Strange bug in DFG OSR in JSC
https://bugs.webkit.org/show_bug.cgi?id=109491

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
inject something just before a SetLocal we should be aware that the previous operation may have been
a side-effect associated with the current code origin. Hence, we should use a forward exit.
Int32ToDouble does not do forward exits by default.
        
This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
signaling exit direction is not "great" but it's what we use in other places already (like
ForwardCheckStructure).

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::int32ToDoubleCSE):
(CSEPhase):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCommon.h:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::willHaveCodeGenOrOSR):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStream::reconstruct):

LayoutTests: 

Reviewed by Mark Hahnenberg.
        
Added one version of the test (dfg-int32-to-double-on-set-local-and-exit) that is based
exactly on Gabor's original test, and another that ought to fail even if I fix other bugs
in the future (see https://bugs.webkit.org/show_bug.cgi?id=109511).

* fast/js/dfg-int32-to-double-on-set-local-and-exit-expected.txt: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-exit.html: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-sometimes-exit-expected.txt: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-sometimes-exit.html: Added.
* fast/js/script-tests/dfg-int32-to-double-on-set-local-and-exit.js: Added.
(checkpoint):
(func1):
(func2):
(func3):
(test):
* fast/js/script-tests/dfg-int32-to-double-on-set-local-and-sometimes-exit.js: Added.
(checkpoint):
(func1):
(func2):
(func3):
(test):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142544 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WEBGL_compressed_texture_s3tc extension can be enabled even when not supported
https://bugs.webkit.org/show_bug.cgi?id=109508

Reviewed by Kenneth Russell.

* html/canvas/WebGLRenderingContext.cpp:
(WebCore):
(WebCore::WebGLRenderingContext::getExtension): Check whether the extension support is there before returning the extension pointer.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142545 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make WebCore Derived Sources work with SDK identifiers too
https://bugs.webkit.org/show_bug.cgi?id=109324

Patch by David Farler <dfarler@apple.com> on 2013-02-11
Reviewed by Sam Weinig.

* WebCore.xcodeproj/project.pbxproj: Pass SDKROOT to make for DerivedSources.make

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142546 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix Mac build after http://trac.webkit.org/changeset/142535.

Unreviewed build fix.

* html/parser/HTMLTokenizer.h:
(WebCore::HTMLTokenizer::emitAndReconsumeIn):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142547 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVG DOM manipulation crash
https://bugs.webkit.org/show_bug.cgi?id=108709

Reviewed by Eric Seidel.

Adding a test for the case where an SVG <use> tree is rebuild due to
one event listener and a subsequent listener tries to access it. This
does not crash in WebKit but has caused problems in browser code where
the listener tries to access and use toNode on the target of the
event. The test prevents regressions and gives automated security
tests something to work on.

* svg/custom/use-listener-append-crash-expected.txt: Added.
* svg/custom/use-listener-append-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142548 268f45cc-cd09-0410-ab3c-d52691b4dbfc