Teach DFG::Worklist and its clients that it may be reused for different kinds of compilations
https://bugs.webkit.org/show_bug.cgi?id=120489

Reviewed by Geoffrey Garen.
        
If the baseline JIT hits an OSR entry trigger into the DFG and we already have a
DFG compilation but we've also started one or more FTL compilations, then we
shouldn't get confused. Previously we would have gotten confused because we would
see an in-process deferred compile (the FTL compile) and also an optimized
replacement (the DFG code).
        
If the baseline JIT hits an OSR entry trigger into the DFG and we previously
did two things in this order: triggered a tier-up compilation from the DFG into
the FTL, and then jettisoned the DFG code because it exited a bunch, then we
shouldn't be confused by the presence of an in-process deferred compile (the FTL
compile). Previously we would have waited for that compile to finish; but the more
sensible thing to do is to let it complete and then invalidate it, while at the
same time enqueueing a DFG compile to create a new, more valid, DFG code block.
        
If the DFG JIT hits a loop OSR entry trigger (into the FTL) and it has already
triggered an FTL compile for replacement, then it should fire off a second compile
instead of thinking that it can wait for that one to finish. Or vice-versa. We
need to allow for two FTL compiles to be enqueued at the same time (one for
replacement and one for OSR entry in a loop).
        
Then there's also the problem that DFG::compile() is almost certainly going to be
the hook for triggering both DFG compiles and the two kinds of FTL compiles, but
right now there is no way to tell it which one you want.
        
This fixes these problems and removes a bunch of potential confusion by making the
key for a compile in the DFG::Worklist be a CompilationMode (one of DFGMode,
FTLMode, or FTLForOSREntryMode). That mode is also passed to DFG::compile().
        
Awkwardly, this still leaves us in a no DFG->FTL tier-up situation - so
DFG::compile() is always passed DFGMode and then it might do an FTL compile if
possible. Fixing that is a bigger issue for a later changeset.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::checkIfOptimizationThresholdReached):
* dfg/DFGCompilationKey.cpp: Added.
(JSC::DFG::CompilationKey::dump):
* dfg/DFGCompilationKey.h: Added.
(JSC::DFG::CompilationKey::CompilationKey):
(JSC::DFG::CompilationKey::operator!):
(JSC::DFG::CompilationKey::isHashTableDeletedValue):
(JSC::DFG::CompilationKey::profiledBlock):
(JSC::DFG::CompilationKey::mode):
(JSC::DFG::CompilationKey::operator==):
(JSC::DFG::CompilationKey::hash):
(JSC::DFG::CompilationKeyHash::hash):
(JSC::DFG::CompilationKeyHash::equal):
* dfg/DFGCompilationMode.cpp: Added.
(WTF::printInternal):
* dfg/DFGCompilationMode.h: Added.
* dfg/DFGDriver.cpp:
(JSC::DFG::compileImpl):
(JSC::DFG::compile):
* dfg/DFGDriver.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::Plan):
(JSC::DFG::Plan::key):
* dfg/DFGPlan.h:
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::enqueue):
(JSC::DFG::Worklist::compilationState):
(JSC::DFG::Worklist::completeAllReadyPlansForVM):
(JSC::DFG::Worklist::runThread):
* dfg/DFGWorklist.h:
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154854 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Crash when VoiceOver reference a TextMarker from an iframe that has been removed
https://bugs.webkit.org/show_bug.cgi?id=120318

Reviewed by Darin Adler.

Source/WebCore:

These crashes occur because an AXTextMarker is retrieved that reference a Node in an iframe.
The iframe goes away, but when it tries to clean up and remove that Node from the InUse cache,
the document() tree has already been detached, so it never clears the actual InUse cache.

The fix here is to pre-emptively clean up any nodes in the document going away when the frame is about to disconnect.

I'm removing the clearAXObjectCache() at the disconnectOwnerElement because it
   1) Cleared the AXObjectCache for the iframe document (which is always empty -- only the top level doc maintains the cache), because
        the document() tree had already been detached... so it essentially did nothing.
   2) And if it did work, we wouldn't want this behavior -- that is to say, when an iframe goes away, we don't want to clear the entire cache for all
       the other documents (there's even an existing layout test to verify this behavior).

Test: platform/mac/accessibility/stale-textmarker-crash.html

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::clearTextMarkerNodesInUse):
* accessibility/AXObjectCache.h:
* page/Frame.cpp:
(WebCore::Frame::disconnectOwnerElement):

LayoutTests:

* platform/mac/accessibility/stale-textmarker-crash-expected.txt: Added.
* platform/mac/accessibility/stale-textmarker-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154855 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SVG clipping, masking, and gradients-on-text do not respect the device scale factor
https://bugs.webkit.org/show_bug.cgi?id=120377
<rdar://problem/14777944>

Reviewed by Simon Fraser.

Tests: svg/custom/masking-clipping-hidpi.svg

calculateTransformationToOutermostCoordinateSystem should include the page's
device scale factor in its transform.

* rendering/svg/SVGRenderingContext.cpp:
(WebCore::SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem):

Add a test that ensures that when deviceScaleFactor=2, masks, clipping,
gradients, and patterns are rendered @2x.

* svg/custom/masking-clipping-hidpi-expected.svg: Added.
* svg/custom/masking-clipping-hidpi.svg: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154856 268f45cc-cd09-0410-ab3c-d52691b4dbfc
new-run-webkit-tests does not respect --no-sample-on-timeout switch
https://bugs.webkit.org/show_bug.cgi?id=120491

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-08-29
Reviewed by Darin Adler.

* Scripts/webkitpy/port/server_process.py:
(ServerProcess._handle_timeout):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154857 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement object-fit CSS property
https://bugs.webkit.org/show_bug.cgi?id=52040

Source/WebCore:

Reviewed by Antti Koivisto, Sam Weinig.

Merge object-fit patch from Blink r156535, which started as a patch
by me.

Since then, the spec has gone to CR. This patch is an
implementation of object-fit as described in
http://www.w3.org/TR/2012/CR-css3-images-20120417/#object-fit

Object-fit is used to maintain the aspect ratio of replaced content
within its content box. All object-fit values but the initial one
('fill') will always ensure that the aspect ratio is retained, in
different ways (fit inside the content box, cover the content box, or
use intrinsic size). Painting is always clipped against the content
box, regardless of the 'overflow' property.

Tests: fast/css/object-fit/object-fit-canvas.html
       fast/css/object-fit/object-fit-embed.html
       fast/css/object-fit/object-fit-grow-landscape.html
       fast/css/object-fit/object-fit-grow-portrait.html
       fast/css/object-fit/object-fit-img-svg.html
       fast/css/object-fit/object-fit-img-svg2.html
       fast/css/object-fit/object-fit-img.html
       fast/css/object-fit/object-fit-input-image.html
       fast/css/object-fit/object-fit-object.html
       fast/css/object-fit/object-fit-shrink.html
       fast/css/object-fit/object-fit-video-poster.html
       fast/css/parsing-object-fit.html
       http/tests/css/object-fit-delayed-img-svg.html
       media/video-object-fit-change.html
       media/video-object-fit.html

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::propertyValue):
* css/CSSParser.cpp:
(WebCore::isValidKeywordPropertyAndValue):
(WebCore::isKeywordPropertyID):
(WebCore::CSSParser::parseValue):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator EObjectFit):
* css/CSSProperty.cpp:
(WebCore::CSSProperty::isInheritedProperty):
* css/CSSPropertyNames.in:
* css/CSSValueKeywords.in:
* css/DeprecatedStyleBuilder.cpp:
(WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::applyProperty):
* css/html.css:
(video): Set object-fit to 'contain'. This is how VIDEO elements
work, apparently.
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::imageSizeForRenderer):
* loader/cache/CachedImage.h:
* platform/graphics/LayoutSize.h:
(WebCore::fitLayoutSizeToAspectRatio): New function to grow or shrink
in one dimension to fit to the aspect ratio.
* rendering/RenderHTMLCanvas.cpp:
(WebCore::RenderHTMLCanvas::paintReplaced): Apply object-fit and
clip if necessary.
* rendering/RenderImage.cpp:
(WebCore::RenderImage::updateInnerContentRect):
(WebCore::RenderImage::imageDimensionsChanged): Update intrinsic
size properly, and recalculate the inner content rectangle (the
exact area occupied by the replaced content) again if appropriate.
(WebCore::RenderImage::paintReplaced): Apply object-fit and clip
if necessary.
(WebCore::RenderImage::foregroundIsKnownToBeOpaqueInRect):
object-fit may leave parts of the content box empty, in which case
it won't be fully obscured.
(WebCore::RenderImage::layout):
* rendering/RenderImage.h:
* rendering/RenderImageResource.cpp:
(WebCore::RenderImageResource::intrinsicSize): Need this to
differentiate between intrinsic and extrinsic size for SVG images.
* rendering/RenderImageResource.h:
* rendering/RenderImageResourceStyleImage.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::replacedContentRect): Return the
rectangle occupied by the replaced content. This will be identical
to the content box if object-fit is 'fill', but will typically be
something else for other values.
* rendering/RenderReplaced.h:
* rendering/RenderVideo.cpp:
(WebCore::RenderVideo::videoBox): Not much left to do here, with
the new RenderReplaced::replacedContentRect() method in place.
(WebCore::RenderVideo::paintReplaced): Apply object-fit and clip
if necessary.
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::changeRequiresRepaint):
* rendering/style/RenderStyle.h:
* rendering/style/RenderStyleConstants.h:
* rendering/style/StyleRareNonInheritedData.cpp:
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):
* rendering/style/StyleRareNonInheritedData.h:

LayoutTests:

Reviewed by Antti Koivisto, Sam Weinig.

Tests for object-fit.

* fast/css/object-fit/object-fit-canvas-expected.html: Added.
* fast/css/object-fit/object-fit-canvas.html: Added.
* fast/css/object-fit/object-fit-embed-expected.html: Added.
* fast/css/object-fit/object-fit-embed.html: Added.
* fast/css/object-fit/object-fit-grow-landscape-expected.html: Added.
* fast/css/object-fit/object-fit-grow-landscape.html: Added.
* fast/css/object-fit/object-fit-grow-portrait-expected.html: Added.
* fast/css/object-fit/object-fit-grow-portrait.html: Added.
* fast/css/object-fit/object-fit-img-expected.html: Added.
* fast/css/object-fit/object-fit-img-svg-expected.html: Added.
* fast/css/object-fit/object-fit-img-svg.html: Added.
* fast/css/object-fit/object-fit-img-svg2-expected.html: Added.
* fast/css/object-fit/object-fit-img-svg2.html: Added.
* fast/css/object-fit/object-fit-img.html: Added.
* fast/css/object-fit/object-fit-input-image-expected.html: Added.
* fast/css/object-fit/object-fit-input-image.html: Added.
* fast/css/object-fit/object-fit-object-expected.html: Added.
* fast/css/object-fit/object-fit-object.html: Added.
* fast/css/object-fit/object-fit-shrink-expected.html: Added.
* fast/css/object-fit/object-fit-shrink.html: Added.
* fast/css/object-fit/object-fit-video-poster-expected.html: Added.
* fast/css/object-fit/object-fit-video-poster.html: Added.
* fast/css/parsing-object-fit-expected.txt: Added.
* fast/css/parsing-object-fit.html: Added.
* fast/css/resources/circle.svg: Added.
* fast/css/resources/circle2.svg: Added.
* fast/css/resources/circles-landscape-small.png: Added.
* fast/css/resources/circles-landscape.png: Added.
* fast/css/resources/circles-portrait-small.png: Added.
* fast/css/resources/circles-portrait.png: Added.
* http/tests/css/object-fit-delayed-img-svg-expected.html: Added.
* http/tests/css/object-fit-delayed-img-svg.html: Added.
* media/video-object-fit-change-expected.html: Added.
* media/video-object-fit-change.html: Added.
* media/video-object-fit-expected.html: Added.
* media/video-object-fit.html: Added.
* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154858 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Avoid Node references from AXObjectCache from leaking
https://bugs.webkit.org/show_bug.cgi?id=120501

Reviewed by Darin Adler.

Merge https://chromium.googlesource.com/chromium/blink/+/454f31497613b6d0fbcfb0df757254b64a177c06
without any tests since we don't have the same infrastructure to detect leaks in WebKit.

A real world example of this would be selecting an <option> item inside frame by keyboard. The node will not be deref()-ed until the topDocument() is detached. 

The issue was that AccessibilityMenuListOption is created in childrenChanged()
hook called when its RenderObject is being destroyed. This patch modifies AccessibilityMenuListPopup so it won't create AccessibilityMenuListOption if its
element is already detached.

* accessibility/AccessibilityMenuListPopup.cpp:
(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::didUpdateActiveOption):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154859 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Web Inspector: inspector/storage-panel-dom-storage-update.html fails
https://bugs.webkit.org/show_bug.cgi?id=116241

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2013-08-29
Reviewed by Darin Adler.

* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154860 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement ES6 Map object
https://bugs.webkit.org/show_bug.cgi?id=120333

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Implement support for the ES6 Map type and related classes.

* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/CopyToken.h: Add a new token to track copying the backing store
* runtime/CommonIdentifiers.h: Add new identifiers
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
    Add new structures and prototypes

* runtime/JSMap.cpp: Added.
* runtime/JSMap.h: Added.
    New JSMap class to represent a Map instance

* runtime/MapConstructor.cpp: Added.
* runtime/MapConstructor.h: Added.
    The Map constructor

* runtime/MapData.cpp: Added.
* runtime/MapData.h: Added.
    The most interesting data structure.  The roughly corresponds
    to the ES6 notion of MapData.  It provides the core JSValue->JSValue
    map implementation.  We implement it using 2 hashtables and a flat
    table.  Due to the different semantics of string comparisons vs.
    all others we need have one map keyed by String and the other by
    generic JSValue.  The actual table is represented more or less
    exactly as described in the ES6 draft - a single contiguous list of
    key/value pairs.  The entire map could be achieved with just this
    table, however we need the HashMaps in order to maintain O(1) lookup.

    Deleted values are simply cleared as the draft says, however the
    implementation compacts the storage on copy as long as the are no
    active iterators.

* runtime/MapPrototype.cpp: Added.
* runtime/MapPrototype.h: Added.
    Implement Map prototype functions

* runtime/VM.cpp:
    Add new structures.

LayoutTests:

Tests

* fast/js/basic-map-expected.txt: Added.
* fast/js/basic-map.html: Added.
* fast/js/script-tests/basic-map.js: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154861 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix issues found by MSVC (which also happily fixes an unintentional pessimisation)

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154862 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CodeBlock: LLIntCallLinkInfo vector can be sized-to-fit at creation.
<https://webkit.org/b/120487>

Reviewed by Oliver Hunt.

CodeBlock::m_llintCallLinkInfos never changes size after creation, so make it a Vector
instead of a SegmentedVector. Use resizeToFit() instead of grow() since we know the
exact amount of space needed.

* bytecode/CodeBlock.h:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::shrinkToFit):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154863 268f45cc-cd09-0410-ab3c-d52691b4dbfc