Use std::unique_ptr<> and std::make_unique<> in WebCore
https://bugs.webkit.org/show_bug.cgi?id=138560

Reviewed by Chris Dumez.

Clean up unused OwnPtr.h and PassOwnPtr.h and use std::unique_ptr.

No new tests, no behavior changes.

* Modules/encryptedmedia/CDMPrivateMediaPlayer.h:
* dom/ContainerNode.h:
* dom/ElementIteratorAssertions.h:
(WebCore::ElementIteratorAssertions::ElementIteratorAssertions):
* dom/ElementRareData.h:
* page/DragController.h:
* rendering/RenderView.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175844 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add scope operand to op_create_lexical_environment
https://bugs.webkit.org/show_bug.cgi?id=138588

Reviewed by Geoffrey Garen.

Added a second operand to op_create_lexical_environment that contains the scope register
to update.  Note that the DFG relies on operationCreateActivation() to update the
scope register since we can't issue a set() with a non-local, non-argument register.
This is temporary until the scope register is allocated as a local.

* bytecode/BytecodeList.json:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
Added the scope register operand.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
Filled in the scope register operand.

* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_create_lexical_environment):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_create_lexical_environment):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
Set the scope register with the result of the appropriate create activation slow call.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175845 268f45cc-cd09-0410-ab3c-d52691b4dbfc
The JIT should cache property lookup misses.
<https://webkit.org/b/135578>

Source/JavaScriptCore:

Add support for inline caching of missed property lookups.
Previously this would banish us to C++ slow path.

It's implemented as a simple GetById cache that returns jsUndefined()
as long as the Structure chain check passes. There's no DFG exploitation
of this knowledge in this patch.

Test: js/regress/undefined-property-access.js (~5.5x speedup)

Reviewed by Filip Pizlo.

* bytecode/PolymorphicGetByIdList.h:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):

    Add GetByIdAccess::SimpleMiss so we can communicate to the DFG that
    the access has been cached.

* jit/Repatch.cpp:
(JSC::toString):
(JSC::kindFor):
(JSC::generateByIdStub):
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):

    Added a GetUndefined stub kind, just a simple "store jsUndefined()" snippet.
    Use this to cache missed lookups, piggybacking mostly on the GetValue kind.

* runtime/PropertySlot.h:
(JSC::PropertySlot::isUnset):

    Exposed the unset state so PropertySlot can communicate that lookup failed.

LayoutTests:

Add a JSRegress test for caching of property lookup misses.
There are three subtests:

    1. Pure speed test.
    2. Test for when a property previously cached as missing suddenly
       appears on the object.
    3. Same as (2), but it appears on the prototype.

The test runs ~5.5x faster with the optimization.

Reviewed by Filip Pizlo.

* js/regress/script-tests/undefined-property-access.js: Added.
(foo):
(bar):
(baz):
* js/regress/undefined-property-access-expected.txt: Added.
* js/regress/undefined-property-access.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175846 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore:
SVG foreign objects do not inherit the container coordinates system if they are repainted.
https://bugs.webkit.org/show_bug.cgi?id=138481.

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2014-11-10
Reviewed by Simon Fraser.

If a foreign object is included in an SVG, it should inherit the coordinates system
of the container if it is repainted. The foreign object is actually redrawn in the
CSS coordinates system regardless of the transformation that may be applied to the
container.

The bug is RenderSVG* classes use computeFloatRectForRepaint(), but the rest of the
render classes use computeRectForRepaint(). RenderSVGForeignObject::computeRectForRepaint()
was not defined, so we end up hitting RenderObject::computeRectForRepaint() for
a RenderSVGTransformableContainer and completely miss the transform.

Tests: svg/transforms/svg-transform-foreign-object-repaint.html

Implement RenderSVGForeignObject::computeRectForRepaint() so we can apply the
container transformation on the SVG foreign object repaint rectangle.
* rendering/svg/RenderSVGForeignObject.cpp:
(WebCore::RenderSVGForeignObject::computeRectForRepaint):
* rendering/svg/RenderSVGForeignObject.h:

LayoutTests:
SVG foreign objects do not inherit the container coordinates system if they are repainted..
https://bugs.webkit.org/show_bug.cgi?id=138481.

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2014-11-10
Reviewed by Simon Fraser.

Ensure the repaint rectangle of the SVG foreign object is calculated correctly
when the container element has transformation.

* svg/transforms/svg-transform-foreign-object-repaint-expected.png: Added.
* svg/transforms/svg-transform-foreign-object-repaint-expected.txt: Added.
* svg/transforms/svg-transform-foreign-object-repaint.html: Added.

Re-baseline these tests since the render tree dumping uses renderer.absoluteClippedOverflowRect()
in writePositionAndStyle() to get the object rectangle so this issue only affects test output.

* svg/zoom/page/zoom-foreign-content-expected.txt:
* platform/mac/svg/zoom/page/zoom-foreignObject-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175847 268f45cc-cd09-0410-ab3c-d52691b4dbfc