[Win] Build fix after r122737.

* dom/Node.h: Add explicit WebCore namespace to macro definition to work around
Visual Studio bug.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Baseline JIT should use the DFG's PutById IC
https://bugs.webkit.org/show_bug.cgi?id=122704

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Mostly no big deal, just removing the old Baseline JIT's put_by_id IC support and forcing
that JIT to use the DFG's (i.e. JITOperations) PutById IC.
        
The only complicated part was that the PutById operations assumed that we first did a
cell speculation, which the baseline JIT obviously won't do. So I changed all of those
slow paths to deal with EncodedJSValue's.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::resetStubInternal):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JIT.cpp:
(JSC::PropertyStubCompilationInfo::copyToStubInfo):
* jit/JIT.h:
(JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
(JSC::PropertyStubCompilationInfo::slowCaseInfo):
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOperationWrappers.h:
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::compileGetByIdHotPath):
(JSC::JIT::compileGetByIdSlowCase):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::compileGetByIdSlowCase):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/Repatch.cpp:
(JSC::appropriateGenericPutByIdFunction):
(JSC::appropriateListBuildingPutByIdFunction):
(JSC::resetPutByID):

LayoutTests: 

Reviewed by Mark Hahnenberg.

* js/regress/put-by-id-expected.txt: Added.
* js/regress/put-by-id.html: Added.
* js/regress/script-tests/put-by-id.js: Added.
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157411 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove some silly null checks in Element/NamedNodeMap.
<https://webkit.org/b/122767>

Reviewed by Darin Adler.

Make shouldIgnoreAttributeCase() take a const Element&, exposing
some unnecessary null checks.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
https://bugs.webkit.org/show_bug.cgi?id=122667

Reviewed by Filip Pizlo.

The issue this patch is attempting to fix is that there are places in our codebase
where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
operations that can initiate a garbage collection. Garbage collection then calls 
some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
always necessarily run during garbage collection). This causes a deadlock.

To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores 
into a thread-local field that indicates that it is unsafe to perform any operation 
that could trigger garbage collection on the current thread. In debug builds, 
ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly 
detect deadlocks.

This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
which uses the DeferGC mechanism to prevent collections from occurring while the 
lock is held.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.cpp: Added.
* heap/DeferGC.h:
(JSC::DisallowGC::DisallowGC):
(JSC::DisallowGC::~DisallowGC):
(JSC::DisallowGC::isGCDisallowedOnCurrentThread):
(JSC::DisallowGC::initialize):
* jit/JITStubs.cpp:
(JSC::tryCachePutByID):
(JSC::tryCacheGetByID):
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
(JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::unlockEarly):
(JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
(JSC::ConcurrentJITLocker::ConcurrentJITLocker):
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/Structure.cpp:
(JSC::Structure::materializePropertyMap):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
* runtime/Structure.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157413 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Image valued shape-outside shapes should update the layout after the image has been loaded
https://bugs.webkit.org/show_bug.cgi?id=122340

Reviewed by Simon Fraser.

Source/WebCore:

Ensure that the an image-valued shape-outside layout is updated after the image has
been loaded.

Test: http/tests/css/css-image-valued-shape.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::imageChanged): Added code for the shape-outside case.
(WebCore::RenderBlock::updateShapeInsideInfoAfterStyleChange): Ditto.
* rendering/RenderElement.cpp:
(WebCore::RenderElement::~RenderElement): Ditto.
(WebCore::RenderElement::setStyle): Ditto.

LayoutTests:

Verify that an image-valued shape-outside layout is updated after the image has been loaded.

* http/tests/css/css-image-valued-shape-expected.txt: Added.
* http/tests/css/css-image-valued-shape.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r157408): Crashes in RenderFullScreen::wrapRenderer().

Unreviewed crash fix for these two tests:

- fullscreen/full-screen-restrictions.html
- fullscreen/empty-anonymous-block-continuation-crash.html

* rendering/RenderFullScreen.cpp:
(RenderFullScreen::wrapRenderer):

    Get the RenderArena from Document like we did before this patch.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CTTE: NamedNodeMap always has a corresponding Element.
<https://webkit.org/b/122769>

Reviewed by Anders Carlsson.

Made NamedNodeMap::m_element a reference and remove an assertion
that it's never null.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157416 268f45cc-cd09-0410-ab3c-d52691b4dbfc