Some cleanup in JSValue::get
https://bugs.webkit.org/show_bug.cgi?id=119343

Reviewed by Geoff Garen.

Source/JavaScriptCore: 

JSValue::get is implemented to:
    1) Check if the value is a cell – if not, synthesize a prototype to search,
    2) call getOwnPropertySlot on the cell,
    3) if this returns false, cast to JSObject to get the prototype, and walk the prototype chain.
By all rights this should crash when passed a string and accessing a property that does not exist, because
the string is a cell, getOwnPropertySlot should return false, and the cast to JSObject should be unsafe.
To work around this, JSString::getOwnPropertySlot actually implements 'get' functionality - searching the
prototype chain, and faking out a return value of undefined if no property is found.

This is a huge hazard, since fixing JSString::getOwnPropertySlot or calling getOwnPropertySlot on cells
from elsewhere would introduce bugs. Fortunately it is only ever called in this one place.

The fix here is to move getOwnPropertySlot onto JSObjecte and end this madness - cells don't have property
slots anyway.

Interesting changes are in JSCJSValueInlines.h, JSString.cpp - the rest is pretty much all JSCell -> JSObject.

Source/WebCore: 

* WebCore.exp.in:
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertySlot):
(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorDeclaration):
(GenerateConstructorHelperMethods):
* bridge/objc/objc_runtime.h:
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertySlot):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::getOwnPropertySlot):
(JSC::RuntimeArray::getOwnPropertySlotByIndex):
* bridge/runtime_array.h:
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::getOwnPropertySlot):
* bridge/runtime_method.h:
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::getOwnPropertySlot):
* bridge/runtime_object.h:
    - getOwnPropertySlot, JSCell -> JSObject

Source/WebKit2: 

* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::getOwnPropertySlot):
* WebProcess/Plugins/Netscape/JSNPObject.h:
    - getOwnPropertySlot, JSCell -> JSObject



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. AppleWin port.

* platform/win/editing/selection/move-left-right-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153533 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Re-enable WinEWS tests following r153527.

* Scripts/webkitpy/common/config/ews.json:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153534 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update scripts to reference contributors.json instead of committers.py in messaging
https://bugs.webkit.org/show_bug.cgi?id=119342

Reviewed by Ryosuke Niwa.

Change the scripts to point people to contributors.json instead of
committers.py since the latter no longer contains the list of
contributors.

* Scripts/webkitpy/common/config/committervalidator.py:
(CommitterValidator._contributors_json_path):
(CommitterValidator._flag_permission_rejection_message):
* Scripts/webkitpy/common/config/committervalidator_unittest.py:
(CommitterValidatorTest.test_flag_permission_rejection_message):
* Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
(Bugzilla._commit_queue_flag):
* Scripts/webkitpy/common/watchlist/watchlistparser.py:
(WatchListParser._validate):
* Scripts/webkitpy/common/watchlist/watchlistparser_unittest.py:
(WatchListParserTest.test_cc_rule_with_invalid_email):
* Scripts/webkitpy/tool/bot/feeders_unittest.py:
* Scripts/webkitpy/tool/commands/queues_unittest.py:
* Scripts/webkitpy/tool/steps/validatereviewer.py:
(ValidateReviewer.run):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153535 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderEmbeddedObject::isReplacementObscured is wrong if an obscuring element has pointer-events: none set
https://bugs.webkit.org/show_bug.cgi?id=119348

Reviewed by Dean Jackson.

Change the expected outcome of the test to want a visually-obscured
but clickable embed (because the obscuring element has pointer-events: none)
to be considered obscured.

Also, adjust the test so that it runs all of the subtests even if
some of them fail.

* plugins/unavailable-plugin-indicator-obscurity-expected.txt:
* plugins/unavailable-plugin-indicator-obscurity.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153536 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Speculative Windows build fix.

Reviewed by NOBODY

* runtime/JSString.cpp:
(JSC::JSRopeString::getIndexSlowCase):
* runtime/JSString.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG doesn't account for inlining of functions with switch statements that haven't been executed by the baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=119349

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

Prior to this patch, the baseline JIT was responsible for resizing the ctiOffsets Vector for 
SimpleJumpTables to be equal to the size of the branchOffsets Vector. The DFG implicitly relied
on code it compiled with any switch statements to have been run in the baseline JIT first. 
However, if the DFG chooses to inline a function that has never been compiled by the baseline 
JIT then this resizing never happens and we crash at link time in the DFG.

We can fix this by also doing the resize in the DFG to catch this case.

* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):

LayoutTests: 

* fast/js/dfg-inline-switch-imm-expected.txt: Added.
* fast/js/dfg-inline-switch-imm.html: Added.
* fast/js/script-tests/dfg-inline-switch-imm.js: Added.
(foo):
(bar):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153540 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<input type=color> Mac UI behaviour
<rdar://problem/10269922> and https://bugs.webkit.org/show_bug.cgi?id=61276

Source/JavaScriptCore:

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

* Configurations/FeatureDefines.xcconfig: Enabled INPUT_TYPE_COLOR.

Source/WebCore:

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

This patch turns on INPUT_TYPE_COLOR and implements it using the native
Mac color panel.

No new tests added.

Currently, there are no automated ways to test the types of changes made in this patch. (i.e. checking
which color is being displayed in the color panel, checking which color element is currently
associated to the color panel, checking the state of color elements after directing away and
being directed back to its page, etc.)

* Configurations/FeatureDefines.xcconfig: Enabled INPUT_TYPE_COLOR.
* WebCore.exp.in:
* WebCore.xcodeproj/project.pbxproj:

* html/ColorInputType.cpp:
(WebCore::ColorInputType::handleDOMActivateEvent): Reattaches the color picker if
  a color picker has already been shown for an element
(WebCore::ColorInputType::shouldResetOnDocumentActivation): Always returns true, needed to
  detach the color picker when caching a page.
* html/ColorInputType.h:

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::documentDidResumeFromPageCache): For <input type='color'>,
  don't reset the element.
(WebCore::HTMLInputElement::documentWillSuspendForPageCache): For <input type='color'>, call detach().
* html/HTMLInputElement.h:

* platform/ColorChooser.h:
(WebCore::ColorChooser::reattachColorChooser): Added definition.

Source/WebKit/mac:

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

* Configurations/FeatureDefines.xcconfig: Enabled INPUT_TYPE_COLOR.
* WebCoreSupport/WebChromeClient.h:
* WebCoreSupport/WebChromeClient.mm:
(WebChromeClient::createColorPicker): Added stub implementation.

Source/WebKit2:

Implemented <input type='color'> on Mac using the native color picker.

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

Code for WebColorPickerMac is derived from Chromium's color_chooser_mac.mm:
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/ui/cocoa/color_chooser_mac.mm

* Configurations/FeatureDefines.xcconfig: Enabled INPUT_TYPE_COLOR.

* UIProcess/API/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::createColorPicker): Replaced stub implementation
  and return a WebColorPickerMac object.

* UIProcess/WebColorPicker.cpp:
(WebKit::WebColorPicker::invalidate): Updated to call endChooser().
(WebKit::WebColorPicker::showColorPicker): Added stub implementation.
* UIProcess/WebColorPicker.h:

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::close): Removed invalidation of removed color picker objects.
(WebKit::WebPageProxy::showColorPicker): Updated so that it works for
  multiple <input type='color'> elements on a page.
(WebKit::WebPageProxy::didEndColorPicker): Removed cleanup of removed color picker objects.
(WebKit::WebPageProxy::resetStateAfterProcessExited): Removed cleanup of removed color picker objects.

* UIProcess/mac/WebColorPickerMac.h: Added.
* UIProcess/mac/WebColorPickerMac.mm: Added.
(WebKit::WebColorPickerMac::create):
(WebKit::WebColorPickerMac::~WebColorPickerMac):
(WebKit::WebColorPickerMac::WebColorPickerMac):
(WebKit::WebColorPickerMac::endPicker):
(WebKit::WebColorPickerMac::setSelectedColor):
(WebKit::WebColorPickerMac::didChooseColor):
(WebKit::WebColorPickerMac::showColorPicker):
WebColorPickerMac contains a reference to a WKColorPanelMac object
  and is responsible for maintaining the color picker UI.

(-[WKColorPanelMac setAndShowPicker:withColor:]):
(-[WKColorPanelMac invalidate]):
(-[WKColorPanelMac windowWillClose:]):
(-[WKColorPanelMac didChooseColor:]):
(-[WKColorPanelMac setColor:]):
WKColorPanelMac is a wrapper for a NSColorPanel object and
  is responsible for the color picker UI.

* WebKit2.xcodeproj/project.pbxproj:

* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createColorChooser): Updated to always create a
  WebColorChooser object.

* WebProcess/WebCoreSupport/WebColorChooser.cpp:
(WebKit::WebColorChooser::reattachColorChooser): Sets the page's
  active color chooser to the current object and pings the UIProcess
  to show the color picker.
(WebKit::WebColorChooser::setSelectedColor): Only sets the color in the
  color picker if the WebColorChooser object is the active color element.
* WebProcess/WebCoreSupport/WebColorChooser.h:

Source/WTF:

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

* wtf/FeatureDefines.h: Enabled INPUT_TYPE_COLOR on Mac port.

LayoutTests:

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-07-31
Reviewed by Brady Eidson.

Updated tests to reflect <input type='color'> being implemented with a native color picker.

* fast/forms/color/input-color-onchange-event-expected.txt:

* platform/mac/TestExpectations: Enabled fast/form/color tests on Mac.

* platform/mac/accessibility/color-well-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription.html:

* platform/mac/fast/forms/color/input-appearance-color-expected.txt: Updated test expectations
on Mac to reflect the fact that the list attribute for <input type='color'> is not yet supported.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Upload images for a potential blog post

* blog-files/size-matters: Added.
* blog-files/size-matters/JavaScript-growth.png: Added.
* blog-files/size-matters/WebCore-growth-baseline.png: Added.
* blog-files/size-matters/WebCore-growth.png: Added.
* blog-files/size-matters/WebKit-growth.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153542 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Convert SVG test from r153433 to a reftest
https://bugs.webkit.org/show_bug.cgi?id=119346

Reviewed by Philip Rogers.

Reftest taken from https://chromium.googlesource.com/chromium/blink/+/ac10e305a870c8fd500b42e90075aee3aa48da8d.

* platform/qt/svg/animations/attributeNameAndAttributeTypeMissmatch-expected.txt: Removed.
* svg/animations/attributeNameAndAttributeTypeMismatch-expected.html: Added.
* svg/animations/attributeNameAndAttributeTypeMismatch.html: Added.
* svg/animations/attributeNameAndAttributeTypeMissmatch.svg: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153543 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Winlauncher shouldn't look for Safari Install Directory
https://bugs.webkit.org/show_bug.cgi?id=119351

Reviewed by Darin Adler.

* win/DLLLauncher/DLLLauncherMain.cpp: Don't check registry for
the Safari install location. Instead, use the proper support
library path for the build architecture.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153544 268f45cc-cd09-0410-ab3c-d52691b4dbfc