<rdar://problem/14528244> False-positive leaks from FastMalloc.

A logic error in the page map enumeration code within FastMalloc could result in a subset of the memory regions
owned by FastMalloc being skipped by the malloc zone enumeration code used by leaks and other performance tools.
If the only reference to an allocated object lived within one of the skipped memory regions, leaks would believe
it had been leaked since it would not find any references to the object.

The logic error manifested when a FastMalloc span owned a region of memory that crossed a 16MB address space boundary,
and when there was one or more other spans immediately after it in the address space. Crossing the 16MB address space
boundary means that the start and end points of the span are in different leaf nodes of the page map trie, and the
code within the page map's visitValues method didn't correctly account this case when skipping to the end of the span
after visiting it. It would resume iterating from the start of the next leaf node rather than continuing to skip values
until the end of the span was passed. The value representing the end of the span would then be processed as if it were
the start of a new span, and more values would be skipped even though they may contain actual spans.

The solution is to rework the algorithm used in visitValues so that it will skip the correct number of values even when
some of the values are in different leaf nodes. This is a more involved change than it may seem since it's also necessary
to deal with the case where a memory region spans two separate root nodes, which can happen if the region happens to cross
a 64GB boundary in the address space.

Reviewed by Geoff Garen.

* wtf/TCPageMap.h:
(TCMalloc_PageMap3::visitValues): Use a single loop to iterate, with the loop index being the key in to the page map in the
same form as used by get and set. This allows us to correctly deal with the index being skipped to a different intermediate or
root node as a result of visiting a span that crosses a 16MB boundary in memory.
(TCMalloc_PageMap2::visitValues): Ditto, but without having to deal with intermediate nodes.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153635 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/14235491> FastMalloc zone enumerator responding to MALLOC_PTR_REGION_RANGE_TYPE with individual allocations

Teach PageMapMemoryUsageRecorder::recordPendingRegions to only record data of the type that it's asked for.
This also fixes the vmmap output to associate some regions with the FastMalloc malloc zone that were previously
associated with it only via the VM tag, meaning they were incorrectly being omitted from the malloc statistics
section of the report.

Reviewed by Dan Bernstein.

* wtf/FastMalloc.cpp:
(WTF::PageMapMemoryUsageRecorder::recordPendingRegions): Report the individual allocations only when requested. Add
the ability to report the regions containing pointers separately from the allocations.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153636 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<http://webkit.org/b/119169> RetainPtr should support ARC for Objective-C objects.

While RetainPtr is not necessary under ARC, having it available makes it easier to transition
existing code from manual retain / release to ARC.

Under ARC, the object member of RetainPtr is treated as a strong reference by the compiler.
This means that merely assigning to the member variable is sufficient to retain the object,
and clearing the member variable is sufficient to release it. We still need to explicitly
CFRetain / CFRelease CoreFoundation types so the explicit calls to these functions are
moved in to helper functions and overloading is used to have the Objective-C object versions
of them be no-ops under ARC.

Reviewed by Anders Carlsson.

* wtf/RetainPtr.h:
(WTF::retain): Continue to always CFRetain / CFRelease CoreFoundation objects. Only CFRetain / CFRelease
Objective-C objects when using manual retain / release.
(WTF::release): Ditto.
(WTF::adoptNSReference): Adopting references will be handled automatically by the compiler
when possible under ARC by eliminating redundant retain / release pairs.
(WTF::RetainPtr::ImplicitConversionToBoolIsNotAllowed): A new method that exists only to be used by the
conversion to the unspecified bool type.
(WTF::RetainPtr::operator UnspecifiedBoolType): Switch to using a pointer to a member function as the
unspecified bool type to avoid warnings from the compiler when casting Objective-C object types under ARC.

(WTF::RetainPtr::RetainPtr): Switch to our retain / release helper functions.
(WTF::RetainPtr::~RetainPtr): Ditto.
(WTF::::RetainPtr): Ditto.
(WTF::::clear): Ditto.
(WTF::=): Ditto.
(WTF::adoptCF): Annotate the argument with CF_RELEASES_ARGUMENT on both the declaration and the definition.
(WTF::adoptNS): Ditto for NS_RELEASES_ARGUMENT.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153637 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Check WTF::Vector size with '0' inline capacity
https://bugs.webkit.org/show_bug.cgi?id=119397

Reviewed by Andreas Kling.

Putting in place the compile assertion that had been removed with r153514.

* wtf/SizeLimits.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153638 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add --rmdir option to git svn dcommit
https://bugs.webkit.org/show_bug.cgi?id=119398

Reviewed by Ryosuke Niwa.

Add this option tells git-svn to remove empty directories
from the svn tree so they do not leave over there.

* Scripts/webkitpy/common/checkout/scm/git.py:
(Git.push_local_commits_to_server):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Frame flattening: Change the logic on whether resize event needs to be dispatched.
https://bugs.webkit.org/show_bug.cgi?id=119394

Reviewed by Simon Fraser.

http://trac.webkit.org/changeset/149287 changed the logic so that resize events are
sent out from FrameView::setFrameRect() too. Checking whether frame flattening is
enabled is sufficient enough to ensure that no extra resize events are dispatched.

Source/WebCore:

Test: fast/frames/flattening/iframe-flattening-resize-event-count.html

* page/FrameView.cpp:
(WebCore::FrameView::FrameView):
(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::frameFlatteningEnabled):
(WebCore::FrameView::supportsFrameFlattening):
(WebCore::FrameView::avoidScrollbarCreation):
(WebCore::FrameView::calculateScrollbarModesForLayout):
(WebCore::FrameView::layout):
(WebCore::FrameView::isInChildFrameWithFrameFlattening):
* page/FrameView.h:
* rendering/RenderFrameBase.cpp:
(WebCore::RenderFrameBase::layoutWithFlattening):

LayoutTests:

* fast/frames/flattening/iframe-flattening-resize-event-count-expected.txt: Added.
* fast/frames/flattening/iframe-flattening-resize-event-count.html: Added.
* fast/frames/flattening/resources/iframe-to-resize.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153640 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removing an empty style sheet shouldn't trigger style recalc.
<http://webkit.org/b/119248>
<rdar://problem/14629045>

Reviewed by Antti Koivisto.

Teach DocumentStyleSheetCollection to filter out empty style sheets when deciding whether
or not to trigger a style recalc. We can then be clever when an empty style sheet is removed
from the document, and avoid causing extra work.

Some pages use this pattern:

    (1) Create a <style> element.
    (2) Add it to the document's <head> element.
    (3) Insert some CSS as a text child of the <style> element.

Since the <style> element is already inside the document at (3), we had to treat this as an
old style sheet being removed, even though it was just an empty sheet of nothing.

With this patch, Document gains enough smarts to know that removing/adding an empty sheet
won't affect layout/rendering in any meaningful way, thus a style recalc can be avoided.

* dom/Document.h:
* dom/Document.cpp:
(WebCore::Document::styleResolverChanged):

    Add a DeferRecalcStyleIfNeeded mode to styleResolverChanged().

* css/CSSStyleSheet.h:
* css/CSSStyleSheet.cpp:
(WebCore::CSSStyleSheet::clearOwnerNode):

    Use DeferRecalcStyleIfNeeded when saying bye from a CSSStyleSheet and let Document decide
    if removing the sheet should trigger style recalc instead of always assuming it should.

* dom/DocumentStyleSheetCollection.cpp:
(WebCore::filterEnabledNonemptyCSSStyleSheets):
(WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):

    Exclude empty sheets from the activeAuthorStyleSheets() collection. They are still
    visible through CSSOM's document.styleSheets.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153641 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Correct bugzilla link in my last commit.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153642 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove redundant call of argsList->current() from loops in CSSParser.
https://bugs.webkit.org/show_bug.cgi?id=119432

Reviewed by Christophe Dumez.

while loops in CSSParser call argList->current() function at the start
of each iteration, but this is redundant because argsList->next() at
the end of the iteration calls the argList->current() and returns the
result.

Blink merge from https://src.chromium.org/viewvc/blink?view=rev&revision=155402

* css/CSSParser.cpp:
(WebCore::CSSParser::parseMixFunction):
(WebCore::CSSParser::parseCustomFilterFunctionWithInlineSyntax):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153643 268f45cc-cd09-0410-ab3c-d52691b4dbfc