[Win] Build fix after r122737.

* dom/Node.h: Add explicit WebCore namespace to macro definition to work around
Visual Studio bug.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157410 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Baseline JIT should use the DFG's PutById IC
https://bugs.webkit.org/show_bug.cgi?id=122704

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Mostly no big deal, just removing the old Baseline JIT's put_by_id IC support and forcing
that JIT to use the DFG's (i.e. JITOperations) PutById IC.
        
The only complicated part was that the PutById operations assumed that we first did a
cell speculation, which the baseline JIT obviously won't do. So I changed all of those
slow paths to deal with EncodedJSValue's.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::resetStubInternal):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JIT.cpp:
(JSC::PropertyStubCompilationInfo::copyToStubInfo):
* jit/JIT.h:
(JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
(JSC::PropertyStubCompilationInfo::slowCaseInfo):
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOperationWrappers.h:
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::compileGetByIdHotPath):
(JSC::JIT::compileGetByIdSlowCase):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::compileGetByIdSlowCase):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/Repatch.cpp:
(JSC::appropriateGenericPutByIdFunction):
(JSC::appropriateListBuildingPutByIdFunction):
(JSC::resetPutByID):

LayoutTests: 

Reviewed by Mark Hahnenberg.

* js/regress/put-by-id-expected.txt: Added.
* js/regress/put-by-id.html: Added.
* js/regress/script-tests/put-by-id.js: Added.
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157411 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove some silly null checks in Element/NamedNodeMap.
<https://webkit.org/b/122767>

Reviewed by Darin Adler.

Make shouldIgnoreAttributeCase() take a const Element&, exposing
some unnecessary null checks.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
https://bugs.webkit.org/show_bug.cgi?id=122667

Reviewed by Filip Pizlo.

The issue this patch is attempting to fix is that there are places in our codebase
where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
operations that can initiate a garbage collection. Garbage collection then calls 
some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
always necessarily run during garbage collection). This causes a deadlock.

To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores 
into a thread-local field that indicates that it is unsafe to perform any operation 
that could trigger garbage collection on the current thread. In debug builds, 
ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly 
detect deadlocks.

This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
which uses the DeferGC mechanism to prevent collections from occurring while the 
lock is held.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.cpp: Added.
* heap/DeferGC.h:
(JSC::DisallowGC::DisallowGC):
(JSC::DisallowGC::~DisallowGC):
(JSC::DisallowGC::isGCDisallowedOnCurrentThread):
(JSC::DisallowGC::initialize):
* jit/JITStubs.cpp:
(JSC::tryCachePutByID):
(JSC::tryCacheGetByID):
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
(JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::unlockEarly):
(JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
(JSC::ConcurrentJITLocker::ConcurrentJITLocker):
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/Structure.cpp:
(JSC::Structure::materializePropertyMap):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
* runtime/Structure.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157413 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Image valued shape-outside shapes should update the layout after the image has been loaded
https://bugs.webkit.org/show_bug.cgi?id=122340

Reviewed by Simon Fraser.

Source/WebCore:

Ensure that the an image-valued shape-outside layout is updated after the image has
been loaded.

Test: http/tests/css/css-image-valued-shape.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::imageChanged): Added code for the shape-outside case.
(WebCore::RenderBlock::updateShapeInsideInfoAfterStyleChange): Ditto.
* rendering/RenderElement.cpp:
(WebCore::RenderElement::~RenderElement): Ditto.
(WebCore::RenderElement::setStyle): Ditto.

LayoutTests:

Verify that an image-valued shape-outside layout is updated after the image has been loaded.

* http/tests/css/css-image-valued-shape-expected.txt: Added.
* http/tests/css/css-image-valued-shape.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r157408): Crashes in RenderFullScreen::wrapRenderer().

Unreviewed crash fix for these two tests:

- fullscreen/full-screen-restrictions.html
- fullscreen/empty-anonymous-block-continuation-crash.html

* rendering/RenderFullScreen.cpp:
(RenderFullScreen::wrapRenderer):

    Get the RenderArena from Document like we did before this patch.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CTTE: NamedNodeMap always has a corresponding Element.
<https://webkit.org/b/122769>

Reviewed by Anders Carlsson.

Made NamedNodeMap::m_element a reference and remove an assertion
that it's never null.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
window.crypto doesn't preserve custom properties
https://bugs.webkit.org/show_bug.cgi?id=122770

Reviewed by Mark Hahnenberg.

Source/WebCore: 

Test: security/crypto-gc.html

Generate isReachableFromOpaqueRoots that makes Crypto live as long as the document
lives (because that's when it's observable through window object).

* page/Crypto.cpp:
(WebCore::Crypto::Crypto):
(WebCore::Crypto::~Crypto):
(WebCore::Crypto::document):
* page/Crypto.h:
(WebCore::Crypto::create):
Made Crypto a ContextDestructionObserver, so that it can report its document to bindings.
Removed ScriptWrappable, because it seems to have served no purpose in this class.

* page/Crypto.idl: Added GenerateIsReachable. Removed ImplementationLacksVTable,
because the class now has a vtable, and can be checked for bindings integrity.

* page/DOMWindow.cpp: (WebCore::DOMWindow::crypto): Pass a document when creating
crypto.

LayoutTests: 

* security/crypto-gc-expected.txt: Added.
* security/crypto-gc.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[cmake] MediaControlsApple is used only by Efl port and is on CMakeLists.txt
https://bugs.webkit.org/show_bug.cgi?id=122772

Reviewed by Anders Carlsson.

* CMakeLists.txt: Removed MediaControlsApple.cpp
* PlatformEfl.cmake: Added MediaControlsApple.cpp


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157418 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Virtualize PlatformCALayer
https://bugs.webkit.org/show_bug.cgi?id=122672

Reviewed by Anders Carlsson.

No new tests, just a refactoring.

* WebCore.exp.in:
setGeometryFlipped is on PlatformCALayerMac now.

* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
Add PlatformCALayer.cpp, PlatformCALayerWin.h, and let VS do its
thing with some other files.

* WebCore.xcodeproj/project.pbxproj:
Add PlatformCALayer.cpp and PlatformCALayerMac.h.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::platformLayer):
Make a PlatformCALayerWin explicitly.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::createPlatformCALayer):
Added. Decide whether to make a PlatformCALayer{Mac, Win} based on the platform.
Later, we will decide between other subclasses based on other things.

(WebCore::GraphicsLayerCA::filtersCanBeComposited):
Do the same thing for filtersCanBeComposited.

(WebCore::GraphicsLayerCA::GraphicsLayerCA):
(WebCore::GraphicsLayerCA::setContentsToSolidColor):
(WebCore::GraphicsLayerCA::setContentsToMedia):
(WebCore::GraphicsLayerCA::setContentsToCanvas):
(WebCore::GraphicsLayerCA::recursiveCommitChanges):
(WebCore::GraphicsLayerCA::ensureStructuralLayer):
(WebCore::GraphicsLayerCA::updateContentsImage):
(WebCore::GraphicsLayerCA::updateContentsRects):
(WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
Use createPlatformCALayer instead of PlatformCALayer::create.

* platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
For now, use the PlatformCALayerMac version of filtersCanBeComposited,
since this code is heavily tied to having CALayers in the Web process.

* platform/graphics/ca/GraphicsLayerCA.h:
Include PlatformCALayer.h here so we can get the LayerType enum.
(NOTE-to-be-removed: if there's a better way to do this, I'm open to
suggestions; I couldn't puzzle out nested 'enum class' stuff).

Add the createPlatformCALayers.

* platform/graphics/ca/PlatformCAAnimation.h:
Friend the subclasses too.

* platform/graphics/ca/PlatformCALayer.cpp: Added.
(WebCore::PlatformCALayer::~PlatformCALayer):
Pull the shared part of the PlatformCALayer destructor out.

* platform/graphics/ca/PlatformCALayer.h:
(WebCore::PlatformCALayer::platformLayer):
(WebCore::PlatformCALayer::setOwner):
(WebCore::PlatformCALayer::PlatformCALayer):
Virtualize all the things. Move platform specific members to their new subclasses.

* platform/graphics/ca/mac/PlatformCALayerMac.h: Added.
* platform/graphics/ca/mac/PlatformCALayerMac.mm:
Move the PLATFORM(MAC) implementations from PlatformCALayer to PlatformCALayerMac.

(PlatformCALayer::platformCALayer):
The platformCALayer lookup function is static on PlatformCALayer, so it can't
be moved to the subclasses. It might be a good idea in the future to move towards
a platform-independent mechanism for looking up PlatformCALayers from PlatformLayers,
and to avoid needing to do this as often as we do now.

* platform/graphics/ca/win/CACFLayerTreeHost.cpp:
(WebCore::CACFLayerTreeHost::CACFLayerTreeHost):
* platform/graphics/ca/win/PlatformCALayerWin.cpp:
Move the PLATFORM(WIN) implementations from PlatformCALayer to PlatformCALayerWin.

(PlatformCALayerWin::create):
(PlatformCALayer::platformCALayer):

* platform/graphics/ca/win/PlatformCALayerWin.h: Added.

* platform/graphics/win/GraphicsContext3DWin.cpp:
(WebCore::GraphicsContext3D::GraphicsContext3D):
* platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
(WebCore::MediaPlayerPrivateQuickTimeVisualContext::createLayerForMovie):
Include PlatformCALayerWin.h and explicitly make PlatformCALayerWins here.

* FullscreenVideoController.cpp:
(FullscreenVideoController::FullscreenVideoController):
Include PlatformCALayerWin.h and explicitly make PlatformCALayerWins here.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157419 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Separate out array iteration intrinsics
https://bugs.webkit.org/show_bug.cgi?id=122656

Reviewed by Michael Saboff.

Separate out the intrinsics for key and values iteration
of arrays.

This requires moving moving array iteration into the iterator
instance, rather than the prototype, but this is essentially
unobservable so we'll live with it for now.

* jit/ThunkGenerators.cpp:
(JSC::arrayIteratorNextThunkGenerator):
(JSC::arrayIteratorNextKeyThunkGenerator):
(JSC::arrayIteratorNextValueThunkGenerator):
* jit/ThunkGenerators.h:
* runtime/ArrayIteratorPrototype.cpp:
(JSC::ArrayIteratorPrototype::finishCreation):
* runtime/Intrinsic.h:
* runtime/JSArrayIterator.cpp:
(JSC::JSArrayIterator::finishCreation):
(JSC::createIteratorResult):
(JSC::arrayIteratorNext):
(JSC::arrayIteratorNextKey):
(JSC::arrayIteratorNextValue):
(JSC::arrayIteratorNextGeneric):
* runtime/VM.cpp:
(JSC::thunkGeneratorForIntrinsic):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix the paths so that the test passes.

* js/regress/put-by-id.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157421 268f45cc-cd09-0410-ab3c-d52691b4dbfc
COLLECT_ON_EVERY_ALLOCATION causes assertion failures
https://bugs.webkit.org/show_bug.cgi?id=122652

Reviewed by Filip Pizlo.

COLLECT_ON_EVERY_ALLOCATION wasn't accounting for the new GC deferral mechanism,
so we would end up ASSERTing during garbage collection.

* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::allocateSlowCase):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157422 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=122774.
<rdar://problem/6138855>.

Reviewed by Brent Fulgham.

Add a field to keep track of hovered over index.
Use index to determine whether or not to use the existing selected index on the mouse down event.

* platform/win/PopupMenuWin.cpp:
(WebCore::PopupMenuWin::PopupMenuWin):
(WebCore::PopupMenuWin::show):
(WebCore::PopupMenuWin::wndProc):
* platform/win/PopupMenuWin.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157423 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r157413.
http://trac.webkit.org/changeset/157413
https://bugs.webkit.org/show_bug.cgi?id=122779

Appears to have caused frequent crashes (Requested by ap on
#webkit).

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.cpp: Removed.
* heap/DeferGC.h:
* jit/JITStubs.cpp:
(JSC::tryCacheGetByID):
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/Structure.cpp:
(JSC::Structure::materializePropertyMap):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
* runtime/Structure.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157424 268f45cc-cd09-0410-ab3c-d52691b4dbfc
The content of the DOM panel for iframes is not updated until the "onload" event
https://bugs.webkit.org/show_bug.cgi?id=122653

Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/inspector-protocol/loading-iframe-document-node.html

Renamed InspectorDOMAgent::loadEventFired to InspectorDOMAgent::didCommitLoad and moved the call site
from InspectorInstrumentation::loadEventFiredImpl to InspectorInstrumentation::didCommitLoadImpl.
This is to make sure that it will invalidate the content of the iframe as soon as the frame navigates
to a different page. This way the new node can be retrieved as soon as the page has some content, and
not just when the page is fully loaded.

* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::didCommitLoad): Renamed from loadEventFired, as it is now called from
didCommitLoadImpl instead.
(WebCore::InspectorDOMAgent::frameDocumentUpdated): Updated comment to point to the new function name.
* inspector/InspectorDOMAgent.h:
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::loadEventFiredImpl): Removed call do InspectorDOMAgent.loadEventFired.
(WebCore::InspectorInstrumentation::didCommitLoadImpl): Added call to InspectorDOMAgent.didCommitLoad.

LayoutTests:

Added test to check that immediately after the scripting context is created, the
inspector already has access to the nodeId of the document of the iframe.

* http/tests/inspector-protocol/loading-iframe-document-node-expected.txt: Added.
* http/tests/inspector-protocol/loading-iframe-document-node.html: Added.
* http/tests/inspector-protocol/resources/slow-test-page.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157425 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix after r157366
http://bugs.webkit.org/show_bug.cgi?id=122783

When TOUCH_AJUSTMENT is enabled build fails due to some
refactors in TextRender functions.

Patch by Nick Diego Yamane <nick.yamane@openbossa.org> on 2013-10-14
Reviewed by Anders Carlsson.

* page/TouchAdjustment.cpp:
(WebCore::TouchAdjustment::appendContextSubtargetsForNode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157426 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[sh4] Fixes after r157404 and r157411.
https://bugs.webkit.org/show_bug.cgi?id=122782

Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-14
Reviewed by Michael Saboff.

* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JITInlines.h:
(JSC::JIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_put_by_id): Remove unwanted BEGIN_UNINTERRUPTED_SEQUENCE.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157427 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove GestureEvent leftovers from WebCore
<https://webkit.org/b/122780>

Patch by Nick Diego Yamane <nick.yamane@openbossa.org> on 2013-10-14
Reviewed by Anders Carlsson.

- Removed some remaining references to PlatformGestureEvent, supposed to
  be removed by r157316
- TOUCH_ADJUSTMENT should be reworked after GestureEvent feature
  removal

* page/EventHandler.cpp:
(WebCore::EventHandler::bestZoomableAreaForTouchPoint):
* page/EventHandler.h:
* platform/PlatformEvent.h:
* platform/ScrollAnimatorNone.cpp:
* platform/ScrollableArea.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157428 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add FTL support for LogicalNot(string)
https://bugs.webkit.org/show_bug.cgi?id=122765

Patch by Nadav Rotem <nrotem@apple.com> on 2013-10-14
Reviewed by Filip Pizlo.

This patch is tested by:
regress/script-tests/emscripten-cube2hash.js.ftl-eager

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileLogicalNot):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157429 268f45cc-cd09-0410-ab3c-d52691b4dbfc