HeapTimer lifetime should be less complicated
https://bugs.webkit.org/show_bug.cgi?id=114529

Reviewed by Oliver Hunt.

Right now our HeapTimer lifetime is rather complicated. HeapTimers are "owned" by the JSGlobalData,
but there's an issue in that there can be races between a thread that is trying to tear down a JSGlobalData
and the HeapTimer's fire function. Our current code for tearing down HeapTimers is an intricate and delicate
dance which probably contains subtle bugs.

We can make our lives easier by changing things around a bit.

1) We should free the API lock from being solely owned by the JSGlobalData so we don't have to worry about
   grabbing the lock out of invalid memory when our HeapTimer callback fires.

2) We should also make it so that we deref the JSGlobalData first, then unlock the API lock so that when we
   have the lock, the JSGlobalData is in one of two states: fully valid or completely destroyed, and we know exactly which one.

3) The JSLock can tell us this information by keeping a back pointer to the JSGlobalData. When the JSGlobalData's
   destructor is called, it clears this pointer in the JSLock. Other clients of the API lock can then check
   this pointer to determine whether or not the JSGlobalData is still around.

4) The CFRunLoopTimer will use the API lock as its context rather than the HeapTimer itself. The only way
   the HeapTimer's callback can get to the HeapTimer is through the API lock's JSGlobalData pointer.

5) The CFRunLoopTimerContext struct has two fields for retain and release callbacks for the context's info field.
   We'll provide these callbacks to ref() and deref() the JSLock as necessary. Thus, the timer becomes the other
   owner of the JSLock apart from the JSGlobalData.

* API/APIShims.h: Remove the cruft that was required by the previous design, such as RefGlobalDataTag.
(JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
(JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
(APIEntryShimWithoutLock):
(JSC::APIEntryShim::APIEntryShim):
(JSC::APIEntryShim::~APIEntryShim): Protect the API lock with a RefPtr, deref the JSGlobalData, which could destroy it,
then unlock the API lock. This ordering prevents others from obtaining the API lock while the JSGlobalData is in the
middle of being torn down.
(JSC::APIEntryShim::init): We now take the lock, then ref the JSGlobalData, which is the opposite order of when we
tear down the shim.
* heap/Heap.cpp:
(JSC::Heap::setActivityCallback): Use PassOwnPtr now.
(JSC::Heap::activityCallback): Ditto.
(JSC::Heap::sweeper): Ditto.
(JSC):
* heap/Heap.h:
(Heap):
* heap/HeapTimer.cpp:
(JSC::retainAPILock): Retain callback for CFRunLoopTimerContext struct.
(JSC::releaseAPILock): Release callback for the CFRunLoopTimerContext struct.
(JSC::HeapTimer::HeapTimer): Use the API lock as the context's info field rather than the HeapTimer.
(JSC::HeapTimer::timerDidFire): Grab the API lock. Return early if the JSGlobalData has already been destroyed.
Otherwise, figure out which kind of HeapTimer we are based on the CFRunLoopTimerRef passed to the callback and
call the HeapTimer's callback.
* heap/HeapTimer.h:
(HeapTimer):
* heap/IncrementalSweeper.cpp:
(JSC::IncrementalSweeper::create): PassOwnPtr all the things.
* heap/IncrementalSweeper.h:
(IncrementalSweeper):
* jsc.cpp:
(jscmain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
* runtime/GCActivityCallback.h:
(DefaultGCActivityCallback):
(JSC::DefaultGCActivityCallback::create):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
(JSC::JSGlobalData::~JSGlobalData): Notify the API lock that the JSGlobalData is being torn down.
* runtime/JSGlobalData.h:
(JSGlobalData):
(JSC::JSGlobalData::apiLock):
* runtime/JSLock.cpp:
(JSC::JSLockHolder::JSLockHolder): Ref, then lock (just like the API shim).
(JSC):
(JSC::JSLock::willDestroyGlobalData):
(JSC::JSLockHolder::init):
(JSC::JSLockHolder::~JSLockHolder): Protect, deref, then unlock (just like the API shim).
(JSC::JSLock::JSLock):
* runtime/JSLock.h: Add back pointer to the JSGlobalData and a callback for when the JSGlobalData is being
torn down that clears this pointer to notify other clients (i.e. timer callbacks) that the JSGlobalData is no
longer valid.
(JSLockHolder):
(JSLock):
(JSC::JSLock::globalData):
* testRegExp.cpp:
(realMain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] build fix after r148434
https://bugs.webkit.org/show_bug.cgi?id=114647

Patch by Seokju Kwon <seokju.kwon@gmail.com> on 2013-04-15
Reviewed by Benjamin Poulain.

* UIProcess/API/efl/EwkView.cpp:
(EwkView::showContextMenu):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ScriptWrappable subclasses shouldn't have to include WeakInlines.h
https://bugs.webkit.org/show_bug.cgi?id=114641

Reviewed by Alexey Proskuryakov.

Source/JavaScriptCore:

Move back the Weak constructor, destructor and clear() to Weak.h. Add a new weakClearSlowCase function
and put it in Weak.cpp.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* heap/Weak.cpp: Added.
* heap/Weak.h:
* heap/WeakInlines.h:
* heap/WeakSetInlines.h:

Source/WebCore:

Remove ScriptWrappableInlines.h includes, they're not needed anymore.

* css/WebKitCSSMatrix.cpp:
* dom/ClientRect.cpp:
* dom/ClientRectList.cpp:
* dom/Clipboard.cpp:
* dom/DOMStringMap.cpp:
* dom/Event.cpp:
* dom/MutationRecord.cpp:
* fileapi/FileList.cpp:
* page/BarInfo.cpp:
* plugins/DOMMimeTypeArray.cpp:
* plugins/DOMPlugin.cpp:
* plugins/DOMPluginArray.cpp:
* storage/Storage.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148479 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove V8-specific extended attributes from IDL files
https://bugs.webkit.org/show_bug.cgi?id=114523

Reviewed by Geoffrey Garen.

No tests because no behavior change is expected.

* Modules/encryptedmedia/MediaKeyMessageEvent.idl:
* Modules/encryptedmedia/MediaKeyNeededEvent.idl:
* Modules/encryptedmedia/MediaKeySession.idl:
* Modules/encryptedmedia/MediaKeys.idl:
* Modules/filesystem/HTMLInputElementFileSystem.idl:
* Modules/indexeddb/IDBAny.idl:
* Modules/mediasource/MediaSource.idl:
* Modules/mediasource/SourceBuffer.idl:
* Modules/mediasource/SourceBufferList.idl:
* Modules/mediastream/MediaStream.idl:
* Modules/webaudio/AudioDestinationNode.idl:
* html/track/TextTrackCue.idl:
* html/track/TextTrackCueList.idl:
* html/track/TextTrackList.idl:
* html/track/TextTrackRegion.idl:
* html/track/TextTrackRegionList.idl:
* html/track/TrackEvent.idl:
* storage/Storage.idl:
* svg/SVGDocument.idl:
* svg/SVGElement.idl:
* workers/WorkerContext.idl:
* xml/XMLHttpRequest.idl:
* xml/XPathNSResolver.idl:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148480 268f45cc-cd09-0410-ab3c-d52691b4dbfc
activating a focused link to an in-page fragment ID should transfer focus to the target of the link when possible
https://bugs.webkit.org/show_bug.cgi?id=17450

Reviewed by Maciej Stachowiak.

Source/WebCore: 

When a fragment is scrolled to due to an activation event or on load, focus should attempt to 
move to the fragment if possible.

Test: fast/dom/fragment-activation-focuses-target.html

* page/FrameView.cpp:
(WebCore::FrameView::scrollToAnchor):

LayoutTests: 

* fast/dom/fragment-activation-focuses-target.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148481 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Plugins that resize might need to be snapshotted.
https://bugs.webkit.org/show_bug.cgi?id=102157
<rdar://problem/12696259>

Reviewed by Tim Horton.

Source/WebCore:

A plugin could avoid snapshotting if it started very
small (below the threshold where we autostart), and then
resized to be large (above the threshold). Detect this
case and tell the plugin to snapshot.

There unfortunately is a bit of state to track when doing
this. We have to start the snapshotting in a post-layout
task, so we carry a flag to say we're checking size but
not wanting the plugin to update (which would restart it).
We also might be a plugin that would have already restarted
due to a similar plugin being clicked or detected as dominant.
So this patch introduces a member variable that tracks what
decision has been made on snapshotting.

I also added some more logging to be more clear about what is
happening to plugins going through the snapshot process, and
changed the order of the tests in the algorithm so that domain
detection comes before examining the size.

* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement): Initialise
    the two new member variables.
(WebCore::HTMLPlugInImageElement::setDisplayState): Mark a restarted
    plugin as NeverSnapshot. This means that if it later resizes above the
    threshold, it won't trigger the snapshot detection.
(WebCore::HTMLPlugInImageElement::checkSnapshotStatus): Renamed from
    updateSnapshotInfo. This now updates the snapshot, but also runs
    the check for size changes.
(WebCore::addPlugInsFromNodeListMatchingPlugInOrigin): Gather all plugins
    that look like a restarting plugin, not just those snapshotted. That
    way they can all be marked as NeverSnapshot.
(WebCore::HTMLPlugInImageElement::restartSimilarPlugIns): Bless every
    plugin that looks similar, whether or not it is snapshotted.
(WebCore::HTMLPlugInImageElement::userDidClickSnapshot): More logging.
(WebCore::HTMLPlugInImageElement::setIsPrimarySnapshottedPlugIn): Ditto.
(WebCore::HTMLPlugInImageElement::checkSizeChangeForSnapshotting): New
    method. If the plugin was below the threshold and is now above it,
    begin the snapshotting process.
(WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Plugins
    that were marked as NeverSnapshot should start immediately. Move the origin
    test earlier in the method. If a plugin avoided snapshotting due to size,
    remember the size.
(WebCore::HTMLPlugInImageElement::subframeLoaderDidCreatePlugIn): Mark the
    plugin as NeverSnapshot.

* html/HTMLPlugInImageElement.h:
(HTMLPlugInImageElement): Four new member variables:
    - the decision we made regarding snapshotting (or not), uses the SnapshotDecision enum
    - the size when it avoided snapshotting
    - a flag to indicate the post layout update was triggered due to
      a size change
(WebCore::HTMLPlugInImageElement::needsCheckForSizeChange): New method.
(WebCore::HTMLPlugInImageElement::setNeedsCheckForSizeChange): New method.
(WebCore::HTMLPlugInImageElement::snapshotDecision): Return the decision
    regarding snapshotting or not snapshotting.

* page/FrameView.cpp:
(WebCore::FrameView::addWidgetToUpdate): Guard updating the widget. We don't
    want to do it when we're checking for a size change in the plugin.
(WebCore::FrameView::updateWidget): Call new name.

* plugins/PluginViewBase.h:
(WebCore::PluginViewBase::beginSnapshottingRunningPlugin): Empty virtual
    method to snapshot a running plugin.

* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::layout): If the plugin has increased in
    size add it to the post layout list so that it will be checked.

Source/WebKit2:

Allow a running plugin to be snapshotted. All this
means is that we start the snapshot timer again.

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::beginSnapshottingRunningPlugin): Restart
    the timer.
* WebProcess/Plugins/PluginView.h: Virtual method declaration.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebKit/mac: plugins/get-url-beforeunload-destroys-plugin.html crashes in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=114653
<rdar://problem/13659541>

Reviewed by Sam Weinig.

Protect the NetscapePluginInstanceProxy since it can otherwise go away.

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::performRequest):

LayoutTests: plugins/get-url-beforeunload-destroys-plugin.html crashes in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=114653

Reviewed by Sam Weinig.

Move this test back now that it passes in WK1.

* http/tests/plugins/get-url-beforeunload-destroys-plugin-expected.txt: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/get-url-beforeunload-destroys-plugin-expected.txt.
* http/tests/plugins/get-url-beforeunload-destroys-plugin.html: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/get-url-beforeunload-destroys-plugin.html.
* http/tests/plugins/resources/notify-done.html: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/resources/notify-done.html.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148483 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit should not expose AXSubrole:AXDescriptionList on Mountain Lion as it causes a regression in VoiceOver behavior
https://bugs.webkit.org/show_bug.cgi?id=113975

Patch by James Craig <james@cookiecrook.com> on 2013-04-15
Reviewed by Chris Fleizach.

Serve NSAccessibilityDescriptionListSubrole or NSAccessibilityDefinitionListSubrole
depending on platform. Updated existing test coverage.

Source/WebCore:

* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper subrole]):

LayoutTests:

* platform/mac/accessibility/lists-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148484 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove V8 attribtues from IDLAttributes.txt
https://bugs.webkit.org/show_bug.cgi?id=114651

Reviewed by Sam Weinig.

No tests because no behavior change is expected.

* bindings/scripts/IDLAttributes.txt: Remove V8 attribtues.
* html/track/TextTrackList.idl: Remove a stray V8-specific attribute
(so I guess this change is not useless)


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148486 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rename restartedPlugin to isRestartedPlugin. This was
review feedback from r148038 that I thought I fixed
everywhere but failed.
https://bugs.webkit.org/show_bug.cgi?id=114233

* html/HTMLPlugInElement.h:
(WebCore::HTMLPlugInElement::isRestartedPlugin): Prefix with "is".
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
(WebCore::HTMLPlugInImageElement::setDisplayState):
(WebCore::HTMLPlugInImageElement::removeSnapshotTimerFired):
* html/HTMLPlugInImageElement.h:
* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::paintContents):
* rendering/RenderLayerBacking.cpp:
(WebCore::isRestartedPlugin):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148487 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r148462.
http://trac.webkit.org/changeset/148462
https://bugs.webkit.org/show_bug.cgi?id=114658

Broke Windows builds (Requested by rniwa on #webkit).


* wtf/FastMalloc.cpp:
(WTF):
(WTF::setThreadHeap):
(WTF::TCMalloc_ThreadCache::GetThreadHeap):
(WTF::TCMalloc_ThreadCache::InitTSD):
* wtf/ThreadSpecificWin.cpp:
(WTF::destructorsList):
(WTF::destructorsMutex):
(WTF::threadSpecificKeyCreate):
(WTF::threadSpecificKeyDelete):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Windows clean build fix after r148479.

* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
* JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148489 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r148488.
http://trac.webkit.org/changeset/148488
https://bugs.webkit.org/show_bug.cgi?id=114660

Roll back in r148462 since it was a false positive. (Requested
by rniwa on #webkit).


* wtf/FastMalloc.cpp:
(WTF):
(WTF::setThreadHeap):
(WTF::TCMalloc_ThreadCache::GetThreadHeap):
(WTF::TCMalloc_ThreadCache::InitTSD):
* wtf/ThreadSpecificWin.cpp:
(WTF::destructorsList):
(WTF::destructorsMutex):
(WTF::threadSpecificKeyCreate):
(WTF::threadSpecificKeyDelete):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148490 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Add missing Localized strings
https://bugs.webkit.org/show_bug.cgi?id=114656

Patch by Seokju Kwon <seokju.kwon@gmail.com> on 2013-04-15
Reviewed by Timothy Hatcher.

No tests because no behavior change is expected.

* English.lproj/localizedStrings.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148494 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Make var and function declarations work again in the Console.

https://webkit.org/b/114534
rdar://problem/13614477

Reviewed by Oliver Hunt.

Source/WebCore:

* inspector/InjectedScriptSource.js:
(InjectedScript.prototype._evaluateOn): Use 'with' when not evaluating
on a call frame.

LayoutTests:

* inspector/console/command-line-api-expected.txt:
* inspector/console/console-eval-syntax-error-expected.txt:
* inspector/extensions/extensions-eval-expected.txt:
* platform/mac/http/tests/inspector/console-resource-errors-expected.txt:
Updated test results.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Potential use after free in ApplyStyleCommand::splitAncestorsWithUnicodeBidi
https://bugs.webkit.org/show_bug.cgi?id=114664

Reviewed by Oliver Hunt.

Use RefPtr as needed.

No new tests since this bug was discovered by code inspection.

* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148497 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Isolate Early Warning System definitions into a JSON
https://bugs.webkit.org/show_bug.cgi?id=114558

Reviewed by Benjamin Poulain.

Added ews.json to common/config, and made tool/commands/__init__.py call
AbstractEarlyWarningSystem.load_ews_classes to instantiate classes based on ews.json.

* Scripts/webkitpy/common/config/ews.json: Extracted from earlywarningsystem.py.
* Scripts/webkitpy/tool/commands/__init__.py:
* Scripts/webkitpy/tool/commands/earlywarningsystem.py:
(AbstractEarlyWarningSystem):
(AbstractEarlyWarningSystem.__init__):
(AbstractEarlyWarningSystem.load_ews_classes): Added. Loads ews.json.
* Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
(EarlyWarningSystemTest._default_expected_logs):
(_test_ews):
(test_ewses):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148498 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Unreviewed gardening.

* platform/qt/TestExpectations: Skipped a failing test after r148203. Unskip now passing test after r147619.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148499 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: [Network] Cover the type of preflight xhr.
https://bugs.webkit.org/show_bug.cgi?id=113471.

Patch by Pan Deng <pan.deng@intel.com> on 2013-04-16
Reviewed by Vsevolod Vlasov.

Add the Network resource type test to make sure the xhr-preflight is "xhr".

* http/tests/inspector/network-preflight-options-expected.txt:
* http/tests/inspector/network-preflight-options.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148500 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r148498.
http://trac.webkit.org/changeset/148498
https://bugs.webkit.org/show_bug.cgi?id=114669

Appears to have broken EWS (Requested by rniwa on #webkit).

* Scripts/webkitpy/common/config/ews.json: Removed.
* Scripts/webkitpy/tool/commands/__init__.py:
* Scripts/webkitpy/tool/commands/earlywarningsystem.py:
(AbstractEarlyWarningSystem):
(AbstractEarlyWarningSystem.__init__):
(AbstractEarlyWarningSystem.handle_script_error.does):
(GtkEWS):
(GtkWK2EWS):
(EflEWS):
(QtEWS):
(QtWK2EWS):
(WinEWS):
(MacEWS):
(MacWK2EWS):
* Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
(EarlyWarningSystemTest._default_expected_logs):
(_test_ews):
(test_ewses):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148501 268f45cc-cd09-0410-ab3c-d52691b4dbfc