DFG PhantomArguments shouldn't rely on a dead Phi graph
https://bugs.webkit.org/show_bug.cgi?id=126218

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
This change dramatically rationalizes our handling of PhantomArguments (i.e.
speculative elision of arguments object allocation).
        
It's now the case that if we decide that we can elide arguments allocation, we just
turn the arguments-creating node into a PhantomArguments and mark all locals that
it's stored to as being arguments aliases. Being an arguments alias and being a
PhantomArguments means basically the same thing: in DFG execution you have the empty
value, on OSR exit an arguments object is allocated in your place, and all operations
that use the value now just refer directly to the actual arguments in the call frame
header (or the arguments we know that we passed to the call, in case of inlining).
        
This means that we no longer have arguments simplification creating a dead Phi graph
that then has to be interpreted by the OSR exit logic. That sort of never made any
sense.
        
This means that PhantomArguments now has a clear story in SSA: basically SSA just
gets rid of the "locals" but everything else is the same.
        
Finally, this means that we can more easily get rid of forward exiting. As I was
working on the code to get rid of forward exiting, I realized that I'd have to
carefully preserve the special meanings of MovHint and SetLocal in the case of
PhantomArguments. It was really bizarre: even the semantics of MovHint were tied to
our specific treatment of PhantomArguments. After this change this is no longer the
case.
        
One of the really cool things about this change is that arguments reification now
just becomes a special kind of FlushFormat. This further unifies things: it means
that a MovHint(PhantomArguments) and a SetLocal(PhantomArguments) both have the same
meaning, since both of them dictate that the way we recover the local on exit is by
reifying arguments. Previously, the SetLocal(PhantomArguments) case needed some
special handling to accomplish this.
        
A downside of this approach is that we will now emit code to store the empty value
into aliased arguments variables, and we will even emit code to load that empty value
as well. As far as I can tell this doesn't cost anything, since PhantomArguments are
most profitable in cases where it allows us to simplify control flow and kill the
arguments locals entirely. Of course, this isn't an issue in SSA form since SSA form
also eliminates the locals.

* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
(JSC::DFG::ArgumentsSimplificationPhase::detypeArgumentsReferencingPhantomChild):
* dfg/DFGFlushFormat.cpp:
(WTF::printInternal):
* dfg/DFGFlushFormat.h:
(JSC::DFG::resultFor):
(JSC::DFG::useKindFor):
(JSC::DFG::dataFormatFor):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValueSource.h:
(JSC::DFG::ValueSource::ValueSource):
(JSC::DFG::ValueSource::forFlushFormat):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::flushFormat):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::buildExitArguments):

LayoutTests: 

Reviewed by Oliver Hunt.
        
Added a test for an obvious case that I don't think we had coverage for in
microbenchmarks. Of course, this case was already covered by more complex tests.

* js/regress/inline-arguments-aliased-access-expected.txt: Added.
* js/regress/inline-arguments-aliased-access.html: Added.
* js/regress/script-tests/inline-arguments-aliased-access.js: Added.
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161072 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (Lazy tree creation): css3/calc/transitions-dependent.html is frequently failing
https://bugs.webkit.org/show_bug.cgi?id=126142

* TestExpectations: Marked it as flaky.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161073 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r161033): http/tests/security/cross-frame-access-put.html fails
https://bugs.webkit.org/show_bug.cgi?id=126238

* TestExpectations: Marking the test as failing for now.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161074 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] [WK2] http/tests/security/cross-frame-access-put.html fails
https://bugs.webkit.org/show_bug.cgi?id=116649

* platform/mac-wk2/TestExpectations: Removing an expectation for this old bug that
was no longer occurring. Failures on this test are now tracked via bug 126238.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161075 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DatabaseProcess: Implement version changing
https://bugs.webkit.org/show_bug.cgi?id=126099

Reviewed by Sam Weinig.

Source/WebCore:

No new tests (No change in WebCore behavior).

* Modules/indexeddb/IDBTransactionBackend.cpp:
(WebCore::IDBTransactionBackend::commit): Update some logging.

* Modules/indexeddb/IDBTransactionBackendOperations.cpp:
(WebCore::IDBDatabaseBackend::VersionChangeOperation::perform): Move some things that used to be in
  IDBServerConnectionLevelDB::changeDatabaseVersion to this cross-platform location.
* Modules/indexeddb/IDBTransactionBackendOperations.h:
(WebCore::IDBDatabaseBackend::VersionChangeOperation::transaction):

* Modules/indexeddb/leveldb/IDBServerConnectionLevelDB.cpp:
(WebCore::IDBServerConnectionLevelDB::changeDatabaseVersion): Move the actual updating of the database backend
  metadata to the VersionChangeOperation.

Source/WebKit2:

* DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp:
(WebKit::DatabaseProcessIDBConnection::getOrEstablishIDBDatabaseMetadata): Add logging.
(WebKit::DatabaseProcessIDBConnection::openTransaction): Ditto.
(WebKit::DatabaseProcessIDBConnection::beginTransaction): Ditto.
(WebKit::DatabaseProcessIDBConnection::commitTransaction): Ditto.
(WebKit::DatabaseProcessIDBConnection::resetTransaction): Ditto.
(WebKit::DatabaseProcessIDBConnection::rollbackTransaction): Ditto.
(WebKit::DatabaseProcessIDBConnection::changeDatabaseVersion): Implement this!
* DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h:
* DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.messages.in:

* DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp:
(WebKit::UniqueIDBDatabase::shutdown): Clean up all requests, and also cleanup the backing store
  on the database queue.
(WebKit::UniqueIDBDatabase::shutdownBackingStore): Shutdown the backing store.
(WebKit::UniqueIDBDatabase::didShutdownBackingStore):
(WebKit::UniqueIDBDatabase::changeDatabaseVersion): Pass along the new version to the database queue.
(WebKit::UniqueIDBDatabase::didChangeDatabaseVersion):
(WebKit::UniqueIDBDatabase::changeDatabaseVersionInBackingStore): Set the new version in the backing store.
(WebKit::UniqueIDBDatabase::postMainThreadTask): Add a ref() to keep the database alive incase it is being
  shutdown on the main thread.
(WebKit::UniqueIDBDatabase::performNextMainThreadTask): Balance the ref() from postMainThreadTask, and
  accept an empty mainThreadTask queue.
* DatabaseProcess/IndexedDB/UniqueIDBDatabase.h:

* DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h: Add changeDatabaseVersion.

Flesh out SQLiteIDBTransaction to actually operation on a SQLiteTransaction in a real SQLiteDatabase:
* DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.cpp:
(WebKit::SQLiteIDBTransaction::SQLiteIDBTransaction):
(WebKit::SQLiteIDBTransaction::~SQLiteIDBTransaction):
(WebKit::SQLiteIDBTransaction::begin):
(WebKit::SQLiteIDBTransaction::commit):
(WebKit::SQLiteIDBTransaction::reset):
(WebKit::SQLiteIDBTransaction::rollback):
(WebKit::SQLiteIDBTransaction::inProgress):
* DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.h:
(WebKit::SQLiteIDBTransaction::create):
(WebKit::SQLiteIDBTransaction::mode):

Rename m_metadataDB to m_sqliteDB,
* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp:
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::createAndPopulateInitialMetadata):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::extractExistingMetadata):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::openSQLiteDatabaseAtPath): Disable threading checks on the DB
  as work queues can change threads.
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::getOrEstablishMetadata):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::establishTransaction):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::beginTransaction):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::changeDatabaseVersion): After validating the transaction, actually
  update the version number on disk.
* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h:

* WebProcess/Databases/IndexedDB/WebIDBServerConnection.cpp:
(WebKit::WebIDBServerConnection::~WebIDBServerConnection): Make sure to abort in-flight requests.
(WebKit::WebIDBServerConnection::changeDatabaseVersion):
(WebKit::WebIDBServerConnection::didChangeDatabaseVersion):
* WebProcess/Databases/IndexedDB/WebIDBServerConnection.h:
* WebProcess/Databases/IndexedDB/WebIDBServerConnection.messages.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161076 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r161033 and r161074.
http://trac.webkit.org/changeset/161033
http://trac.webkit.org/changeset/161074
https://bugs.webkit.org/show_bug.cgi?id=126240

Oliver says that a rollout would be better (Requested by ap on
#webkit).

Source/JavaScriptCore:

* API/JSObjectRef.cpp:
(JSObjectSetProperty):
* dfg/DFGOperations.cpp:
(JSC::DFG::operationPutByValInternal):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/Arguments.cpp:
(JSC::Arguments::putByIndex):
* runtime/ArrayPrototype.cpp:
(JSC::putProperty):
(JSC::arrayProtoFuncPush):
* runtime/JSCJSValue.cpp:
(JSC::JSValue::putToPrimitiveByIndex):
* runtime/JSCell.cpp:
(JSC::JSCell::putByIndex):
* runtime/JSFunction.cpp:
(JSC::JSFunction::put):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
* runtime/JSONObject.cpp:
(JSC::Walker::walk):
* runtime/JSObject.cpp:
(JSC::JSObject::putByIndex):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::deleteProperty):
* runtime/JSObject.h:
(JSC::JSObject::putDirect):
* runtime/Lookup.h:
(JSC::putEntry):
(JSC::lookupPut):
* runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::PutPropertySlot):
(JSC::PutPropertySlot::setNewProperty):
(JSC::PutPropertySlot::isCacheable):

Source/WebCore:

* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::put):
* bindings/objc/WebScriptObject.mm:
(-[WebScriptObject setValue:forKey:]):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterface::putByIndex):
* bridge/NP_jsobject.cpp:
(_NPN_SetProperty):

Source/WebKit/mac:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::setProperty):

Source/WebKit2:

* WebProcess/Plugins/Netscape/NPJSObject.cpp:
(WebKit::NPJSObject::setProperty):

LayoutTests:

* TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161077 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revision selection behavior at build.webkit.org/dashboard is annoying
https://bugs.webkit.org/show_bug.cgi?id=126235

Reviewed by Tim Horton.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueueView.js:
(BuildbotQueueView.prototype.revisionLinksForIteration): Make the whole message
selectable, not just the numbers in it.
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Styles/Main.css:
(.selectable): Make selectable enable default behavior, not user-select:all.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161078 268f45cc-cd09-0410-ab3c-d52691b4dbfc