svg/animations/smil-leak-*.svg tests are flaky
https://bugs.webkit.org/show_bug.cgi?id=114280

Approved in person by Geoff Garen.

Increased the number of nodes in the test 10x to see what happens with the number
of leaked nodes.

* svg/animations/smil-leak-dynamically-added-element-instances.svg:
* svg/animations/smil-leak-element-instances-noBaseValRef.svg:
* svg/animations/smil-leak-element-instances.svg:
* svg/animations/smil-leak-elements.svg:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155728 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use nullptr instead of 0 in calls to HashMap::add
https://bugs.webkit.org/show_bug.cgi?id=121322

Reviewed by Sam Weinig.

Source/JavaScriptCore:

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitLoad):
(JSC::BytecodeGenerator::addStringConstant):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::cellConstant):

Source/WebCore:

* bridge/IdentifierRep.cpp:
(WebCore::IdentifierRep::get):
* css/CSSFontFaceSource.cpp:
(WebCore::CSSFontFaceSource::getFontData):
* css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::getFontFace):
* css/CSSSegmentedFontFace.cpp:
(WebCore::CSSSegmentedFontFace::getFontData):
* css/CSSValuePool.cpp:
(WebCore::CSSValuePool::createFontFamilyValue):
(WebCore::CSSValuePool::createFontFaceValue):
* dom/ChildListMutationScope.cpp:
(WebCore::ChildListMutationAccumulator::getOrCreate):
* dom/Document.cpp:
(WebCore::Document::getCSSCanvasElement):
* dom/NodeRareData.h:
(WebCore::NodeListsNodeData::addCacheWithAtomicName):
(WebCore::NodeListsNodeData::addCacheWithName):
(WebCore::NodeListsNodeData::addCacheWithQualifiedName):
* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
* page/PageGroup.cpp:
(WebCore::PageGroup::pageGroup):
* page/animation/AnimationController.cpp:
(WebCore::AnimationControllerPrivate::ensureCompositeAnimation):
* platform/mac/ScrollbarThemeMac.mm:
(WebCore::ScrollbarThemeMac::registerScrollbar):
* storage/StorageNamespaceImpl.cpp:
(WebCore::StorageNamespaceImpl::localStorageNamespace):

Source/WebKit/mac:

* Plugins/Hosted/NetscapePluginHostManager.mm:
(WebKit::NetscapePluginHostManager::hostForPlugin):

Source/WebKit2:

* Platform/CoreIPC/Connection.cpp:
(CoreIPC::Connection::SyncMessageState::getOrCreate):
* UIProcess/Storage/StorageManager.cpp:
(WebKit::StorageManager::createLocalStorageMap):
(WebKit::StorageManager::createSessionStorageMap):
(WebKit::StorageManager::getOrCreateLocalStorageNamespace):
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::addBackForwardItem):
* WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:
(WebKit::InjectedBundleNodeHandle::getOrCreate):
* WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:
(WebKit::InjectedBundleRangeHandle::getOrCreate):
* WebProcess/Storage/StorageNamespaceImpl.cpp:
(WebKit::StorageNamespaceImpl::createLocalStorageNamespace):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::createWebPage):
(WebKit::WebProcess::webPageGroup):

Tools:

* DumpRenderTree/mac/TestRunnerMac.mm:
(TestRunner::evaluateScriptInIsolatedWorld):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::evaluateScriptInIsolatedWorld):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155729 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
https://bugs.webkit.org/show_bug.cgi?id=121330

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg and Oliver Hunt.
        
Also print whether a function is strict mode in debug dumps.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpAssumingJITType):
* bytecode/CodeOrigin.cpp:
(JSC::InlineCallFrame::dumpInContext):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

Tools: 

Reviewed by Mark Hahnenberg and Oliver Hunt.

We should run tests even if they don't have expected files yet.
        
* Scripts/run-layout-jsc:

LayoutTests: 

Reviewed by Mark Hahnenberg and Oliver Hunt.

* js/dfg-strict-mode-to-this-expected.txt: Added.
* js/dfg-strict-mode-to-this.html: Added.
* js/jsc-test-list:
* js/script-tests/dfg-strict-mode-to-this.js: Added.
(thingy.bar):
(thingy.foo):
(thingy):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155730 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Chrome, DragController and FocusController should hold onto a Page&
https://bugs.webkit.org/show_bug.cgi?id=121325

Reviewed by Anders Carlsson.

* editing/FrameSelection.cpp:
* editing/FrameSelection.h:
* page/Chrome.cpp:
(WebCore::Chrome::Chrome):
(WebCore::Chrome::scroll):
(WebCore::Chrome::createWindow):
(WebCore::canRunModalIfDuringPageDismissal):
(WebCore::Chrome::runBeforeUnloadConfirmPanel):
(WebCore::Chrome::runJavaScriptAlert):
(WebCore::Chrome::runJavaScriptConfirm):
(WebCore::Chrome::runJavaScriptPrompt):
(WebCore::Chrome::mouseDidMoveOverElement):
(WebCore::Chrome::setToolTip):
(WebCore::Chrome::windowScreenDidChange):
* page/Chrome.h:
* page/DragController.cpp:
* page/DragController.h:
* page/mac/DragControllerMac.mm:
* page/FocusController.cpp:
* page/FocusController.h:
* page/Page.cpp:
(WebCore::Page::Page):
* page/PageGroupLoadDeferrer.cpp:
* page/PageGroupLoadDeferrer.h:
Take references where possible.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155731 268f45cc-cd09-0410-ab3c-d52691b4dbfc
http/tests/misc/submit-post-keygen.html is extremely slow on bots, often timing out
https://bugs.webkit.org/show_bug.cgi?id=121331

* platform/mac/TestExpectations: Marked the test as sometimes timing out.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155732 268f45cc-cd09-0410-ab3c-d52691b4dbfc
svg/dom/SVGScriptElement/script-load-and-error-events.svg is flakey
https://bugs.webkit.org/show_bug.cgi?id=25817

Reviewed by Tim Horton.

* svg/dom/SVGScriptElement/script-load-and-error-events.svg: Let test 5 finish
before starting test 6.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155733 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Avoid a couple of zero-sized fastMalloc calls
https://bugs.webkit.org/show_bug.cgi?id=121333

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

* API/JSStringRefCF.cpp:
(JSStringCopyCFString):
Return an empty constant CFStringRef if the JSStringRef is empty.

* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::JSPropertyNameIterator):
Don't allocate an empty m_jsStrings array if m_jsStringsSize is 0.

Source/WTF:

* wtf/text/StringBuffer.h:
(WTF::StringBuffer::StringBuffer):
Initialize m_data to null if m_length is null, and use Checked<size_t> to check for
overflow when multiplying m_length with the character size.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155734 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL JIT broke after r155711
https://bugs.webkit.org/show_bug.cgi?id=121332

Reviewed by Geoffrey Garen.

Fixed OSR entry to use the local variable's index instead of its VirtualRegister.
Initialized ExitArgumentForOperand::m_operand to InvalidVirtualRegister instead of -1.
Fixed compileCallOrConstruct() to update locals on callframe going down.
Fixed prepareOSREntry() to grow stack down if needed.

* ftl/FTLExitArgumentForOperand.h:
(JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
(JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
* ftl/FTLOSREntry.cpp:
(JSC::FTL::prepareOSREntry):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155735 268f45cc-cd09-0410-ab3c-d52691b4dbfc