Make WKBrowsingContextGroup work with WKObject wrapping
https://bugs.webkit.org/show_bug.cgi?id=124948

Reviewed by Dan Bernstein.

- Adds mechanism to use the inline data wrapping mechanism when the Objective-C wrapper is created
  by the caller (rather than by Object::newObject).
- Adopts the mechanism for WKBrowsingContextGroup.

* Shared/APIObject.h:
(API::Object::constructInWrapper):
Add a helper which does a forwarding placement-new into the API::Object of the passed in wrapper, after which it sets up m_wrapper.

(API::TypedObject::operator new):
Add a operator new to for placement-new. Also make TypedObject friends with Object so that constructInWrapper can call this.

* Shared/Cocoa/APIObject.mm:
(API::Object::newObject):
Add support for WKBrowsingContextGroup.

* UIProcess/API/mac/WKBrowsingContextGroup.mm:
(-[WKBrowsingContextGroup API::]):
(-[WKBrowsingContextGroup dealloc]):
(-[WKBrowsingContextGroup initWithIdentifier:]):
(-[WKBrowsingContextGroup allowsJavaScript]):
(-[WKBrowsingContextGroup setAllowsJavaScript:]):
(-[WKBrowsingContextGroup allowsJavaScriptMarkup]):
(-[WKBrowsingContextGroup setAllowsJavaScriptMarkup:]):
(-[WKBrowsingContextGroup allowsPlugIns]):
(-[WKBrowsingContextGroup setAllowsPlugIns:]):
(-[WKBrowsingContextGroup addUserStyleSheet:baseURL:whitelistedURLPatterns:blacklistedURLPatterns:mainFrameOnly:]):
(-[WKBrowsingContextGroup removeAllUserStyleSheets]):
(-[WKBrowsingContextGroup addUserScript:baseURL:whitelistedURLPatterns:blacklistedURLPatterns:injectionTime:mainFrameOnly:]):
(-[WKBrowsingContextGroup removeAllUserScripts]):
(-[WKBrowsingContextGroup _pageGroupRef]):
Convert from wrapping the C-SPI type to storing the bits of the wrapped object inline (modeled on WKBackForwardList).

* UIProcess/API/mac/WKBrowsingContextGroupInternal.h: Added.
(WebKit::wrapper):
Add wrapper() helper and declare conformance to the WKObject protocol.

* UIProcess/WebPageGroup.cpp:
(WebKit::WebPageGroup::create):
(WebKit::WebPageGroup::WebPageGroup):
* UIProcess/WebPageGroup.h:
Make the WebPageGroup constructor public (for use with Object::constructInWrapper) and move being set in the webPageGroupMap()
to the constructor.

* WebKit2.xcodeproj/project.pbxproj:
Add new file.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159824 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Do bytecode validation as part of testing
https://bugs.webkit.org/show_bug.cgi?id=124913

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
Also fix some small bugs in the bytecode liveness analysis that I found by doing
this validation thingy.

* bytecode/BytecodeLivenessAnalysis.cpp:
(JSC::isValidRegisterForLiveness):
(JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::validate):
(JSC::CodeBlock::beginValidationDidFail):
(JSC::CodeBlock::endValidationDidFail):
* bytecode/CodeBlock.h:
* runtime/Executable.cpp:
(JSC::ScriptExecutable::prepareForExecutionImpl):
* runtime/Options.h:

Source/WTF: 

Reviewed by Oliver Hunt.

* GNUmakefile.list.am:
* WTF.vcxproj/WTF.vcxproj:
* WTF.xcodeproj/project.pbxproj:
* wtf/CMakeLists.txt:
* wtf/FastBitVector.cpp: Added.
(WTF::FastBitVector::dump):
* wtf/FastBitVector.h:
(WTF::FastBitVector::resize):
(WTF::FastBitVector::bitCount):
(WTF::FastBitVector::arrayLength):

Tools: 

Reviewed by Oliver Hunt.

* Scripts/run-jsc-stress-tests:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159825 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Finally fix some obvious Bartlett bugs
https://bugs.webkit.org/show_bug.cgi?id=124951

Reviewed by Mark Hahnenberg.
        
Sanitize the stack (i.e. zero parts of it known to be dead) at three key points:
        
- GC.
        
- At beginning of OSR entry.
        
- Just as we finish preparing OSR entry. This clears those slots on the stack that
  could have been live in baseline but that are known to be dead in DFG.
        
This is as much as a 2x speed-up on splay if you run it in certain modes, and run it
for a long enough interval. It appears to fix all instances of the dreaded exponential
heap growth that splay gets into when some stale pointer stays around.
        
This doesn't have much of an effect on real-world programs. This bug has only ever
manifested in splay and for that reason we thus far opted against fixing it. But splay
is, for what it's worth, the premiere GC stress test in JavaScript - so making sure we
can run it without pathologies - even when you tweak its configuration - is probably
fairly important.

* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::noticeOSREntry):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSREntry.h:
* heap/Heap.cpp:
(JSC::Heap::markRoots):
* interpreter/JSStack.cpp:
(JSC::JSStack::JSStack):
(JSC::JSStack::sanitizeStack):
* interpreter/JSStack.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159826 268f45cc-cd09-0410-ab3c-d52691b4dbfc