https://bugs.webkit.org/show_bug.cgi?id=119995
Start removing custom implementations of getOwnPropertyDescriptor

Patch by Gavin Barraclough <barraclough@apple.com> on 2013-08-18
Reviewed by Oliver Hunt.

This can now typically implemented in terms of getOwnPropertySlot.
Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
Switch over most classes in JSC & the WebCore bindings generator to use this.

* API/JSCallbackObjectFunctions.h:
* debugger/DebuggerActivation.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSArrayBuffer.cpp:
* runtime/JSArrayBufferView.cpp:
* runtime/JSCell.cpp:
* runtime/JSDataView.cpp:
* runtime/JSDataViewPrototype.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGenericTypedArrayViewInlines.h:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/NamePrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* runtime/PropertyDescriptor.h:
    - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
* runtime/PropertySlot.h:
(JSC::PropertySlot::isValue):
(JSC::PropertySlot::isGetter):
(JSC::PropertySlot::isCustom):
(JSC::PropertySlot::isCacheableValue):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::attributes):
(JSC::PropertySlot::getterSetter):
    - Add accessors necessary to convert PropertySlot to descriptor.
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpMatchesArray.h:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154303 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119994> DFG new Array() inlining could get confused about global objects

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):

LayoutTests: 

* fast/js/dfg-cross-global-object-new-array.html: Added.
* fast/js/dfg-cross-global-object-new-array-expected.txt: Added.
* fast/js/script-tests/dfg-cross-global-object-new-array.js: Added.
(foo):
(runTest):
(doit):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154304 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should inline typedArray.byteOffset
https://bugs.webkit.org/show_bug.cgi?id=119962

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
This adds a new node, GetTypedArrayByteOffset, which inlines
typedArray.byteOffset.
        
Also, I improved a bunch of the clobbering logic related to typed arrays
and clobbering in general. For example, PutByOffset/PutStructure are not
clobber-world so they can be handled by most default cases in CSE. Also,
It's better to use the 'Class_field' notation for typed arrays now that
they no longer involve magical descriptor thingies.

* bytecode/SpeculatedType.h:
* dfg/DFGAbstractHeap.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGArrayMode.h:
(JSC::DFG::neverNeedsStorage):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::getByOffsetLoadElimination):
(JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::checkArrayElimination):
(JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
(JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
(JSC::DFG::FixupPhase::convertToGetArrayLength):
(JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
* runtime/ArrayBuffer.h:
(JSC::ArrayBuffer::offsetOfData):
* runtime/Butterfly.h:
(JSC::Butterfly::offsetOfArrayBuffer):
* runtime/IndexingHeader.h:
(JSC::IndexingHeader::offsetOfArrayBuffer):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/dfg-byteOffset-neuter.html: Added.
* fast/js/dfg-byteOffset-neuter-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int32Array-byteOffset-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int32Array-byteOffset.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-Int32Array-byteOffset.js: Added.
* fast/js/script-tests/dfg-byteOffset-neuter.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154305 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=120028
ASSERTION FAILED: m_history->provisionalItem() == m_requestedHistoryItem.get()
when navigating to an uncached subframe

Reviewed by Brady Eidson.

Source/WebCore:

Test: http/tests/navigation/post-frames-goback1-uncached.html

* loader/FrameLoader.cpp: (WebCore::FrameLoader::loadURLIntoChildFrame):
Set m_requestedHistoryItem in a code path that doesn't go through FrameLoader::loadItem.

* loader/HistoryController.cpp: (WebCore::HistoryController::restoreDocumentState):
Now that we always set m_requestedHistoryItem, there is no need to traverse frame
tree to see if this document is being loaded as part of b/f navigation (which was
add in bug 90870).

LayoutTests:

Added a nearly identical version of http/tests/navigation/post-frames-goback1.html
that checks what happens when navigating back to an uncached main resource.

* http/tests/navigation/post-frames-goback1-uncached-expected.txt: Added.
* http/tests/navigation/post-frames-goback1-uncached.html: Copied from LayoutTests/http/tests/navigation/post-frames-goback1.html.
* http/tests/navigation/resources/form-target-uncached.pl: Copied from LayoutTests/http/tests/navigation/resources/form-target.pl.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154306 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120036> [iOS] Upstream Source/WTF Xcode project for iOS

Reviewed by David Kilzer.

Include iOS only WebCoreThread.* files in an ios group, and clean up
the included files a bit.

* WTF.xcodeproj/project.pbxproj:
* wtf/ios/WebCoreThread.cpp:
* wtf/ios/WebCoreThread.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154307 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/119930> input[type=range]: Fix a crash by changing input type in 'input' event handler

Reviewed by Kent Tamura.

Source/WebCore:

Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5

In SliderThumbElement::setPositionFromPoint, renderer() can be NULL after HTMLInputElement::setValueFromRenderer,
which dispatches 'input' event. Also, make a local vairable 'input' a RefPtr just in case.

Also add null-poinetr checks for the host element as SliderThumbElement only weakly holds onto the host element.

Test: fast/forms/range/range-type-change-oninput.html

* html/shadow/SliderThumbElement.cpp:
(WebCore::SliderThumbElement::isDisabledFormControl):
(WebCore::SliderThumbElement::matchesReadOnlyPseudoClass):
(WebCore::SliderThumbElement::matchesReadWritePseudoClass):
(WebCore::SliderThumbElement::setPositionFromPoint):
(WebCore::SliderThumbElement::hostInput):

LayoutTests:

Add a regresion test from https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5

* fast/forms/range/range-type-change-oninput-expected.txt: Added.
* fast/forms/range/range-type-change-oninput.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154308 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add diagram of JSVirtualMachine memory management architecture.
Merge branch 'master' into javascriptcore_jsexport_api