Add 'colno' attribute to ErrorEvent interface
https://bugs.webkit.org/show_bug.cgi?id=119257

Reviewed by Darin Adler.

Source/WebCore:

Add 'colno' attribute to ErrorEvent interface to match the latest specification:
http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.html#errorevent

The 'colno' attribute is already supported by IE10 and Blink.

No new tests, covered by existing tests.

* dom/ErrorEvent.cpp:
(WebCore::ErrorEventInit::ErrorEventInit):
(WebCore::ErrorEvent::ErrorEvent):
* dom/ErrorEvent.h:
* dom/ErrorEvent.idl:

LayoutTests:

Update several test cases to check the new ErrorEvent.colno
attribute.

* fast/events/constructors/error-event-constructor-expected.txt:
* fast/events/constructors/error-event-constructor.html:
* fast/events/window-onerror9-expected.txt:
* fast/events/window-onerror9.html:
* fast/workers/worker-script-error-expected.txt:
* fast/workers/worker-script-error.html:
* http/tests/workers/worker-importScriptsOnError-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        [Mac] can-read-in-dragstart-event.html and can-read-in-copy-and-cut-events.html fail
        https://bugs.webkit.org/show_bug.cgi?id=113094

        The test still fails on WK1, and needs to be marked accordingly.

        * platform/mac-wk2/TestExpectations:
        * platform/mac/TestExpectations:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153496 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add an assertion to SpeculateCellOperand
https://bugs.webkit.org/show_bug.cgi?id=119276

Reviewed by Michael Saboff.

More assertions are better

* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153497 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        REGRESSION(r139282): Fix document leak when selection is created inside the document
        https://bugs.webkit.org/show_bug.cgi?id=119122

        OK'd by Ryosuke Niwa.

        The added test was very flaky. Trying to make it better with a gc() call at the beginning.

        * editing/selection/leak-document-with-selection-inside.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153498 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Speculative fix for crash due to string access on multiple threads
https://bugs.webkit.org/show_bug.cgi?id=119279
<rdar://problem/14267833>

Reviewed by Darin Adler.

We can't use String::isolatedCopy for passing the local storage directory to the storage thread since
that returns a String that's copied and then destroyed after the call to bind returns, leaving a small window
where the refcount can be accessed simultaneously from two threads.

Work around this by passing a PassRefPtr<StringImpl> to bind instead; the act of copying the PassRefPtr will
clear out the original and so when the original is destroyed the underlying StringImpl pointer will be null.

* UIProcess/Storage/LocalStorageDatabaseTracker.cpp:
(WebKit::LocalStorageDatabaseTracker::setLocalStorageDirectory):
(WebKit::LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal):
* UIProcess/Storage/LocalStorageDatabaseTracker.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153499 268f45cc-cd09-0410-ab3c-d52691b4dbfc
GetByVal on Arguments does the wrong size load when checking the Arguments object length
https://bugs.webkit.org/show_bug.cgi?id=119281

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

This leads to out of bounds accesses and subsequent crashes.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests: 

* fast/js/dfg-strict-mode-arguments-get-beyond-length-expected.txt: Added.
* fast/js/dfg-strict-mode-arguments-get-beyond-length.html: Added.
* fast/js/script-tests/dfg-strict-mode-arguments-get-beyond-length.js: Added.
(foo):
(bar):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153500 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        REGRESSION: Crash when opening a message on Gmail
        https://bugs.webkit.org/show_bug.cgi?id=119105

        Landing missing test results.

        * fast/js/dfg-get-by-id-unset-then-proto-expected.txt: Added.
        * fast/js/dfg-get-by-id-unset-then-proto-less-warmup-expected.txt: Added.
        * fast/js/dfg-get-by-id-unset-then-proto-more-warmup-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153501 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Content filter replacement data uses the encoding from the blocked page's response headers
https://bugs.webkit.org/show_bug.cgi?id=119237

Reviewed by Darin Adler.

When a document specifies an encoding in an HTTP response header, or
when the embedder specifies an override encoding, and the content filter
blocks the document, we interpret the content filter's replacement data
using this encoding. This might be the wrong.

Forget about encodings determined from these sources. The replacement
data will specify an encoding in a <meta charset>, so let that be used
instead.

No new tests. We don't currently have a mechanism for testing the
content filter from WebKit.

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::commitData): Pretend as if no encoding is
specified if the content filter blocked the load.
(WebCore::DocumentLoader::dataReceived): Stopped calling commitLoad()
before early-returning if the content filter needs more data. This isn't
necessary.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153502 268f45cc-cd09-0410-ab3c-d52691b4dbfc