Unreviewed, rolling out r167855.
https://bugs.webkit.org/show_bug.cgi?id=132301

Broke the windows build (Requested by bfulgham on #webkit).

Reverted changeset:

"ScriptExecutionContext::Task should work well with C++11
lambdas"
https://bugs.webkit.org/show_bug.cgi?id=129795
http://trac.webkit.org/changeset/167855

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167904 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit2 View Gestures (Swipe): Discard snapshots made with a different view size/pixel density
https://bugs.webkit.org/show_bug.cgi?id=132115

Reviewed by Simon Fraser.

We shouldn't try to use snapshots if they no longer match the destination view size.
To do this, we need an accurate understanding of the topContentInset, both for the Web view,
and for any custom views, because we don't want to include the inset area in the snapshot,
and we don't want to reject snapshots that differ from the current view only because they have an inset or not.

* UIProcess/API/Cocoa/WKViewPrivate.h:
* UIProcess/API/mac/WKView.mm:
(-[WKView _takeViewSnapshot]):
(-[WKView _setCustomSwipeViewsTopContentInset:]):
Add and plumb through a topContentInset property to apply to the custom swipe views.
For simplicitly's sake in the multi-view case, it is applied in window coordinates,
so clients will have to do conversions if necessary.
Don't include the top content inset in the snapshot that is taken.

* UIProcess/mac/ViewGestureController.h:
(WebKit::ViewGestureController::setCustomSwipeViewsTopContentInset):
* UIProcess/mac/ViewGestureControllerMac.mm:
(WebKit::ViewGestureController::ViewGestureController):
(WebKit::ViewGestureController::windowRelativeBoundsForCustomSwipeViews):
Apply the aforementioned custom swipe view top content inset.

(WebKit::ViewGestureController::determineSnapshotLayerParent):
(WebKit::ViewGestureController::determineLayerAdjacentToSnapshotForParent):
Factor these out of beginSwipeGesture.

(WebKit::ViewGestureController::retrieveSnapshotForItem):
Don't return a snapshot if the current deviceScaleFactor doesn't match that
at which the snapshot was taken, or if the size of the snapshot doesn't match
the unobscured part of the snapshot layer (the layer's size sans top content inset).

(WebKit::layerGeometryFlippedToRoot): Added.
Determine whether geometry flipping occurs between a layer and the root of the tree it is in.

(WebKit::ViewGestureController::applyDebuggingPropertiesToSwipeViews):
Factor out debugging layer properties, and add some borders and backgrounds to our layers.
I switched to invert instead of blur because blur makes the borders hard to use.

(WebKit::ViewGestureController::beginSwipeGesture):
Add an additional layer, the swipeLayer, which is the parent of the swipeSnapshotLayer.
We use this layer to compensate for geometry flipping, since we don't necessarily
know the structure of the layer tree ahead of time when inserting snapshots into the
client's layer tree, in the custom swipe view case.
The swipe layer is always the full size of the view, including topContentInset, and
has a white background in order to fill in that space. The snapshot layer is the size
of the view *excluding* the topContentInset, which should match the size of the snapshot image
itself (and we reject the image and just paint white if this is not the case).

(WebKit::ViewGestureController::handleSwipeGesture):
(WebKit::ViewGestureController::removeSwipeSnapshot):
Move and remove the new swipeLayer.

* UIProcess/mac/ViewSnapshotStore.h:
* UIProcess/mac/ViewSnapshotStore.mm:
(WebKit::ViewSnapshotStore::recordSnapshot):
Store the deviceScaleFactor at the time the snapshot was taken.
Fix a bug where the count of snapshots with live images was too high
because we were failing to decrement it when replacing a snapshot of
an existing item with a fresh one.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167905 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore: The LLInt is awesome and it should get more of the action.

Rubber stamped by Geoffrey Garen.
        
5% speed-up on JSBench and no meaningful regressions.  Should be a PLT/DYE speed-up also.

* runtime/Options.h:

Tools: Make sure that the coverage of our tests doesn't change much if we change the thresholds now and in the future, but making
"no-cjit" runs force the old-school threshold.

Rubber stamped by Mark Hahnenberg.

* Scripts/run-jsc-stress-tests:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167906 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Use the animated version of setHighlighted on NSButtonCell where available
https://bugs.webkit.org/show_bug.cgi?id=132295
<rdar://problem/16747240>

Reviewed by Beth Dakin.

Like setState, there is an animated version of setHighlighted available.

* platform/mac/ThemeMac.mm:
(WebCore::updateStates): Use private version of _setHighlighted where possible.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167907 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r167857.
https://bugs.webkit.org/show_bug.cgi?id=132305

the change was rolled out, roll out the new expectations as
well (Requested by thorton on #webkit).

Reverted changeset:

"Unreviewed. Updating one bindings test baseline after
r167855."
http://trac.webkit.org/changeset/167857

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167908 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2 iOS] Need to show title in the action sheet for images not inside an anchor element.
https://bugs.webkit.org/show_bug.cgi?id=132304
<rdar://problem/16535227>

Reviewed by Benjamin Poulain.

If the image in not inside an anchor tag, we must use the title attribute as
title for the action sheet.

* UIProcess/ios/WKActionSheetAssistant.mm:
(-[WKActionSheetAssistant _createSheetWithElementActions:showLinkTitle:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167909 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[New Multicolumn] event.offsetX/offsetY don't work correctly
https://bugs.webkit.org/show_bug.cgi?id=132284

Reviewed by Simon Fraser.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
Change the code here to only trigger for CSS Regions and not for
multi-column. Add a FIXME pointing out that the code is broken even for
CSS regions.

 * rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::mapAbsoluteToLocalPoint):
Override mapAbsoluteToLocalPoint in order to guess a region and attempt
to translate the point from that region to the flow thread local coordinate
space.

(WebCore::RenderMultiColumnFlowThread::physicalTranslationFromRegionToFlow):
* rendering/RenderMultiColumnFlowThread.h:
New helper function that just wraps calling the region's logical translation
function and converting to/from physical coordinates.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167910 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Scrollbars do not update properly when topContentInset changes dynamically
https://bugs.webkit.org/show_bug.cgi?id=132309
-and corresponding-
<rdar://problem/16642232>

Reviewed by Tim Horton.

It is not sufficient to do a layout and call updateScrollbars(). We must also call 
RenderLayerCompositor::frameViewDidChangeSize() in order to properly adjust the 
size and position of all of the scrolling-related layers.
* page/FrameView.cpp:
(WebCore::FrameView::topContentInsetDidChange):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167911 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a transcription error from r167901.

When addressing Darin's review feedback, I moved the iteration of dataArray from
QuickLookDocumentData::append() to WebQuickLookHandleClient::didReceiveDataArray(),
but I forgot to update the context argument to CFArrayApplyFunction() accordingly.

* WebProcess/WebCoreSupport/ios/WebQuickLookHandleClient.cpp:
(WebKit::WebQuickLookHandleClient::didReceiveDataArray):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167912 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in platform/mac/accessibility/table-visible-rows.html
https://bugs.webkit.org/show_bug.cgi?id=132146

Reviewed by Filip Pizlo.

Instead of creating a local JSValueRef array on the stack and passing that to
JSObjectMakeArray(), changed to create an empty JSArray and then populate the
values using the JSObjectSetPropertyAtIndex() API.

* DumpRenderTree/AccessibilityUIElement.cpp:
(elementsForRangeCallback):
(convertElementsToObjectArray):
* DumpRenderTree/mac/TestRunnerMac.mm:
(originsArrayToJS):
* WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
(WTR::EventSendingController::contextClick):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::stringArrayToJS):
* WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:
(WTR::convertElementsToObjectArray):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167913 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS][WK2] iOS fix after r167867
https://bugs.webkit.org/show_bug.cgi?id=132302

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

iOS Touch Points uses "phase" for describing the touch points state for historical reasons.
This patch adds state() as a synonym for phase, and revert r167893.

* Shared/WebEvent.h:
(WebKit::WebPlatformTouchPoint::state):
* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167914 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed EFL gardening.

Skip editing/pasteboard which EFL port does not support.

* platform/efl-wk1/TestExpectations:
* platform/efl-wk2/TestExpectations:
* platform/efl/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167915 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS][WK2] Restore the scroll position and scale from the HistoryItem (mostly)
https://bugs.webkit.org/show_bug.cgi?id=132307

Source/WebCore: 

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

* WebCore.exp.in:

Source/WebKit2: 
<rdar://problem/16031704>

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

Restore the scroll position and scale on back-forward by restoring the values from HistoryItem.
This covers the common cases, see <rdar://problem/16031704>.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _didCommitLayerTree:WebKit::]):
(-[WKWebView _didCommitLoadForMainFrame]): Deleted.
* UIProcess/API/Cocoa/WKWebViewInternal.h:
* UIProcess/ios/WKContentView.mm:
(-[WKContentView _didCommitLoadForMainFrame]):
Get rid of the old code restoring the scroll position. This is now done by the WebProcess.

* UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
Update the scrolling tree after invoking didCommitLayerTree() on the WebPageProxy.

WKContentView and WKWebView states are updated in response to didCommitLayerTree(), the content size
and scale in particular are set there.

After that, the content size/scale is in the same state as the layerTree update, and we can scroll
the content as needed.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm:
(WebKit::WebFrameLoaderClient::restoreViewState):
iOS WebKit1 uses a custom restoreViewState(), do the same for WebKit2 since the generic code is #ifdefed out.
This is also necessary for the main frame's state update.

* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::restorePageState):
Restore the scale and position of the main frame. For now, we assume m_userHasChangedPageScaleFactor is set otherwise
the initial-scale would override the restored value. We will need to fix that, the value should probably be saved with
the history.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167916 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r153142) ASSERT from CodeBlock::dumpBytecode dumping String Switch Jump Tables
https://bugs.webkit.org/show_bug.cgi?id=132315

Reviewed by Mark Hahnenberg.

Used the StringImpl version of utf8() instead of creating a String first.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167917 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Versioning.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167919 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS JIT: backtracking with current / parent element for child
https://bugs.webkit.org/show_bug.cgi?id=132057

Patch by Yusuke Suzuki <utatane.tea@gmail.com> on 2014-04-28
Reviewed by Benjamin Poulain.

Calculate appropriate backtracking start height from the closest
descendant. And at first, we use it for a simple optimization.

1. When backtracking start height equals to current height, we
can simply jump to a descendant element check phase.
2. When backtracking start height equals to current height + 1, we
can simply jump to a descendant element traversing phase.

We can apply this optimization to fragments with adjacent combinators.
But, in the meantime, we start to implement it for a fragment with
child combinator.

Source/WebCore:
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
(WebCore::SelectorCompiler::TagNamePattern::TagNamePattern):
(WebCore::SelectorCompiler::solveDescendantBacktrackingActionForChild):
(WebCore::SelectorCompiler::solveBacktrackingAction):
(WebCore::SelectorCompiler::equalTagNames):
(WebCore::SelectorCompiler::equalTagNamePatterns):
(WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant):
(WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
(WebCore::SelectorCompiler::requiresAdjacentTail):
(WebCore::SelectorCompiler::requiresDescendantTail):
(WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentNode):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateParentElementTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateAncestorTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):

LayoutTests:
* fast/selectors/backtracking-child-combinator-with-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-with-tail.html: Added.
* fast/selectors/backtracking-child-combinator-without-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-without-tail.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167920 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SelectorCodeGenerator::generateElementIsNthChild() leaks the parent register :nth-child() is non-filtering
https://bugs.webkit.org/show_bug.cgi?id=132311

Reviewed by Andreas Kling.


Source/WebCore: 
In two cases, the parent register was never returned to the register allocator:
-Non filtering selectors (the early return).
-Non marking selectors (at the moment: only querySelector API).

Unfortunately, generateElementIsNthChild() makes function call, which forces us to do this manual allocation
of the parentElement register. Long term, I want RegisterAllocator and FunctionCall to have a special type for that.

Test: fast/selectors/several-nth-child.html

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):

LayoutTests: 
* fast/selectors/several-nth-child-expected.txt: Added.
* fast/selectors/several-nth-child.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167921 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Simplify tryCacheGetById
https://bugs.webkit.org/show_bug.cgi?id=132314

Reviewed by Oliver Hunt and Filip Pizlo.

This is neutral across all benchmarks we track, although it looks like a wee 0.5% progression on sunspider.

* jit/Repatch.cpp:
(JSC::tryCacheGetByID): If we fail to cache on self, we just repatch to call tryBuildGetByIDList next time.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167922 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/16750708> REGRESSION (r159358): Crash in InjectedBundleHitTestResult::frame
https://bugs.webkit.org/show_bug.cgi?id=132318

Reviewed by Andy Estes.

* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::PolicyClient::decidePolicyForNavigationAction): Fixed a typo: set
the source frame, not the destination frame.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction): Changed to get the
frame for the action not from a hit test result, because some link activation actions are
not mouse events, but rather from the event’s target.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167923 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][WK2] Avoid Vector copies in WebViewBaseInputMethodFilter::setPreedit()
https://bugs.webkit.org/show_bug.cgi?id=132323

Reviewed by Carlos Garcia Campos.

* UIProcess/API/gtk/WebViewBaseInputMethodFilter.cpp:
(WebKit::WebViewBaseInputMethodFilter::setPreedit): Inline the Vector object construction into
the WebPageProxy::setComposition() call to avoid extra Vector copies and moves.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167924 268f45cc-cd09-0410-ab3c-d52691b4dbfc