d52691b4dbfc
The content of the DOM panel for iframes is not updated until the "onload" event
https://bugs.webkit.org/show_bug.cgi?id=122653

Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/inspector-protocol/loading-iframe-document-node.html

Renamed InspectorDOMAgent::loadEventFired to InspectorDOMAgent::didCommitLoad and moved the call site
from InspectorInstrumentation::loadEventFiredImpl to InspectorInstrumentation::didCommitLoadImpl.
This is to make sure that it will invalidate the content of the iframe as soon as the frame navigates
to a different page. This way the new node can be retrieved as soon as the page has some content, and
not just when the page is fully loaded.

* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::didCommitLoad): Renamed from loadEventFired, as it is now called from
didCommitLoadImpl instead.
(WebCore::InspectorDOMAgent::frameDocumentUpdated): Updated comment to point to the new function name.
* inspector/InspectorDOMAgent.h:
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::loadEventFiredImpl): Removed call do InspectorDOMAgent.loadEventFired.
(WebCore::InspectorInstrumentation::didCommitLoadImpl): Added call to InspectorDOMAgent.didCommitLoad.

LayoutTests:

Added test to check that immediately after the scripting context is created, the
inspector already has access to the nodeId of the document of the iframe.

* http/tests/inspector-protocol/loading-iframe-document-node-expected.txt: Added.
* http/tests/inspector-protocol/loading-iframe-document-node.html: Added.
* http/tests/inspector-protocol/resources/slow-test-page.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157425 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix after r157366
http://bugs.webkit.org/show_bug.cgi?id=122783

When TOUCH_AJUSTMENT is enabled build fails due to some
refactors in TextRender functions.

Patch by Nick Diego Yamane <nick.yamane@openbossa.org> on 2013-10-14
Reviewed by Anders Carlsson.

* page/TouchAdjustment.cpp:
(WebCore::TouchAdjustment::appendContextSubtargetsForNode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157426 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[sh4] Fixes after r157404 and r157411.
https://bugs.webkit.org/show_bug.cgi?id=122782

Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-14
Reviewed by Michael Saboff.

* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JITInlines.h:
(JSC::JIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_put_by_id): Remove unwanted BEGIN_UNINTERRUPTED_SEQUENCE.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157427 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove GestureEvent leftovers from WebCore
<https://webkit.org/b/122780>

Patch by Nick Diego Yamane <nick.yamane@openbossa.org> on 2013-10-14
Reviewed by Anders Carlsson.

- Removed some remaining references to PlatformGestureEvent, supposed to
  be removed by r157316
- TOUCH_ADJUSTMENT should be reworked after GestureEvent feature
  removal

* page/EventHandler.cpp:
(WebCore::EventHandler::bestZoomableAreaForTouchPoint):
* page/EventHandler.h:
* platform/PlatformEvent.h:
* platform/ScrollAnimatorNone.cpp:
* platform/ScrollableArea.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157428 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add FTL support for LogicalNot(string)
https://bugs.webkit.org/show_bug.cgi?id=122765

Patch by Nadav Rotem <nrotem@apple.com> on 2013-10-14
Reviewed by Filip Pizlo.

This patch is tested by:
regress/script-tests/emscripten-cube2hash.js.ftl-eager

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileLogicalNot):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157429 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add an empty window.crypto.webkitSubtle
https://bugs.webkit.org/show_bug.cgi?id=122778

Reviewed by Mark Hahnenberg.

Source/WebCore:

Tests: security/crypto-subtle-gc-2.html
       security/crypto-subtle-gc-3.html
       security/crypto-subtle-gc.html

* DerivedSources.make: Process SubtleCrypto.idl.

* crypto: Added.
* WebCore.xcodeproj/project.pbxproj:
* CMakeLists.txt:
* DerivedSources.make:
* GNUmakefile.am:
* GNUmakefile.list.am:
* WebCore.vcxproj/WebCore.vcxproj.filters:

* bindings/js/JSSubtleCryptoCustom.cpp: Added. Empty for now, but we'll certainly
need custom bindings code here.

* crypto/SubtleCrypto.cpp: Added.
(WebCore::SubtleCrypto::SubtleCrypto):
(WebCore::SubtleCrypto::document):
* crypto/SubtleCrypto.h: Added.
* crypto/SubtleCrypto.idl: Added.
* page/Crypto.cpp:
(WebCore::Crypto::subtle):
* page/Crypto.h:
* page/Crypto.idl:

LayoutTests:

* TestExpectations: The feature isn't enabled anywhere yet, so skipping the new tests.

* security/crypto-subtle-gc-2-expected.txt: Added.
* security/crypto-subtle-gc-2.html: Added.
* security/crypto-subtle-gc-3-expected.txt: Added.
* security/crypto-subtle-gc-3.html: Added.
* security/crypto-subtle-gc-expected.txt: Added.
* security/crypto-subtle-gc.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157430 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure in Range::processContentsBetweenOffsets
https://bugs.webkit.org/show_bug.cgi?id=122777

Reviewed by Darin Adler.

Source/WebCore: 

Merge https://chromium.googlesource.com/chromium/blink/+/c15de182774c7859c20d97126eb844ae97b792a4

This patch changes ASSERT statements for checking |endOffset| inbound in Range::processContentsBetweenOffsets()
to limit |endOffset|. This is necessary when DOMNodeRemovedFromDocument event handler splits text nodes,
Range::insertNode() on text node, in the range calling Range::deleteContents().

Test: fast/dom/Range/range-delete-contents-mutation-event-crash.html

* dom/Range.cpp:
(WebCore::Range::processContentsBetweenOffsets):

LayoutTests: 

* fast/dom/Range/range-delete-contents-mutation-event-crash-expected.txt: Added.
* fast/dom/Range/range-delete-contents-mutation-event-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed build fix.

* WebCore.vcxproj/WebCoreCommon.props:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157432 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG PutById IC should use the ConcurrentJITLocker since it's now dealing with IC's that get read by the compiler thread
https://bugs.webkit.org/show_bug.cgi?id=122786

Reviewed by Mark Hahnenberg.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::resetStub): Resetting a stub should acquire the lock since this is observable from the thread; but we should only acquire the lock if we're resetting outside of GC.
* jit/Repatch.cpp:
(JSC::repatchPutByID): Doing the PutById patching should hold the lock.
(JSC::buildPutByIdList): Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157433 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: fieldset should have GroupRole and legend should be description.
https://bugs.webkit.org/show_bug.cgi?id=122534

Patch by Samuel White <samuel_white@apple.com> on 2013-10-14
Reviewed by Chris Fleizach.

Source/WebCore:

Changes fieldset to derive AXDescription from legend if one is available. Added
convenience method to AccessibilityObject to fetch element if available.

Test: accessibility/fieldset-element.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::canHaveChildren):
(WebCore::AccessibilityNodeObject::alternativeText):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::element):
(WebCore::AccessibilityObject::isARIAHidden):
(WebCore::AccessibilityObject::isDOMHidden):
(WebCore::AccessibilityObject::defaultObjectInclusion):
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::isHidden):
* accessibility/AccessibilitySlider.cpp:
(WebCore::AccessibilitySlider::getAttribute):
(WebCore::AccessibilitySlider::valueForRange):
(WebCore::AccessibilitySlider::maxValueForRange):
(WebCore::AccessibilitySlider::minValueForRange):
(WebCore::AccessibilitySlider::setValue):
(WebCore::AccessibilitySlider::inputElement):
* accessibility/AccessibilitySlider.h:
* accessibility/mac/AccessibilityObjectMac.mm:
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
* html/HTMLFieldSetElement.cpp:
(WebCore::HTMLFieldSetElement::legend):
* html/HTMLFieldSetElement.h:

LayoutTests:

legend no longer treated as titleUIElement so removing tests that check this functionality.
Added test to check that legend is used as AXDescription of fieldset if present.

* accessibility/fieldset-element.html: Added.
* accessibility/hidden-legend-expected.txt: Removed.
* accessibility/hidden-legend.html: Removed.
* accessibility/legend.html: Removed.
* platform/efl/accessibility/legend-expected.txt: Removed.
* platform/gtk/accessibility/legend-expected.txt: Removed.
* platform/mac/accessibility/fieldset-element-expected.txt: Added.
* platform/mac/accessibility/legend-expected.txt: Removed.
* platform/mac/accessibility/role-subrole-roledescription-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157434 268f45cc-cd09-0410-ab3c-d52691b4dbfc