[Qt] unreviewed gardening. Rebaseline after r155253.

* platform/qt-wk2/editing/selection/caret-rtl-2-expected.png: Removed.
* platform/qt-wk2/editing/selection/caret-rtl-2-left-expected.png: Removed.
* platform/qt-wk2/editing/selection/caret-rtl-expected.png: Removed.
* platform/qt-wk2/editing/selection/caret-rtl-right-expected.png: Removed.
* platform/qt-wk2/editing/selection/caret-rtl-right-expected.txt: Removed.
* platform/qt/editing/selection/caret-rtl-2-expected.txt:
* platform/qt/editing/selection/caret-rtl-2-left-expected.txt:
* platform/qt/editing/selection/caret-rtl-expected.txt:
* platform/qt/editing/selection/caret-rtl-right-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed fix after r155675. Move new tests from fast/js to js.

* js/array-with-double-assign-expected.txt: Renamed from LayoutTests/fast/js/array-with-double-assign-expected.txt.
* js/array-with-double-assign.html: Renamed from LayoutTests/fast/js/array-with-double-assign.html.
* js/array-with-double-push-expected.txt: Renamed from LayoutTests/fast/js/array-with-double-push-expected.txt.
* js/array-with-double-push.html: Renamed from LayoutTests/fast/js/array-with-double-push.html.
* js/script-tests/array-with-double-assign.js: Renamed from LayoutTests/fast/js/script-tests/array-with-double-assign.js.
(foo):
* js/script-tests/array-with-double-push.js: Renamed from LayoutTests/fast/js/script-tests/array-with-double-push.js.
(foo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Update sync.profile
https://bugs.webkit.org/show_bug.cgi?id=121295

Reviewed by Simon Hausmann.

Ensure we let the dependencies pick the right branch instead of always master
and list all the dependencies we need on all platforms.

* Source/sync.profile:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
One more Unreviewed fix after r155675.

* js/array-with-double-assign-expected.txt:
* js/array-with-double-assign.html: Path fixed.
* js/array-with-double-push-expected.txt:
* js/array-with-double-push.html: Path fixed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155695 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] RenderSVGViewportContainer always has a SVGSVGElement.
<https://webkit.org/b/121297>

Reviewed by Antti Koivisto.

This renderer is never anonymous, and always has a corresponding <svg> element.
Tighten this up and remove some pointless null checks and type checks.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155696 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove support for QXmlStream as the XML parser.
https://bugs.webkit.org/show_bug.cgi?id=121229

Reviewed by Andreas Kling.

Source/WebCore:

Remove the implementation and all the #ifdef related to it.

* Target.pri:
* WebCore.pri:
* dom/TransformSource.h:
* xml/XMLErrors.h:
* xml/XSLStyleSheet.h:
* xml/XSLTProcessor.h:
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::enterText):
(WebCore::toString):
(WebCore::XMLDocumentParser::exitText):
(WebCore::XMLDocumentParser::insertErrorMessageBlock):
* xml/parser/XMLDocumentParser.h:
* xml/parser/XMLDocumentParserQt.cpp: Removed.

Source/WebKit/blackberry:

Removed USE flags.

* WebCoreSupport/AboutDataUseFeatures.in:

Source/WTF:

Removed USE flags.

* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155697 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] RenderSVGText always has a SVGTextElement.
<https://webkit.org/b/121299>

Reviewed by Antti Koivisto.

This renderer is never anonymous, and always has a corresponding <svg> element.
Tighten this up and remove some pointless assertions.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] REGRESSION(r154444): xss-DENIED test results changed
https://bugs.webkit.org/show_bug.cgi?id=120595

Reviewed by Jocelyn Turcotte.

Tools:

Avoid overwriting Qt meta properties, which we identify by them being undeletable.

* DumpRenderTree/qt/DumpRenderTreeQt.cpp:
(DumpRenderTree::initJSObjects):

LayoutTests:

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Finish removing layer-violating code from Pasteboard (just for Mac during this first step)
https://bugs.webkit.org/show_bug.cgi?id=121279

Reviewed by Anders Carlsson.

* editing/Editor.h: Added webContentFromPasteboard member function, private nested class
WebContentReader, private createFragmentForImageResourceAndAddResource and
createFragmentAndAddResources member functions.

* editing/mac/EditorMac.mm: Re-sorted includes and added some.
(WebCore::Editor::pasteWithPasteboard): Call the new webContentFromPasteboard function.
(WebCore::Editor::insertParagraphSeparatorInQuotedContent): Comment tweak.
(WebCore::styleForSelectionStart): Removed an unneeded call to String::impl.
(WebCore::Editor::readPlainTextFromPasteboard): Updated to use an isURL boolean instead
of a separate string named "url".
(WebCore::Editor::WebContentReader::readWebArchive): Added. Contains reworked code that
was originally in Pasteboard::documentFragment.
(WebCore::Editor::WebContentReader::readFilenames): Ditto.
(WebCore::Editor::WebContentReader::readHTML): Ditto.
(WebCore::Editor::WebContentReader::readRTFD): Ditto.
(WebCore::Editor::WebContentReader::readRTF): Ditto.
(WebCore::Editor::WebContentReader::readImage): Ditto.
(WebCore::Editor::WebContentReader::readURL): Ditto.
(WebCore::Editor::WebContentReader::readPlainText): Ditto.
(WebCore::Editor::webContentFromPasteboard): Added. Uses WebContentReader to read the
content from the pasteboard.
(WebCore::Editor::createFragmentForImageResourceAndAddResource): Added. Helper used
by code above.
(WebCore::Editor::createFragmentAndAddResources): Ditto.

* platform/Pasteboard.h: Added new PasteboardWebContentReader abstract class so
client can get the various types of pasteboard content and stop on the kind it
can handle. Improved comments and formatting a bit. Removed documentFragment
when compiling for PLATFORM(MAC).

* platform/mac/DragDataMac.mm:
(WebCore::DragData::asFragment): Changed to use Editor::webContentFromPasteboard.

* platform/mac/PasteboardMac.mm:
(WebCore::Pasteboard::read): Updated the plain text overload of this for changes
to the struct that holds the result. Added a new web content overload of this,
which retains the pasteboard-reading part of Pasteboard::documentFragment, but
omits the document fragment construction part.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155700 268f45cc-cd09-0410-ab3c-d52691b4dbfc
OwnArrayPtr: Never allow implicit pointer conversion
https://bugs.webkit.org/show_bug.cgi?id=121291

Reviewed by Anders Carlsson.

We should never allow implicit pointer conversion in OwnArrayPtr
and remove its template copy constructor & template assignment operator, as:
- these methods are never used
- these methods are inappropriate to have in OwnArrayPtr as arrays do not
  interact well with polymorphism.

* wtf/OwnArrayPtr.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build with namespaced Qt.

Unreviewed build fix.

One forward declaration of QUrl was missing proper namespace macros.

* UIProcess/API/qt/qquickurlschemedelegate_p.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155702 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] RenderSVGResourceFilterPrimitive always has an SVGFilterPrimitiveStandardAttributes.
<https://webkit.org/b/121300>

Reviewed by Anders Carlsson.

This renderer is never anonymous, and always has a corresponding SVGFilterPrimitiveStandardAttributes element.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155703 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] Tighter element types for RenderSVGShape and subclasses.
<https://webkit.org/b/121302>

Reviewed by Antti Koivisto.

Codify the following:

- RenderSVGPath always has an SVGGraphicsElement.
- RenderSVGEllipse always has an SVGGraphicsElement.
- RenderSVGRect always has an SVGRectElement.
- RenderSVGShape always has an SVGGraphicsElement.

None of these renderers are ever anonymous, so delete element() and provide
strongly typed reference getters instead.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155704 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ARM EABI hardfp buildfix after r155675
https://bugs.webkit.org/show_bug.cgi?id=121287

Reviewed by Geoffrey Garen.

* dfg/DFGCCallHelpers.h:
(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155705 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] RenderSVGImage always has a SVGImageElement.
<https://webkit.org/b/121301>

Reviewed by Anders Carlsson.

This renderer is never anonymous, and always has a corresponding SVGImageElement.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155706 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CTTE] RenderSVGTransformableContainer is never anonymous.
<https://webkit.org/b/121304>

Reviewed by Anders Carlsson.

This renderer is never anonymous. Tighten things up with a graphicsElement()
reference getter.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155707 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: AXPress does not work in SVG
https://bugs.webkit.org/show_bug.cgi?id=121248

Reviewed by Mario Sanchez Prada.

Source/WebCore: 

Implement accessKeyAction() on SVGElements, which is what accessibility code
uses in order to activate Elements.

Test: accessibility/svg-element-press.html

* svg/SVGElement.cpp:
(WebCore::SVGElement::accessKeyAction):
* svg/SVGElement.h:

LayoutTests: 

* accessibility/svg-element-press-expected.txt: Added.
* accessibility/svg-element-press.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155708 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove layering-violating Pasteboard::writeURL (for all platforms now)
https://bugs.webkit.org/show_bug.cgi?id=121306

Reviewed by Antti Koivisto.

* editing/Editor.cpp:
(WebCore::Editor::copyURL): Move the contents of the writeURLToPasteboard function
in here.

* editing/Editor.h: Removed Mac-specific writeURLToPasteboard, added private
Mac-specific fillInUserVisibleForm function for the one Mac-specific part of writing URLs.

* editing/efl/EditorEfl.cpp: Deleted Editor::writeURLToPasteboard.

* editing/mac/EditorMac.mm: Deleted Editor::writeURLToPasteboard, moving the code
into copyURL.
(WebCore::Editor::fillInUserVisibleForm): Added.

* page/DragController.cpp:
(WebCore::DragController::startDrag): Call copyURL instead of writeURL or
writeURLToPasteboard.

* platform/Pasteboard.h: Fixed up the PasteboardURL struct so it's suitable for
cross-platform use. Removed the writeURL function. Removed the Frame* argument from
the Windows-specific writeURLToDataObject function.

* platform/blackberry/PasteboardBlackBerry.cpp:
(WebCore::Pasteboard::write): Renamed/refactored from writeURL.
* platform/gtk/PasteboardGtk.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/nix/PasteboardNix.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/qt/PasteboardQt.cpp:
(WebCore::Pasteboard::write): Ditto.
* platform/win/PasteboardWin.cpp:
(WebCore::Pasteboard::writeURLToDataObject): Removed unused Frame* argument.
(WebCore::Pasteboard::write): Renamed/refactored from writeURL.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155709 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move LineLayoutState class to LineLayoutState.h
https://bugs.webkit.org/show_bug.cgi?id=121263

Reviewed by Ryosuke Niwa.

I added bitfields, reordered the members and a functions too.

No new tests, no behavior change.

* rendering/LineLayoutState.h: Added.
(WebCore::LineLayoutState::LineLayoutState):
(WebCore::LineLayoutState::markForFullLayout):
(WebCore::LineLayoutState::isFullLayout):
(WebCore::LineLayoutState::usesRepaintBounds):
(WebCore::LineLayoutState::setRepaintRange):
(WebCore::LineLayoutState::updateRepaintRangeFromBox):
(WebCore::LineLayoutState::endLineMatched):
(WebCore::LineLayoutState::setEndLineMatched):
(WebCore::LineLayoutState::checkForFloatsFromLastLine):
(WebCore::LineLayoutState::setCheckForFloatsFromLastLine):
(WebCore::LineLayoutState::lineInfo):
(WebCore::LineLayoutState::endLineLogicalTop):
(WebCore::LineLayoutState::setEndLineLogicalTop):
(WebCore::LineLayoutState::endLine):
(WebCore::LineLayoutState::setEndLine):
(WebCore::LineLayoutState::lastFloat):
(WebCore::LineLayoutState::setLastFloat):
(WebCore::LineLayoutState::floats):
(WebCore::LineLayoutState::floatIndex):
(WebCore::LineLayoutState::setFloatIndex):
(WebCore::LineLayoutState::adjustedLogicalLineTop):
(WebCore::LineLayoutState::setAdjustedLogicalLineTop):
(WebCore::LineLayoutState::flowThread):
(WebCore::LineLayoutState::setFlowThread):
* rendering/RenderBlockLineLayout.cpp: Remove LineLayoutState.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155710 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fourthTier: Change JSStack to grow from high to low addresses
https://bugs.webkit.org/show_bug.cgi?id=118758

Reviewed by Oliver Hunt.

Changed the JSC stack to grow down.  Effectively the JSC stack frame is flipped from
what it was.  See JSStack.h for the new offsets.  Changed JSStack begin() and end()
to be getBaseOfStack() and getLimitOfStack().  Most of the changes are address or offset
calculation changes.  Decoupled a local register ordinal (loop variable or array index)
from the offset into the callFrame using localToOperand() and the inverse operandToLocal().

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::trustedImm32ForShift):
(JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index
* assembler/X86Assembler.h:
(JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecode/CodeBlock.h:
(JSC::unmodifiedArgumentsRegister):
(JSC::CodeBlock::isCaptured):
* bytecode/CodeOrigin.h:
(JSC::CodeOrigin::stackOffset):
* bytecode/Operands.h:
(JSC::localToOperand):
(JSC::operandIsLocal):
(JSC::operandToLocal):
(JSC::operandIsArgument):
(JSC::operandToArgument):
(JSC::argumentToOperand):
* bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in
31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addVar):
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
(JSC::BytecodeGenerator::newRegister):
(JSC::BytecodeGenerator::emitNewArray):
* bytecompiler/BytecodeGenerator.h:
(JSC::CallArguments::registerOffset):
* bytecompiler/NodesCodegen.cpp:
(JSC::CallArguments::CallArguments):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileFunction):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOperations.cpp:
* dfg/DFGScoreBoard.h:
(JSC::DFG::ScoreBoard::allocate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callFrameSlot):
(JSC::DFG::SpeculativeJIT::argumentSlot):
(JSC::DFG::SpeculativeJIT::callFrameTagSlot):
(JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
(JSC::DFG::SpeculativeJIT::argumentTagSlot):
(JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::reportValidationContext):
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* heap/ConservativeRoots.cpp:
(JSC::ConservativeRoots::genericAddSpan):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::frameExtentInternal):
* interpreter/CallFrame.h:
(JSC::ExecState::init):
(JSC::ExecState::argumentOffset):
(JSC::ExecState::argumentOffsetIncludingThis):
(JSC::ExecState::argIndexForRegister):
* interpreter/Interpreter.cpp:
(JSC::loadVarargs):
(JSC::Interpreter::dumpRegisters):
* interpreter/JSStack.cpp:
(JSC::JSStack::JSStack):
(JSC::JSStack::~JSStack):
(JSC::JSStack::growSlowCase):
(JSC::JSStack::gatherConservativeRoots):
(JSC::JSStack::releaseExcessCapacity):
(JSC::JSStack::disableErrorStackReserve):
* interpreter/JSStack.h:
(JSC::JSStack::getBaseOfStack):
(JSC::JSStack::getLimitOfStack):
(JSC::JSStack::size):
(JSC::JSStack::end):
(JSC::JSStack::containsAddress):
(JSC::JSStack::lowAddress):
(JSC::JSStack::highAddress):
(JSC::JSStack::reservationEnd):
(JSC::JSStack::shrink):
(JSC::JSStack::grow):
* interpreter/JSStackInlines.h:
(JSC::JSStack::getTopOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
(JSC::JSStack::installTrapsAfterFrame):
* interpreter/StackVisitor.cpp:
(JSC::inlinedFrameOffset):
(JSC::StackVisitor::readInlinedFrame):
* jit/JIT.cpp:
(JSC::JIT::privateCompile):
* jit/JITCall.cpp:
(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_create_activation):
(JSC::JIT::emit_op_get_argument_by_val):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_get_argument_by_val):
* jit/JITStubs.cpp:
(JSC::throwExceptionFromOpCall):
(JSC::DEFINE_STUB_FUNCTION):
* jit/ThunkGenerators.cpp:
(JSC::arityFixup):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::genericCall):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArgList.cpp:
(JSC::ArgList::getSlice):
(JSC::MarkedArgumentBuffer::slowAppend):
* runtime/ArgList.h:
(JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::slotFor):
(JSC::MarkedArgumentBuffer::mallocBase):
(JSC::ArgList::at):
* runtime/Arguments.cpp:
(JSC::Arguments::tearOff):
* runtime/ArrayConstructor.cpp:
(JSC::constructArrayWithSizeQuirk):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/JSActivation.h:
(JSC::JSActivation::registersOffset):
(JSC::JSActivation::tearOff):
(JSC::JSActivation::isValidIndex):
* runtime/JSArray.h:
(JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::globalExec):
* runtime/JSGlobalObject.h:
(JSC::constructArrayNegativeIndexed):
* runtime/JSString.h:
* runtime/Operations.h:
(JSC::jsStringFromRegisterArray):
* runtime/SymbolTable.h:
(JSC::SharedSymbolTable::captureCount):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155711 268f45cc-cd09-0410-ab3c-d52691b4dbfc