llint_slow_path_check_has_instance() should not adjust PC before accessing operands.
<https://webkit.org/b/129768>

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

When evaluating "a instanceof b" where b is an object that ImplementsHasInstance
and OverridesHasInstance (e.g. a bound function), the LLINT will take the slow
path llint_slow_path_check_has_instance(), and execute a code path that does the
following:
1. Adjusts the byte code PC to the jump target PC.
2. For the purpose of storing the result, get the result registerIndex from the
   1st operand using the PC as if the PC is still pointing to op_check_has_instance
   bytecode.

The result is that whatever value resides after where the jump target PC is will
be used as a result register value.  Depending on what that value is, the result
can be:
1. the code coincidently works correctly
2. memory corruption
3. crashes

The fix is to only adjust the byte code PC after we have stored the result.

* llint/LLIntSlowPaths.cpp:
(llint_slow_path_check_has_instance):

LayoutTests:

* js/instanceof-operator-expected.txt:
* js/script-tests/instanceof-operator.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165162 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: ASSERTION FAILED: m_javaScriptBreakpoints.isEmpty()
https://bugs.webkit.org/show_bug.cgi?id=129763

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-05
Reviewed by Geoffrey Garen.

Clear the list of all breakpoints, including unresolved breakpoints.

* inspector/agents/InspectorDebuggerAgent.cpp:
(Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165163 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSObject::fastGetOwnPropertySlot does a slow check for OverridesGetOwnPropertySlot
https://bugs.webkit.org/show_bug.cgi?id=129754

Reviewed by Geoffrey Garen.

InlineTypeFlags are stored in JSCell, so we can just load those instead of going through the TypeInfo.

* runtime/JSCell.h:
(JSC::JSCell::inlineTypeFlags):
* runtime/JSObject.h:
(JSC::JSObject::fastGetOwnPropertySlot):
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::TypeInfo):
(JSC::TypeInfo::overridesGetOwnPropertySlot):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165164 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Prevent possible deadlock in view indication
https://bugs.webkit.org/show_bug.cgi?id=129766

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-05
Reviewed by Geoffrey Garen.

* inspector/remote/RemoteInspector.mm:
(Inspector::RemoteInspector::receivedIndicateMessage):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165165 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][CMake] The GObject DOM bindings should always be built
https://bugs.webkit.org/show_bug.cgi?id=127963

Reviewed by Ryosuke Niwa.

* PlatformGTK.cmake: Make compilation of the WebKitGTK+ GObject DOM bindings
unconditional, instead of conditional on the WebKit2 build.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165166 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r165141, r165157, and r165158.
http://trac.webkit.org/changeset/165141
http://trac.webkit.org/changeset/165157
http://trac.webkit.org/changeset/165158
https://bugs.webkit.org/show_bug.cgi?id=129772

"broke ftl" (Requested by olliej_ on #webkit).

Source/JavaScriptCore:

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/PolymorphicPutByIdList.cpp:
(JSC::PutByIdAccess::visitWeak):
(JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
(JSC::PolymorphicPutByIdList::from):
* bytecode/PolymorphicPutByIdList.h:
(JSC::PutByIdAccess::transition):
(JSC::PutByIdAccess::replace):
(JSC::PutByIdAccess::oldStructure):
(JSC::PutByIdAccess::chain):
(JSC::PutByIdAccess::stubRoutine):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):
(JSC::PutByIdStatus::dump):
* bytecode/PutByIdStatus.h:
(JSC::PutByIdStatus::PutByIdStatus):
(JSC::PutByIdStatus::takesSlowPath):
* bytecode/StructureStubInfo.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitPutById):
(JSC::DFG::ByteCodeParser::handlePutById):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCommon.h:
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCompile.cpp:
(JSC::FTL::fixFunctionBasedOnStackMaps):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITByIdGenerator::JITByIdGenerator):
(JSC::JITPutByIdGenerator::JITPutByIdGenerator):
* jit/JITInlineCacheGenerator.h:
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_put_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_put_by_id):
* jit/Repatch.cpp:
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):
(JSC::tryCachePutByID):
(JSC::tryBuildPutByIdList):
* jit/SpillRegistersMode.h: Removed.
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/Lookup.h:
(JSC::putEntry):
* runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::isCacheable):
(JSC::PutPropertySlot::cachedOffset):

Source/WebCore:

* ForwardingHeaders/jit/SpillRegistersMode.h: Removed.

LayoutTests:

* js/regress/assign-custom-setter-expected.txt: Removed.
* js/regress/assign-custom-setter-polymorphic-expected.txt: Removed.
* js/regress/assign-custom-setter-polymorphic.html: Removed.
* js/regress/assign-custom-setter.html: Removed.
* js/regress/script-tests/assign-custom-setter-polymorphic.js: Removed.
* js/regress/script-tests/assign-custom-setter.js: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165167 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unused method from Vibration
https://bugs.webkit.org/show_bug.cgi?id=129732

Reviewed by Gyuyoung Kim.

* Modules/vibration/Vibration.cpp:
Removed isActive(), which is never called since r152441.
* Modules/vibration/Vibration.h: Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165168 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Reduce RWI message frequency
https://bugs.webkit.org/show_bug.cgi?id=129767

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-05
Reviewed by Timothy Hatcher.

This used to be 0.2s and changed by accident to 0.02s.

* inspector/remote/RemoteInspector.mm:
(Inspector::RemoteInspector::pushListingSoon):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165169 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Support IOS Accessibility in WK2
https://bugs.webkit.org/show_bug.cgi?id=129527

Unreviewed build fix.

* WebProcess/WebPage/mac/WKAccessibilityWebPageObjectMac.mm:
(-[WKAccessibilityWebPageObject accessibilityHitTest:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165170 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed EFL gardening.
Mofify the TestExpectaions according to the renamed file name in r164299.

* platform/efl/TestExpectations: copy-paste-converts-sticky-and-fixed.html is renamed
to copy-paste-wraps-position-absolute.html.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165171 268f45cc-cd09-0410-ab3c-d52691b4dbfc