Web Inspector: Breakpoint in gutter has clipped / broken border image.
https://bugs.webkit.org/show_bug.cgi?id=131500

Reviewed by Joseph Pecoraro.

Typo in r166925.

Source/WebCore:

Test: fast/borders/border-image-slice-missing-right.html

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintNinePieceImage):

LayoutTests:

* fast/borders/border-image-slice-missing-right-expected.html: Added.
* fast/borders/border-image-slice-missing-right.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix after http://trac.webkit.org/changeset/167085.

Reviewed by Timothy Hatcher.

* plugins/PluginData.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure, !node || node->isElementNode(), in
WebCore::RenderBlock::clone()
<https://bugs.webkit.org/show_bug.cgi?id=110489>
<rdar://problem/13666425>

Reviewed by Antti Koivisto.

Source/WebCore:

We're ending up in RenderBlock::splitBlocks() with |this| ==
|fromBlock|.  We then try to climb the ancestor block chain from
this->parent() to |fromBlock|, but this->parent() is already above
|fromBlock|, so we end up climbing up to the RenderView and trying to
clone it, causing the assertion failure.

Adopt Chromium's mitigation for this from
<https://codereview.chromium.org/13852041>. This is not intended as a
fix for the underlying issue.

Also, fix another issue that occurs with this fuzzed test case that's
not handled by the Chromium fix.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::splitBlocks):
Ensure while we're in the loop that |curr| is a descendant of
|fromBlock|. From the Chromium patch:

    We need to check in every iteration of the loop because
    moveChildrenTo could have moved |curr|. This is a mitigation and
    not really a fix against a class of tree craziness.

Finally, before moving children from |fromBlock| to |toBlock|, ensure
that the children are children of |fromBlock|. If we never entered the
loop, they will be siblings of |fromBlock|, not children.

LayoutTests:

* fast/multicol/fuzzed-test-case-expected.txt: Added.
* fast/multicol/fuzzed-test-case.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure in WebCore::FlexBoxIterator::next()
<https://bugs.webkit.org/show_bug.cgi?id=117176>
<rdar://problem/14054549>

Source/WebCore:

Code added in r115687 began removing anonymous wrappers when children
become inline. However, there are some objects, like
RenderDeprecatedFlexBox, whose children should always be blocks.

Reviewed by Tim Horton.

* rendering/RenderBlock.h:
(WebCore::RenderBlock::canCollapseAnonymousBlockChild):
Made public.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
Return early if we can't collapse anonymous block children.

LayoutTests:

Reviewed by Tim Horton.

* fast/flexbox/collapse-anonymous-wrappers-assertion-expected.txt: Added.
* fast/flexbox/collapse-anonymous-wrappers-assertion.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LLInt interpreter code should be generated as part of one function
https://bugs.webkit.org/show_bug.cgi?id=131205

Reviewed by Mark Lam.

Source/JavaScriptCore: 

Changed the generation of llint opcodes so that they are all part of the same
global function, llint_entry.  That function is used to fill in an entry point
table that includes each of the opcodes and helpers.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
* JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
* JavaScriptCore.xcodeproj/project.pbxproj:
Added appropriate use of new -I option to offline assembler and offset
generator scripts.

* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter.cpp:
* llint/LowLevelInterpreter.h:
* offlineasm/arm.rb:
* offlineasm/arm64.rb:
* offlineasm/asm.rb:
* offlineasm/ast.rb:
* offlineasm/backends.rb:
* offlineasm/cloop.rb:
* offlineasm/generate_offset_extractor.rb:
* offlineasm/instructions.rb:
* offlineasm/parser.rb:
* offlineasm/registers.rb:
* offlineasm/self_hash.rb:
* offlineasm/settings.rb:
* offlineasm/transform.rb:
* offlineasm/x86.rb:
Added a new "global" keyword to the offline assembler that denotes a label that
should be exported.  Added opcode and operand support to get the absolute
address of a local label using position independent calculations.  Updated the
offline assembler to handle included files, both when generating the checksum
as well as including files from other than the local directory via a newly
added -I option.  The offline assembler now automatically determines external
functions by keeping track of referenced functions that are defined within the
assembly source.  This is used both for choosing the correct macro for external
references as well as generating the needed EXTERN directives for masm.
Updated the generation of the masm only .sym file to be written once at the end
of the offline assembler.

* assembler/MacroAssemblerCodeRef.h:
(JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
(JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFromLLInt):
* bytecode/Opcode.h:
(JSC::padOpcodeName):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFromLLInt):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JITStubs.h:
* llint/LLIntCLoop.cpp:
(JSC::LLInt::initialize):
* llint/LLIntData.h:
(JSC::LLInt::getCodeFunctionPtr):
(JSC::LLInt::getOpcode): Deleted.
(JSC::LLInt::getCodePtr): Deleted.
* llint/LLIntOpcode.h:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LLIntThunks.cpp:
(JSC::LLInt::functionForCallEntryThunkGenerator):
(JSC::LLInt::functionForConstructEntryThunkGenerator):
(JSC::LLInt::functionForCallArityCheckThunkGenerator):
(JSC::LLInt::functionForConstructArityCheckThunkGenerator):
(JSC::LLInt::evalEntryThunkGenerator):
(JSC::LLInt::programEntryThunkGenerator):
* llint/LLIntThunks.h:
Changed references to llint helpers to go through the entry point table populated
by llint_entry.  Added helpers to OpcodeID enum for all builds.

* bytecode/BytecodeList.json:
* generate-bytecode-files:
* llint/LLIntCLoop.cpp:
(JSC::LLInt::CLoop::initialize):
Reordered sections to match the order that the functions are added to the entry point
table.  Added new "asmPrefix" property for symbols that have one name but are generated
with a prefix, e.g. op_enter -> llint_op_enter.  Eliminated the "emitDefineID" property
as we are using enums for all bytecode references.  Changed the C Loop only
llint_c_loop_init to llint_entry.

Source/WebKit: 

Updated VS dependencies for JavaScriptCore changes.

* WebKit.vcxproj/WebKit.sln:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Radio buttons are using the wrong sizes and margins
https://bugs.webkit.org/show_bug.cgi?id=131503

Reviewed by Jer Noble.

This is a regression that I caused recently when I combined radio button and 
checkbox code. 
* platform/mac/ThemeMac.mm:
(WebCore::paintToggleButton):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK build fix after r167074.

This involves replacing resetDragSession() by
resetCurrentDragInformation() and dragSession().operation by
currentDragOperation().

Patch by Sergio Villar Senin <svillar@igalia.com> on 2014-04-10

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseDragDataReceived):
(webkitWebViewBaseDragMotion):
(dragExitedCallback):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS WebKit2] Disable the find overlay for now
https://bugs.webkit.org/show_bug.cgi?id=131509

Reviewed by Adele Peterson.

* Shared/WebPreferencesStore.h:
* WebProcess/WebPage/FindController.cpp:
(WebKit::FindController::FindController):
(WebKit::FindController::hideFindOverlay):
(WebKit::FindController::hideFindUI):
(WebKit::FindController::setShouldShowOverlay):
* WebProcess/WebPage/FindController.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):
Add a setting allowing us to turn off the find-in-page overlay on iOS.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167097 268f45cc-cd09-0410-ab3c-d52691b4dbfc