The threaded HTML parser should pass all the fast/parser tests
https://bugs.webkit.org/show_bug.cgi?id=109486

Reviewed by Tony Gentilcore.

Source/WebCore:

This patch fixes the last two test failures in fast/parser, which were
crashes caused by not having a tokenizer when document.close() was
called. (The tokenizer is created lazily by calls to document.write,
which might not happen before document.close).

fast/parser/document-close-iframe-load.html
fast/parser/document-close-nested-iframe-load.html

In addition, I've added a new test to make sure we flush the tokenizer
properly in these cases.

Test: fast/parser/document-close-iframe-load-partial-entity.html

* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::prepareToStopParsing):
(WebCore::HTMLDocumentParser::pumpTokenizer):

LayoutTests:

* fast/parser/document-close-iframe-load-partial-entity-expected.txt: Added.
* fast/parser/document-close-iframe-load-partial-entity.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142525 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FrameView::setScrollPosition should clamp scroll position before handing it to
ScrollingCoordinator instead of depending on ScrollView to do this
https://bugs.webkit.org/show_bug.cgi?id=109497
<rdar://problem/12631789>

Reviewed by Simon Fraser.

Clamp scroll position before handing it to ScrollingCoordinator. Also, like ScrollView does,
bail out if we've already scrolled to the clamped scroll position.

Test: platform/mac-wk2/tiled-drawing/clamp-out-of-bounds-scrolls.html

* page/FrameView.cpp:
(WebCore::FrameView::setScrollPosition):

Adjust some test results which previously expected out-of-bounds scrolling to happen.

Add a test that ensures that out-of-bounds scrolling doesn't happen.

* platform/mac-wk2/tiled-drawing/clamp-out-of-bounds-scrolls-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/clamp-out-of-bounds-scrolls.html: Added.
* platform/mac-wk2/tiled-drawing/fixed/negative-scroll-offset-expected.txt:
* platform/mac-wk2/tiled-drawing/fixed/negative-scroll-offset-in-view-expected.txt:
* platform/mac-wk2/tiled-drawing/sticky/negative-scroll-offset-expected.txt:
* platform/mac-wk2/tiled-drawing/tile-coverage-scroll-to-bottom-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142526 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] Handle shape-outside changing a float's overhang behavior
https://bugs.webkit.org/show_bug.cgi?id=106927

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-02-11
Reviewed by Julien Chaffraix.

Source/WebCore:

When the position on a shape outside causes a float to spill out into
another block than it's container, it was not being drawn correctly. It
became apparent that in order to fix this properly, the approach to
positioning shape outsides and floats needed to be changed. The new
approach also fixes some other outstanding issues, like hit detection.

When a float has a shape outside, inline and float layout happens
using the exclusion shape bounds instead of the float's box.  The
effect of this is that the float itself no longer has any effect on
layout, both with respect to positioning of the float's siblings as
well as positioning the float's box. This means that when the float is
positioned, it is the shape's box that must obey the positioning rules
for floats. When the shape is given a position relative to the float's
box, the rules for float positioning determine where the shape sits
in the parent, causing the float's box to be offset by the position of
the shape. Since the float's box does not affect layout (due to the
shape), this is similar to relative positioning in that the offset is
a paint time occurrence.

So the new approach is to implement positioning of shape outside on
floats similar to how relative positioning is implemented, using a
RenderLayer.

This is also tested by the existing tests for shape outside on floats positioning.

Test: fast/exclusions/shape-outside-floats/shape-outside-floats-overhang.html

* rendering/ExclusionShapeOutsideInfo.h:
(WebCore::ExclusionShapeOutsideInfo::shapeLogicalOffset): Utility method to create a LayoutSize for computing the layer offset.
(ExclusionShapeOutsideInfo):
* rendering/LayoutState.cpp:
(WebCore::LayoutState::LayoutState): Check for floats with shape outside as well as in flow positioning.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::flipFloatForWritingModeForChild): Remove old positioning implementation.
(WebCore::RenderBlock::paintFloats): Remove old positioning implementation.
(WebCore::RenderBlock::blockSelectionGaps): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderBlock::positionNewFloats): Remove old positioning implementation.
(WebCore::RenderBlock::addOverhangingFloats): Remove FIXME.
(WebCore::positionForPointRespectingEditingBoundaries): Check for floats with shape outside as well as in flow positioning.
* rendering/RenderBlock.h:
(RenderBlock): Remove old positioning implementation.
(WebCore::RenderBlock::xPositionForFloatIncludingMargin): Remove old positioning implementation.
(WebCore::RenderBlock::yPositionForFloatIncludingMargin): Remove old positioning implementation.
* rendering/RenderBox.cpp:
(WebCore::RenderBox::mapLocalToContainer): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderBox::offsetFromContainer): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderBox::computeRectForRepaint): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderBox::layoutOverflowRectForPropagation): Check for floats with shape outside as well as in flow positioning.
* rendering/RenderBox.h: Make floats with shape outside get a layer.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintOffset): Method to return in flow
    positioning offset + offset from shape outside on floats.
* rendering/RenderBoxModelObject.h:
(RenderBoxModelObject): Add paintOffset method.
* rendering/RenderInline.cpp:
(WebCore::RenderInline::clippedOverflowRectForRepaint): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderInline::computeRectForRepaint): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderInline::mapLocalToContainer): Check for floats with shape outside as well as in flow positioning.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::updateLayerPosition): Check for floats with shape outside as well as in flow positioning.
(WebCore::RenderLayer::calculateClipRects): Check for floats with shape outside as well as in flow positioning.
* rendering/RenderLayer.h:
(WebCore::RenderLayer::paintOffset): Rename offsetForInFlowPosition to reflect that it's not just for
    in flow positioning, it also reflects shape outside position on floats.
(RenderLayer):
* rendering/RenderObject.h:
(WebCore::RenderObject::hasPaintOffset): Determines if this object is in flow positioined or is a float with shape outside.
* rendering/style/RenderStyle.h: Add hasPaintOffset method, analagous to method with same name on RenderObject.

LayoutTests:

This is also tested by the existing tests for shape outside on floats positioning.

* fast/exclusions/shape-outside-floats/shape-outside-floats-overhang-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-overhang.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142527 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix code style violations in GIFImageReader.{cc|h}
https://bugs.webkit.org/show_bug.cgi?id=109007

Reviewed by Stephen White.

This is just a style clean up for GIFImageReader.{cc|h}.

There's going to be a lot changes in these two files and style check
will add a lot of noise in later reviews. Fix style problems first.

There is no change in logic at all. Just style fixes.

No new tests.

* platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::frameCount):
(WebCore::GIFImageDecoder::repetitionCount):
(WebCore::GIFImageDecoder::haveDecodedRow):
(WebCore::GIFImageDecoder::initFrameBuffer):
* platform/image-decoders/gif/GIFImageReader.cpp:
(GIFImageReader::outputRow):
(GIFImageReader::doLZW):
(GIFImageReader::read):
* platform/image-decoders/gif/GIFImageReader.h:
(GIFFrameContext):
(GIFFrameContext::GIFFrameContext):
(GIFFrameContext::~GIFFrameContext):
(GIFImageReader::GIFImageReader):
(GIFImageReader::~GIFImageReader):
(GIFImageReader):
(GIFImageReader::imagesCount):
(GIFImageReader::loopCount):
(GIFImageReader::globalColormap):
(GIFImageReader::globalColormapSize):
(GIFImageReader::frameContext):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142528 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderText::isAllCollapsibleWhitespace() shouldn't upconvert string to 16-bit.
<http://webkit.org/b/109354>

Reviewed by Eric Seidel.

254 KB progression on Membuster3.

* rendering/RenderText.cpp:
(WebCore::RenderText::isAllCollapsibleWhitespace):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142529 268f45cc-cd09-0410-ab3c-d52691b4dbfc
NonStringCell and Object are practically the same thing for the purpose of speculation
https://bugs.webkit.org/show_bug.cgi?id=109492

Reviewed by Mark Hahnenberg.
        
Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
        
Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
        
I believe this is correct because even weird object types like JSNotAnObject end up
being "objects" from the standpoint of our typesystem. Anyway, the assumption that
"is cell but not a string" equates to "object" is an assumption that is already made
in other places in the system so there's little value in being paranoid about it.

* bytecode/SpeculatedType.h:
(JSC::isObjectSpeculation):
(JSC::isObjectOrOtherSpeculation):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::shouldSpeculateObjectOrOther):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142530 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[HTMLTemplateElement] <template> inside of <head> may not create <body> if EOF is hit
https://bugs.webkit.org/show_bug.cgi?id=109338

Reviewed by Adam Barth.

Source/WebCore:

This patch adds the logic to clear the stack of open elements back to the first <template> when EOF
is hit. This allows a <body> to be generated if the initial <template> was opened inside of <head>.

Tests added to html5lib.

* html/parser/HTMLTreeBuilder.cpp:
(WebCore):
(WebCore::HTMLTreeBuilder::popAllTemplates):
(WebCore::HTMLTreeBuilder::processEndTag):
(WebCore::HTMLTreeBuilder::processEndOfFile):
* html/parser/HTMLTreeBuilder.h:
(HTMLTreeBuilder):

LayoutTests:

* html5lib/resources/template.dat:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142531 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed WK2 buildfix after r142518.

* DerivedSources.pri:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Add ENABLE_DELETION_UI to control the use of the deletion UI.
https://bugs.webkit.org/show_bug.cgi?id=109463.

Reviewed by Ryosuke Niwa.
        
This patch adds #if ENABLE(DELETION_UI) in every spot where
DeleteButtonController is used. This class is now only instantiated
if the feature is enabled. I've also done some cleanup in the
DeleteButtonController class, removing unused methods and making
private some methods only used internally to the class.
Both DeleteButtonController and DeleteButton classes are now excluded
from the compilation if the feature is not enabled.

No new tests, no change of functionality.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::cloneChildNodes):
* editing/CompositeEditCommand.cpp:
(WebCore::EditCommandComposition::unapply):
(WebCore::EditCommandComposition::reapply):
(WebCore::CompositeEditCommand::apply):
* editing/DeleteButton.cpp:
* editing/DeleteButtonController.cpp:
* editing/DeleteButtonController.h: Some cleanup.
(WebCore::DeleteButtonController::enabled): Made private.
* editing/EditCommand.cpp:
(WebCore::EditCommand::EditCommand):
* editing/Editor.cpp:
(WebCore::Editor::notifyComponentsOnChangedSelection):
(WebCore::Editor::Editor):
(WebCore::Editor::rangeForPoint):
(WebCore::Editor::deviceScaleFactorChanged):
* editing/Editor.h:
* editing/htmlediting.cpp: avoidIntersectionWithNode is
used only if the feature is enabled.
* editing/htmlediting.h:
* editing/markup.cpp:
(WebCore::createMarkup):
(WebCore::createFragmentFromNodes):
* rendering/RenderTable.cpp: Removed unnecessary include
fo DeleteButtonController.h

Source/WTF: Add ENABLE_DELETION_UI to control the use of the deletion UI.
https://bugs.webkit.org/show_bug.cgi?id=109463.
        
ENABLE_DELETION_UI is set to 1 by default for
all ports. It is explicitly enabled for MAC and disabled for iOS.

Reviewed by Ryosuke Niwa.

* wtf/Platform.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142533 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Text Autosizing] Collect narrow descendants and process them separately. Refactoring for
a change to follow.
https://bugs.webkit.org/show_bug.cgi?id=109054

Preparational change to combine narrow descendants of the same autosizing cluster into
groups by the width difference between the descendant and the block containing all text of
the parent autosizing cluster. The groups will be autosized with the same multiplier.

For example, on sites with a sidebar, sometimes the paragraphs next to the sidebar will have
a large margin individually applied (via a CSS selector), causing them all to individually
appear narrower than their enclosing blockContainingAllText. Rather than making each of
these paragraphs into a separate cluster, we eventually want to be able to merge them back
together into one (or a few) descendant clusters.

Patch by Anton Vayvod <avayvod@chromium.org> on 2013-02-11
Reviewed by Julien Chaffraix.

No behavioral changes thus no new tests or test changes.

* rendering/TextAutosizer.cpp:
(TextAutosizingClusterInfo): Vector of narrow descendants.
(WebCore::TextAutosizer::processCluster): Process narrow descendants separately.
(WebCore::TextAutosizer::processContainer):

    Remember narrow descendants of the parent cluster for later processing.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142534 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fold MarkupTokenizerBase into HTMLTokenizer now that it is the only subclass
https://bugs.webkit.org/show_bug.cgi?id=109499

Reviewed by Adam Barth.

For great justice.  And sanity.
Epic amount of template code deleted.

* GNUmakefile.list.am:
* Target.pri:
* WebCore.gypi:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* html/parser/HTMLTokenizer.cpp:
(WebCore::HTMLTokenizer::HTMLTokenizer):
* html/parser/HTMLTokenizer.h:
(HTMLTokenizer):
(Checkpoint):
(WebCore::HTMLTokenizer::state):
(WebCore::HTMLTokenizer::setState):
(WebCore::HTMLTokenizer::shouldSkipNullCharacters):
(WebCore::HTMLTokenizer::bufferCharacter):
(WebCore::HTMLTokenizer::emitAndResumeIn):
(WebCore::HTMLTokenizer::emitAndReconsumeIn):
(WebCore::HTMLTokenizer::emitEndOfFile):
(WebCore::HTMLTokenizer::haveBufferedCharacterToken):
* xml/parser/MarkupTokenizerBase.h: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142535 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Harden FastMalloc (again)
https://bugs.webkit.org/show_bug.cgi?id=109334

Reviewed by Mark Hahnenberg.

Re-implement hardening of linked lists in TCMalloc.

In order to keep heap introspection working, we need to thread the
heap entropy manually as the introspection process can't use the
address of a global in determining the mask.  Given we now have to
thread a value through anyway, I've stopped relying on ASLR for entropy
and am simply using arc4random() on darwin, and time + ASLR everywhere
else.

I've also made an explicit struct type for the FastMalloc singly linked
lists, as it seemed like the only way to reliably distinguish between
void*'s that were lists vs. void* that were not.  This also made it
somewhat easier to reason about things across processes.

Verified that all the introspection tools work as expected.

* wtf/FastMalloc.cpp:
(WTF::internalEntropyValue):
(WTF):
(HardenedSLL):
(WTF::HardenedSLL::create):
(WTF::HardenedSLL::null):
(WTF::HardenedSLL::setValue):
(WTF::HardenedSLL::value):
(WTF::HardenedSLL::operator!):
(WTF::HardenedSLL::operator UnspecifiedBoolType):
(TCEntry):
(WTF::SLL_Next):
(WTF::SLL_SetNext):
(WTF::SLL_Push):
(WTF::SLL_Pop):
(WTF::SLL_PopRange):
(WTF::SLL_PushRange):
(WTF::SLL_Size):
(PageHeapAllocator):
(WTF::PageHeapAllocator::Init):
(WTF::PageHeapAllocator::New):
(WTF::PageHeapAllocator::Delete):
(WTF::PageHeapAllocator::recordAdministrativeRegions):
(WTF::Span::next):
(WTF::Span::remoteNext):
(WTF::Span::prev):
(WTF::Span::setNext):
(WTF::Span::setPrev):
(Span):
(WTF::DLL_Init):
(WTF::DLL_Remove):
(WTF::DLL_IsEmpty):
(WTF::DLL_Length):
(WTF::DLL_Prepend):
(TCMalloc_Central_FreeList):
(WTF::TCMalloc_Central_FreeList::enumerateFreeObjects):
(WTF::TCMalloc_Central_FreeList::entropy):
(TCMalloc_PageHeap):
(WTF::TCMalloc_PageHeap::init):
(WTF::TCMalloc_PageHeap::scavenge):
(WTF::TCMalloc_PageHeap::New):
(WTF::TCMalloc_PageHeap::AllocLarge):
(WTF::TCMalloc_PageHeap::Carve):
(WTF::TCMalloc_PageHeap::Delete):
(WTF::TCMalloc_PageHeap::ReturnedBytes):
(WTF::TCMalloc_PageHeap::Check):
(WTF::TCMalloc_PageHeap::CheckList):
(WTF::TCMalloc_PageHeap::ReleaseFreeList):
(TCMalloc_ThreadCache_FreeList):
(WTF::TCMalloc_ThreadCache_FreeList::Init):
(WTF::TCMalloc_ThreadCache_FreeList::empty):
(WTF::TCMalloc_ThreadCache_FreeList::Push):
(WTF::TCMalloc_ThreadCache_FreeList::PushRange):
(WTF::TCMalloc_ThreadCache_FreeList::PopRange):
(WTF::TCMalloc_ThreadCache_FreeList::Pop):
(WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects):
(TCMalloc_ThreadCache):
(WTF::TCMalloc_Central_FreeList::Init):
(WTF::TCMalloc_Central_FreeList::ReleaseListToSpans):
(WTF::TCMalloc_Central_FreeList::ReleaseToSpans):
(WTF::TCMalloc_Central_FreeList::InsertRange):
(WTF::TCMalloc_Central_FreeList::RemoveRange):
(WTF::TCMalloc_Central_FreeList::FetchFromSpansSafe):
(WTF::TCMalloc_Central_FreeList::FetchFromSpans):
(WTF::TCMalloc_Central_FreeList::Populate):
(WTF::TCMalloc_ThreadCache::Init):
(WTF::TCMalloc_ThreadCache::Deallocate):
(WTF::TCMalloc_ThreadCache::FetchFromCentralCache):
(WTF::TCMalloc_ThreadCache::ReleaseToCentralCache):
(WTF::TCMalloc_ThreadCache::InitModule):
(WTF::TCMalloc_ThreadCache::NewHeap):
(WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
* wtf/MallocZoneSupport.h:
(RemoteMemoryReader):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142536 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] Upstream changes to Platform.h
<http://webkit.org/b/109459>

Reviewed by Benjamin Poulain.

* wtf/Platform.h:
- Changes for armv7s.
- Add ENABLE() definitions for DASHBOARD_SUPPORT and WEBGL.
- Re-sort USE() macros.
- Remove ENABLE() macros for JIT, LLINT and YARR_JIT to enable
  on iOS Simulator.  They are already defined below.
- Turn off HAVE(HOSTED_CORE_ANIMATION) for iOS.
- Turn on USE(COREMEDIA) for iOS 6.0 and later.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
XMLHttpRequestProgressEventThrottle::resume() always schedules timer even when unnecessary
https://bugs.webkit.org/show_bug.cgi?id=105348

Reviewed by Alexey Proskuryakov.

Let resume() clear the defer flag and return if there is deferred events to dispatch.

No new tests as this should not affect existing cross-platform behavior. It should be
OK as long as it doesn't break anything.

* xml/XMLHttpRequestProgressEventThrottle.cpp:
(WebCore::XMLHttpRequestProgressEventThrottle::resume):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change RenderFrameSet::paint to use m-rows/m_cols directly.
https://bugs.webkit.org/show_bug.cgi?id=108503

Source/WebCore:

Reviewed by Eric Seidel.

Test: fast/frames/invalid-frameset.html

* rendering/RenderFrameSet.cpp:
(WebCore::RenderFrameSet::paint):

LayoutTests:

Reviewed by Eric Seidel.

Add test for how we render an invalid frameset.

* fast/frames/invalid-frameset-expected.html: Added.
* fast/frames/invalid-frameset.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142539 268f45cc-cd09-0410-ab3c-d52691b4dbfc
PluginProcessConnectionManager should be a QueueClient
https://bugs.webkit.org/show_bug.cgi?id=109496

Reviewed by Andreas Kling.

* WebProcess/Plugins/PluginProcessConnectionManager.cpp:
(WebKit::PluginProcessConnectionManager::didReceiveMessageOnConnectionWorkQueue):
(WebKit):
(WebKit::PluginProcessConnectionManager::didCloseOnConnectionWorkQueue):
* WebProcess/Plugins/PluginProcessConnectionManager.h:
(PluginProcessConnectionManager):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeConnection):
* WebProcess/WebProcess.h:
(WebProcess):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142540 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] setMinimumLayoutWidth should bail if there's no WebProcess
https://bugs.webkit.org/show_bug.cgi?id=109512
<rdar://problem/13093627>

Reviewed by Anders Carlsson.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setMinimumLayoutWidth):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142542 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Strange bug in DFG OSR in JSC
https://bugs.webkit.org/show_bug.cgi?id=109491

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
inject something just before a SetLocal we should be aware that the previous operation may have been
a side-effect associated with the current code origin. Hence, we should use a forward exit.
Int32ToDouble does not do forward exits by default.
        
This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
signaling exit direction is not "great" but it's what we use in other places already (like
ForwardCheckStructure).

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::int32ToDoubleCSE):
(CSEPhase):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCommon.h:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::willHaveCodeGenOrOSR):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStream::reconstruct):

LayoutTests: 

Reviewed by Mark Hahnenberg.
        
Added one version of the test (dfg-int32-to-double-on-set-local-and-exit) that is based
exactly on Gabor's original test, and another that ought to fail even if I fix other bugs
in the future (see https://bugs.webkit.org/show_bug.cgi?id=109511).

* fast/js/dfg-int32-to-double-on-set-local-and-exit-expected.txt: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-exit.html: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-sometimes-exit-expected.txt: Added.
* fast/js/dfg-int32-to-double-on-set-local-and-sometimes-exit.html: Added.
* fast/js/script-tests/dfg-int32-to-double-on-set-local-and-exit.js: Added.
(checkpoint):
(func1):
(func2):
(func3):
(test):
* fast/js/script-tests/dfg-int32-to-double-on-set-local-and-sometimes-exit.js: Added.
(checkpoint):
(func1):
(func2):
(func3):
(test):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142544 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WEBGL_compressed_texture_s3tc extension can be enabled even when not supported
https://bugs.webkit.org/show_bug.cgi?id=109508

Reviewed by Kenneth Russell.

* html/canvas/WebGLRenderingContext.cpp:
(WebCore):
(WebCore::WebGLRenderingContext::getExtension): Check whether the extension support is there before returning the extension pointer.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142545 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make WebCore Derived Sources work with SDK identifiers too
https://bugs.webkit.org/show_bug.cgi?id=109324

Patch by David Farler <dfarler@apple.com> on 2013-02-11
Reviewed by Sam Weinig.

* WebCore.xcodeproj/project.pbxproj: Pass SDKROOT to make for DerivedSources.make

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142546 268f45cc-cd09-0410-ab3c-d52691b4dbfc