<https://webkit.org/b/120165> Web Inspector: Update CodeMirror to 3.16.1

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-08-22
Reviewed by Andy Estes.

* Tools/PrettyPrinting/codemirror.css:
* Tools/PrettyPrinting/codemirror.js:
* Tools/PrettyPrinting/css.js:
* Tools/PrettyPrinting/javascript.js:
* UserInterface/External/CodeMirror/codemirror.css:
* UserInterface/External/CodeMirror/codemirror.js:
* UserInterface/External/CodeMirror/css.js:
* UserInterface/External/CodeMirror/javascript.js:
* UserInterface/External/CodeMirror/xml.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154456 268f45cc-cd09-0410-ab3c-d52691b4dbfc
errorDescriptionForValue() should not assume error value is an Object
https://bugs.webkit.org/show_bug.cgi?id=119812

Patch by Chris Curtis <chris_curtis@apple.com> on 2013-08-22
Reviewed by Geoffrey Garen.

Added a check to make sure that the JSValue was an object before casting it as an object. Also, in case the parameterized JSValue
has no type, the function now returns the empty string.
* runtime/ExceptionHelpers.cpp:
(JSC::errorDescriptionForValue):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154457 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FrameLoader::history() should return a reference.
<https://webkit.org/b/120163>

Reviewed by Anders Carlsson.

Rehued by Anders Carlsson.

FrameLoader::m_history is never null, so make history() return a reference.
Also made HistoryController::m_frame a reference, since HistoryController's
lifetime is tied to FrameLoader, which is tied to the Frame.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154458 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=120128
Remove putDirectVirtual

Reviewed by Sam Weinig.

This could most generously be described as 'vestigial'.
No performance impact.

* API/JSObjectRef.cpp:
(JSObjectSetProperty):
    - changed to use defineOwnProperty
* debugger/DebuggerActivation.cpp:
* debugger/DebuggerActivation.h:
    - remove putDirectVirtual
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
    - changed to use defineOwnProperty
* runtime/ClassInfo.h:
* runtime/JSActivation.cpp:
* runtime/JSActivation.h:
* runtime/JSCell.cpp:
* runtime/JSCell.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
* runtime/JSObject.cpp:
* runtime/JSObject.h:
* runtime/JSProxy.cpp:
* runtime/JSProxy.h:
* runtime/JSSymbolTableObject.cpp:
* runtime/JSSymbolTableObject.h:
    - remove putDirectVirtual
* runtime/PropertyDescriptor.h:
(JSC::PropertyDescriptor::PropertyDescriptor):
    - added constructor for convenience



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154459 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Error.stack should not be enumerable
https://bugs.webkit.org/show_bug.cgi?id=120171

Reviewed by Oliver Hunt.

Breaks ECMA tests.

Source/JavaScriptCore: 

* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::finishCreation):
    - None -> DontEnum

LayoutTests: 

* fast/js/exception-properties-expected.txt:
* fast/js/script-tests/exception-properties.js:
    - Update test expectations.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154460 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=120128
Remove putDirectVirtual

Unreviewed, checked in commented out code. :-(

* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
    - delete commented out code



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154461 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[SVG2] Merge SVGStyledElement and SVGElement
https://bugs.webkit.org/show_bug.cgi?id=107386

Reviewed by Andreas Kling.

Source/WebCore:

Merge SVGStyledElement into SVGElement to simplify the SVG inheritance
model and match the SVG2 specification:
https://svgwg.org/svg2-draft/single-page.html#types-InterfaceSVGElement

Test: svg/dom/svg2-inheritance.html

* CMakeLists.txt:
* DerivedSources.cpp:
* DerivedSources.make:
* DerivedSources.pri:
* GNUmakefile.list.am:
* Target.pri:
* WebCore.order:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::alternativeText):
(WebCore::AccessibilityNodeObject::accessibilityDescription):
* css/SVGCSSStyleSelector.cpp:
* rendering/style/SVGRenderStyle.cpp:
* rendering/svg/RenderSVGContainer.cpp:
(WebCore::RenderSVGContainer::RenderSVGContainer):
* rendering/svg/RenderSVGContainer.h:
* rendering/svg/RenderSVGHiddenContainer.cpp:
(WebCore::RenderSVGHiddenContainer::RenderSVGHiddenContainer):
* rendering/svg/RenderSVGHiddenContainer.h:
* rendering/svg/RenderSVGModelObject.cpp:
(WebCore::RenderSVGModelObject::RenderSVGModelObject):
(WebCore::getElementCTM):
* rendering/svg/RenderSVGModelObject.h:
* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage):
(WebCore::RenderSVGResourceClipper::calculateClipContentRepaintRect):
(WebCore::RenderSVGResourceClipper::hitTestClipContent):
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
* rendering/svg/RenderSVGResourceContainer.h:
* rendering/svg/RenderSVGResourceFilter.cpp:
* rendering/svg/RenderSVGResourceFilterPrimitive.h:
* rendering/svg/RenderSVGResourceMarker.cpp:
* rendering/svg/RenderSVGResourceMarker.h:
* rendering/svg/RenderSVGResourceMasker.cpp:
(WebCore::RenderSVGResourceMasker::drawContentIntoMaskImage):
(WebCore::RenderSVGResourceMasker::calculateMaskContentRepaintRect):
* rendering/svg/RenderSVGResourcePattern.cpp:
(WebCore::RenderSVGResourcePattern::createTileImage):
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::RenderSVGRoot):
* rendering/svg/RenderSVGRoot.h:
* rendering/svg/RenderSVGViewportContainer.cpp:
(WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
* rendering/svg/RenderSVGViewportContainer.h:
* rendering/svg/SVGRenderSupport.cpp:
(WebCore::SVGRenderSupport::layoutChildren):
* rendering/svg/SVGRenderTreeAsText.cpp:
* rendering/svg/SVGResources.cpp:
(WebCore::registerPendingResource):
* rendering/svg/SVGResourcesCache.cpp:
* svg/SVGAElement.cpp:
(WebCore::SVGAElement::title):
* svg/SVGAllInOne.cpp:
* svg/SVGAltGlyphDefElement.h:
* svg/SVGAltGlyphItemElement.h:
* svg/SVGAnimateElement.cpp:
* svg/SVGAnimatedType.cpp:
(WebCore::SVGAnimatedType::valueAsString):
(WebCore::SVGAnimatedType::setValueAsString):
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::isTargetAttributeCSSProperty):
(WebCore::SVGAnimationElement::computeCSSPropertyValue):
(WebCore::SVGAnimationElement::adjustForInheritance):
(WebCore::inheritsFromProperty):
* svg/SVGComponentTransferFunctionElement.h:
* svg/SVGCursorElement.h:
* svg/SVGDescElement.cpp:
(WebCore::SVGDescElement::SVGDescElement):
* svg/SVGDescElement.h:
* svg/SVGDescElement.idl:
* svg/SVGElement.cpp:
(WebCore::mapAttributeToCSSProperty):
(WebCore::cssPropertyToTypeMap):
(WebCore::SVGElement::SVGElement):
(WebCore::SVGElement::~SVGElement):
(WebCore::SVGElement::removedFrom):
(WebCore::SVGElement::parseAttribute):
(WebCore::SVGElement::animatedPropertyTypeForAttribute):
(WebCore::collectInstancesForSVGElement):
(WebCore::SVGElement::isAnimatableAttribute):
(WebCore::SVGElement::title):
(WebCore::SVGElement::rendererIsNeeded):
(WebCore::SVGElement::cssPropertyIdForSVGAttributeName):
(WebCore::SVGElement::isAnimatableCSSProperty):
(WebCore::SVGElement::isPresentationAttribute):
(WebCore::SVGElement::collectStyleForPresentationAttribute):
(WebCore::SVGElement::isKnownAttribute):
(WebCore::SVGElement::svgAttributeChanged):
(WebCore::SVGElement::insertedInto):
(WebCore::SVGElement::buildPendingResourcesIfNeeded):
(WebCore::SVGElement::childrenChanged):
(WebCore::SVGElement::getPresentationAttribute):
(WebCore::SVGElement::instanceUpdatesBlocked):
(WebCore::SVGElement::setInstanceUpdatesBlocked):
(WebCore::SVGElement::localCoordinateSpaceTransform):
(WebCore::SVGElement::updateRelativeLengthsInformation):
(WebCore::SVGElement::isMouseFocusable):
(WebCore::SVGElement::isKeyboardFocusable):
* svg/SVGElement.h:
(WebCore::SVGElement::supportsMarkers):
(WebCore::SVGElement::hasRelativeLengths):
(WebCore::SVGElement::needsPendingResourceHandling):
(WebCore::SVGElement::selfHasRelativeLengths):
(WebCore::SVGElement::updateRelativeLengthsInformation):
* svg/SVGElement.idl:
* svg/SVGElementInstance.cpp:
(WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
(WebCore::SVGElementInstance::InstanceUpdateBlocker::InstanceUpdateBlocker):
* svg/SVGElementInstance.h:
* svg/SVGFEBlendElement.idl:
* svg/SVGFEColorMatrixElement.idl:
* svg/SVGFEComponentTransferElement.idl:
* svg/SVGFECompositeElement.idl:
* svg/SVGFEConvolveMatrixElement.idl:
* svg/SVGFEDiffuseLightingElement.idl:
* svg/SVGFEDisplacementMapElement.idl:
* svg/SVGFEDropShadowElement.idl:
* svg/SVGFEFloodElement.idl:
* svg/SVGFEGaussianBlurElement.idl:
* svg/SVGFEImageElement.idl:
* svg/SVGFELightElement.h:
* svg/SVGFEMergeElement.idl:
* svg/SVGFEMergeNodeElement.h:
* svg/SVGFEMorphologyElement.idl:
* svg/SVGFEOffsetElement.idl:
* svg/SVGFESpecularLightingElement.idl:
* svg/SVGFETileElement.idl:
* svg/SVGFETurbulenceElement.idl:
* svg/SVGFilterElement.cpp:
(WebCore::SVGFilterElement::SVGFilterElement):
(WebCore::SVGFilterElement::parseAttribute):
(WebCore::SVGFilterElement::svgAttributeChanged):
(WebCore::SVGFilterElement::childrenChanged):
* svg/SVGFilterElement.h:
* svg/SVGFilterElement.idl:
* svg/SVGFilterPrimitiveStandardAttributes.cpp:
(WebCore::SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes):
(WebCore::SVGFilterPrimitiveStandardAttributes::parseAttribute):
(WebCore::SVGFilterPrimitiveStandardAttributes::svgAttributeChanged):
(WebCore::SVGFilterPrimitiveStandardAttributes::childrenChanged):
(WebCore::SVGFilterPrimitiveStandardAttributes::rendererIsNeeded):
* svg/SVGFilterPrimitiveStandardAttributes.h:
* svg/SVGFontElement.cpp:
(WebCore::SVGFontElement::SVGFontElement):
* svg/SVGFontElement.h:
* svg/SVGFontFaceElement.cpp:
* svg/SVGFontFaceElement.h:
* svg/SVGFontFaceFormatElement.h:
* svg/SVGFontFaceNameElement.h:
* svg/SVGFontFaceSrcElement.h:
* svg/SVGFontFaceUriElement.h:
* svg/SVGGElement.cpp:
(WebCore::SVGGElement::rendererIsNeeded):
* svg/SVGGlyphElement.cpp:
(WebCore::SVGGlyphElement::SVGGlyphElement):
(WebCore::SVGGlyphElement::parseAttribute):
(WebCore::SVGGlyphElement::insertedInto):
(WebCore::SVGGlyphElement::removedFrom):
* svg/SVGGlyphElement.h:
* svg/SVGGlyphRefElement.cpp:
(WebCore::SVGGlyphRefElement::SVGGlyphRefElement):
(WebCore::SVGGlyphRefElement::parseAttribute):
* svg/SVGGlyphRefElement.h:
* svg/SVGGlyphRefElement.idl:
* svg/SVGGradientElement.cpp:
(WebCore::SVGGradientElement::SVGGradientElement):
(WebCore::SVGGradientElement::parseAttribute):
(WebCore::SVGGradientElement::svgAttributeChanged):
(WebCore::SVGGradientElement::childrenChanged):
* svg/SVGGradientElement.h:
* svg/SVGGradientElement.idl:
* svg/SVGGraphicsElement.cpp:
(WebCore::SVGGraphicsElement::SVGGraphicsElement):
(WebCore::SVGGraphicsElement::parseAttribute):
(WebCore::SVGGraphicsElement::svgAttributeChanged):
* svg/SVGGraphicsElement.h:
* svg/SVGGraphicsElement.idl:
* svg/SVGLocatable.cpp:
(WebCore::SVGLocatable::computeCTM):
* svg/SVGMPathElement.h:
* svg/SVGMarkerElement.cpp:
(WebCore::SVGMarkerElement::SVGMarkerElement):
(WebCore::SVGMarkerElement::parseAttribute):
(WebCore::SVGMarkerElement::svgAttributeChanged):
(WebCore::SVGMarkerElement::childrenChanged):
* svg/SVGMarkerElement.h:
* svg/SVGMarkerElement.idl:
* svg/SVGMaskElement.cpp:
(WebCore::SVGMaskElement::SVGMaskElement):
(WebCore::SVGMaskElement::parseAttribute):
(WebCore::SVGMaskElement::svgAttributeChanged):
(WebCore::SVGMaskElement::childrenChanged):
* svg/SVGMaskElement.h:
* svg/SVGMaskElement.idl:
* svg/SVGMetadataElement.h:
* svg/SVGMissingGlyphElement.cpp:
(WebCore::SVGMissingGlyphElement::SVGMissingGlyphElement):
* svg/SVGMissingGlyphElement.h:
* svg/SVGMissingGlyphElement.idl:
* svg/SVGPatternElement.cpp:
(WebCore::SVGPatternElement::SVGPatternElement):
(WebCore::SVGPatternElement::parseAttribute):
(WebCore::SVGPatternElement::svgAttributeChanged):
(WebCore::SVGPatternElement::childrenChanged):
* svg/SVGPatternElement.h:
* svg/SVGPatternElement.idl:
* svg/SVGScriptElement.h:
* svg/SVGStopElement.cpp:
(WebCore::SVGStopElement::SVGStopElement):
(WebCore::SVGStopElement::parseAttribute):
(WebCore::SVGStopElement::svgAttributeChanged):
* svg/SVGStopElement.h:
* svg/SVGStopElement.idl:
* svg/SVGStyleElement.h:
* svg/SVGStyledElement.cpp: Removed.
* svg/SVGStyledElement.h: Removed.
* svg/SVGStyledElement.idl: Removed.
* svg/SVGSymbolElement.cpp:
(WebCore::SVGSymbolElement::SVGSymbolElement):
(WebCore::SVGSymbolElement::parseAttribute):
(WebCore::SVGSymbolElement::svgAttributeChanged):
* svg/SVGSymbolElement.h:
* svg/SVGSymbolElement.idl:
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::insertedInto):
(WebCore::SVGTRefElement::removedFrom):
* svg/SVGTitleElement.cpp:
(WebCore::SVGTitleElement::SVGTitleElement):
(WebCore::SVGTitleElement::insertedInto):
* svg/SVGTitleElement.h:
* svg/SVGTitleElement.idl:
* svg/SVGTransformable.cpp:
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::selfHasRelativeLengths):
* svg/SVGViewElement.cpp:
(WebCore::SVGViewElement::SVGViewElement):
(WebCore::SVGViewElement::parseAttribute):
* svg/SVGViewElement.h:
* svg/animation/SVGSMILElement.h:
* svg/graphics/filters/SVGFEImage.cpp:
(WebCore::FEImage::platformApplySoftware):

LayoutTests:

Add layout test to validate the SVG2 inheritance model.

* svg/dom/svg2-inheritance-expected.txt: Added.
* svg/dom/svg2-inheritance.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154462 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unavailable plug-in indicator text is one pixel too low
https://bugs.webkit.org/show_bug.cgi?id=120177
<rdar://problem/14811951>

Reviewed by Kevin Decker.

Move the unavailable plug-in indicator text up one pixel.

* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::paintReplaced):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't leak registers for redeclared variables
https://bugs.webkit.org/show_bug.cgi?id=120174

Reviewed by Geoff Garen.

We currently always allocate registers for new global variables, but these are wasted when the variable is being redeclared.
Only allocate new registers when necessary.

No performance impact.

* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
* runtime/Executable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):
    - Don't allocate the register here.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::addGlobalVar):
    - Allocate the register here instead.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154466 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<https://webkit.org/b/120180> Fix issues with OTHER_LDFLAGS in various .xcconfig files

Reviewed by David Kilzer.

Source/WebKit2:

Adding ld flags for ASAN overwrote the unexported symbol flags we were
previously specifying. Since the unexported symbol ld flags are only
needed for the framework target, move them to WebKit2.xcconfig where we
can add them to OTHER_LDFLAGS along with the ASAN values inherited from
DebugRelease.xcconfig (and other values).

* Configurations/Base.xcconfig: Removed the unexported symbol ld flags.
* Configurations/WebKit2.xcconfig: ... and moved them here.

Tools:

* TestWebKitAPI/Configurations/Base.xcconfig: Removed the definition of
OTHER_CPLUSPLUSFLAGS since -ftemplate-depth=256 is already set in
DebugRelease.xcconfig and TestWebKitAPI isn't built in Production.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154467 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update LLVM binary drops and scripts to the latest version from SVN
https://bugs.webkit.org/show_bug.cgi?id=120184

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):

Tools: 

* ReducedFTL/build.sh:
* Scripts/configure-llvm: Added.
* Scripts/copy-webkitlibraries-to-product-directory:
* Scripts/export-llvm-build:

WebKitLibraries: 

Updated binary drops to r189066.

* LLVMIncludesMountainLion.tar.bz2:
* LLVMLibrariesMountainLion.tar.bz2:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154468 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Repaint counters are sometimes not in the corner of the compositing layer
https://bugs.webkit.org/show_bug.cgi?id=120176

Reviewed by Beth Dakin.

Sometimes the repaint counters are not in the corner of the compositing layer;
they are either inset, or partially or entirely outside the layer.

Fix by making sure that we restore the CGContext before drawing
the counter, since the WebCore code may have translated the CTM.

The counter-painting code saves and restores the context itself,
so this is safe.

* platform/graphics/mac/WebLayer.mm:
(drawLayerContents):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154469 268f45cc-cd09-0410-ab3c-d52691b4dbfc
compositing/geometry/bounds-ignores-hidden-dynamic.html has incorrect initial rendering
https://bugs.webkit.org/show_bug.cgi?id=119825

Source/WebCore:

Reviewed by Tim Horton.

r137526 and some earlier commits attempted to avoid unconditionally
repainting layers when their size changes, because this was causing
TiledBacking layers to repaint when the document size changed.

However, the approach required that we have good information about
whether size changes require a repaint, which in some cases is hard
to determine, especially when RenderLayer changes affect our
decisions about which layers are composited.

Fix by pushing the decision about whether to repaint on size change
into GraphicsLayer. The default is to repaint on size change,
but GraphicsLayer provides a function that can be overridden to
modify this behavior; GraphicsLayerCA does so to avoid repaints
when layers with TiledBackings get resized.

Test: compositing/repaint/repaint-on-layer-grouping-change.html

* WebCore.exp.in: WebKit2 needs GraphicsLayer::setSize, which is no longer inline.
* platform/graphics/GraphicsLayer.cpp:
(WebCore::GraphicsLayer::setOffsetFromRenderer):
(WebCore::GraphicsLayer::setSize):
* platform/graphics/GraphicsLayer.h:
(WebCore::GraphicsLayer::shouldRepaintOnSizeChange):
* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::shouldRepaintOnSizeChange):
* platform/graphics/ca/GraphicsLayerCA.h:
* rendering/RenderLayerBacking.h: No longer need m_boundsConstrainedByClipping
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::RenderLayerBacking):
(WebCore::RenderLayerBacking::updateCompositedBounds):
(WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): setSize takes
care of repainting for us now, so we can remove all the conditional code.

LayoutTests:

Reviewed by Tim Horton.

Test that dumps repaint rects on layers after visibility changes affect
the layer hierarchy.

* compositing/repaint/repaint-on-layer-grouping-change-expected.txt: Added.
* compositing/repaint/repaint-on-layer-grouping-change.html: Added.
* compositing/repaint/resize-repaint-expected.txt: Update result.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154470 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSObject and JSArray code shouldn't have to tiptoe around garbage collection
https://bugs.webkit.org/show_bug.cgi?id=120179

Reviewed by Geoffrey Garen.

There are many places in the code for JSObject and JSArray where they are manipulating their
Butterfly/Structure, e.g. after expanding their out-of-line backing storage via allocating. Within
these places there are certain "critical sections" where a GC would be disastrous. Gen GC looks
like it will make this dance even more intricate. To make everybody's lives easier we should use
the DeferGC mechanism in these functions to make these GC critical sections both obvious in the
code and trivially safe. Deferring collections will usually only last marginally longer, thus we
should not incur any additional overhead.

* heap/Heap.h:
* runtime/JSArray.cpp:
(JSC::JSArray::unshiftCountSlowCase):
* runtime/JSObject.cpp:
(JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
(JSC::JSObject::createInitialUndecided):
(JSC::JSObject::createInitialInt32):
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::createInitialContiguous):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::increaseVectorLength):
(JSC::JSObject::ensureLengthSlow):
* runtime/JSObject.h:
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
(JSC::JSObject::putDirectWithoutTransition):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154471 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Introduce toSVGLinearGradientElement(), and use it
https://bugs.webkit.org/show_bug.cgi?id=120154

Reviewed by Andreas Kling.

As a step to clean-up static_cast<SVGXXX>, toSVGLinearGradientElement() is added to clean-up
static_cast<SVGLinearGradientElement*>.

* rendering/svg/RenderSVGResourceLinearGradient.cpp:
(WebCore::RenderSVGResourceLinearGradient::collectGradientAttributes):
* rendering/svg/SVGRenderTreeAsText.cpp:
(WebCore::writeSVGResourceContainer):
* svg/SVGLinearGradientElement.cpp:
(WebCore::SVGLinearGradientElement::collectGradientAttributes):
* svg/SVGLinearGradientElement.h:
(WebCore::toSVGLinearGradientElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Need to disable FakeSYSVSHM when sandboxing is not enabled
https://bugs.webkit.org/show_bug.cgi?id=120182
<rdar://problem/14814461>

Patch by Simon Cooper <scooper@apple.com> on 2013-08-22
Reviewed by Alexey Proskuryakov.

When not in a sandbox do not enable the FakeSYSVSHIM. This
allows LocalConnection to work when Flash Player is run in
"Unsafe Mode".

* PluginProcess/mac/PluginProcessShim.mm:
(WebKit::shim_disabled):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154473 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Wrong interface version used in WebKitWebPage for loader client
https://bugs.webkit.org/show_bug.cgi?id=120199

Reviewed by Gustavo Noronha Silva.

* WebProcess/InjectedBundle/API/gtk/WebKitWebPage.cpp:
(webkitWebPageCreate): Use kWKBundlePageLoaderClientCurrentVersion
instead of kWKBundlePageResourceLoadClientCurrentVersion in loader
client initialization.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154474 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MathML: ASSERTION FAILED: !isPreferredLogicalHeightDirty() in RenderMathMLBlock::preferredLogicalHeight() const
https://bugs.webkit.org/show_bug.cgi?id=120157

Reviewed by Antti Koivisto.

RenderListMarker needs to be inserted to the render tree before
we start computing the preferred logical widths for the associated
RenderListItem.

Source/WebCore:

Test: mathml/mn-as-list-item-assert.html

* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
(WebCore::RenderListItem::layout):
(WebCore::RenderListItem::computePreferredLogicalWidths):
* rendering/RenderListItem.h:

LayoutTests:

* mathml/mn-as-list-item-assert-expected.txt: Added.
* mathml/mn-as-list-item-assert.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Missing null-check in HTMLFormElement::rendererIsNeeded()
https://bugs.webkit.org/show_bug.cgi?id=120159

Reviewed by Ryosuke Niwa.

Source/WebCore:

Null-check parentRenderer in HTMLFormElement::rendererIsNeeded()
and early return.

Test: fast/forms/missing-parentrenderer-crash.html

* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::rendererIsNeeded):

LayoutTests:

Test for the handling of null parentRederer.

* fast/forms/missing-parentrenderer-crash-expected.txt: Added.
* fast/forms/missing-parentrenderer-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154476 268f45cc-cd09-0410-ab3c-d52691b4dbfc