<https://webkit.org/b/119918> Frame::selection() should return a reference

Reviewed by Darin Adler.

m_selection is never NULL so return a reference from Frame::selection(). Also removed some
unnecessary null checks and assert diff ts exposed as a result.

Source/WebCore:

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::selection):
(WebCore::AccessibilityRenderObject::setSelectedTextRange):
(WebCore::AccessibilityRenderObject::isFocused):
(WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
(WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper accessibilityModifySelection:increase:]):
(-[WebAccessibilityObjectWrapper accessibilityMoveSelectionToMarker:]):
(-[WebAccessibilityObjectWrapper _convertToNSRange:]):
(-[WebAccessibilityObjectWrapper _convertToDOMRange:]):
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::isFrameFocused):
* dom/CharacterData.cpp:
(WebCore::CharacterData::setDataAndUpdate):
* dom/Document.cpp:
(WebCore::Document::nodeChildrenWillBeRemoved):
(WebCore::Document::nodeWillBeRemoved):
* dom/Element.cpp:
(WebCore::Element::updateFocusAppearance):
* editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::stopPendingCorrection):
(WebCore::AlternativeTextController::applyAlternativeTextToRange):
(WebCore::AlternativeTextController::applyAutocorrectionBeforeTypingIfAppropriate):
(WebCore::AlternativeTextController::respondToUnappliedSpellCorrection):
(WebCore::AlternativeTextController::timerFired):
(WebCore::AlternativeTextController::respondToChangedSelection):
* editing/DeleteButtonController.cpp:
(WebCore::DeleteButtonController::respondToChangedSelection):
(WebCore::DeleteButtonController::enable):
(WebCore::DeleteButtonController::deleteTarget):
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
* editing/DictationCommand.cpp:
(WebCore::DictationCommand::insertText):
* editing/EditCommand.cpp:
(WebCore::EditCommand::EditCommand):
* editing/EditingStyle.cpp:
(WebCore::EditingStyle::mergeTypingStyle):
* editing/Editor.cpp:
(WebCore::Editor::selectionForCommand):
(WebCore::Editor::canEdit):
(WebCore::Editor::canEditRichly):
(WebCore::Editor::canDHTMLCut):
(WebCore::Editor::canDHTMLCopy):
(WebCore::Editor::canCopy):
(WebCore::Editor::canDelete):
(WebCore::Editor::canSmartCopyOrDelete):
(WebCore::Editor::deleteWithDirection):
(WebCore::Editor::deleteSelectionWithSmartDelete):
(WebCore::Editor::replaceSelectionWithFragment):
(WebCore::Editor::selectedRange):
(WebCore::Editor::tryDHTMLCopy):
(WebCore::Editor::tryDHTMLCut):
(WebCore::Editor::hasBidiSelection):
(WebCore::Editor::selectionUnorderedListState):
(WebCore::Editor::selectionOrderedListState):
(WebCore::Editor::increaseSelectionListLevel):
(WebCore::Editor::increaseSelectionListLevelOrdered):
(WebCore::Editor::increaseSelectionListLevelUnordered):
(WebCore::Editor::decreaseSelectionListLevel):
(WebCore::Editor::findEventTargetFromSelection):
(WebCore::Editor::applyStyle):
(WebCore::Editor::applyParagraphStyle):
(WebCore::Editor::applyStyleToSelection):
(WebCore::Editor::applyParagraphStyleToSelection):
(WebCore::Editor::selectionStartHasStyle):
(WebCore::Editor::selectionHasStyle):
(WebCore::Editor::selectionStartCSSPropertyValue):
(WebCore::Editor::appliedEditing):
(WebCore::Editor::insertTextWithoutSendingTextEvent):
(WebCore::Editor::insertLineBreak):
(WebCore::Editor::insertParagraphSeparator):
(WebCore::Editor::cut):
(WebCore::Editor::copy):
(WebCore::Editor::paste):
(WebCore::Editor::baseWritingDirectionForSelectionStart):
(WebCore::Editor::selectComposition):
(WebCore::Editor::setComposition):
(WebCore::Editor::ignoreSpelling):
(WebCore::Editor::learnSpelling):
(WebCore::Editor::advanceToNextMisspelling):
(WebCore::Editor::misspelledWordAtCaretOrRange):
(WebCore::Editor::isSelectionUngrammatical):
(WebCore::Editor::guessesForMisspelledOrUngrammatical):
(WebCore::Editor::markMisspellingsAfterTypingToWord):
(WebCore::Editor::isSpellCheckingEnabledInFocusedNode):
(WebCore::Editor::markAndReplaceFor):
(WebCore::Editor::updateMarkersForWordsAffectedByEditing):
(WebCore::Editor::revealSelectionAfterEditingOperation):
(WebCore::Editor::getCompositionSelection):
(WebCore::Editor::transpose):
(WebCore::Editor::changeSelectionAfterCommand):
(WebCore::Editor::selectedText):
(WebCore::Editor::computeAndSetTypingStyle):
(WebCore::Editor::findString):
(WebCore::Editor::respondToChangedSelection):
(WebCore::Editor::selectionStartHasMarkerFor):
(WebCore::Editor::toggleOverwriteModeEnabled):
* editing/EditorCommand.cpp:
(WebCore::executeToggleStyleInList):
(WebCore::expandSelectionToGranularity):
(WebCore::stateTextWritingDirection):
(WebCore::executeDelete):
(WebCore::executeDeleteToMark):
(WebCore::executeMoveBackward):
(WebCore::executeMoveBackwardAndModifySelection):
(WebCore::executeMoveDown):
(WebCore::executeMoveDownAndModifySelection):
(WebCore::executeMoveForward):
(WebCore::executeMoveForwardAndModifySelection):
(WebCore::executeMoveLeft):
(WebCore::executeMoveLeftAndModifySelection):
(WebCore::executeMovePageDown):
(WebCore::executeMovePageDownAndModifySelection):
(WebCore::executeMovePageUp):
(WebCore::executeMovePageUpAndModifySelection):
(WebCore::executeMoveRight):
(WebCore::executeMoveRightAndModifySelection):
(WebCore::executeMoveToBeginningOfDocument):
(WebCore::executeMoveToBeginningOfDocumentAndModifySelection):
(WebCore::executeMoveToBeginningOfLine):
(WebCore::executeMoveToBeginningOfLineAndModifySelection):
(WebCore::executeMoveToBeginningOfParagraph):
(WebCore::executeMoveToBeginningOfParagraphAndModifySelection):
(WebCore::executeMoveToBeginningOfSentence):
(WebCore::executeMoveToBeginningOfSentenceAndModifySelection):
(WebCore::executeMoveToEndOfDocument):
(WebCore::executeMoveToEndOfDocumentAndModifySelection):
(WebCore::executeMoveToEndOfSentence):
(WebCore::executeMoveToEndOfSentenceAndModifySelection):
(WebCore::executeMoveToEndOfLine):
(WebCore::executeMoveToEndOfLineAndModifySelection):
(WebCore::executeMoveToEndOfParagraph):
(WebCore::executeMoveToEndOfParagraphAndModifySelection):
(WebCore::executeMoveParagraphBackwardAndModifySelection):
(WebCore::executeMoveParagraphForwardAndModifySelection):
(WebCore::executeMoveUp):
(WebCore::executeMoveUpAndModifySelection):
(WebCore::executeMoveWordBackward):
(WebCore::executeMoveWordBackwardAndModifySelection):
(WebCore::executeMoveWordForward):
(WebCore::executeMoveWordForwardAndModifySelection):
(WebCore::executeMoveWordLeft):
(WebCore::executeMoveWordLeftAndModifySelection):
(WebCore::executeMoveWordRight):
(WebCore::executeMoveWordRightAndModifySelection):
(WebCore::executeMoveToLeftEndOfLine):
(WebCore::executeMoveToLeftEndOfLineAndModifySelection):
(WebCore::executeMoveToRightEndOfLine):
(WebCore::executeMoveToRightEndOfLineAndModifySelection):
(WebCore::executeSelectAll):
(WebCore::executeSelectToMark):
(WebCore::executeSetMark):
(WebCore::executeSwapWithMark):
(WebCore::executeUnselect):
(WebCore::enabledInRichlyEditableText):
(WebCore::enabledRangeInEditableText):
(WebCore::enabledRangeInRichlyEditableText):
(WebCore::valueFormatBlock):
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setSelection):
(WebCore::FrameSelection::selectFrameElementInParentIfFullySelected):
* editing/InsertLineBreakCommand.cpp:
(WebCore::InsertLineBreakCommand::doApply):
* editing/InsertTextCommand.cpp:
(WebCore::InsertTextCommand::doApply):
* editing/ModifySelectionListLevel.cpp:
(WebCore::IncreaseSelectionListLevelCommand::canIncreaseSelectionListLevel):
(WebCore::DecreaseSelectionListLevelCommand::canDecreaseSelectionListLevel):
* editing/RemoveFormatCommand.cpp:
(WebCore::RemoveFormatCommand::doApply):
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::doApply):
* editing/SetSelectionCommand.cpp:
(WebCore::SetSelectionCommand::doApply):
(WebCore::SetSelectionCommand::doUnapply):
* editing/SpellingCorrectionCommand.cpp:
(WebCore::SpellingCorrectionCommand::doApply):
* editing/TextInsertionBaseCommand.cpp:
(WebCore::TextInsertionBaseCommand::applyTextInsertionCommand):
* editing/TypingCommand.cpp:
(WebCore::TypingCommand::deleteSelection):
(WebCore::TypingCommand::updateSelectionIfDifferentFromCurrentSelection):
(WebCore::TypingCommand::insertText):
(WebCore::TypingCommand::deleteKeyPressed):
(WebCore::TypingCommand::forwardDeleteKeyPressed):
* editing/ios/EditorIOS.mm:
(WebCore::Editor::setTextAlignmentForChangedBaseWritingDirection):
(WebCore::styleForSelectionStart):
(WebCore::Editor::fontForSelection):
* editing/mac/EditorMac.mm:
(WebCore::styleForSelectionStart):
(WebCore::Editor::fontForSelection):
(WebCore::Editor::canCopyExcludingStandaloneImages):
(WebCore::Editor::readSelectionFromPasteboard):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::defaultEventHandler):
(WebCore::HTMLAnchorElement::setActive):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateFocusAppearance):
* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::updateFocusAppearance):
(WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::setSelectionRange):
(WebCore::HTMLTextFormControlElement::computeSelectionStart):
(WebCore::HTMLTextFormControlElement::computeSelectionEnd):
(WebCore::HTMLTextFormControlElement::computeSelectionDirection):
(WebCore::HTMLTextFormControlElement::selectionChanged):
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::clear):
* loader/archive/cf/LegacyWebArchive.cpp:
(WebCore::LegacyWebArchive::createFromSelection):
* page/ContextMenuController.cpp:
(WebCore::insertUnicodeCharacter):
(WebCore::ContextMenuController::contextMenuItemSelected):
(WebCore::selectionContainsPossibleWord):
(WebCore::ContextMenuController::populate):
(WebCore::ContextMenuController::checkOrEnableIfNeeded):
* page/DOMSelection.cpp:
(WebCore::selectionShadowAncestor):
(WebCore::DOMSelection::visibleSelection):
(WebCore::DOMSelection::isCollapsed):
(WebCore::DOMSelection::type):
(WebCore::DOMSelection::rangeCount):
(WebCore::DOMSelection::collapse):
(WebCore::DOMSelection::collapseToEnd):
(WebCore::DOMSelection::collapseToStart):
(WebCore::DOMSelection::empty):
(WebCore::DOMSelection::setBaseAndExtent):
(WebCore::DOMSelection::setPosition):
(WebCore::DOMSelection::modify):
(WebCore::DOMSelection::extend):
(WebCore::DOMSelection::getRangeAt):
(WebCore::DOMSelection::removeAllRanges):
(WebCore::DOMSelection::addRange):
(WebCore::DOMSelection::deleteFromDocument):
(WebCore::DOMSelection::containsNode):
(WebCore::DOMSelection::toString):
* page/DragController.cpp:
(WebCore::DragController::dragIsMove):
(WebCore::setSelectionToDragCaret):
(WebCore::DragController::concludeEditDrag):
(WebCore::DragController::draggableElement):
(WebCore::selectElement):
(WebCore::dragLocForSelectionDrag):
(WebCore::DragController::startDrag):
* page/DragController.h:
* page/EventHandler.cpp:
(WebCore::setSelectionIfNeeded):
(WebCore::EventHandler::updateSelectionForMouseDownDispatchingSelectStart):
(WebCore::EventHandler::handleMousePressEventDoubleClick):
(WebCore::EventHandler::handleMousePressEventSingleClick):
(WebCore::EventHandler::updateSelectionForMouseDrag):
(WebCore::EventHandler::lostMouseCapture):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::nodeIsNotBeingEdited):
(WebCore::EventHandler::selectCursor):
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::handleMouseDoubleClickEvent):
(WebCore::EventHandler::dispatchMouseEvent):
(WebCore::EventHandler::sendContextMenuEvent):
(WebCore::EventHandler::sendContextMenuEventForKey):
(WebCore::handleKeyboardSelectionMovement):
(WebCore::EventHandler::handleDrag):
* page/FocusController.cpp:
(WebCore::FocusController::setFocusedFrame):
(WebCore::FocusController::setFocused):
(WebCore::FocusController::advanceFocusInDocumentOrder):
(WebCore::clearSelectionIfNeeded):
(WebCore::FocusController::setActive):
* page/Frame.cpp:
(WebCore::Frame::dragImageForSelection):
* page/Frame.h:
(WebCore::Frame::selection):
* page/FrameView.cpp:
(WebCore::FrameView::performPostLayoutTasks):
(WebCore::FrameView::paintContentsForSnapshot):
* page/Page.cpp:
(WebCore::Page::findString):
(WebCore::Page::findStringMatchingRanges):
(WebCore::Page::selection):
* page/mac/FrameMac.mm:
(WebCore::Frame::dragImageForSelection):
* page/mac/FrameSnapshottingMac.mm:
(WebCore::selectionImage):
* page/win/FrameWin.cpp:
(WebCore::imageFromSelection):
(WebCore::Frame::dragImageForSelection):
* platform/ios/PasteboardIOS.mm:
(WebCore::Pasteboard::documentFragmentForPasteboardItemAtIndex):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::isSelected):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::paintCaret):
* rendering/RenderImage.cpp:
(WebCore::RenderImage::paintAreaElementFocusRing):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::scrollTo):
* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::paintItemForeground):
(WebCore::RenderListBox::paintItemBackground):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::selectionBackgroundColor):
(WebCore::RenderObject::selectionColor):
* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
* rendering/RenderTheme.cpp:
(WebCore::RenderTheme::isFocused):
* rendering/RenderThemeWin.cpp:
(WebCore::RenderThemeWin::adjustSearchFieldStyle):
* rendering/RenderTreeAsText.cpp:
(WebCore::writeSelection):
* rendering/RenderView.cpp:
(WebCore::RenderView::setSelection):
* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::deselectAll):
* svg/SVGTextContentElement.cpp:
(WebCore::SVGTextContentElement::selectSubString):
* testing/Internals.cpp:
(WebCore::Internals::absoluteCaretBounds):
(WebCore::Internals::selectionBounds):

Source/WebKit/blackberry:

* Api/InRegionScroller.cpp:
(BlackBerry::WebKit::InRegionScrollerPrivate::setLayerScrollPosition):
* WebKitSupport/DatePickerClient.cpp:
(BlackBerry::WebKit::DatePickerClient::setValueAndClosePopup):
* WebKitSupport/InPageSearchManager.cpp:
(BlackBerry::WebKit::InPageSearchManager::findNextString):
(BlackBerry::WebKit::InPageSearchManager::clearTextMatches):
* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::focusedNodeChanged):
(BlackBerry::WebKit::InputHandler::requestSpellingCheckingOptions):
(BlackBerry::WebKit::InputHandler::setElementUnfocused):
(BlackBerry::WebKit::InputHandler::setInputModeEnabled):
(BlackBerry::WebKit::InputHandler::setElementFocused):
(BlackBerry::WebKit::InputHandler::openDatePopup):
(BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
(BlackBerry::WebKit::InputHandler::selectionPosition):
(BlackBerry::WebKit::InputHandler::setSelection):
(BlackBerry::WebKit::InputHandler::deleteSelection):
(BlackBerry::WebKit::InputHandler::setRelativeCursorPosition):
* WebKitSupport/SelectionHandler.cpp:
(BlackBerry::WebKit::SelectionHandler::cancelSelection):
(BlackBerry::WebKit::SelectionHandler::shouldUpdateSelectionOrCaretForPoint):
(BlackBerry::WebKit::SelectionHandler::setCaretPosition):
(BlackBerry::WebKit::SelectionHandler::extendSelectionToFieldBoundary):
(BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
(BlackBerry::WebKit::SelectionHandler::setSelection):
(BlackBerry::WebKit::SelectionHandler::startCaretViewportRect):
(BlackBerry::WebKit::SelectionHandler::selectNextParagraph):
(BlackBerry::WebKit::SelectionHandler::expandSelectionToGranularity):
(BlackBerry::WebKit::SelectionHandler::selectObject):
(BlackBerry::WebKit::directionOfEnclosingBlock):
(BlackBerry::WebKit::SelectionHandler::selectionPositionChanged):
(BlackBerry::WebKit::SelectionHandler::notifyCaretPositionChangedIfNeeded):
(BlackBerry::WebKit::SelectionHandler::caretPositionChanged):
(BlackBerry::WebKit::SelectionHandler::selectionContains):
* WebKitSupport/SpellingHandler.cpp:
(BlackBerry::WebKit::SpellingHandler::spellCheckTextBlock):

Source/WebKit/efl:

* WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
(DumpRenderTreeSupportEfl::selectionRectangle):
(DumpRenderTreeSupportEfl::firstRectForCharacterRange):
(DumpRenderTreeSupportEfl::selectedRange):
* WebCoreSupport/EditorClientEfl.cpp:
(WebCore::EditorClientEfl::handleEditingKeyboardEvent):
* ewk/ewk_frame.cpp:
(ewk_frame_text_selection_type_get):

Source/WebKit/gtk:

* WebCoreSupport/ChromeClientGtk.cpp:
(WebKit::ChromeClient::paint):
* WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
(DumpRenderTreeSupportGtk::firstRectForCharacterRange):
(DumpRenderTreeSupportGtk::selectedRange):
(DumpRenderTreeSupportGtk::rectangleForSelection):
* WebCoreSupport/EditorClientGtk.cpp:
(WebKit::collapseSelection):
(WebKit::setSelectionPrimaryClipboardIfNeeded):
* webkit/webkitwebframe.cpp:
(webkit_web_frame_get_range_for_word_around_caret):
* webkit/webkitwebview.cpp:
(getLocationForKeyboardGeneratedContextMenu):

Source/WebKit/mac:

* Plugins/WebPluginController.mm:
* WebView/WebFrame.mm:
(-[WebFrame _hasSelection]):
(-[WebFrame _rangeByAlteringCurrentSelection:FrameSelection::direction:granularity:]):
(-[WebFrame _selectionGranularity]):
(-[WebFrame _convertToNSRange:]):
(-[WebFrame _convertToDOMRange:]):
(-[WebFrame _insertParagraphSeparatorInQuotedContent]):
(-[WebFrame _typingStyle]):
(-[WebFrame _selectedNSRange]):
(-[WebFrame _selectNSRange:]):
(-[WebFrame _replaceSelectionWithFragment:selectReplacement:smartReplace:matchStyle:]):
(-[WebFrame _replaceSelectionWithText:selectReplacement:smartReplace:]):
* WebView/WebHTMLRepresentation.mm:
(-[WebHTMLRepresentation currentForm]):
* WebView/WebHTMLView.mm:
(-[WebHTMLView readSelectionFromPasteboard:]):
(-[WebHTMLView _selectedRange]):
(-[WebHTMLView _hasSelection]):
(-[WebHTMLView _hasSelectionOrInsertionPoint]):
(-[WebHTMLView _hasInsertionPoint]):
(-[WebHTMLView _isEditable]):
(-[WebHTMLView jumpToSelection:]):
(-[WebHTMLView validateUserInterfaceItemWithoutDelegate:]):
(-[WebHTMLView maintainsInactiveSelection]):
(isTextInput):
(isInPasswordField):
(-[WebHTMLView centerSelectionInVisibleArea:]):
(-[WebHTMLView _canSmartCopyOrDelete]):
(-[WebHTMLView _lookUpInDictionaryFromMenu:]):
(-[WebHTMLView _updateSelectionForInputManager]):
(-[WebHTMLView selectionRect]):
(-[WebHTMLView selectionTextRects]):
(-[WebHTMLView selectionImageRect]):
(-[WebHTMLView selectAll]):
(-[WebHTMLView deselectAll]):
(-[WebHTMLView selectedAttributedString]):
* WebView/WebTextCompletionController.mm:
(-[WebTextCompletionController doCompletion]):
* WebView/WebView.mm:
(-[WebView setSelectedDOMRange:affinity:]):
(-[WebView selectedDOMRange]):
(-[WebView selectionAffinity]):
(-[WebView setEditable:]):
(-[WebView _selectionIsCaret]):
(-[WebView _selectionIsAll]):

Source/WebKit/qt:

* WebCoreSupport/DumpRenderTreeSupportQt.cpp:
(DumpRenderTreeSupportQt::selectedRange):
(DumpRenderTreeSupportQt::firstRectForCharacterRange):
* WebCoreSupport/EditorClientQt.cpp:
(WebCore::EditorClientQt::respondToChangedSelection):
(WebCore::EditorClientQt::handleKeyboardEvent):
* WebCoreSupport/QWebPageAdapter.cpp:
(QWebPageAdapter::hasSelection):
(QWebPageAdapter::selectedText):
(QWebPageAdapter::findText):
(QWebPageAdapter::inputMethodEvent):
(QWebPageAdapter::inputMethodQuery):

Source/WebKit/win:

* WebFrame.cpp:
(WebFrame::currentForm):
* WebView.cpp:
(WebView::updateFocusedAndActiveState):
(WebView::selectionRect):
(WebView::centerSelectionInVisibleArea):
(WebView::hasSelectedRange):
(WebView::replaceSelectionWithText):
(WebView::clearSelection):
(WebView::prepareCandidateWindow):
(WebView::onIMERequestCharPosition):
(WebView::onIMERequestReconvertString):
(WebView::firstRectForCharacterRangeForTesting):
(WebView::selectedRangeForTesting):

Source/WebKit/wince:

* WebCoreSupport/EditorClientWinCE.cpp:
(WebKit::EditorClientWinCE::handleEditingKeyboardEvent):

Source/WebKit2:

* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::updateGlobalSelection):
* WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
(WebKit::collapseSelection):
(WebKit::WebEditorClient::updateGlobalSelection):
* WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:
(WebKit::WebContextMenuClient::lookUpInDictionary):
(WebKit::WebContextMenuClient::searchWithSpotlight):
* WebProcess/WebPage/FindController.cpp:
(WebKit::frameWithSelection):
(WebKit::FindController::updateFindUIAfterPageScroll):
(WebKit::FindController::getFindIndicatorBitmapAndRect):
(WebKit::FindController::getImageForFindMatch):
(WebKit::FindController::selectFindMatch):
(WebKit::FindController::updateFindIndicator):
(WebKit::FindController::drawRect):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::editorState):
(WebKit::WebPage::scaledSnapshotWithOptions):
(WebKit::WebPage::centerSelectionInVisibleArea):
(WebKit::frameWithSelection):
(WebKit::WebPage::clearSelection):
(WebKit::WebPage::confirmComposition):
(WebKit::WebPage::setComposition):
(WebKit::WebPage::currentSelectionAsRange):
* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::setComposition):
(WebKit::WebPage::insertText):
(WebKit::WebPage::insertDictatedText):
(WebKit::WebPage::getMarkedRange):
(WebKit::WebPage::getSelectedRange):
(WebKit::WebPage::getAttributedSubstringFromRange):
(WebKit::WebPage::characterIndexForPoint):
(WebKit::convertToRange):
(WebKit::WebPage::performDictionaryLookupAtLocation):
(WebKit::WebPage::readSelectionFromPasteboard):
(WebKit::WebPage::getStringSelectionForPasteboard):
(WebKit::WebPage::getDataSelectionForPasteboard):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154286 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120008> [GTK][ARM] javascriptcore compilation is broken

Patch by Víctor Manuel Jáquez Leal <vjaquez@igalia.com> on 2013-08-19
Reviewed by Oliver Hunt.

Guard the compilation of these files only if DFG_JIT is enabled.

* dfg/DFGDesiredTransitions.cpp:
* dfg/DFGDesiredTransitions.h:
* dfg/DFGDesiredWeakReferences.cpp:
* dfg/DFGDesiredWeakReferences.h:
* dfg/DFGDesiredWriteBarriers.cpp:
* dfg/DFGDesiredWriteBarriers.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120013> Tighten up logic in HTMLTableRowsCollection

Reviewed by Andy Estes.

I was looking for incorrect uses of hasLocalName in places where hasTagName should be used.
The use in HTMLTableRowsCollection looked like that kind of mistake, but when I tried to
make a test case to show the mistake, I found I could not. So I wrote assertions to restate
what I learned, and removed an unneeded null check and tightened up the code a bit. This
should make code size slightly smaller.

* html/HTMLTableRowsCollection.cpp:
(WebCore::assertRowIsInTable): Added. Asserts that the row's position in the table is consistent
with the invariants of how the collection class works. A row that is processed here would have
to be an immediate child of the table, or an immediate child of a table section that in turn is
an immediate child of the table.
(WebCore::isInSection): Added. Replaces the three more-specific helper functions. Unlike those,
this does not do a null check.
(WebCore::HTMLTableRowsCollection::rowAfter): Changed to use the two new functions.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154288 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: !node || node->isShadowRoot() in WebCore::EventRetargeter::eventTargetRespectingTargetRules
https://bugs.webkit.org/show_bug.cgi?id=119720

Reviewed by Andy Estes.

Merge https://chromium.googlesource.com/chromium/blink/+/4ce9bfbf54410179cd0f18b3d1a912045fc0ec3d

* dom/EventRetargeter.h:
(WebCore::EventRetargeter::eventTargetRespectingTargetRules):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154289 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119860> Crash during exception unwinding

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Add an "Unreachable" NodeType, and then rearrange op_throw and op_throw_reference_error
to plant Throw or ThrowReferenceError followed by a flush and then the Unreachable node.

We need this so that Throw and ThrowReferenceError no longer need to be treated as
terminals and the subsequent flush keeps the activation (and other registers) live.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::isTerminal):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Add a test

* fast/js/dfg-activation-register-overwritten-in-throw-expected.txt: Added.
* fast/js/dfg-activation-register-overwritten-in-throw.html: Added.
* fast/js/script-tests/dfg-activation-register-overwritten-in-throw.js: Added.
(g):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154290 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120019> Document::visitedLinkState() should return a reference

Reviewed by Andreas Kling.

Document::m_visitedLinkState is never NULL so we can just return a reference. Also make it a const.

* css/StyleResolver.cpp:
(WebCore::StyleResolver::State::initElement):
* dom/Document.h:
(WebCore::Document::visitedLinkState):
* history/CachedPage.cpp:
(WebCore::CachedPage::restore):
* page/Page.cpp:
(WebCore::Page::allVisitedStateChanged):
(WebCore::Page::visitedStateChanged):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154291 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. Partial revert of r154283 which caused test failures on all Mac ports.

* platform/mac/accessibility/lists-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154292 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Skip these failing tests pending fix:
        
svg/custom/bug78807.svg
svg/custom/use-invalid-style.svg

* TestExpectations:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154293 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119905> [iOS] Upstream Source/WTF

Reviewed by Benjamin Poulain.

Upstream iOS WebKit Source/WTF.

* Configurations/Base.xcconfig:
JavaScriptCore.framework is a public framework.

* wtf/Assertions.h:
Define an export macro for iOS projects just including <wtf/Assertions.h>.

* wtf/Platform.h:
* wtf/FeatureDefines.h:
iOS ENABLE and USE defines.

* wtf/MainThread.h:
* wtf/mac/MainThreadMac.mm:
(WTF::initializeApplicationUIThreadIdentifier):
(WTF::initializeWebThreadIdentifier):
(WTF::canAccessThreadLocalDataForThread):
* wtf/WeakPtr.h:
(WTF::WeakReference::get):
(WTF::WeakReference::clear):
Shared WebThread and MainThread access to thread local data.

* wtf/WTFThreadData.cpp:
(WTF::WTFThreadData::WTFThreadData):
Shared WebThread and MainThread identifier tables.

* wtf/ThreadSpecific.h:
(WTF::::replace):
Used later on so that WebThread can share the MainThread's thread global data.

* wtf/text/StringStatics.cpp:
(WTF::AtomicString::init):
When USE(WEB_THREAD) assert AtomicString::init is initialized on the realMainThread.

* wtf/unicode/CharacterNames.h:
* wtf/unicode/icu/UnicodeIcu.h:
(WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic):
Minor iOS constants and functions used later by WebCore.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154294 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://bugs.webkit.org/show_bug.cgi?id=120025> REGRESSION (r154254): fast/frames/frameset-frameborder-inheritance.html failing on Apple MountainLion Debug WK1 (Tests)

Unreviewed gardening. Add failing test to TestExpectations.

* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154295 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119934> Remove a repeated "private:" from ElementRuleCollector

Reviewed by Darin Adler.

* css/ElementRuleCollector.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154296 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119937> Remove ElementRuleCollector's m_behaviorAtBoundary

Reviewed by Darin Adler.

The value DoesNotCrossBoundary is the default behavior boundary of SelectorChecker,
and it is never changed by ElementRuleCollector.

* css/ElementRuleCollector.cpp:
(WebCore::ElementRuleCollector::collectMatchingRules):
(WebCore::ElementRuleCollector::ruleMatches):
* css/ElementRuleCollector.h:
(WebCore::ElementRuleCollector::ElementRuleCollector):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154297 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=120020 Change Set 154207 causes wrong register to be used for 32 bit tests

Reviewed by Benjamin Poulain.

Change branshTest32 to only use the byte for 8 bit test on the lower 4 registers.
Registers 4 through 7 as byte regisers are ah, ch, dh and bh instead of sp, bp, si and di.

* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::branchTest32):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154298 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119936> Fix some encapsulation issues of RuleSet

Reviewed by Darin Adler.

None of the attributes of RuleSet should be modified directly.

* css/DocumentRuleSets.cpp:
(WebCore::DocumentRuleSets::initUserStyle):
* css/ElementRuleCollector.cpp:
(WebCore::ElementRuleCollector::collectMatchingRulesForRegion):
* css/RuleSet.h:
(WebCore::RuleSet::RuleSetSelectorPair::RuleSetSelectorPair):
(WebCore::RuleSet::regionSelectorsAndRuleSets):
(WebCore::RuleSet::ruleCount):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::checkRegionStyle):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154299 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=119995
Start removing custom implementations of getOwnPropertyDescriptor

Reviewed by Sam Weinig.

This can now typically implemented in terms of getOwnPropertySlot.
Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
Switch over most classes in JSC & the WebCore bindings generator to use this.

Source/JavaScriptCore: 

* API/JSCallbackObjectFunctions.h:
* debugger/DebuggerActivation.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSArrayBuffer.cpp:
* runtime/JSArrayBufferView.cpp:
* runtime/JSCell.cpp:
* runtime/JSDataView.cpp:
* runtime/JSDataViewPrototype.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGenericTypedArrayViewInlines.h:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/NamePrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* runtime/PropertyDescriptor.h:
    - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
* runtime/PropertySlot.h:
(JSC::PropertySlot::isValue):
(JSC::PropertySlot::isGetter):
(JSC::PropertySlot::isCustom):
(JSC::PropertySlot::isCacheableValue):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::attributes):
(JSC::PropertySlot::getterSetter):
    - Add accessors necessary to convert PropertySlot to descriptor.
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpMatchesArray.h:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.

Source/WebCore: 

* bindings/js/JSCSSStyleDeclarationCustom.cpp:
* bindings/js/JSHTMLAppletElementCustom.cpp:
* bindings/js/JSHTMLEmbedElementCustom.cpp:
* bindings/js/JSHTMLObjectElementCustom.cpp:
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::getOwnPropertySlotDelegate):
* bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertySlotDelegate):
* bindings/js/JSWorkerGlobalScopeCustom.cpp:
    - Remove getOwnPropertyDescriptorDelegate methods,
      Change attributes of cross-frame access properties in JSHistory/JSLocation to prevent properties from being redefined.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
* bindings/scripts/test/JS/JSTestException.cpp:
* bindings/scripts/test/JS/JSTestInterface.cpp:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
* bindings/scripts/test/JS/JSTestNode.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
    - Update test expectations.

LayoutTests: 

* http/tests/security/xss-DENIED-defineProperty-expected.txt:
    - Remove erroneous error messages - cross frame access to reload is allowed - it's just read-only, non-configurable.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=119915
REGRESSION(r154144): ASSERTION FAILED: m_history->provisionalItem() == m_requestedHistoryItem.get()

Reviewed by Darin Adler.

Tools:

The issue was that we ended up having no CFNetwork cache in the testing session due
to an incorrect cache model. There is a number of things not implemented when it
comes to dynamically changing cache model as attempted by WebKitTestRunner, but
the easiest way to get this going is to initialize it to correct value upfront.

* WebKitTestRunner/TestController.cpp: (WTR::TestController::initialize):

LayoutTests:

* platform/mac-wk2/TestExpectations: Unskipping the failing test.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154301 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120027> AXObjectCache's 
accessibilityEnhancedUserInterfaceEnabled should be initialized on process 
creation

Reviewed by Sam Weinig.

Right now we only call AXObjectCache::setEnhancedAccessibility() when AppKit sends 
us a notification indicating that the value has changed. We should not have to 
rely on that to properly initialize this value. It should be done with the 
WebProcessCreationParamters. 

* Shared/WebProcessCreationParameters.cpp:
(WebKit::WebProcessCreationParameters::encode):
(WebKit::WebProcessCreationParameters::decode):
* Shared/WebProcessCreationParameters.h:
* UIProcess/mac/WebContextMac.mm:
(WebKit::WebContext::platformInitializeWebProcess):
* WebProcess/mac/WebProcessMac.mm:
(WebKit::WebProcess::platformInitializeWebProcess):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154302 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=119995
Start removing custom implementations of getOwnPropertyDescriptor

Patch by Gavin Barraclough <barraclough@apple.com> on 2013-08-18
Reviewed by Oliver Hunt.

This can now typically implemented in terms of getOwnPropertySlot.
Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
Switch over most classes in JSC & the WebCore bindings generator to use this.

* API/JSCallbackObjectFunctions.h:
* debugger/DebuggerActivation.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSArrayBuffer.cpp:
* runtime/JSArrayBufferView.cpp:
* runtime/JSCell.cpp:
* runtime/JSDataView.cpp:
* runtime/JSDataViewPrototype.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGenericTypedArrayViewInlines.h:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/NamePrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* runtime/PropertyDescriptor.h:
    - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
* runtime/PropertySlot.h:
(JSC::PropertySlot::isValue):
(JSC::PropertySlot::isGetter):
(JSC::PropertySlot::isCustom):
(JSC::PropertySlot::isCacheableValue):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::attributes):
(JSC::PropertySlot::getterSetter):
    - Add accessors necessary to convert PropertySlot to descriptor.
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpMatchesArray.h:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154303 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119994> DFG new Array() inlining could get confused about global objects

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):

LayoutTests: 

* fast/js/dfg-cross-global-object-new-array.html: Added.
* fast/js/dfg-cross-global-object-new-array-expected.txt: Added.
* fast/js/script-tests/dfg-cross-global-object-new-array.js: Added.
(foo):
(runTest):
(doit):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154304 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should inline typedArray.byteOffset
https://bugs.webkit.org/show_bug.cgi?id=119962

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
This adds a new node, GetTypedArrayByteOffset, which inlines
typedArray.byteOffset.
        
Also, I improved a bunch of the clobbering logic related to typed arrays
and clobbering in general. For example, PutByOffset/PutStructure are not
clobber-world so they can be handled by most default cases in CSE. Also,
It's better to use the 'Class_field' notation for typed arrays now that
they no longer involve magical descriptor thingies.

* bytecode/SpeculatedType.h:
* dfg/DFGAbstractHeap.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGArrayMode.h:
(JSC::DFG::neverNeedsStorage):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::getByOffsetLoadElimination):
(JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::checkArrayElimination):
(JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
(JSC::DFG::FixupPhase::convertToGetArrayLength):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
* runtime/ArrayBuffer.h:
(JSC::ArrayBuffer::offsetOfData):
* runtime/Butterfly.h:
(JSC::Butterfly::offsetOfArrayBuffer):
* runtime/IndexingHeader.h:
(JSC::IndexingHeader::offsetOfArrayBuffer):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/dfg-byteOffset-neuter.html: Added.
* fast/js/dfg-byteOffset-neuter-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int32Array-byteOffset-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int32Array-byteOffset.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-Int32Array-byteOffset.js: Added.
* fast/js/script-tests/dfg-byteOffset-neuter.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154305 268f45cc-cd09-0410-ab3c-d52691b4dbfc