JSArrayBufferViews of length 0 allocate 0 CopiedSpace bytes, which is invalid
https://bugs.webkit.org/show_bug.cgi?id=123746

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

This patch disallows clients from allocating 0 bytes in CopiedSpace. We enforce this invariant 
with an ASSERT in C++ code and a breakpoint in JIT code. Clients who care about 0-byte 
allocations (like JSArrayBufferViews) must handle that case themselves, but we don't punish 
anybody else for the rare case that somebody decides to allocate a 0-length typed array. 
It also makes the allocation and copying cases consistent for CopiedSpace: no 0-byte allocations, 
no 0-byte copying.
 
Also added a check so that JSArrayBufferViews don't try to copy their m_vector backing store when 
their length is 0. Also sprinkled several ASSERTs throughout the JSArrayBufferView code to make sure that 
when length is 0 m_vector is null.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
* heap/CopiedSpaceInlines.h:
(JSC::CopiedSpace::tryAllocate):
* runtime/ArrayBuffer.h:
(JSC::ArrayBuffer::create):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::::visitChildren):
(JSC::::copyBackingStore):
(JSC::::slowDownAndWasteMemory):

LayoutTests: 

Added a test to make sure that we don't crash when allocating a typed array with 0 length.

* js/script-tests/typedarray-zero-size.js: Added.
(foo):
* js/typedarray-zero-size-expected.txt: Added.
* js/typedarray-zero-size.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158583 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[css shapes] Fix support for shape-outside on a float with padding
https://bugs.webkit.org/show_bug.cgi?id=123590

Reviewed by Alexandru Chiculita.

Source/WebCore:

The line top was being improperly converted to the coordinates of the
shape, causing the shape to be positioned incorrectly when the float
had padding. This fixes that problem.

No new tests, covered by updates to existing ones.

* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::updateDeltasForContainingBlockLine):

LayoutTests:

Fix existing tests that depended on the incorrect behavior so that
they are now testing the proper thing. Also fix up the tests to make
them clearer and more robust.

* csswg/contributors/adobe/submitted/shapes/shape-outside/resources/w3c-import.log:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-circle-000-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-circle-000.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-ellipse-000-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-ellipse-000.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-inset-rectangle-001-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-inset-rectangle-001.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-000-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-000.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-001-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-001.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-002-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-002.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-003-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-003.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-004-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-004.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-005-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-005.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-006-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-006.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-007-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-007.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-008-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-008.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-009-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-padding-009.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-001-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-001.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-002-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-002.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-003-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-003.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-004-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-rounded-rectangle-004.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-square-border-000-expected.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/shape-outside-floats-square-border-000.html:
* csswg/contributors/adobe/submitted/shapes/shape-outside/w3c-import.log:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158584 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fixes. In particular, we were missing the code to generate JSONs in report.php :(

* public/api/report.php:
* public/include/test-results.php:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Eliminate HostCall bit from JSC Stack CallerFrame
https://bugs.webkit.org/show_bug.cgi?id=123642

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

Replace the HostCallFrame bit or'ed to the CallerFrame value in a CallFrame with
a VM entry sentinel CallFrame.  Logically, the VM entry sentinel call frame is
pushed on the stack before the callee frame when calling from native to JavaScript
code.  The callee frame's CallerFrame points at the VM entry sentinel call frame
and the VM entry sentinel call frame's CallerFrame points to the real caller.
The VM entry sentinel call frame has a sentinel (1) in the CodeBlock to indicate
its a VM entry sentinel call frame.  It's ScopeChain has vm.topCallFrame at the
time of the call.  This allows for a complete stack walk as well as walking just
the contiguous JS frames.

The VM entry sentinel call frame and callee frame are currently allocated and
initialized in ExecState::init(), but this initialization will be moved to
ctiTrampoline when we actually move onto the native stack.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::noticeIncomingCall):
* debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::callerFrame):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileExceptionHandlers):
* interpreter/CallFrame.h:
(JSC::ExecState::frameExtent):
(JSC::ExecState::currentVPC):
(JSC::ExecState::setCurrentVPC):
(JSC::ExecState::init):
(JSC::ExecState::noCaller):
(JSC::ExecState::isVMEntrySentinel):
(JSC::ExecState::vmEntrySentinelCallerFrame):
(JSC::ExecState::initializeVMEntrySentinelFrame):
(JSC::ExecState::callerFrameSkippingVMEntrySentinel):
(JSC::ExecState::vmEntrySentinelCodeBlock):
* interpreter/Interpreter.cpp:
(JSC::unwindCallFrame):
(JSC::Interpreter::getStackTrace):
* interpreter/Interpreter.h:
(JSC::TopCallFrameSetter::TopCallFrameSetter):
(JSC::TopCallFrameSetter::~TopCallFrameSetter):
(JSC::NativeCallFrameTracer::NativeCallFrameTracer):
* interpreter/JSStack.cpp:
(JSC::JSStack::~JSStack):
* interpreter/JSStackInlines.h:
(JSC::JSStack::getStartOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
* interpreter/Register.h:
(JSC::Register::operator=):
(JSC::Register::callFrame):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::readFrame):
(JSC::StackVisitor::readNonInlinedFrame):
(JSC::StackVisitor::readInlinedFrame):
(JSC::StackVisitor::Frame::print):
* interpreter/VMInspector.cpp:
(JSC::VMInspector::countFrames):
* jit/JIT.cpp:
(JSC::JIT::privateCompileExceptionHandlers):
* jit/JITOperations.cpp:
* jit/JITStubsARM.h:
(JSC::ctiTrampoline):
* jit/JITStubsARM64.h:
* jit/JITStubsARMv7.h:
(JSC::ctiTrampoline):
* jit/JITStubsMIPS.h:
* jit/JITStubsMSVC64.asm:
* jit/JITStubsSH4.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86_64.h:
* jsc.cpp:
(functionDumpCallFrame):
* llint/LowLevelInterpreter.cpp:
(JSC::CLoop::execute):
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::throwException):

Source/WebCore: 

Updated JavaScript stack walking as a result of the corresponding changes made in
JavaScriptCore.

* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy):
* bindings/js/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::stepOutOfFunction):
(WebCore::ScriptDebugServer::returnEvent):
(WebCore::ScriptDebugServer::didExecuteProgram):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158586 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make LiveNodeListBase use Elements instead of Nodes
https://bugs.webkit.org/show_bug.cgi?id=123745

Reviewed by Anders Carlsson.

* WebCore.exp.in:
* dom/Element.cpp:
(WebCore::Element::firstElementChild):
(WebCore::Element::lastElementChild):
        
    Switch to correct calls. ElementTraversal::previous and previousChild are no longer equivalent.

* dom/ElementTraversal.h:
(WebCore::::lastWithinTemplate):
(WebCore::::previousTemplate):
        
    Fix ElementTraversal::lastWithin and previous. They had no real clients and didn't work correctly.
    With LiveNodeListBase starting to use these they get excellent test coverage.

* dom/LiveNodeList.cpp:
(WebCore::LiveNodeListBase::invalidateCache):
* dom/LiveNodeList.h:
(WebCore::LiveNodeListBase::LiveNodeListBase):
(WebCore::LiveNodeListBase::isElementCacheValid):
(WebCore::LiveNodeListBase::cachedElement):
(WebCore::LiveNodeListBase::cachedElementOffset):
(WebCore::LiveNodeListBase::setCachedElement):
        
    Make the cache Element based.
    Switch to Elements in all helpers.
    Rename item -> element for clarity.

* dom/NodeIterator.cpp:
(WebCore::NodeIterator::NodePointer::moveToPrevious):
(WebCore::NodeIterator::updateForNodeRemoval):
        
    This code expected the old inconsistent NodeTraversal::previous behavior where the traversal includes
    the root as the last item. Drop the stayWithin parameter and handle the one case where it is needed here.

* dom/NodeTraversal.cpp:
(WebCore::NodeTraversal::last):
(WebCore::NodeTraversal::deepLastChild):
* dom/NodeTraversal.h:
        
    Support ElementTraversal::previous/lastWithin.

(WebCore::NodeTraversal::previous):
        
    This was slightly wrong too.

* html/HTMLCollection.cpp:
(WebCore::previousElement):
(WebCore::lastElement):
(WebCore::LiveNodeListBase::iterateForPreviousElement):
(WebCore::LiveNodeListBase::itemBefore):
(WebCore::LiveNodeListBase::isLastItemCloserThanLastOrCachedItem):
(WebCore::LiveNodeListBase::isFirstItemCloserThanCachedItem):
(WebCore::LiveNodeListBase::setCachedElement):
(WebCore::LiveNodeListBase::item):
(WebCore::LiveNodeListBase::elementBeforeOrAfterCachedElement):
* html/HTMLCollection.h:
(WebCore::HTMLCollection::isEmpty):
(WebCore::HTMLCollection::hasExactlyOneItem):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158587 268f45cc-cd09-0410-ab3c-d52691b4dbfc