.: Heap-use-after-free in WebCore::ScrollingCoordinator::hasVisibleSlowRepaintViewportConstrainedObjects.
https://bugs.webkit.org/show_bug.cgi?id=108695

Add a manual test. Unable to write a normal layout test because
1) must waitUntilDone() to reproduce the crash but the redirected URL can't notifyDone();
2) Can't use a frame to contain the test because ScrollingCoordinator handles only the main frame.

Reviewed by Abhishek Arya.

* ManualTests/scrolling-coordinator-viewport-constrained-crash.html: Added.

Source/WebCore: Heap-use-after-free in WebCore::ScrollingCoordinator::hasVisibleSlowRepaintViewportConstrainedObjects
https://bugs.webkit.org/show_bug.cgi?id=108695

See comments of RenderLayerModelObject::willBeDestroyed() below for details.

Reviewed by Abhishek Arya.

Test: ManulTests/scrolling-coordinator-viewport-constrained-crash.html
Unable to write a normal layout test because
1) must waitUntilDone() to reproduce the crash but the redirected URL can't notifyDone();
2) Can't use a frame to contain the test because ScrollingCoordinator handles only the main frame.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::willBeDestroyed): Moved removeViewportConstrainedObject() call into RenderLayerModelObject::willBeDestroyed() because only RenderLayerModelObjects can be added as viewportConstrainedObjects.
* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::willBeDestroyed): Changed this->view() (then view->frameView()) to this->frame() (then frame->view()) because when willBeDestroyed() is called, the document has set its renderView to 0 thus this->view() will return 0, causing removeViewportConstrainedObject() not called and a deleted RenderLayerModelObject in FrameView's viewportConstrainedObjects.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142760 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Remove remaining dead code from the GLib unicode backend
https://bugs.webkit.org/show_bug.cgi?id=109707

Patch by Martin Robinson <mrobinson@igalia.com> on 2013-02-13
Reviewed by Philippe Normand.

Source/WebCore:

* platform/KURL.cpp:
(WebCore::appendEncodedHostname):
* platform/text/TextEncoding.cpp:
(WebCore::TextEncoding::encode):
* platform/text/TextEncodingRegistry.cpp:
(WebCore::buildBaseTextCodecMaps):
(WebCore::extendTextCodecMaps):

Source/WTF:

* wtf/unicode/Unicode.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142761 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r142736.
http://trac.webkit.org/changeset/142736
https://bugs.webkit.org/show_bug.cgi?id=109716

Broke ABI, nightly builds crash on launch (Requested by ap on
#webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-13

Source/WebKit2:

* Shared/APIClientTraits.cpp:
(WebKit):
* Shared/APIClientTraits.h:
* UIProcess/API/C/WKPage.h:
* UIProcess/API/gtk/WebKitLoaderClient.cpp:
(attachLoaderClientToView):
* WebProcess/InjectedBundle/API/c/WKBundlePage.h:
* WebProcess/qt/QtBuiltinBundlePage.cpp:
(WebKit::QtBuiltinBundlePage::QtBuiltinBundlePage):

Tools:

* MiniBrowser/mac/WK2BrowserWindowController.m:
(-[WK2BrowserWindowController awakeFromNib]):
* WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
(WTR::InjectedBundlePage::InjectedBundlePage):
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::createWebViewWithOptions):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142762 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make SecItemShimProxy be a WorkQueueMessageReceiver
https://bugs.webkit.org/show_bug.cgi?id=109719

Reviewed by Sam Weinig.

This adds a WantsConnection message attribute to be used for messages whose handlers
should take the connection the message was delivered to.

* Platform/CoreIPC/HandleMessage.h:
(CoreIPC::handleMessage):
Add new handleMessage overload.

* Scripts/webkit2/messages.py:
(async_message_statement):
(generate_message_handler):
Handle the WantsMessage attribute.

* UIProcess/mac/SecItemShimProxy.cpp:
(WebKit::SecItemShimProxy::shared):
Use dispatch_once and adoptRef.

(WebKit::SecItemShimProxy::SecItemShimProxy):
Initialize the queue.

(WebKit::SecItemShimProxy::initializeConnection):
Add the proxy as a work queue message receiver.

(WebKit::SecItemShimProxy::secItemRequest):
This no longer needs to call out to a dispatch queue, it's already on a queue.

* UIProcess/mac/SecItemShimProxy.messages.in:
This doesn't need to be a legacy receiver. Also, add the WantsConnection message.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142763 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Avoid updating timer heap when nothing changes
https://bugs.webkit.org/show_bug.cgi?id=109630

Reviewed by Andreas Kling.

When the fire time of a Timer is changed we remove it from the timer heap and reinsert it. This is pretty slow. 
Turns out that in ~80% of cases we are already in the heap and the insertion position is the same as the 
original position. We can check if anything is actually going to change before doing this work.
        
This makes starting a timer ~30% faster in average, ~0.1% progression in PLT3.
        
* platform/Timer.cpp:
(TimerHeapLessThanFunction):
(WebCore::TimerHeapLessThanFunction::operator()):
(WebCore::parentHeapPropertyHolds):
(WebCore):
(WebCore::childHeapPropertyHolds):
(WebCore::TimerBase::hasValidHeapPosition):
        
    The code here assumes that STL heap is a normal binary heap. If there is a different implementation
    somewhere the assertions will catch it.

(WebCore::TimerBase::updateHeapIfNeeded):
        
    Skip updating the heap if it is already valid.

(WebCore::TimerBase::setNextFireTime):
* platform/Timer.h:
(TimerBase):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142764 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Replace SVG bitmap cache with directly-rendered SVG
https://bugs.webkit.org/show_bug.cgi?id=106159

Reviewed by Tim Horton.

Source/WebCore:

This patch removes the caching of SVG bitmaps so SVG images are rendered directly. This
enables WebKit to pass the IE Chalkboard demo in 10s on a Z620:
http://ie.microsoft.com/testdrive/Performance/Chalkboard/

On a simple scaled SVG benchmark similar to the IE10 Chalkboard demo
(http://philbit.com/SvgImagePerformance/viewport.html):
    without patch: ~20FPS
    with patch: ~55FPS

The bitmap SVG image cache had several shortcomings:
    - The bitmap cache prevented viewport rendering. (WK104693)
    - Bitmap memory usage was high. (WK106484)
    - Caching animating images was expensive.

This change removes almost all of the SVGImageCache implementation, replacing it with
directly-rendered SVG. Instead of caching bitmaps, an SVGImageForContainer is cached which
is a thin wrapper around an SVG image with the associated container size and scale.
When rendering patterns (e.g., tiled backgrounds), a temporary bitmap is used for
performance. This change also removes the redraw timer of the old cache, instead relying
on the SVG image to notify clients if the image changes (e.g., during animations).

This patch fixes two existing bugs (WK99481 and WK104189) that were due to caching bitmaps
at a fixed size. A test has been added for each of these bugs.

Tests: svg/as-image/svg-image-scaled.html
       svg/as-image/svg-image-viewbox.html

* CMakeLists.txt:
* GNUmakefile.list.am:
* Target.pri:
* WebCore.gypi:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::lookupOrCreateImageForRenderer):
(WebCore::CachedImage::setContainerSizeForRenderer):
(WebCore::CachedImage::clear):
(WebCore::CachedImage::changedInRect):

    SVG images are no longer special-cased here. When the SVG image changes, users are
    notified through this function, and users can then request their content to be redrawn.

* svg/graphics/SVGImage.cpp:
(WebCore::SVGImage::setContainerSize):
(WebCore::SVGImage::drawForContainer):

    drawForContainer lays out the SVG content for a specific container size and renders it.
    The logic is fairly straightforward but a note about the scales and zooms here:
        the destination rect parameter is zoomed but not scaled
        the source rect parameter is zoomed but not scaled
        the context is scaled but not zoomed
    SVGImage::draw(...) only accepts a source and destination rect but does not consider
    scale or zoom. Therefore, drawForContainer removes the zoom component from the source
    so SVGImage::draw(...) will draw from the pre-zoom source to the post-zoom destination.

(WebCore::SVGImage::drawPatternForContainer):

    For performance, drawPatternForContainer renders the SVG content onto a bitmap, then
    has the bitmap image draw the pattern. This is necessary because drawPattern is used
    for tiling.

(WebCore):
(WebCore::SVGImage::startAnimation):
(WebCore::SVGImage::stopAnimation):
(WebCore::SVGImage::resetAnimation):
(WebCore::SVGImage::reportMemoryUsage):
* svg/graphics/SVGImage.h:
(WebCore):
(SVGImage):
* svg/graphics/SVGImageCache.cpp:

    Instead of storing a SizeAndScales values for each renderer, a SVGImageForContainer
    is stored which is just a thin wrapper around an SVG image that contains container
    sizing information. By combining the image and size information, the two maps of
    SVGImageCache have been merged into one.

    To make this patch easier to review, SVGImageCache still exists and works similar to
    how it did before the patch. Now, SVGImageCache simply stores the SVGImageForContainers.
    In a followup patch it will be removed.

    Note: the redraw timer of SVGImageCache has been removed because animation
    invalidation is now properly propagated back to the image clients.

(WebCore):
(WebCore::SVGImageCache::SVGImageCache):
(WebCore::SVGImageCache::~SVGImageCache):
(WebCore::SVGImageCache::removeClientFromCache):
(WebCore::SVGImageCache::setContainerSizeForRenderer):
(WebCore::SVGImageCache::imageSizeForRenderer):

    Previously, this function returned the scaled image size which was incorrect. The image
    size is used by clients such as GraphicsContext2D to determine the source size
    for drawing the image. draw() accepts zoomed but not scaled values, so this has been
    changed.

(WebCore::SVGImageCache::imageForRenderer):

    A FIXME has been added here to not set the scale on every lookup. This can be improved
    by setting the page scale factor in setContainerSizeForRenderer() in a future patch.

* svg/graphics/SVGImageCache.h:
(WebCore):
(SVGImageCache):
* svg/graphics/SVGImageForContainer.cpp: Added.
(WebCore):

    SVGImageForContainer is a thin wrapper around an SVG image. The lifetime of the
    SVGImage will be longer than the image cache.

(WebCore::SVGImageForContainer::size):

    This is the only logic in SVGImageForContainer. The size returned needs to be zoomed
    but not scaled because it is used (e.g., by RenderImage) to pass back into draw() which
    takes zoomed but not scaled values.

(WebCore::SVGImageForContainer::draw):
(WebCore::SVGImageForContainer::drawPattern):
* svg/graphics/SVGImageForContainer.h: Added.
(WebCore):
(SVGImageForContainer):

    In a future patch SVGImageForContainer can be made immutable but without a refactoring
    for not setting the page scale factor in SVGImageCache::lookupOrCreateImageForRenderer,
    setters are needed.

(WebCore::SVGImageForContainer::create):
(WebCore::SVGImageForContainer::containerSize):
(WebCore::SVGImageForContainer::pageScale):
(WebCore::SVGImageForContainer::zoom):
(WebCore::SVGImageForContainer::setSize):
(WebCore::SVGImageForContainer::setZoom):
(WebCore::SVGImageForContainer::setPageScale):
(WebCore::SVGImageForContainer::SVGImageForContainer):
(WebCore::SVGImageForContainer::destroyDecodedData):
(WebCore::SVGImageForContainer::decodedSize):

LayoutTests:

This patch fixes two existing bugs (WK99481 and WK104189) that were due to caching bitmaps
at a fixed size. A test has been added for each of these bugs.

* platform/chromium/TestExpectations:
* svg/as-image/svg-image-scaled-expected.html: Added.
* svg/as-image/svg-image-scaled.html: Added.
* svg/as-image/svg-image-viewbox-expected.html: Added.
* svg/as-image/svg-image-viewbox.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142765 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't copy Vector<UChar> when passing to new String methods from bug 109617
https://bugs.webkit.org/show_bug.cgi?id=109708

Reviewed by Tony Gentilcore.

Thanks for the catch Darin.

* wtf/text/AtomicString.h:
(WTF::AtomicString::AtomicString):
* wtf/text/StringImpl.h:
(WTF::StringImpl::create8BitIfPossible):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142766 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled Chromium DEPS to r182150.  Requested by
jamesr_ via sheriffbot.

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-13

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142767 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make PluginProcessConnectionManager a WorkQueueMessageReceiver
https://bugs.webkit.org/show_bug.cgi?id=109727

Reviewed by Andreas Kling.

* WebProcess/Plugins/PluginProcessConnectionManager.cpp:
(WebKit::PluginProcessConnectionManager::create):
(WebKit):
(WebKit::PluginProcessConnectionManager::PluginProcessConnectionManager):
(WebKit::PluginProcessConnectionManager::initializeConnection):
(WebKit::PluginProcessConnectionManager::pluginProcessCrashed):
* WebProcess/Plugins/PluginProcessConnectionManager.h:
(PluginProcessConnectionManager):
* WebProcess/Plugins/PluginProcessConnectionManager.messages.in:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::WebProcess):
(WebKit::WebProcess::initializeConnection):
(WebKit::WebProcess::pluginProcessConnectionManager):
* WebProcess/WebProcess.h:
(WebKit):
(WebProcess):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142768 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unnecessary indirection to non-local variable access operations
https://bugs.webkit.org/show_bug.cgi?id=109724

Reviewed by Filip Pizlo.

Linked bytecode now stores a direct pointer to the resolve operation
vectors, so the interpreter no longer needs a bunch of indirection to
to perform non-local lookup.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
* bytecode/CodeBlock.h:
(CodeBlock):
* bytecode/Instruction.h:
* dfg/DFGByteCodeParser.cpp:
(ByteCodeParser):
(InlineStackEntry):
(JSC::DFG::ByteCodeParser::parseResolveOperations):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCapabilities.h:
(JSC::DFG::canInlineOpcode):
* dfg/DFGGraph.h:
(ResolveGlobalData):
(ResolveOperationData):
(PutToBaseOperationData):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_put_to_base):
(JSC::JIT::emit_op_resolve):
(JSC::JIT::emitSlow_op_resolve):
(JSC::JIT::emit_op_resolve_base):
(JSC::JIT::emitSlow_op_resolve_base):
(JSC::JIT::emit_op_resolve_with_base):
(JSC::JIT::emitSlow_op_resolve_with_base):
(JSC::JIT::emit_op_resolve_with_this):
(JSC::JIT::emitSlow_op_resolve_with_this):
(JSC::JIT::emitSlow_op_put_to_base):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_put_to_base):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142769 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit ignores column-rules wider than column-gap
https://bugs.webkit.org/show_bug.cgi?id=15553

Paint column rules even if they are wider than the gap.
Rules wider than the gap should just overlap with column contents.

Patch by Morten Stenshorne <mstensho@opera.com> on 2013-02-13
Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/multicol/rule-thicker-than-gap.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::paintColumnRules):

LayoutTests:

* fast/multicol/rule-thicker-than-gap-expected.html: Added.
* fast/multicol/rule-thicker-than-gap.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142770 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Unreviewed VS2010 fix to add $(ConfigurationBuildDir)/private
to include paths, to match VS2005 build behavior.

* DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncherCommon.props:
* DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncherCommon.props:
* DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginCommon.props:
* WinLauncher/WinLauncher.vcxproj/WinLauncherCommon.props:
* WinLauncher/WinLauncher.vcxproj/WinLauncherLibCommon.props:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142771 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use fancy new Vector-based String constructors in the WebVTT parser
https://bugs.webkit.org/show_bug.cgi?id=109619

Reviewed by Benjamin Poulain.

No change in behavior. Added some FIXMEs for future perf optimization.

* html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::constructTreeFromToken):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142772 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MediaStream API: Use the source id when creating new tracks
https://bugs.webkit.org/show_bug.cgi?id=109688

Reviewed by Adam Barth.

Source/Platform:

Added id to initialize and renamed audio/videoSources to audio/videoTracks.

* chromium/public/WebMediaStream.h:
(WebKit):
(WebMediaStream):
(WebKit::WebMediaStream::audioSources):
(WebKit::WebMediaStream::videoSources):
* chromium/public/WebMediaStreamTrack.h:
(WebMediaStreamTrack):

Source/WebCore:

This patch reuses the ids from the source when creating tracks instead of creating a new one.
This was requested by the chromium port to greatly simplify their implementation.
In the longer run the API should be rewritten to only use tracks instead of sources.

Covered by existing tests.

* platform/chromium/support/WebMediaStream.cpp:
(WebKit::WebMediaStream::audioTracks):
(WebKit::WebMediaStream::videoTracks):
(WebKit::WebMediaStream::initialize):
(WebKit):
* platform/chromium/support/WebMediaStreamTrack.cpp:
(WebKit::WebMediaStreamTrack::initialize):
(WebKit):
* platform/mediastream/MediaStreamComponent.h:
(WebCore::MediaStreamComponent::create):
(MediaStreamComponent):
(WebCore::MediaStreamComponent::MediaStreamComponent):
(WebCore):
* platform/mediastream/MediaStreamDescriptor.h:
(WebCore::MediaStreamDescriptor::create):
(MediaStreamDescriptor):
(WebCore::MediaStreamDescriptor::MediaStreamDescriptor):

Tools:

Switching mock to new API.

* DumpRenderTree/chromium/TestRunner/src/WebUserMediaClientMock.cpp:
(WebTestRunner::WebUserMediaClientMock::requestUserMedia):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142773 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Clicking outside captions menu should dismiss it
https://bugs.webkit.org/show_bug.cgi?id=109648

Reviewed by Eric Carlson.

Source/WebCore:

Add a virtual override to the platform-specific
defaultEventHandler to intercept any click in the controls,
and hide the captions menu if it is showing.

Test: media/video-controls-captions-trackmenu-hide-on-click.html

* html/shadow/MediaControlsApple.cpp:
(WebCore::MediaControlsApple::defaultEventHandler): Override from MediaControls. Hide
    captions menu if a click event comes in.
* html/shadow/MediaControlsApple.h:

LayoutTests:

New test for captions menu. Skip it everywhere but Mac.

* media/video-controls-captions-trackmenu-hide-on-click.html: Added.
* platform/mac/media/video-controls-captions-trackmenu-hide-on-click-expected.txt: Added.
* platform/chromium/TestExpectations:
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142774 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Small update to speech bubble for captions menu [Mac]
https://bugs.webkit.org/show_bug.cgi?id=109641

Reviewed by Eric Carlson

Small adjustment to the embedded SVG that draws a speech bubble
for the captions button. Remove a polygon that was so small
it looked like a rendering error.

* css/mediaControlsQuickTime.css:
(video::-webkit-media-controls-toggle-closed-captions-button):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142775 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix after r142768.

r142768 broke the EFL WK2 build due to wrong member initialization
order in the WebProcess constructor initialization list.

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::WebProcess):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142776 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Try to fix the build after r142756

* Source/autotools/SetupAutomake.m4: Instead of using the (now gone) have_gstreamer
variable, activate GStreamer if either web audio or web video is enabled.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142777 268f45cc-cd09-0410-ab3c-d52691b4dbfc
EventDispatcher should be a WorkQueueMessageReceiver
https://bugs.webkit.org/show_bug.cgi?id=109736

Reviewed by Andreas Kling.

* WebProcess/WebPage/EventDispatcher.cpp:
(WebKit::EventDispatcher::create):
(WebKit):
(WebKit::EventDispatcher::EventDispatcher):
(WebKit::EventDispatcher::initializeConnection):
(WebKit::EventDispatcher::wheelEvent):
(WebKit::EventDispatcher::gestureEvent):
* WebProcess/WebPage/EventDispatcher.h:
(EventDispatcher):
* WebProcess/WebPage/EventDispatcher.messages.in:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::WebProcess):
(WebKit::WebProcess::initializeConnection):
* WebProcess/WebProcess.h:
(WebKit):
(WebKit::WebProcess::eventDispatcher):
(WebProcess):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142778 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG LogicalNot/Branch peephole removal and inversion ignores the possibility of things exiting
https://bugs.webkit.org/show_bug.cgi?id=109489

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
If things can exit between the LogicalNot and the Branch then don't peephole.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

LayoutTests: 

Reviewed by Mark Hahnenberg.

* fast/js/dfg-branch-logical-not-peephole-around-osr-exit-expected.txt: Added.
* fast/js/dfg-branch-logical-not-peephole-around-osr-exit.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-branch-logical-not-peephole-around-osr-exit.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142779 268f45cc-cd09-0410-ab3c-d52691b4dbfc