Add support for sessions to MemoryCache.
https://bugs.webkit.org/show_bug.cgi?id=127794

Patch by Martin Hock <mhock@apple.com> on 2014-03-05
Reviewed by Sam Weinig.

Source/WebCore:

* WebCore.exp.in:
* editing/DeleteButtonController.cpp:
(WebCore::DeleteButtonController::createDeletionUI): Initialize CachedImage with sessionID.
* html/DOMURL.cpp:
(WebCore::DOMURL::revokeObjectURL): Remove URL from MemoryCache for all sessions.
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::cachedResource): Pass sessionID to MemoryCache.
* inspector/InspectorResourceAgent.cpp:
(WebCore::InspectorResourceAgent::replayXHR): Ditto.
* loader/DocumentLoader.cpp:
(WebCore::areAllLoadersPageCacheAcceptable): Ditto.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads): Ditto.
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement): Initialize CachedImage with sessionID.
* loader/archive/cf/LegacyWebArchive.cpp:
(WebCore::LegacyWebArchive::create): Pass sessionID to MemoryCache.
* loader/cache/CachedCSSStyleSheet.cpp:
(WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet): Constructor takes sessionID.
* loader/cache/CachedCSSStyleSheet.h:
* loader/cache/CachedFont.cpp: Ditto.
(WebCore::CachedFont::CachedFont):
* loader/cache/CachedFont.h:
* loader/cache/CachedImage.cpp: Ditto.
(WebCore::CachedImage::CachedImage):
* loader/cache/CachedImage.h:
* loader/cache/CachedRawResource.cpp: Ditto.
(WebCore::CachedRawResource::CachedRawResource):
* loader/cache/CachedRawResource.h:
* loader/cache/CachedResource.cpp: Ditto.
(WebCore::CachedResource::CachedResource):
(WebCore::CachedResource::~CachedResource): Pass sessionID to MemoryCache.
* loader/cache/CachedResource.h:
(WebCore::CachedResource::sessionID):
* loader/cache/CachedResourceLoader.cpp:
(WebCore::createResource): Constructors take sessionID.
(WebCore::CachedResourceLoader::sessionID): Retrieve sessionID from page.
(WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Pass sessionID to MemoryCache.
(WebCore::CachedResourceLoader::requestResource): Initialize CachedCSSStyleSheet with sessionID.
(WebCore::CachedResourceLoader::revalidateResource): Initialize cached resource with sessionID.
(WebCore::CachedResourceLoader::loadResource): Pass sessionID to MemoryCache and initialize cached resource with sessionID.
* loader/cache/CachedResourceLoader.h:
* loader/cache/CachedSVGDocument.cpp: Constructor takes sessionID.
(WebCore::CachedSVGDocument::CachedSVGDocument):
* loader/cache/CachedSVGDocument.h:
* loader/cache/CachedScript.cpp: Ditto.
(WebCore::CachedScript::CachedScript):
* loader/cache/CachedScript.h:
* loader/cache/CachedTextTrack.cpp: Ditto.
(WebCore::CachedTextTrack::CachedTextTrack):
* loader/cache/CachedTextTrack.h:
* loader/cache/CachedXSLStyleSheet.cpp: Ditto.
(WebCore::CachedXSLStyleSheet::CachedXSLStyleSheet):
* loader/cache/CachedXSLStyleSheet.h:
* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::getSessionMap): Retrieve CachedResourceMap based on sessionID.
(WebCore::MemoryCache::add): Use sessionID from CachedResource parameter.
(WebCore::MemoryCache::revalidationSucceeded): Add sessionID parameter.
(WebCore::MemoryCache::resourceForURL): Ditto.
(WebCore::MemoryCache::resourceForRequest): Ditto, also move impl into impl method.
(WebCore::MemoryCache::resourceForRequestImpl): Add CachedResourceMap parameter.
(WebCore::MemoryCache::addImageToCache): Use default sessionID.
(WebCore::MemoryCache::removeImageFromCache): Ditto.
(WebCore::MemoryCache::evict): Use sessionID from CachedResource parameter.
(WebCore::MemoryCache::removeResourcesWithOrigin): Iterate through all CachedResourceMaps.
(WebCore::MemoryCache::getOriginsWithCache): Ditto.
(WebCore::MemoryCache::removeUrlFromCache): Add sessionID parameter.
(WebCore::MemoryCache::removeRequestFromCache): Ditto.
(WebCore::MemoryCache::removeRequestFromSessionCaches): Remove request from all CachedResourceMaps, with multithread support.
(WebCore::MemoryCache::removeRequestFromCacheImpl): Add sessionID parameter.
(WebCore::MemoryCache::removeRequestFromSessionCachesImpl): Iterate through all CachedResourceMaps.
(WebCore::MemoryCache::crossThreadRemoveRequestFromCache): Add sessionID parameter.
(WebCore::MemoryCache::crossThreadRemoveRequestFromSessionCaches): Pass on request to removeRequestFromSessionCachesImpl.
(WebCore::MemoryCache::getStatistics): Iterate through all CachedResourceMaps.
(WebCore::MemoryCache::setDisabled): Ditto.
* loader/cache/MemoryCache.h: Create another level for cache.
* platform/CrossThreadCopier.cpp: Allow copying SessionIDs across threads.
(WebCore::SessionID>::copy):
* platform/CrossThreadCopier.h:
* platform/network/cf/ResourceRequest.h:
(WebCore::ResourceRequest::ResourceRequest): Remove trailing whitespace.
* rendering/RenderSnapshottedPlugIn.cpp:
(WebCore::RenderSnapshottedPlugIn::updateSnapshot): Initialize CachedImage with sessionID.
* testing/Internals.cpp:
(WebCore::Internals::isLoadingFromMemoryCache): Pass sessionID to MemoryCache.

Source/WebKit:

* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:

Source/WebKit2:

* NetworkProcess/NetworkResourceLoader.h: Add sessionID() method.
(WebKit::NetworkResourceLoader::sessionID):
* NetworkProcess/mac/DiskCacheMonitor.h: Add sessionID member.
* NetworkProcess/mac/DiskCacheMonitor.mm:
(WebKit::DiskCacheMonitor::DiskCacheMonitor): Send sessionID to NetworkProcessConnection::DidCacheResource.
* WebProcess/Network/NetworkProcessConnection.cpp: Add sessionID parameter to didCacheResource and pass to MemoryCache.
(WebKit::NetworkProcessConnection::didCacheResource):
* WebProcess/Network/NetworkProcessConnection.h: Ditto.
* WebProcess/Network/NetworkProcessConnection.messages.in: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165117 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ObjC exception when dropping files into a WKView: drag and drop uses code from WebKit.framework
https://bugs.webkit.org/show_bug.cgi?id=129752

Source/WebCore:

Reviewed by Enrica Casucci.

Add C functions for NSURL-related functionality required by WebKit2

* WebCore.exp.in:
* platform/mac/WebCoreNSURLExtras.h:
* platform/mac/WebCoreNSURLExtras.mm:
(WebCore::URLByCanonicalizingURL):
(WebCore::rangeOfURLScheme):
(WebCore::looksLikeAbsoluteURL):

Source/WebKit/mac:

Reviewed by Enrica Casucci.

Call URLByCanonicalizingURL() which is implemented in WebCore.

* Misc/WebNSURLExtras.mm:
(-[NSURL _webkit_canonicalize]):

Source/WebKit2:

Reviewed by Enrica Casucci.

Get WebDragClientMac off of all WebKit headers, and WebEditorClientMac off
all but one by using C functions from WebCoreNSURLExtras.h rather than
the NSURL category.

* WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
(WebKit::WebDragClient::declareAndWriteDragImage):
* WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
(WebKit::WebEditorClient::userVisibleString):
(WebKit::WebEditorClient::canonicalizeURL):
(WebKit::WebEditorClient::canonicalizeURLString):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165118 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL loadStructure always generates invalid IR
https://bugs.webkit.org/show_bug.cgi?id=129747

Reviewed by Mark Hahnenberg.

As the comment at the top of FTL::Output states, the FTL doesn't use LLVM's notion
of pointers. LLVM's notion of pointers tries to model C, in the sense that you have
to have a pointer to a type, and you can only load things of that type from that
pointer. Pointer arithmetic is basically not possible except through the bizarre
getelementptr operator. This doesn't fit with how the JS object model works since
the JS object model doesn't consist of nice and tidy C types placed in C arrays.
Also, it would be impossible to use getelementptr and LLVM pointers for accessing
any of JSC's C or C++ objects unless we went through the exercise of redeclaring
all of our fundamental data structures in LLVM IR as LLVM types. Clang could do
this for us, but that would require that to use the FTL, JSC itself would have to
be compiled with clang. Worse, it would have to be compiled with a clang that uses
a version of LLVM that is compatible with the one against which the FTL is linked.
Yuck!

The solution is to NEVER use LLVM pointers. This has always been the case in the
FTL. But it causes some confusion.
        
Not using LLVM pointers means that if the FTL has a "pointer", it's actually a
pointer-wide integer (m_out.intPtr in FTL-speak). The act of "loading" and
"storing" from or to a pointer involves first bitcasting the intPtr to a real LLVM
pointer that has the type that we want. The load and store operations over pointers
are called Output::load* and Output::store*, where * is one of "8", "16", "32",
"64", "Ptr", "Float", or "Double.
        
There is unavoidable confusion here. It would be bizarre for the FTL to call its
"pointer-wide integers" anything other than "pointers", since they are, in all
respects that we care about, simply pointers. But they are *not* LLVM pointers and
they never will be that.
        
There is one exception to this "no pointers" rule. The FTL does use actual LLVM
pointers for refering to LLVM alloca's - i.e. local variables. To try to reduce
confusion, we call these "references". So an "FTL reference" is actually an "LLVM
pointer", while an "FTL pointer" is actually an "LLVM integer". FTL references have
methods for access called Output::get and Output::set. These lower to LLVM load
and store, since FTL references are just LLVM pointers.
        
This confusion appears to have led to incorrect code in loadStructure().
loadStructure() was using get() and set() to access FTL pointers. But those methods
don't work on FTL pointers and never will, since they are for FTL references.
        
The worst part of this is that it was previously impossible to have test coverage
for the relevant path (MasqueradesAsUndefined) without writing a DRT test. This
patch fixes this by introducing a Masquerader object to jsc.cpp.
        
* ftl/FTLAbstractHeapRepository.h: Add an abstract heap for the structure table.
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::loadStructure): This was wrong.
* ftl/FTLOutput.h: Add a comment to disuade people from using get() and set().
* jsc.cpp: Give us the power to test for MasqueradesAsUndefined.
(WTF::Masquerader::Masquerader):
(WTF::Masquerader::create):
(WTF::Masquerader::createStructure):
(GlobalObject::finishCreation):
(functionMakeMasquerader):
* tests/stress/equals-masquerader.js: Added.
(foo):
(test):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165119 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSDataViewPrototype::getData() and setData() crash on platforms that don't allow unaligned accesses
https://bugs.webkit.org/show_bug.cgi?id=129746

Reviewed by Filip Pizlo.

Source/JavaScriptCore: 

Changed to use a union to manually assemble or disassemble the various types
from / to the corresponding bytes.  All memory access is now done using
byte accesses.

* runtime/JSDataViewPrototype.cpp:
(JSC::getData):
(JSC::setData):

LayoutTests: 

New test to validate proper operation of DataView operations at
various byte offsets using both little and big endian.

* js/arraybuffer-dataview-expected.txt: Added.
* js/arraybuffer-dataview.html: Added.
* js/script-tests/arraybuffer-dataview.js: Added.
(paddedHex):
(byteString):
(clearView):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165121 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Fix the Apple-internal builds.

* Configurations/WebKit2.xcconfig: Add -framework OpenGL.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165122 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] Rename the various VisibleExtent variations to exposedContentRect
https://bugs.webkit.org/show_bug.cgi?id=129728

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-03-05
Reviewed by Simon Fraser.

Source/WebCore: 

Rename DocumentVisibleExtent and VisibleExtentContentRect to ExposedContentRect in a desperate
attempt to make things a tiny little bit less confusing.

The name is ExposedContentRect and not ExposedRect as that rect is exposed on ScrollView, while the
rect is in document coordinates (which does not make any difference on WebKit1...).

* WebCore.exp.in:
* platform/ScrollView.h:
* platform/ios/ScrollViewIOS.mm:
(WebCore::ScrollView::exposedContentRect):
(WebCore::ScrollView::setExposedContentRect):
* platform/ios/wak/WAKScrollView.h:
* platform/ios/wak/WAKScrollView.mm:
(-[WAKScrollView exposedContentRect]):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::flushPendingLayerChanges):
(WebCore::RenderLayerCompositor::didChangeVisibleRect):

Source/WebKit2: 

* WebProcess/WebPage/DrawingArea.h:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::updateVisibleContentRects):
* WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h:
* WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:
(WebKit::RemoteLayerTreeDrawingArea::setExposedContentRect):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165124 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] Show external device name/type in placeholder
https://bugs.webkit.org/show_bug.cgi?id=129723

Reviewed by Jer Noble.

Source/WebCore: 

Make the name and type of the external device available to the JS based controls.
* Modules/mediacontrols/MediaControlsHost.cpp:
(WebCore::MediaControlsHost::externalDeviceDisplayName):
(WebCore::MediaControlsHost::externalDeviceType):
* Modules/mediacontrols/MediaControlsHost.h:
* Modules/mediacontrols/MediaControlsHost.idl:

* Modules/mediacontrols/mediaControlsiOS.js:
(ControllerIOS.prototype.updateWirelessPlaybackStatus): Display device type-specific infomation
    in the placeholder image.

* WebCore.exp.in: Export new WebKitSystemInterface functions.

* platform/graphics/MediaPlayer.cpp:
(WebCore::MediaPlayer::wirelessPlaybackTargetName): Added.
(WebCore::MediaPlayer::wirelessPlaybackTargetType): Ditto.
* platform/graphics/MediaPlayer.h:
* platform/graphics/MediaPlayerPrivate.h:

* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessPlaybackTargetType): Added.
(WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessPlaybackTargetName): Ditto.

* platform/ios/WebCoreSystemInterfaceIOS.mm:
* platform/mac/WebCoreSystemInterface.h:
* platform/mac/WebCoreSystemInterface.mm:

Source/WebKit/mac: 

* WebCoreSupport/WebSystemInterface.mm:
(InitWebCoreSystemInterface):

WebKitLibraries: 

* WebKitSystemInterface.h:
* libWebKitSystemInterfaceLion.a:
* libWebKitSystemInterfaceMavericks.a:
* libWebKitSystemInterfaceMountainLion.a:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165125 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a stupid error in r165118 that caused userVisibleString()
to call itself recursively.

* WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
(WebKit::WebEditorClient::userVisibleString):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165126 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Subpixel rendering: Device pixel round accumulated subpixel value when the RenderLayer with transform paints its content.
https://bugs.webkit.org/show_bug.cgi?id=129079

Reviewed by Simon Fraser.

Snap the content to the device pixel position (as opposed to integral position) before
applying the transform. Recalculate the remaining subpixels that need offsetting at painting time.

Source/WebCore:

Test: compositing/hidpi-absolute-subpixel-positioned-transformed-elements.html

* platform/graphics/LayoutPoint.h:
(WebCore::roundedForPainting):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::paintLayerByApplyingTransform):

LayoutTests:

* compositing/hidpi-absolute-subpixel-positioned-transformed-elements-expected.html: Added.
* compositing/hidpi-absolute-subpixel-positioned-transformed-elements.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165127 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win32][LLINT] Crash when running JSC stress tests.
https://bugs.webkit.org/show_bug.cgi?id=129429

Source/JavaScriptCore:

On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
where the guard page is a barrier between committed and uncommitted memory.
When data from the guard page is read or written, the guard page is moved, and memory is committed.
This is how the system grows the stack.
When using the C stack on Windows we need to precommit the needed stack space.
Otherwise we might crash later if we access uncommitted stack memory.
This can happen if we allocate stack space larger than the page guard size (4K).
The system does not get the chance to move the guard page, and commit more memory,
and we crash if uncommitted memory is accessed.
The MSVC compiler fixes this by inserting a call to the _chkstk() function,
when needed, see http://support.microsoft.com/kb/100775.

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-03-05
Reviewed by Geoffrey Garen.

* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
* jit/Repatch.cpp:
(JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
* offlineasm/x86.rb: Compile fix, and small simplification.
* runtime/VM.cpp:
(JSC::preCommitStackMemory): Added function to precommit stack memory.
(JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.

Source/WTF:

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-03-05
Reviewed by Geoffrey Garen.

* wtf/Platform.h: Enable LLINT on Win32.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165128 268f45cc-cd09-0410-ab3c-d52691b4dbfc
More FTL ARM fixes
https://bugs.webkit.org/show_bug.cgi?id=129755

Reviewed by Geoffrey Garen.
        
- Be more defensive about inline caches that have degenerate chains.
        
- Temporarily switch to allocating all MCJIT memory in the executable pool on non-x86
  platforms. The bug tracking the real fix is: https://bugs.webkit.org/show_bug.cgi?id=129756
        
- Don't even emit intrinsic declarations on non-x86 platforms.
        
- More debug printing support.
        
- Don't use vmCall() in the prologue. This should have crashed on all platforms all the time
  but somehow it gets lucky on x86.

* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::appendVariant):
(JSC::GetByIdStatus::computeForChain):
(JSC::GetByIdStatus::computeForStubInfo):
* bytecode/GetByIdStatus.h:
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
* bytecode/PutByIdStatus.h:
* bytecode/StructureSet.h:
(JSC::StructureSet::overlaps):
* ftl/FTLCompile.cpp:
(JSC::FTL::mmAllocateDataSection):
* ftl/FTLDataSection.cpp:
(JSC::FTL::DataSection::DataSection):
(JSC::FTL::DataSection::~DataSection):
* ftl/FTLDataSection.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::lower):
* ftl/FTLOutput.h:
(JSC::FTL::Output::doubleSin):
(JSC::FTL::Output::doubleCos):
* runtime/JSCJSValue.cpp:
(JSC::JSValue::dumpInContext):
* runtime/JSCell.h:
(JSC::JSCell::structureID):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165129 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Regions] Scrollable regions
https://bugs.webkit.org/show_bug.cgi?id=129301

Reviewed by David Hyatt.

Source/WebCore:

Named flow fragments do not inherit the overflow property from the fragment container.
When asked if the flow thread content should be clipped, the named flow fragments
will respond using the overflow property of the named flow fragment container.

When painting the flow thread layer inside the region, the scrolled content offset of
the region must be used to offset the flow thread's layer.

Tests: fast/regions/scrollable-last-region.html
       fast/regions/scrollable-single-region-bt.html
       fast/regions/scrollable-single-region-lr.html
       fast/regions/scrollable-single-region-relative-element.html
       fast/regions/scrollable-single-region-rl.html
       fast/regions/scrollable-single-region.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderNamedFlowFragment.cpp:
(WebCore::RenderNamedFlowFragment::createStyle):
(WebCore::RenderNamedFlowFragment::shouldClipFlowThreadContent):
* rendering/RenderNamedFlowFragment.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::shouldClipFlowThreadContent):
* rendering/RenderRegion.h:

LayoutTests:

Added tests for scrolling elements flowed into regions.

* fast/regions/scrollable-last-region-expected.html: Added.
* fast/regions/scrollable-last-region.html: Added.
* fast/regions/scrollable-single-region-bt-expected.html: Added.
* fast/regions/scrollable-single-region-bt.html: Added.
* fast/regions/scrollable-single-region-expected.html: Added.
* fast/regions/scrollable-single-region-lr-expected.html: Added.
* fast/regions/scrollable-single-region-lr.html: Added.
* fast/regions/scrollable-single-region-relative-element-expected.html: Added.
* fast/regions/scrollable-single-region-relative-element.html: Added.
* fast/regions/scrollable-single-region-rl-expected.html: Added.
* fast/regions/scrollable-single-region-rl.html: Added.
* fast/regions/scrollable-single-region.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165130 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSCell::m_gcData should encode its information differently
https://bugs.webkit.org/show_bug.cgi?id=129741

Reviewed by Geoffrey Garen.

We want to keep track of three GC states for an object:

1. Not marked (which implies not in the remembered set)
2. Marked but not in the remembered set
3. Marked and in the remembered set
        
Currently we only indicate marked vs. not marked in JSCell::m_gcData. During a write 
barrier, we only want to take the slow path if the object being stored to is in state #2. 
We'd like to make the test for state #2 as fast as possible, which means making it a 
compare against 0.

* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::osrWriteBarrier):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkMarkByte):
(JSC::DFG::SpeculativeJIT::writeBarrier):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::writeBarrier):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::writeBarrier):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::allocateCell):
(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
* heap/Heap.cpp:
(JSC::Heap::clearRememberedSet):
(JSC::Heap::addToRememberedSet):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::checkMarkByte):
* jit/JIT.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::checkMarkByte):
(JSC::JIT::emitWriteBarrier):
* jit/Repatch.cpp:
(JSC::writeBarrier):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/JSCell.h:
(JSC::JSCell::mark):
(JSC::JSCell::remember):
(JSC::JSCell::forget):
(JSC::JSCell::isMarked):
(JSC::JSCell::isRemembered):
* runtime/JSCellInlines.h:
(JSC::JSCell::JSCell):
* runtime/StructureIDBlob.h:
(JSC::StructureIDBlob::StructureIDBlob):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
<http://webkit.org/b/129751>
<rdar://problem/16237965>

Reviewed by Jon Honeycutt.

Merged from Blink (patch by Yuta Kitamura):
https://src.chromium.org/viewvc/blink?revision=168160&view=revision
http://crbug.com/345005

    The root cause is CompositeEditCommand::moveParagraphWithClones() passing
    two positions |start| and |end| which do not follow the document order,
    i.e. in some situations |start| is located after |end| because of
    the difference in affinity.

    This patch fixes this crash by normalizing |end| to |start| in such situations.
    It also adds an ASSERT that checks the relationship between |start| and |end|.

Source/WebCore:

Test: editing/execCommand/format-block-crash.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
(WebCore::CompositeEditCommand::moveParagraphWithClones):
* editing/CompositeEditCommand.h:

LayoutTests:

* editing/execCommand/format-block-crash-expected.txt: Added.
* editing/execCommand/format-block-crash.html: Added.
* editing/execCommand/resources/format-block-crash-iframe.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165138 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Support caching of custom setters
https://bugs.webkit.org/show_bug.cgi?id=129519

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch adds caching of assignment to properties that
are backed by C functions. This provides most of the leg
work required to start supporting setters, and resolves
the remaining regressions from moving DOM properties up
the prototype chain.

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/PolymorphicPutByIdList.cpp:
(JSC::PutByIdAccess::visitWeak):
(JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
(JSC::PolymorphicPutByIdList::from):
* bytecode/PolymorphicPutByIdList.h:
(JSC::PutByIdAccess::transition):
(JSC::PutByIdAccess::replace):
(JSC::PutByIdAccess::customSetter):
(JSC::PutByIdAccess::isCustom):
(JSC::PutByIdAccess::oldStructure):
(JSC::PutByIdAccess::chain):
(JSC::PutByIdAccess::stubRoutine):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):
(JSC::PutByIdStatus::dump):
* bytecode/PutByIdStatus.h:
(JSC::PutByIdStatus::PutByIdStatus):
(JSC::PutByIdStatus::takesSlowPath):
(JSC::PutByIdStatus::makesCalls):
* bytecode/StructureStubInfo.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitPutById):
(JSC::DFG::ByteCodeParser::handlePutById):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCommon.h:
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITByIdGenerator::JITByIdGenerator):
(JSC::JITPutByIdGenerator::JITPutByIdGenerator):
* jit/JITInlineCacheGenerator.h:
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_put_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_put_by_id):
* jit/Repatch.cpp:
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):
(JSC::emitCustomSetterStub):
(JSC::tryCachePutByID):
(JSC::tryBuildPutByIdList):
* jit/SpillRegistersMode.h: Added.
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/Lookup.h:
(JSC::putEntry):
* runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::setCacheableCustomProperty):
(JSC::PutPropertySlot::customSetter):
(JSC::PutPropertySlot::isCacheablePut):
(JSC::PutPropertySlot::isCacheableCustomProperty):
(JSC::PutPropertySlot::cachedOffset):

Source/WebCore:

Add forwarding header

Tests: js/regress/assign-custom-setter-polymorphic.html
       js/regress/assign-custom-setter.html

* ForwardingHeaders/jit/SpillRegistersMode.h: Added.

LayoutTests:

Add test cases.

* js/regress/assign-custom-setter-expected.txt: Added.
* js/regress/assign-custom-setter-polymorphic-expected.txt: Added.
* js/regress/assign-custom-setter-polymorphic.html: Added.
* js/regress/assign-custom-setter.html: Added.
* js/regress/script-tests/assign-custom-setter-polymorphic.js: Added.
(test):
* js/regress/script-tests/assign-custom-setter.js: Added.
(test):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=129722
Update WKSI.

* libWebKitSystemInterfaceLion.a:
* libWebKitSystemInterfaceMavericks.a:
* libWebKitSystemInterfaceMountainLion.a:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165143 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    And Alexey Proskuryakov  <ap@apple.com>

ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
https://bugs.webkit.org/show_bug.cgi?id=129753
<rdar://problem/12069835>

Reviewed by Alexey Proskuryakov.

Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
app cache doesn't contain a manifest resource.

For some reason an app cache for a web site may be partially written to disk. In particular, the
app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
and hence have been unable to create such an app cache. We were able to reproduce this issue using
an app cache database file that was provided by a person that was affected by this issue.

No test included because it's not straightforward to write a test for this change.

* loader/appcache/ApplicationCacheGroup.cpp:
(WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated->manifestResource()
is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
expression into two assertion expressions to make it straightforward to identify the failing sub-expression
on failure.
* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
(WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
have a manifest resource.
(WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
(WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
ApplicationCacheStorage::deleteCacheGroupRecord().
* loader/appcache/ApplicationCacheStorage.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165145 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=129722

And remember to copy the header file!

* WebKitSystemInterface.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165146 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebGL] Use WKSI to see what the system policy for WebGL is
https://bugs.webkit.org/show_bug.cgi?id=129722
<rdar://problem/15790542>

Reviewed by Tim Horton.

Source/WebKit2:

Use the WebKitSystemInterface methods WKShouldBlockWebGL
and WKShouldSuggestBlockingWebGL to query what the host
system thinks about the hardware. Tell the client about
the result in a new WebPage method setSystemWebGLPolicy.

* UIProcess/API/APILoaderClient.h:
(API::LoaderClient::setSystemWebGLLoadPolicy): New empty definition.
* UIProcess/API/C/WKAPICast.h:
(WebKit::toAPI): Convert a WebGLLoadPolicy into a WKWebGLLoadPolicy.
* UIProcess/API/C/WKPage.cpp: Call setSystemWebGLLoadPolicy.
(WKPageSetPageLoaderClient):
* UIProcess/API/C/WKPageLoaderClient.h: New typedef and entry in client structure.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setSystemWebGLPolicy):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in: Add SetSystemWebGLPolicy.
* Source/WebKit2/Configurations/WebKit2.xcconfig: We have to link against OpenGL now, because WKSI
uses it for hardware detection.
* WebProcess/WebPage/WebPage.cpp: Remove the implementation here, but leave
empty methods for non-Apple platforms.
(WebKit::WebPage::WebPage):
(WebKit::WebPage::webGLPolicyForURL):
(WebKit::WebPage::resolveWebGLPolicyForURL):
* WebProcess/WebPage/WebPage.h: Add m_systemWebGLPolicy.
* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::webGLPolicyForURL): Moved in from WebPage, but now they call
into WKSI and send the result to the client if necessary.
(WebKit::WebPage::resolveWebGLPolicyForURL):

Tools:

Dummy entry for setSystemWebGLLoadPolicy.

* WebKitTestRunner/TestController.cpp:
(WTR::TestController::createWebViewWithOptions):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165148 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CMake] Use thin archives if building on Linux for non-shared-core debug builds
https://bugs.webkit.org/show_bug.cgi?id=108330

Reviewed by Martin Robinson.

In order to get non-shared debug builds, this patch applied T option for
thin archives to the flags passed to ar when cmake based ports build on linux.
In addition, applied u option which avoids adding a file twice.

* Source/cmake/OptionsCommon.cmake: Moved archive options from OptionsGTK.cmake.
* Source/cmake/OptionsEfl.cmake:
Removed error messages for non-shared-core debug builds.
* Source/cmake/OptionsGTK.cmake: Moved archive options to OptionsCommon.cmake.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165149 268f45cc-cd09-0410-ab3c-d52691b4dbfc