[GTK] Include a crash-fixing patch for the at-spi2-atk dependency
https://bugs.webkit.org/show_bug.cgi?id=114365

Reviewed by Martin Robinson.

Add a patch for the at-spi2-atk 2.8.0 dependency that is applied through the Jhbuild setup.
The patch addresses crashes in the tally_event_reply method. It is already committed into the
at-spi2-atk source tree and will be available with the next stable release, after which the
patch should be removed and the dependency version bumped.

* gtk/jhbuild.modules:
* gtk/patches/at-spi2-atk-2.8.0-null-check-after-cleanup.patch: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148110 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use minimal tiles during live resize
https://bugs.webkit.org/show_bug.cgi?id=114364

Reviewed by Darin Adler.

We currently update non-visible speculative tiles during resizing. We should just drop them.

* page/FrameView.cpp:
(WebCore::FrameView::willStartLiveResize):
(WebCore::FrameView::willEndLiveResize):
* page/FrameView.h:
* rendering/RenderLayerBacking.cpp:
(WebCore::computeTileCoverage):
        
    Use minimal coverage in live resize state.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148111 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/13617104> WKPageCopySessionState needs to provide more context to the filter callback

Introduce a new value type for WKPageSessionStateFilterCallback that represents the passing
of whole WKBackForwardListItemRefs to the filter callback. This allows clients to consider
more than the original URL of the item when filtering entries from the session state.

Reviewed by Darin Adler.

* UIProcess/API/C/WKPage.cpp:
(WKPageGetSessionBackForwardListItemValueType): Return a static string representing our new value type.
* UIProcess/API/C/WKPage.h:
* UIProcess/cf/WebBackForwardListCF.cpp:
(WebKit::WebBackForwardList::createCFDictionaryRepresentation): Call the filter function with each of the
possible value types in turn, respecting the first false value, if any, that is returned.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148112 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/13617144> WKNavigationData needs to expose the destination of the navigation

Introduce WKNavigationDataCopyNavigationDestinationURL to access the destination of the navigation.

Reviewed by Darin Adler.

* UIProcess/API/C/WKNavigationData.cpp:
(WKNavigationDataCopyURL): Add a note about returning the URL from the original request for sake of
backwards-compatibility.
(WKNavigationDataCopyNavigationDestinationURL): Return the URL from our underlying WebNavigationDataStore.
* UIProcess/API/C/WKNavigationData.h:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::updateGlobalHistory): Store the current URL in to the WebNavigationDataStore
object. WKNavigationData can retrieve the value that we were previously storing here via the originalRequest.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148113 268f45cc-cd09-0410-ab3c-d52691b4dbfc
I should know better than to lie in ChangeLog entries.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148114 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Texmap] In certain situations nested blending with overflow:hidden displays clipped results
https://bugs.webkit.org/show_bug.cgi?id=114290

Patch by Noam Rosenthal <noam@webkit.org> on 2013-04-10
Reviewed by Allan Sandfeld Jensen.

Source/WebCore:

Always apply the clip when binding a surface, even if it hasn't changed.
Otherwise when binding a nested surface and rebinding its container surface,
the clip wouldn't apply.

Test: compositing/overlap-blending/nested-overlap-overflow.html

* platform/graphics/texmap/TextureMapperGL.cpp:
(WebCore::BitmapTextureGL::bind):

LayoutTests:

Added a ref-test that exposes an issue with TextureMapper overlap blending when composited.
This ref-test does not show correct results on Mac, skipped in TestExpectations and created a bug.

* compositing/overlap-blending/nested-overlap-overflow-expected.html: Added.
* compositing/overlap-blending/nested-overlap-overflow.html: Added.
* platform/mac/TestExpectations: Skipped new tests and created bug.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148115 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Layers with opacity and blur filters are reported as opaque to the compositor
https://bugs.webkit.org/show_bug.cgi?id=114295

Reviewed by Simon Fraser.

Source/WebCore:

Test: compositing/contents-opaque/filter.html

Some filters like opacity and blur might still trigger transparency in the layer, even though the
background is opaque. I've added the special case in RenderLayer::backgroundIsKnownToBeOpaqueInRect to check
for filters that might have transparency. Note that this special case is required only for software drawn
filters, as the transparency is going to be backed in the GraphicsLayer content. Composited filters can
figure it out in the compositor.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):

LayoutTests:

Added test to check for blur and opacity filters drawn in software mode which needs
to force the layer report non-opaque to the compositor.

* compositing/contents-opaque/filter-expected.txt: Added.
* compositing/contents-opaque/filter.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148117 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Replace ENABLE_JAVASCRIPT_DEBUGGER preprocessor statements in IDL files with Conditional attribute
https://bugs.webkit.org/show_bug.cgi?id=114352

Reviewed by Timothy Hatcher.

The Conditional attribute does not need a preprocessor, which is source of much pain on native windows.

* page/Console.idl:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148118 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removed bitrotted TimeoutChecker code
https://bugs.webkit.org/show_bug.cgi?id=114336

Reviewed by Alexey Proskuryakov.

../JavaScriptCore: 

This mechanism hasn't worked for a while.

MarkL is working on a new version of this feature with a distinct
implementation.

* API/APIShims.h:
(JSC::APIEntryShim::~APIEntryShim):
(JSC::APIEntryShim::init):
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* dfg/DFGGPRInfo.h:
* jit/JIT.cpp:
* jit/JIT.h:
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/JSInterfaceJIT.h:
(JSInterfaceJIT):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
* runtime/JSGlobalData.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSONObject.cpp:
(JSC::Stringifier::appendStringifiedValue):
(JSC::Walker::walk):
* runtime/TimeoutChecker.cpp: Removed.
* runtime/TimeoutChecker.h: Removed.

../WebCore: 

This mechanism hasn't worked for a while.

MarkL is working on a new version of this feature with a distinct
implementation.

* bindings/js/JSCallbackData.cpp:
(WebCore::JSCallbackData::invokeCallback):
* bindings/js/JSCustomXPathNSResolver.cpp:
(WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::commonJSGlobalData):
* bindings/js/JSErrorHandler.cpp:
(WebCore::JSErrorHandler::handleEvent):
* bindings/js/JSEventListener.cpp:
(WebCore::JSEventListener::handleEvent):
* bindings/js/JSMutationCallback.cpp:
(WebCore::JSMutationCallback::call):
* bindings/js/ScheduledAction.cpp:
(WebCore::ScheduledAction::executeFunctionInContext):
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::evaluateInWorld):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneBase::CloneBase):
(WebCore::CloneSerializer::serialize):
(WebCore::CloneDeserializer::deserialize):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::evaluate):
* bindings/objc/WebScriptObject.mm:
(-[WebScriptObject callWebScriptMethod:withArguments:]):
(-[WebScriptObject evaluateWebScript:]):

../WebKit/blackberry: 

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPage::setTimeoutForJavaScriptExecution):

../WebKit/mac: 

This mechanism hasn't worked for a while.

MarkL is working on a new version of this feature with a distinct
implementation.

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::evaluate):

../WebKit/qt: 

* WebCoreSupport/FrameLoaderClientQt.cpp:
(WebCore::FrameLoaderClientQt::createDocumentLoader):

../WebKit2: 

This mechanism hasn't worked for a while.

MarkL is working on a new version of this feature with a distinct
implementation.

* WebProcess/Plugins/Netscape/NPJSObject.cpp:
(WebKit::NPJSObject::construct):
(WebKit::NPJSObject::invoke):
* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::evaluate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148119 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] Increasing padding does not correctly layout child blocks
https://bugs.webkit.org/show_bug.cgi?id=112929

Reviewed by David Hyatt.

If a child block has changed dimension inside a shape and it has affected the block siblings
we need to relayout the content inside the shape.

Source/WebCore:

Test: fast/exclusions/shape-inside/shape-inside-sibling-block-dimension-change-needs-relayout.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout): Add condition for dimension change.
(WebCore::RenderBlock::layoutBlock): Call updateRegionsAndExclusionsAfterChildLayout with the new parameter.
* rendering/RenderBlock.h:
(RenderBlock): Add extra parameter to updateRegionsAndExclusionsAfterChildLayout(...)

LayoutTests:

* fast/exclusions/shape-inside/shape-inside-sibling-block-dimension-change-needs-relayout-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-sibling-block-dimension-change-needs-relayout.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148120 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Empty inline continuations should only get lineboxes if the padding applies to their side of the inline
https://bugs.webkit.org/show_bug.cgi?id=113896

Reviewed by David Hyatt.

Source/WebCore:

Test: fast/inline/inline-with-empty-inline-continuations.html

Where an empty inline is split across anonymous blocks we should only give lineboxes to the 'sides' of the
inline that have borders, padding or margin.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::shouldApplyStartBorderPaddingOrMargin):
(WebCore):
(WebCore::shouldApplyEndBorderPaddingOrMargin):
(WebCore::hasInlineDirectionBordersPaddingOrMargin):
(WebCore::alwaysRequiresLineBox):

LayoutTests:

* fast/inline/inline-with-empty-inline-continuations-expected.txt: Added.
* fast/inline/inline-with-empty-inline-continuations.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148121 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Minor code cleanup in AnimationBase::progress
https://bugs.webkit.org/show_bug.cgi?id=114371

Reviewed by Dean Jackson.

Convert some "return; else if" to just "return; if".

* page/animation/AnimationBase.cpp:
(WebCore::AnimationBase::progress):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148122 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unneeded headers from FrameLoader.h
https://bugs.webkit.org/show_bug.cgi?id=114223

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Update for WTF changes.

* bytecode/SpeculatedType.h:
* runtime/JSCJSValue.h:

Source/WebCore:

Remove unneeded headers from FrameLoader.h and add them back into the respective .cpp files where needed.

* dom/Document.cpp:
* history/CachedFrame.cpp:
* history/PageCache.cpp:
* inspector/InspectorResourceAgent.cpp:
* loader/DocumentLoader.cpp:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::FrameLoader):
(WebCore::FrameLoader::retryAfterFailedCacheOnlyMainResourceLoad):
* loader/FrameLoader.h:
(WebCore):
(WebCore::FrameLoader::policyChecker):
(WebCore::FrameLoader::history):
(WebCore::FrameLoader::icon):
* loader/MixedContentChecker.h:
* loader/icon/IconLoader.cpp:
* page/History.cpp:
* page/Page.cpp:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
* testing/Internals.cpp:

Source/WebKit/blackberry:

Include HistoryController.h from WebCore.

* WebCoreSupport/FrameLoaderClientBlackBerry.cpp:

Source/WebKit/mac:

Include HistoryController.h from WebCore.

* WebCoreSupport/WebFrameLoaderClient.mm:
* WebView/WebView.mm:

Source/WebKit/win:

Include HistoryController.h from WebCore.

* WebView.cpp:

Source/WebKit2:

Include HistoryController.h from WebCore.

* WebProcess/Plugins/PDF/SimplePDFPlugin.h:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebPage/WebPage.cpp:

Source/WTF:

* wtf/Forward.h:
Add PrintStream.

* wtf/HashTable.h:
Don't include DataLog.h unless DUMP_HASHTABLE_STATS_PER_TABLE is 1.

Tools:

Add back headers implicitly included by other headers.

* WebKitTestRunner/WorkQueueManager.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148123 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refactor Editor::markAndReplaceFor before fixing autocorrection bugs
https://bugs.webkit.org/show_bug.cgi?id=114344

Reviewed by Enrica Casucci.

This patch refactors Editor::markAndReplaceFor so that we can start fixing bugs in a sane state.
Extracted isAutomaticTextReplacementType and correctSpellcheckingPreservingTextCheckingParagraph,
and made convenience local variables const.

In particular, shouldMarkSpelling used to be assigned of false when shouldShowCorrectionPanel was true
in a middle of a function but this was removed in favor of explicitly checking this condition later
since shouldMarkSpelling was only referenced once after the assignment.

* editing/Editor.cpp:
(WebCore::isAutomaticTextReplacementType): Extracted.

(WebCore::correctSpellcheckingPreservingTextCheckingParagraph): Extracted.  Used highestAncestor
and rangeFromLocationAndLength to match the rest of the up-to-date editing code.

(WebCore::Editor::markAndReplaceFor): See above.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148124 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fixed build failure in Plugin.h: FloatPoint was not in namespace WebCore

make[1]: *** Waiting for unfinished jobs....
In file included from Source/WebKit2/PluginProcess/PluginCreationParameters.h:31:0,
                 from Source/WebKit2/PluginProcess/PluginCreationParameters.cpp:27:
./Source/WebKit2/WebProcess/Plugins/Plugin.h:268:58: error: 'FloatPoint' in namespace 'WebCore' does not name a type
./Source/WebKit2/WebProcess/Plugins/Plugin.h:268:77: error: ISO C++ forbids declaration of 'parameter' with no type [-fpermissive]
cc1plus: warning: unrecognized command line option "-Wno-c++11-extensions" [enabled by default]
make[1]: *** [Source/WebKit2/PluginProcess/libwebkit2gtk_3_0_la-PluginCreationParameters.lo] Error 1

It now passes that make target.

https://bugs.webkit.org/show_bug.cgi?id=111862

Patch by Tobias Mueller <tobiasmue@gnome.org> on 2013-04-10
Reviewed by Darin Adler.

* WebProcess/Plugins/Plugin.h:
(WebCore): Added FloatPoint to the WebCore namespace

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148125 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Fix regression to test-webkitpy.
https://bugs.webkit.org/show_bug.cgi?id=114368

Reviewed by Ryosuke Niwa.

* Scripts/webkitpy/layout_tests/port/factory.py:
(PortFactory._default_port): Return qt-linux instead of chromium-linux as default port for linux/freebsd.
(PortFactory.get): Remove obsolete chromium port related code.
* Scripts/webkitpy/layout_tests/port/mac.py:
(MacPort.default_child_processes): Prevent type error if can't determine total memory.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148126 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WinCairo build fails to link.
https://bugs.webkit.org/show_bug.cgi?id=114358

Patch by peavo@outlook.com <peavo@outlook.com> on 2013-04-10
Reviewed by Brent Fulgham.

Export the symbol WTF::MD5::checksum().

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
* JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148127 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Disallow programmatic movement of the browser window while user gestures are in progress.
<http://webkit.org/b/114271>
<rdar://problem/13226530>

Reviewed by Oliver Hunt.

* page/DOMWindow.cpp:
(WebCore::DOMWindow::moveBy):
(WebCore::DOMWindow::moveTo):
(WebCore::DOMWindow::resizeBy):
(WebCore::DOMWindow::resizeTo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148128 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Rename BlackBerry specific Texture class
https://bugs.webkit.org/show_bug.cgi?id=95781

Reviewed by Rob Buis.

Texture was a bit too generic and prone to name conflicts. Renamed it
to LayerTexture.

Source/WebCore:

No change in behavior, no new tests.

PR 322882

* PlatformBlackBerry.cmake:
* platform/graphics/blackberry/LayerCompositingThread.cpp:
(WebCore::LayerCompositingThread::drawSurface):
(WebCore::LayerCompositingThread::contentsTexture):
* platform/graphics/blackberry/LayerCompositingThread.h:
(LayerCompositingThread):
* platform/graphics/blackberry/LayerCompositingThreadClient.h:
(WebCore):
(WebCore::LayerCompositingThreadClient::contentsTexture):
* platform/graphics/blackberry/LayerFilterRenderer.cpp:
(WebCore::LayerFilterRenderer::applyActions):
* platform/graphics/blackberry/LayerFilterRenderer.h:
(LayerFilterRenderer):
* platform/graphics/blackberry/LayerRendererSurface.h:
(WebCore::LayerRendererSurface::texture):
(LayerRendererSurface):
* platform/graphics/blackberry/LayerTexture.cpp: Renamed from Source/WebCore/platform/graphics/blackberry/Texture.cpp.
(WebCore):
(WebCore::LayerTexture::LayerTexture):
(WebCore::LayerTexture::~LayerTexture):
(WebCore::LayerTexture::updateContents):
(WebCore::LayerTexture::setContentsToColor):
(WebCore::LayerTexture::protect):
* platform/graphics/blackberry/LayerTexture.h: Renamed from Source/WebCore/platform/graphics/blackberry/Texture.h.
(WebCore):
(LayerTexture):
(WebCore::LayerTexture::create):
(WebCore::LayerTexture::textureId):
(WebCore::LayerTexture::isDirty):
(WebCore::LayerTexture::hasTexture):
(WebCore::LayerTexture::isColor):
(WebCore::LayerTexture::isOpaque):
(WebCore::LayerTexture::isProtected):
(WebCore::LayerTexture::protect):
(WebCore::LayerTexture::unprotect):
(WebCore::LayerTexture::size):
(WebCore::LayerTexture::width):
(WebCore::LayerTexture::height):
(WebCore::LayerTexture::bytesPerPixel):
(WebCore::LayerTexture::sizeInBytes):
(WebCore::LayerTexture::setTextureId):
(WebCore::LayerTexture::setSize):
* platform/graphics/blackberry/LayerTile.cpp:
(WebCore::LayerTile::setContents):
(WebCore::LayerTile::updateContents):
(WebCore::LayerTile::setTexture):
* platform/graphics/blackberry/LayerTile.h:
(WebCore::LayerTile::texture):
(LayerTile):
* platform/graphics/blackberry/LayerTiler.cpp:
(WebCore::LayerTiler::drawTile):
(WebCore::LayerTiler::contentsTexture):
* platform/graphics/blackberry/LayerTiler.h:
(LayerTiler):
(WebCore::LayerTiler::TextureJob::TextureJob):
(WebCore::LayerTiler::TextureJob::setContents):
(WebCore::LayerTiler::TextureJob::updateContents):
(TextureJob):
* platform/graphics/blackberry/TextureCacheCompositingThread.cpp:
(WebCore::TextureProtector::TextureProtector):
(TextureProtector):
(WebCore::TextureCacheCompositingThread::allocateTextureId):
(WebCore::freeTextureId):
(WebCore::TextureCacheCompositingThread::textureResized):
(WebCore::TextureCacheCompositingThread::textureSizeInBytesChanged):
(WebCore::TextureCacheCompositingThread::textureDestroyed):
(WebCore::TextureCacheCompositingThread::install):
(WebCore::TextureCacheCompositingThread::resizeTexture):
(WebCore::TextureCacheCompositingThread::evict):
(WebCore::TextureCacheCompositingThread::textureAccessed):
(WebCore::TextureCacheCompositingThread::prune):
(WebCore::TextureCacheCompositingThread::textureForTiledContents):
(WebCore::TextureCacheCompositingThread::textureForColor):
(WebCore::TextureCacheCompositingThread::updateContents):
* platform/graphics/blackberry/TextureCacheCompositingThread.h:
(WebCore::TextureCacheCompositingThread::createTexture):
(TextureCacheCompositingThread):
(WebCore::TextureCacheCompositingThread::ZombieTexture::ZombieTexture):
(ZombieTexture):

Source/WebKit/blackberry:

PR 322882

* Api/WebOverlay.cpp:
(BlackBerry::WebKit::WebOverlayLayerCompositingThreadClient::uploadTexturesIfNeeded):
* Api/WebOverlay_p.h:
(WebOverlayLayerCompositingThreadClient):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148129 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG: Negative size for new Array() interpreted as large unsigned int
https://bugs.webkit.org/show_bug.cgi?id=114366

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

Added new check in operationNewArrayWithSize() for a negative
size.  If size is negative throw a "RangeError: Array size is not a
small enough positive integer" exception.

* dfg/DFGOperations.cpp:

LayoutTests:

New test to make sure DFG generated code for new Array() with a
computed negative size throws an exception.

* fast/js/dfg-negative-array-size-expected.txt: Added.
* fast/js/dfg-negative-array-size.html: Added.
* fast/js/script-tests/dfg-negative-array-size.js: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148130 268f45cc-cd09-0410-ab3c-d52691b4dbfc