Fix windows build.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144127 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
https://bugs.webkit.org/show_bug.cgi?id=110808

Reviewed by Adam Barth.

Source/WebCore:

When looking for various table tags in the HTMLElementStack, compare
QualifiedNames rather than just local names, where necessary.

Note that not all uses have been "fixed"; I've only changed for which
I could write a test with differing behavior. A followup patch to
rationalize the use of QualifiedName vs local names would be ideal.

Tests: html5lib/generated/run-math-data.html
       html5lib/generated/run-math-write.html

* html/parser/HTMLElementStack.cpp:
(WebCore::inScopeCommon): Added a version of inScopeCommon that
handles QualifiedNames instead of just localNames.
(WebCore::HTMLElementStack::inTableScope): When given a QualifiedName,
call the new version of inScopeCommon().
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processStartTag):
(WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
(WebCore::HTMLTreeBuilder::processTrEndTagForInRow):

LayoutTests:

* html5lib/generated/run-math-data-expected.txt: Added.
* html5lib/generated/run-math-data.html: Added.
* html5lib/generated/run-math-write-expected.txt: Added.
* html5lib/generated/run-math-write.html: Added.
* html5lib/resources/math.dat: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144128 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Remove WebLayerTreeViewClient::(will|did)BeginFrame
https://bugs.webkit.org/show_bug.cgi?id=110928

Reviewed by Adrienne Walker.

Source/Platform:

* chromium/public/WebLayerTreeViewClient.h:

Source/WebKit/chromium:

* src/WebViewImpl.cpp:
* src/WebViewImpl.h:
* tests/WebLayerTreeViewTestCommon.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144129 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement StorageAreaProxy::getItem and StorageAreaProxy::setItem
https://bugs.webkit.org/show_bug.cgi?id=110927

Reviewed by Sam Weinig.

Source/WebCore:

Export StorageMap::getItem and StorageMap::setItem.

* WebCore.exp.in:

Source/WebKit2:

* UIProcess/Storage/StorageManager.cpp:
(WebKit::StorageManager::setItem):
* UIProcess/Storage/StorageManager.h:
Add empty stub.

* UIProcess/Storage/StorageManager.messages.in:
Add SetItem message.

* WebProcess/Storage/StorageAreaProxy.cpp:
(WebKit::StorageAreaProxy::getItem):
Fill the storage map and get the item from it.

(WebKit::StorageAreaProxy::setItem):
Update the storage map and send a SetItem message to the UI process.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144130 268f45cc-cd09-0410-ab3c-d52691b4dbfc
The DFG backend's and OSR's decision to unbox a variable should be based on whether it's used in a typed context
https://bugs.webkit.org/show_bug.cgi?id=110433

Reviewed by Oliver Hunt and Mark Hahnenberg.
        
This introduces the equivalent of a liveness analysis, except for type checking.
A variable is said to be "profitable for unboxing" (i.e. live at a type check)
if there exists a type check on a GetLocal of that variable, and the type check
is consistent with the variable's prediction. Variables that are not profitable
for unboxing aren't unboxed. Previously they would have been.
        
This is a slight speed-up on some things but mostly neutral.

* dfg/DFGArgumentPosition.h:
(JSC::DFG::ArgumentPosition::ArgumentPosition):
(JSC::DFG::ArgumentPosition::mergeShouldNeverUnbox):
(JSC::DFG::ArgumentPosition::mergeArgumentPredictionAwareness):
(JSC::DFG::ArgumentPosition::mergeArgumentUnboxingAwareness):
(ArgumentPosition):
(JSC::DFG::ArgumentPosition::isProfitableToUnbox):
(JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
* dfg/DFGCommon.h:
(JSC::DFG::checkAndSet):
(DFG):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
(FixupPhase):
(JSC::DFG::FixupPhase::alwaysUnboxSimplePrimitives):
(JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsCaptured):
(JSC::DFG::VariableAccessData::mergeIsProfitableToUnbox):
(VariableAccessData):
(JSC::DFG::VariableAccessData::isProfitableToUnbox):
(JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
(JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
(JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
(JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
(JSC::DFG::VariableAccessData::mergeFlags):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144131 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. AppleWin VS2010 build fix.

* JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144132 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Deleting extraneous baseline after feDisplacementMap fix
https://bugs.webkit.org/show_bug.cgi?id=10592

Unreviewed expectations update. Slow build bot to blame.

* platform/chromium-win-xp/svg/filters/feDisplacementMap-expected.png: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144133 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crashes in fast/notifications/notifications-request-permission.html after r144126
https://bugs.webkit.org/show_bug.cgi?id=108196

Unreviewed expectations update.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144134 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SQLTransactionBackend::doCleanup() should not nullify its current
statement and transaction error fields.
https://bugs.webkit.org/show_bug.cgi?id=110826.

Reviewed by Geoffrey Garen.

The reason for this is because the frontend SQLTransaction may have
tasks that are already registered via callOnMainThread(), and may
invoke transaction state functions that access these objects in the
SQLTransactionBackend. This proves to be problematic if the database
was interrupted resulting in doCleanup() being called concurrently
while those states are executing.

Instead, we leave their clean up to the SQLTransactionBackend destructor
which is guaranteed to only be called when the SQLTransaction is also
destructing i.e. these objects are no longer needed.

No new tests.

* Modules/webdatabase/SQLTransactionBackend.cpp:
(WebCore::SQLTransactionBackend::doCleanup):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Enable threaded HTML parser by default in DumpRenderTree
https://bugs.webkit.org/show_bug.cgi?id=110907

Reviewed by Eric Seidel.

Tools:

This patch changes --enable-threaded-html-parser into
--disable-threaded-html-parser and thereby enables the threaded HTML
parser by default for the Chromium port.

* DumpRenderTree/chromium/DumpRenderTree.cpp:
* DumpRenderTree/chromium/TestRunner/src/WebPreferences.cpp:
(WebTestRunner::WebPreferences::reset):
* DumpRenderTree/chromium/TestShell.cpp:
(TestShell::TestShell):

LayoutTests:

Update test results to show subtle differences in FrameLoaderClient callbacks.

* platform/chromium-mac/security/block-test-no-port-expected.txt: Removed.
* platform/chromium-win/fast/images/support-broken-image-delegate-expected.txt:
* platform/chromium-win/security/block-test-no-port-expected.txt: Removed.
* platform/chromium/fast/images/support-broken-image-delegate-expected.txt:
* platform/chromium/fast/loader/main-document-url-for-non-http-loads-expected.txt: Added.
* platform/chromium/http/tests/loading/307-after-303-after-post-expected.txt: Added.
* platform/chromium/http/tests/misc/favicon-loads-with-images-disabled-expected.txt: Added.
* platform/chromium/http/tests/misc/will-send-request-returns-null-on-redirect-expected.txt:
* platform/chromium/http/tests/misc/window-dot-stop-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-invalid-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-allow-expected.txt: Added.
* platform/chromium/http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny-expected.txt: Added.
* platform/chromium/inspector/debugger/pause-in-inline-script-expected.txt: Added.
* platform/chromium/inspector/timeline/timeline-script-tag-1-expected.txt: Added.
* platform/chromium/security/block-test-no-port-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144136 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG OSR exit doesn't know which virtual register to use for the last result register for post_inc and post_dec
https://bugs.webkit.org/show_bug.cgi?id=109036
<rdar://problem/13292139>

Source/JavaScriptCore: 

Reviewed by Gavin Barraclough.
        
This was a two-fold problem:
        
1) post_inc/dec has two results - the new value of the variable, and the old value of the variable. DFG OSR exit
   assumed that the "last result" used for the Baseline JIT's register allocation would be the new value. It was
   wrong in this assumption.
        
2) The Baseline JIT knew to disable its last result optimization in cases where it might confuse the DFG. But it
   was doing this only for code blocks that could be totally optimized, but not code blocks that could only be
   optimized when inlined.
        
This patch introduces a more rigorous notion of when the Baseline JIT emits profiling, when it does extra work
to account for the possibility of OSR exit, and when it does extra work to account for the possibility of OSR
entry. These notions are called shouldEmitProfiling(), canBeOptimizedOrInlined(), and canBeOptimized(),
respectively.
        
This is performance-neutral and fixes the reported bug. It probably fixes other bugs as well, since previously
we for example weren't doing the more conservative implementation of op_mov in the Baseline JIT for code blocks
that could be inlined but not optimized. So, if such a code block OSR exited at just the right point, you'd get
symptoms similar to this bug.

* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileOpcode):
* dfg/DFGCommon.h:
* jit/JIT.cpp:
(JSC::JIT::privateCompile):
* jit/JIT.h:
(JSC::JIT::compilePatchGetArrayLength):
(JSC::JIT::canBeOptimizedOrInlined):
(JIT):
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_op_post_inc):
(JSC::JIT::emit_op_post_dec):
* jit/JITArithmetic32_64.cpp:
(JSC::JIT::emit_op_post_inc):
(JSC::JIT::emit_op_post_dec):
* jit/JITCall.cpp:
(JSC::JIT::emit_op_call_put_result):
(JSC::JIT::compileOpCall):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall):
* jit/JITInlines.h:
(JSC::JIT::emitArrayProfilingSite):
(JSC::JIT::map):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_mov):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::compileGetByIdHotPath):
(JSC::JIT::privateCompilePutByIdTransition):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::compileGetByIdHotPath):
(JSC::JIT::privateCompilePutByIdTransition):

LayoutTests: 

Reviewed by Gavin Barraclough.

* fast/js/dfg-post-inc-then-exit-expected.txt: Added.
* fast/js/dfg-post-inc-then-exit.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-post-inc-then-exit.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144137 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled Chromium DEPS to r184829.  Requested by
"Mark Pilgrim" <pilgrim@chromium.org> via sheriffbot.

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-26

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144138 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Silence this ASSERT. It is triggered by the threaded HTML parser.
Investigation to follow in https://bugs.webkit.org/show_bug.cgi?id=110937

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::checkLoadComplete):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144139 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SelectorQuery should not ever use ResolvingStyle mode.
https://bugs.webkit.org/show_bug.cgi?id=110843

It looks like we accidentally used ResolvingStyle mode for webkitMatchesSelector, and I exacerbated the problem
in r143858 by switching all of SelectorQuery to use it. There aren't any visible effects, but the style bits
of elements are unnecessarily twiddled when if we do that. Let's not do it.

Reviewed by Eric Seidel.

No public-facing behavior change, covered by existing tests.

* dom/SelectorQuery.cpp:
(WebCore::SelectorDataList::selectorMatches): Switched to always use QueryingRules mode.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144140 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use perf.webkit.org JSON format in results page
https://bugs.webkit.org/show_bug.cgi?id=110842

Reviewed by Benjamin Poulain.

PerformanceTests: 

Updated the results page template to use the new JSON format.

Since new JSON format doesn't contain statistics such as stdev and min, added statistics.js to compute
these values. Also use 95% percentile confidence interval instead of standard deviation in various places.

* resources/results-template.html: Added statistics.js as dependency.
(TestResult): Updated to take a metric instead of its test. Replaced stdev() with confidenceIntervalDelta()
now that we have a fancy Statistics class.

(TestRun.webkitRevision):
(PerfTestMetric): Renamed from PerfTest since this object now encapsulates each measurement (such as time,
JS heap, and malloc) in test. Also added a conversion table from a metric name to a unit since new format
doesn't contain units.
(PerfTestMetric.name): Updated to compute the full metric name from test name and metric name, matching
the old behavior.
(PerfTestMetric.isMemoryTest): Explicitly look for 'JSHeap' and 'Malloc' tests.
(PerfTestMetric.smallerIsBetter):

(attachPlot): Deleted the code to deal with tests that don't provide individual iteration measurement
since such tests no longer exist. Also fixed up the code compute y-axis range.

(createTableRow.markupForRun): Updated to use confidenceIntervalDelta() instead of stdev().
        
(init.addTests): Added. Recursively add metrics.

* resources/statistics.js: Added. Imported from perf.webkit.org.
(Statistics.max):
(Statistics.min):
(Statistics.sum):
(Statistics.squareSum):
(Statistics.sampleStandardDeviation):
(Statistics.supportedConfidenceLevels):
(Statistics.confidenceIntervalDelta):
(Statistics.confidenceInterval):

Tools: 

Change the default JSON format from that of webkit-perf.appspot.com to that of perf.webkit.org.

A whole bunch of integration tests have been updated to use the new JSON format.

* Scripts/webkitpy/performance_tests/perftestsrunner.py:
(PerfTestsRunner._generate_and_show_results): Renamed output and output_path to legacy_output
and legacy_output_json_path respectively.
(PerfTestsRunner._generate_results_dict): Don't assume meta build information is always available.
(PerfTestsRunner._generate_output_files): Make json_output, which is used to generate the default
JSON file and the results page out of perf_webkit_output instead of legacy_output.

* Scripts/webkitpy/performance_tests/perftestsrunner_integrationtest.py:
(MainTest.test_run_memory_test):
(MainTest._test_run_with_json_output.mock_upload_json):
(MainTest):
(MainTest.test_run_with_json_output):
(MainTest.test_run_with_description):
(MainTest.test_run_generates_json_by_default):
(MainTest.test_run_merges_output_by_default):
(MainTest.test_run_respects_reset_results):
(MainTest.test_run_generates_and_show_results_page):
(MainTest.test_run_with_slave_config_json):
(MainTest.test_run_with_multiple_repositories):
(MainTest.test_run_with_upload_json):
(MainTest.test_run_with_upload_json_should_generate_perf_webkit_json):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Remove Event::dataTransferAttrGetterCustom() and Event::valueAttrSetterCustom()
https://bugs.webkit.org/show_bug.cgi?id=110666

Reviewed by Adam Barth.

Event::dataTransferAttrGetterCustom() is not used
(i.e. the custom method is not registered to V8).
Event::valueAttrSetterCustom() is declared but not
implemented. We can remove them.

No tests. No change in behavior.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateHeaderCustomCall):
* bindings/v8/custom/V8EventCustom.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144142 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.

Update expectations to show new FrameLoaderClient callbacks. I missed
this test earlier because it doesn't run on Linux.

* platform/chromium-win/http/tests/loading/redirect-methods-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144143 268f45cc-cd09-0410-ab3c-d52691b4dbfc
getPropertyValue for -webkit-marquee returns null, should compute the shorthand value
https://bugs.webkit.org/show_bug.cgi?id=110816

Patch by Uday Kiran <udaykiran@motorola.com> on 2013-02-26
Reviewed by Alexander Pavlov.

Source/WebCore:

Compute the shorthand value for '-webkit-marquee' specified in CSS.

Test: fast/css/getPropertyValue-webkit-marquee.html

* css/StylePropertySet.cpp:
(WebCore::StylePropertySet::getPropertyValue):

LayoutTests:

Added testcases to check getPropertyValue for -webkit-marquee shorthand.

* fast/css/getPropertyValue-webkit-marquee-expected.txt: Added.
* fast/css/getPropertyValue-webkit-marquee.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
getPropertyValue for -webkit-margin-collapse returns null, should compute the shorthand value
https://bugs.webkit.org/show_bug.cgi?id=110903

Patch by Uday Kiran <udaykiran@motorola.com> on 2013-02-26
Reviewed by Alexander Pavlov.

Source/WebCore:

getPropertyValue("-webkit-margin-collapse") should compute shorthand value
when -webkit-margin-collapse is specified in CSS.

Test: fast/css/getPropertyValue-webkit-margin-collapse.html

* css/StylePropertySet.cpp:
(WebCore::StylePropertySet::getPropertyValue):

LayoutTests:

Added test for getPropertyValue("-webkit-margin-collapse").

* fast/css/getPropertyValue-webkit-margin-collapse-expected.txt: Added.
* fast/css/getPropertyValue-webkit-margin-collapse.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144145 268f45cc-cd09-0410-ab3c-d52691b4dbfc
getPropertyValue for -webkit-column-rule returns null, should compute the shorthand value
https://bugs.webkit.org/show_bug.cgi?id=110698

Patch by Uday Kiran <udaykiran@motorola.com> on 2013-02-26
Reviewed by Alexander Pavlov.

Source/WebCore:

Test: fast/css/getPropertyValue-column-rule.html

* css/StylePropertySet.cpp:
(WebCore::StylePropertySet::getPropertyValue):

LayoutTests:

* fast/css/getPropertyValue-column-rule-expected.txt: Added.
* fast/css/getPropertyValue-column-rule.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144146 268f45cc-cd09-0410-ab3c-d52691b4dbfc