[V8] Rename add{Node,Object}ToGroup() to add{Node,Object}WrapperToGroup()
https://bugs.webkit.org/show_bug.cgi?id=110404

Reviewed by Adam Barth.

The current function name is confusing
(See discussion in bug 110396). We should rename the functions
so that it becomes clear that "Node"/"Object" refers to a type
of a wrapper in the second argument.

No tests. No change in behavior.

* bindings/v8/V8GCController.cpp:
(WebCore::WrapperGrouper::addObjectWrapperToGroup):
(WebCore::WrapperGrouper::addNodeWrapperToGroup):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143636 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Objective-C API: Need a way to use the Objective-C JavaScript API with WebKit
https://bugs.webkit.org/show_bug.cgi?id=106059

Source/JavaScriptCore: 

Reviewed by Geoffrey Garen.
        
* API/JSBase.h: Renamed enable flag for API.
* API/JSBlockAdaptor.h: Using new flag.
* API/JSBlockAdaptor.mm: Ditto.
* API/JSContext.h: Add convenience C API conversion function for JSGlobalContextRef.
* API/JSContext.mm: 
(-[JSContext JSGlobalContextRef]): Implementation of C API convenience function.
(-[JSContext initWithVirtualMachine:]): We don't use the m_apiData field any more.
(-[JSContext initWithGlobalContextRef:]): init method for allocating new JSContexts given a JSGlobalContextRef.
(-[JSContext dealloc]): No more m_apiData.
(-[JSContext wrapperForObjCObject:]): Renamed wrapperForObject. 
(-[JSContext wrapperForJSObject:]): Fetches or allocates the JSValue for the specified JSValueRef in this JSContext.
(+[JSContext contextWithGlobalContextRef:]): Helper function to grab the lightweight JSContext wrapper for a given
JSGlobalContextRef from the global wrapper cache or allocate a new one if there isn't already one.
* API/JSContextInternal.h: New flag, new method declaration for initWithGlobalContextRef.
* API/JSExport.h: New flag.
* API/JSValue.h: New flag and new C API convenience method.
* API/JSValue.mm:
(-[JSValue JSValueRef]): Implementation of the C API convenience method.
(objectToValueWithoutCopy):
(+[JSValue valueWithValue:inContext:]): We now ask the JSContext for an Objective-C JSValue wrapper, which it can cache
in its internal JSWrapperMap.
* API/JSValueInternal.h:
* API/JSVirtualMachine.h:
* API/JSVirtualMachine.mm: Added global cache that maps JSContextGroupRef -> JSVirtualMachine lightweight wrappers.
(wrapperCacheLock):
(initWrapperCache):
(+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
(+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
(-[JSVirtualMachine init]):
(-[JSVirtualMachine initWithContextGroupRef:]):
(-[JSVirtualMachine dealloc]):
(+[JSVirtualMachine virtualMachineWithContextGroupRef:]):
(-[JSVirtualMachine contextForGlobalContextRef:]):
(-[JSVirtualMachine addContext:forGlobalContextRef:]):
* API/JSVirtualMachineInternal.h:
* API/JSWrapperMap.h:
* API/JSWrapperMap.mm:
(-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We use the JSObjectSetPrototype C API call because 
setting the __proto__ property causes all sorts of bad things to happen behind the scenes, which can cause crashes based on 
when it gets called.
(-[JSWrapperMap initWithContext:]):
(-[JSWrapperMap jsWrapperForObject:]):
(-[JSWrapperMap objcWrapperForJSValueRef:]):
* API/JavaScriptCore.h:
* API/ObjCCallbackFunction.h:
* API/ObjCCallbackFunction.mm:
(ObjCCallbackFunction::ObjCCallbackFunction): We never actually should have retained the target in the case that we had a 
block as a callback. Blocks are initially allocated on the stack and are only moved to the heap if we call their copy method.
Retaining the block on the stack was a bad idea because if that stack frame ever went away and we called the block later, 
we'd crash and burn.
(ObjCCallbackFunction::setContext): We need a new setter for when the weak reference to a JSContext inside an ObjCCallbackFunction
disappears, we can allocate a new one in its place.
(ObjCCallbackFunction):
(objCCallbackFunctionCallAsFunction): Reset the callback's context if it's ever destroyed.
(objCCallbackFunctionForInvocation): Again, don't set the __proto__ property because it uses black magic that can cause us to crash
depending on when this is called.
(objCCallbackFunctionForBlock): Here is where we copy the block to the heap when we're first creating the callback object for it.
* API/tests/testapi.c:
(main):
* API/tests/testapi.mm: We're going to get rid of the automatic block conversion, since that is causing leaks. I changed it 
here in this test just so that it wouldn't mask any other potential leaks. Also modified some of the tests since JSContexts are 
just lightweight wrappers now, we're not guaranteed to get the same pointer back from the call to [JSValue context] as the one 
that the value was created in.
(-[TestObject callback:]):
* JavaScriptCore.xcodeproj/project.pbxproj:
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData): No more m_apiData.
* runtime/JSGlobalData.h: Ditto.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject): Ditto.
* runtime/JSGlobalObject.h:

Source/WebCore: 

Reviewed by Geoffrey Garen.

* WebCore.exp.in:
* bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::setWindow): Since we're basically abandoning a JSDOMWindow here, we call
garbageCollectSoon().
* bindings/js/JSDOMWindowShell.h:
* bindings/js/ScriptController.h: New function to get the JSContext for the global object of the current main world.
* bindings/js/ScriptControllerMac.mm: 
(WebCore::ScriptController::javaScriptContext): Ditto.
* bindings/objc/WebScriptObject.h: Added ifdef guards. Also new convenience conversion function for the JSC Obj-C API.
* bindings/objc/WebScriptObject.mm: JSC::JSValue and JSValue conflict with one another, so we have to be more specific.
(-[WebScriptObject _globalContextRef]): Useful helper function for getting the JSGlobalContextRef of a particular WebScriptObject.
(-[WebScriptObject callWebScriptMethod:withArguments:]):
(-[WebScriptObject evaluateWebScript:]):
(-[WebScriptObject valueForKey:]):
(-[WebScriptObject webScriptValueAtIndex:]):
(+[WebScriptObject _convertValueToObjcValue:JSC::originRootObject:rootObject:]):
(-[WebScriptObject JSValue]): Implementation of convenience WebScriptObject conversion function to new Objective-C API.
* bindings/objc/WebScriptObjectPrivate.h:

Source/WebKit/mac: 

Reviewed by Geoffrey Garen.

Addition of appropriate delegate callbacks and support to the WebKit API.

* WebCoreSupport/WebFrameLoaderClient.mm:
* WebView/WebDelegateImplementationCaching.h:
(WebFrameLoadDelegateImplementationCache):
* WebView/WebFrame.h:
* WebView/WebFrame.mm:
(-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
(-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
(-[WebFrame _javaScriptContextForScriptWorld:]):
(-[WebFrame javaScriptContext]):
* WebView/WebFrameLoadDelegate.h:
* WebView/WebFramePrivate.h:
* WebView/WebScriptDebugDelegate.mm:
(-[WebScriptCallFrame _convertValueToObjcValue:JSC::]):
(-[WebScriptCallFrame exception]):
(-[WebScriptCallFrame evaluateWebScript:]):
* WebView/WebScriptWorld.h:
* WebView/WebScriptWorld.mm:
(+[WebScriptWorld scriptWorldForJavaScriptContext:]):
* WebView/WebView.mm:
(-[WebView _cacheFrameLoadDelegateImplementations]):
(aeDescFromJSValue):
(-[WebView aeDescByEvaluatingJavaScriptFromString:]):
(-[WebView _computedStyleIncludingVisitedInfo:forElement:]):

Source/WTF: 

Reviewed by Geoffrey Garen.

* wtf/FeatureDefines.h: Added enable flag for JSC Objective-C API so it can be used in
export files.

Tools: 

Reviewed by Geoffrey Garen.

Added new tests for the WebKit API portion of the JSC Objective-C API.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/JSContextBackForwardCache1.html: Added.
* TestWebKitAPI/Tests/mac/JSContextBackForwardCache2.html: Added.
* TestWebKitAPI/Tests/mac/WebViewDidCreateJavaScriptContext.mm: Added.
(-[MyConsole log:]):
(-[MyConsole printHelloWorld]):
(-[MyConsole add:to:]):
(-[DidCreateJavaScriptContextFrameLoadDelegate webView:didFinishLoadForFrame:]):
(-[DidCreateJavaScriptContextFrameLoadDelegate webView:didCreateJavaScriptContext:forFrame:]):
(TestWebKitAPI):
(TestWebKitAPI::TEST):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143637 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] document WebTestDelegate and WebTestRunner interfaces
https://bugs.webkit.org/show_bug.cgi?id=110472

Reviewed by Adam Barth.

Also remove the default implementation of the remaining WebTestDelegate
methods now that all embedders provide this interface.

* DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
(WebTestDelegate):
* DumpRenderTree/chromium/TestRunner/public/WebTestRunner.h:
(WebTestRunner):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143638 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Remove deprecated WebCompositorSupport::createLayerTreeView() declaration
https://bugs.webkit.org/show_bug.cgi?id=110492

Patch by James Robinson <jamesr@chromium.org> on 2013-02-21
Reviewed by Adrienne Walker.

* chromium/public/WebCompositorSupport.h:
(WebCompositorSupport):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Stop starting animations when leaving a page
https://bugs.webkit.org/show_bug.cgi?id=110257

Reviewed by Stephen Chenney.

Source/WebCore:

SVGImage::resetAnimation() incorrectly started animations which could cause a crash
when leaving the page. This patch fixes resetAnimation to only stop the animation,
similar to BitmapImage::resetAnimation().

Additionally, this patch removes an unneeded call to Document::updateStyleForAllDocuments()
that was present in the animation loop. This makes the animation code more resistant to
similar bugs in the future.

Both of these changes are functionally covered with existing tests.

Test: svg/animations/reset-animation-crash.html

* svg/animation/SMILTimeContainer.cpp:
(WebCore::SMILTimeContainer::updateAnimations):
* svg/graphics/SVGImage.cpp:
(WebCore::SVGImage::resetAnimation):

LayoutTests:

* svg/animations/reset-animation-crash-expected.html: Added.
* svg/animations/reset-animation-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143640 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Out-of-view fixed position check should not be affected by page scale at all on Mac
https://bugs.webkit.org/show_bug.cgi?id=110294
-and corresponding-
<rdar://problem/13247582>

Reviewed by Simon Fraser.

Source/WebCore: 

Don't scale the layerBounds. Generally, the layerBounds should be relative to the 
viewBounds which are also unscaled. Chromium used to want this behavior, but it is 
covered by their pageScaleFactorAppliedInCompositor implementation now.

* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::requiresCompositingForPosition):

LayoutTests: 

These layer results should be the same regardless of the scale factor.

* compositing/layer-creation/fixed-position-out-of-view-scaled-expected.txt:
* compositing/layer-creation/fixed-position-out-of-view-scaled-scroll-expected.txt:
* compositing/layer-creation/fixed-position-out-of-view-scaled-scroll.html:
* compositing/layer-creation/fixed-position-out-of-view-scaled.html:
* platform/chromium/compositing/layer-creation/fixed-position-out-of-view-scaled-expected.txt: Removed.
* platform/chromium/compositing/layer-creation/fixed-position-out-of-view-scaled-scroll-expected.txt: Removed.
* platform/mac-wk2/tiled-drawing/fixed/four-bars-zoomed-expected.txt:

Skip these on Chromium for now.
* platform/chromium/TestExpectations:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143641 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Simplify computation of screenRect/windowRect.
https://bugs.webkit.org/show_bug.cgi?id=110456

Patch by John Mellor <johnme@chromium.org> on 2013-02-21
Reviewed by Adam Barth.

This patch removes applyDeviceScaleFactorInCompositor checks
added by http://trac.webkit.org/changeset/139356 because
Chrome for Android now sizes its screen and window in DIP
units (like other platforms), so they are no longer necessary.

Source/WebCore:

No new tests, since this is just removing an unused codepath.

* platform/chromium/PlatformScreenChromium.cpp:
(WebCore::screenRect):
(WebCore::screenAvailableRect):
* rendering/TextAutosizer.cpp:
(WebCore::TextAutosizer::processSubtree):

Source/WebKit/chromium:

* src/ChromeClientImpl.cpp:
(WebKit::ChromeClientImpl::windowRect):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143642 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Convert buttons from DeprecatedFlexBox to nondeprecated FlexibleBox
https://bugs.webkit.org/show_bug.cgi?id=109994

Patch by Christian Biesinger <cbiesinger@chromium.org> on 2013-02-21
Reviewed by Ojan Vafai.

Source/WebCore:

Covered by existing tests for <button> and <input
type="button|submit|reset">

* css/html.css:
(input[type="button"], input[type="submit"], input[type="reset"], input[type="file"]::-webkit-file-upload-button, button):
Convert from box-align to align-items. We are using flex-start here in
conjunction with an auto margin for correct centering. See
RenderButton.cpp below for the margin & more explanation.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::createAnonymousWithParentRendererAndDisplay):
Add a case for creating a non-deprecated flex box.

* rendering/RenderButton.cpp:
(WebCore::RenderButton::RenderButton):
(WebCore::RenderButton::addChild):
(WebCore::RenderButton::removeChild):
Forward to new base class
(WebCore::RenderButton::styleWillChange):
(WebCore::RenderButton::setupInnerStyle):
We are now using flexbox properties.
- min-width is needed for correct shrinking of the contents
- margin-top and margin-bottom are used for correct centering. We
can't use align-items: center because results are incorrect when the
content overflows. See LayoutTests/fast/forms/control-clip.html

* rendering/RenderButton.h:
Inherit from RenderFlexibleBox

* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::createAnonymous):
(WebCore):
* rendering/RenderFlexibleBox.h:
(RenderFlexibleBox):
Add a createAnonymous function to RenderFlexibleBox.

LayoutTests:

* fast/flexbox/box-orient-button.html: Change -webkit-box to
-webkit-flex, and related changes.
* fast/flexbox/resources/box-orient-button.js:
(setFlexDirection): webkitBoxOrient -> webkitFlexDirection

* fast/replaced/table-percent-height.html: Give a value to the
<input type="button"> so that the layout doesn't change. No need to
change expectations because this test uses dumpAsText() and just
compares one button's height to another.

* http/tests/security/isolatedWorld/userGestureEvents.html: Add text
to the button so that sending the click event doesn't miss the
now-smaller button.
* http/tests/security/isolatedWorld/userGestureEvents-expected.txt:
Add that text to the expectation too.

* fast/forms/button-generated-content-expected.txt:
* platform/chromium-linux/css2.1/20110323/replaced-elements-001-expected.png:
* platform/chromium-linux/css2.1/20110323/replaced-elements-001-expected.txt:
* platform/chromium-linux/fast/forms/button-generated-content-expected.png:
* platform/chromium-linux/fast/forms/button-generated-content-expected.txt:
* platform/chromium-linux/fast/forms/select-baseline-expected.png:
* platform/chromium-linux/fast/forms/select-baseline-expected.txt:
* platform/chromium-linux/svg/custom/foreign-object-skew-expected.png:
* platform/chromium-linux/svg/custom/foreign-object-skew-expected.txt:
* platform/chromium-linux/tables/mozilla/bugs/bug92647-2-expected.png:
* platform/chromium-linux/tables/mozilla/bugs/bug92647-2-expected.txt:
* platform/mac/css2.1/20110323/replaced-elements-001-expected.txt:
* platform/mac/fast/forms/select-baseline-expected.txt:
* platform/mac/svg/custom/foreign-object-skew-expected.txt:
Rebaseline. Most changes come from the fact that an empty button now
consistently has a small height, when previously it would sometimes
have the height of the line. See this testcase:
https://bugs.webkit.org/attachment.cgi?id=188679
The new behavior is consistent with Firefox.

The only other difference is fast/forms/button-generated-content.html:
The empty buttons are now aligned on the baseline instead of being
vertically centered in the line. This is consistent with Firefox.

* platform/chromium/TestExpectations:
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:
Mark tests for rebaselining.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143643 268f45cc-cd09-0410-ab3c-d52691b4dbfc
XSSAuditor should block pages by redirecting to a sandboxed data: URL.
https://bugs.webkit.org/show_bug.cgi?id=110406

Reviewed by Adam Barth.

Source/WebCore:

Patch originally by mkwst@chromium.org.
Tests: http/tests/security/xssAuditor/block-does-not-leak-location.html
       http/tests/security/xssAuditor/block-does-not-leak-referrer.html
       http/tests/security/xssAuditor/full-block-script-tag-cross-domain.html

* html/parser/XSSAuditorDelegate.cpp:
(WebCore::XSSAuditorDelegate::didBlockScript):
    When blocking entire pages via the XSSAuditor, redirect to a data:
    URL to ensure that requests for properties don't leak information.

LayoutTests:

* http/tests/security/xssAuditor/block-does-not-leak-location-expected.txt: Added.
* http/tests/security/xssAuditor/block-does-not-leak-location.html: Added.
* http/tests/security/xssAuditor/block-does-not-leak-referrer-expected.txt: Added.
* http/tests/security/xssAuditor/block-does-not-leak-referrer.html: Added.
* http/tests/security/xssAuditor/full-block-base-href-expected.txt:
* http/tests/security/xssAuditor/full-block-base-href.html:
* http/tests/security/xssAuditor/full-block-get-from-iframe-expected.txt:
* http/tests/security/xssAuditor/full-block-iframe-javascript-url-expected.txt:
* http/tests/security/xssAuditor/full-block-iframe-javascript-url.html:
* http/tests/security/xssAuditor/full-block-iframe-no-inherit.php:
* http/tests/security/xssAuditor/full-block-javascript-link-expected.txt:
* http/tests/security/xssAuditor/full-block-javascript-link.html:
* http/tests/security/xssAuditor/full-block-link-onclick-expected.txt:
* http/tests/security/xssAuditor/full-block-link-onclick.html:
* http/tests/security/xssAuditor/full-block-object-tag-expected.txt:
* http/tests/security/xssAuditor/full-block-object-tag.html:
* http/tests/security/xssAuditor/full-block-post-from-iframe-expected.txt:
* http/tests/security/xssAuditor/full-block-script-tag-cross-domain-expected.txt: Added.
* http/tests/security/xssAuditor/full-block-script-tag-cross-domain.html: Added.
* http/tests/security/xssAuditor/full-block-script-tag-expected.txt:
* http/tests/security/xssAuditor/full-block-script-tag-with-source-expected.txt:
* http/tests/security/xssAuditor/full-block-script-tag-with-source.html:
* http/tests/security/xssAuditor/full-block-script-tag.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-1.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-2.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-3.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-4.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-5.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-6.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-7.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-8.html:
* http/tests/security/xssAuditor/malformed-xss-protection-header-9.html:
* http/tests/security/xssAuditor/report-script-tag-full-block-expected.txt:
* http/tests/security/xssAuditor/xss-protection-parsing-01-expected.txt:
* http/tests/security/xssAuditor/xss-protection-parsing-02.html:
* http/tests/security/xssAuditor/xss-protection-parsing-03-expected.txt:
* http/tests/security/xssAuditor/xss-protection-parsing-03.html:
* http/tests/security/xssAuditor/xss-protection-parsing-04-expected.txt:
* http/tests/security/xssAuditor/xss-protection-parsing-04.html:
    Rebaselined tests. Can no longer use final location of about:blank to
    indicate success.

* http/tests/security/xssAuditor/resources/utilities.js:
(checkIfFrameLocationMatchesSrcAndCallDone):
    Check final location against frame source (should only match when same
    origin and not blocked).

* http/tests/security/xssAuditor/resources/echo-intertag.pl:
    Clean up noise in httpd error log about undefined values.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143644 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add Apache's HashMap.java translated into JavaScript as a JSRegress test

Rubber stamped by Geoffrey Garen.
        
* fast/js/regress/HashMap-put-get-iterate-keys.html: Added.
* fast/js/regress/HashMap-put-get-iterate.html: Added.
* fast/js/regress/HashMap-string-put-get-iterate.html: Added.
* fast/js/regress/script-tests/HashMap-put-get-iterate-keys.js: Added.
(HashMap):
(HashMap.):
(get var):
* fast/js/regress/script-tests/HashMap-put-get-iterate.js: Added.
(HashMap):
(HashMap.):
(get var):
* fast/js/regress/script-tests/HashMap-string-put-get-iterate.js: Added.
(HashMap):
(HashMap.):
(get var):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143645 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r143419.
http://trac.webkit.org/changeset/143419
https://bugs.webkit.org/show_bug.cgi?id=110507

Broke border-image on Mac (Requested by jpfau on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-21

Source/WebCore:

* platform/graphics/GraphicsContext.cpp:
(WebCore::GraphicsContext::drawTiledImage):
* platform/graphics/GraphicsContext.h:
(GraphicsContext):
* platform/graphics/Image.cpp:
(WebCore::Image::drawTiled):
* platform/graphics/Image.h:
(Image):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintNinePieceImage):

LayoutTests:

* fast/borders/border-image-02.html: Removed.
* platform/chromium-linux/fast/borders/border-image-02-expected.png: Removed.
* platform/chromium/TestExpectations:
* platform/chromium/fast/borders/border-image-02-expected.txt: Removed.
* platform/efl/TestExpectations:
* platform/gtk/fast/borders/border-image-02-expected.png: Removed.
* platform/gtk/fast/borders/border-image-02-expected.txt: Removed.
* platform/mac-wk2/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:
* platform/win/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143646 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebalance the running times of JSRegress somewhat.

Rubber stamped by Mark Hahnenberg.

* fast/js/regress/script-tests/adapt-to-double-divide.js:
(foo):
* fast/js/regress/script-tests/array-access-polymorphic-structure.js:
* fast/js/regress/script-tests/int-overflow-local.js:
* fast/js/regress/script-tests/method-on-number.js:
(foo):
* fast/js/regress/script-tests/rare-osr-exit-on-local.js:
* fast/js/regress/script-tests/slow-convergence.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143647 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix duplicate TestExpecataions entry for svg/custom/foreign-object-skew.svg

Unreviewed gardening of TestExpecations

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Tune BackgroundHTMLParser's pendingTokenLimit based on a benchmark
https://bugs.webkit.org/show_bug.cgi?id=110408

Reviewed by Adam Barth.

This constant was tuned by running the top 25 sites in Telemetry on a Nexus 7 device.
The new value decreases the maximum time spent parsing by 40% without significantly impacting total parse time or DOMContentLoaded.

No new tests because no new functionality.

* html/parser/BackgroundHTMLParser.cpp:
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143649 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Plug-in snapshotting code always accepts first snapshot
https://bugs.webkit.org/show_bug.cgi?id=110495

Reviewed by Tim Horton.

When we detect a plugin that can be snapshotted we start capturing
images until we find one that we believe isn't blank, or we timeout.
I introduced a regression recently where we swap renderers as
soon as the snapshot arrives, whether or not is is blank.

The fix was to have the embedder (currently only WK2) be the one
who tells the HTMLPlugInElement to start displaying snapshots.

Source/WebCore:

* html/HTMLPlugInElement.h:
(WebCore::HTMLPlugInElement::setDisplayState): Make this a virtual function.
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::setDisplayState): Override to call the
    base class version, but swap renderers if we should move to the snapshot.
(WebCore::HTMLPlugInImageElement::updateSnapshot): Don't swap renderers here any more.
* html/HTMLPlugInImageElement.h: New virtual version of setDisplayState.

Source/WebKit2:

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::pluginSnapshotTimerFired): When we find a
snapshot that we like, tell the HTMLPlugInElement to move to
the snapshot view.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebaseline 4 SVG tests after an aspect ratio change in r143389

These 4 SVG tests needed a rebaseline after fixing WK99984.

Unreviewed rebaseline of test expectations.

* platform/chromium-linux/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:
* platform/chromium-linux/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:
* platform/chromium-mac-lion/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:
* platform/chromium-mac-lion/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:
* platform/chromium-mac-snowleopard/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:
* platform/chromium-mac-snowleopard/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:
* platform/chromium-mac/svg/as-image/image-preserveAspectRatio-all-expected.png: Added.
* platform/chromium-mac/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:
* platform/chromium-mac/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:
* platform/chromium-mac/svg/filters/feImage-preserveAspectRatio-all-expected.png: Added.
* platform/chromium-win/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:
* platform/chromium-win/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:
* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143651 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Autogenerate Settings that call setNeedsRecalcStyleInAllFrames when set
https://bugs.webkit.org/show_bug.cgi?id=109989

Reviewed by Ryosuke Niwa.

.:

Add setters to export symbols.

* Source/autotools/symbols.filter:

Source/WebCore:

Start generating the code for settings that call m_page->setNeedsRecalcStyleInAllFrames()
when the value is changed. This allows us to generate 10 more settings. As a follow up, we
can remove some methods from DRT/WTR after this.

No new tests, this is a build refactor and should not impact any test results.

* page/Settings.cpp:
(WebCore::Settings::Settings): Remove member variables. Add SETTINGS_SETTER_BODIES macro that
has the generated setter bodies.
* page/Settings.h:
(Settings): Remove code that is now generated.
* page/Settings.in: Add new entries with setNeedsStyleRecalcWhenSetting=1
* page/make_settings.pl:
(defaultItemFactory): Add setNeedsStyleRecalcWhenSetting flag.
(generateSettingsMacrosHeader): Print macro for setter bodies.
(printConditionalMacros): Add setter body code.
(printGettersAndSetters): Pass in setNeedsStyleRecalcWhenSetting so we know whether to inline the
setter in the header or not.
(printGetterAndSetter): Ditto.
(printSetterBodies): Print macro for setter bodies.
(printSetterBody): Print setter body for a single setting.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143652 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, roll chromium deps 183552 -> 183788

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143653 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should not change its mind about what type speculations a node does, by encoding the checks in the NodeType, UseKind, and ArrayMode
https://bugs.webkit.org/show_bug.cgi?id=109371

Reviewed by Oliver Hunt.
        
FixupPhase now locks in the speculations that each node will do. The DFG then
remembers those speculations, and doesn't change its mind about them even if the
graph is transformed - for example if a node's child is repointed to a different
node as part of CSE, CFG simplification, or folding. Each node ensures that it
executes the speculations promised by its edges. This is true even for Phantom
nodes.
        
This still leaves some craziness on the table for future work, like the
elimination of speculating SetLocal's due to CFG simplification
(webkit.org/b/109388) and elimination of nodes via DCE (webkit.org/b/109389).
        
In all, this allows for a huge simplification of the DFG. Instead of having to
execute the right speculation heuristic each time you want to decide what a node
does (for example Node::shouldSpeculateInteger(child1, child2) &&
node->canSpeculateInteger()), you just ask for the use kinds of its children
(typically node->binaryUseKind() == Int32Use). Because the use kinds are
discrete, you can often just switch over them. This makes many parts of the code
more clear than they were before.
        
Having UseKinds describe the speculations being performed also makes it far
easier to perform analyses that need to know what speculations are done. This is
so far only used to simplify large parts of the CFA.
        
To have a larger vocabulary of UseKinds, this also changes the node allocator to
be able to round up Node sizes to the nearest multiple of 16.
        
This appears to be neutral on benchmarks, except for some goofy speed-ups, like
8% on Octane/box2d.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::startExecuting):
(DFG):
(JSC::DFG::AbstractState::executeEdges):
(JSC::DFG::AbstractState::verifyEdge):
(JSC::DFG::AbstractState::verifyEdges):
(JSC::DFG::AbstractState::executeEffects):
(JSC::DFG::AbstractState::execute):
* dfg/DFGAbstractState.h:
(AbstractState):
(JSC::DFG::AbstractState::filterEdgeByUse):
(JSC::DFG::AbstractState::filterByType):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::filter):
* dfg/DFGAdjacencyList.h:
(JSC::DFG::AdjacencyList::AdjacencyList):
(JSC::DFG::AdjacencyList::child):
(JSC::DFG::AdjacencyList::setChild):
(JSC::DFG::AdjacencyList::reset):
(JSC::DFG::AdjacencyList::firstChild):
(JSC::DFG::AdjacencyList::setFirstChild):
(JSC::DFG::AdjacencyList::numChildren):
(JSC::DFG::AdjacencyList::setNumChildren):
(AdjacencyList):
* dfg/DFGAllocator.h:
(DFG):
(Allocator):
(JSC::DFG::Allocator::cellSize):
(JSC::DFG::Allocator::Region::headerSize):
(JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
(JSC::DFG::Allocator::Region::payloadSize):
(JSC::DFG::Allocator::Region::payloadBegin):
(JSC::DFG::Allocator::Region::payloadEnd):
(JSC::DFG::Allocator::Region::isInThisRegion):
(JSC::DFG::::Allocator):
(JSC::DFG::::~Allocator):
(JSC::DFG::::allocate):
(JSC::DFG::::free):
(JSC::DFG::::freeAll):
(JSC::DFG::::reset):
(JSC::DFG::::indexOf):
(JSC::DFG::::allocatorOf):
(JSC::DFG::::bumpAllocate):
(JSC::DFG::::freeListAllocate):
(JSC::DFG::::allocateSlow):
(JSC::DFG::::freeRegionsStartingAt):
(JSC::DFG::::startBumpingIn):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::addToGraph):
(JSC::DFG::ByteCodeParser::handleMinMax):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::setLocalStoreElimination):
(JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
(JSC::DFG::CSEPhase::setReplacement):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCommon.h:
(DFG):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
* dfg/DFGDriver.cpp:
(JSC::DFG::compile):
* dfg/DFGEdge.cpp:
(JSC::DFG::Edge::dump):
* dfg/DFGEdge.h:
(JSC::DFG::Edge::useKindUnchecked):
(JSC::DFG::Edge::useKind):
(JSC::DFG::Edge::shift):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::checkArray):
(JSC::DFG::FixupPhase::blessArrayOperation):
(JSC::DFG::FixupPhase::fixIntEdge):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
(FixupPhase):
(JSC::DFG::FixupPhase::truncateConstantToInt32):
(JSC::DFG::FixupPhase::truncateConstantsIfNecessary):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
* dfg/DFGGraph.cpp:
(DFG):
(JSC::DFG::Graph::refChildren):
(JSC::DFG::Graph::derefChildren):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::ref):
(JSC::DFG::Graph::deref):
(JSC::DFG::Graph::performSubstitution):
(JSC::DFG::Graph::isPredictedNumerical):
(JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
(DFG):
* dfg/DFGNode.h:
(JSC::DFG::Node::Node):
(JSC::DFG::Node::convertToGetByOffset):
(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::willHaveCodeGenOrOSR):
(JSC::DFG::Node::child1):
(JSC::DFG::Node::child2):
(JSC::DFG::Node::child3):
(JSC::DFG::Node::binaryUseKind):
(Node):
(JSC::DFG::Node::isBinaryUseKind):
* dfg/DFGNodeAllocator.h:
(DFG):
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::nodeFlagsAsString):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculationCheck):
(DFG):
(JSC::DFG::SpeculativeJIT::speculationWatchpoint):
(JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
(JSC::DFG::SpeculativeJIT::typeCheck):
(JSC::DFG::SpeculativeJIT::forwardTypeCheck):
(JSC::DFG::SpeculativeJIT::fillStorage):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
(JSC::DFG::SpeculativeJIT::compileAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::compileArithMod):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateInt32):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):
(JSC::DFG::SpeculativeJIT::speculateBoolean):
(JSC::DFG::SpeculativeJIT::speculateCell):
(JSC::DFG::SpeculativeJIT::speculateObject):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculateString):
(JSC::DFG::SpeculativeJIT::speculateNotCell):
(JSC::DFG::SpeculativeJIT::speculateOther):
(JSC::DFG::SpeculativeJIT::speculate):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
(JSC::DFG::SpeculativeJIT::needsTypeCheck):
(JSC::DFG::IntegerOperand::IntegerOperand):
(JSC::DFG::IntegerOperand::edge):
(IntegerOperand):
(JSC::DFG::IntegerOperand::node):
(JSC::DFG::IntegerOperand::gpr):
(JSC::DFG::IntegerOperand::use):
(JSC::DFG::JSValueOperand::JSValueOperand):
(JSValueOperand):
(JSC::DFG::JSValueOperand::edge):
(JSC::DFG::JSValueOperand::node):
(JSC::DFG::JSValueOperand::gpr):
(JSC::DFG::JSValueOperand::fill):
(JSC::DFG::JSValueOperand::use):
(JSC::DFG::StorageOperand::StorageOperand):
(JSC::DFG::StorageOperand::edge):
(StorageOperand):
(JSC::DFG::StorageOperand::node):
(JSC::DFG::StorageOperand::gpr):
(JSC::DFG::StorageOperand::use):
(JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
(SpeculateIntegerOperand):
(JSC::DFG::SpeculateIntegerOperand::edge):
(JSC::DFG::SpeculateIntegerOperand::node):
(JSC::DFG::SpeculateIntegerOperand::gpr):
(JSC::DFG::SpeculateIntegerOperand::use):
(JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
(SpeculateStrictInt32Operand):
(JSC::DFG::SpeculateStrictInt32Operand::edge):
(JSC::DFG::SpeculateStrictInt32Operand::node):
(JSC::DFG::SpeculateStrictInt32Operand::gpr):
(JSC::DFG::SpeculateStrictInt32Operand::use):
(JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
(SpeculateDoubleOperand):
(JSC::DFG::SpeculateDoubleOperand::edge):
(JSC::DFG::SpeculateDoubleOperand::node):
(JSC::DFG::SpeculateDoubleOperand::fpr):
(JSC::DFG::SpeculateDoubleOperand::use):
(JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
(SpeculateCellOperand):
(JSC::DFG::SpeculateCellOperand::edge):
(JSC::DFG::SpeculateCellOperand::node):
(JSC::DFG::SpeculateCellOperand::gpr):
(JSC::DFG::SpeculateCellOperand::use):
(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::edge):
(SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::node):
(JSC::DFG::SpeculateBooleanOperand::gpr):
(JSC::DFG::SpeculateBooleanOperand::use):
(DFG):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillInteger):
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillInteger):
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):
* dfg/DFGUseKind.cpp: Added.
(WTF):
(WTF::printInternal):
* dfg/DFGUseKind.h: Added.
(DFG):
(JSC::DFG::typeFilterFor):
(JSC::DFG::isNumerical):
(WTF):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::reportValidationContext):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143654 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Safari] Crash with opacity + drop shadow filter + child element extending beyond filter outsets
https://bugs.webkit.org/show_bug.cgi?id=107467

Source/WebCore:

Reviewed by Dean Jackson.

The filter code plays games with the current GraphicsContext, replacing the current
context with one which will get filtered.

This doesn't play nicely with the RenderLayer code which lazily starts transparency
layers. If we don't start a transparency layer until painting a child of the filtered
layer, then the transparency layer is started using the wrong context.

Fix by eagerly starting transparency layers if we have both a filter and opacity.

Test: css3/filters/filter-with-opacity-and-children.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::paintLayerContents):

LayoutTests:

Reviewed by Dean Jackson.

Testcase with filtered element with opacity, and layer child.

* css3/filters/filter-with-opacity-and-children-expected.txt: Added.
* css3/filters/filter-with-opacity-and-children.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143655 268f45cc-cd09-0410-ab3c-d52691b4dbfc