[WebKit2 iOS]Add support for caret movement for the 3rd party keyboard protocol.
https://bugs.webkit.org/show_bug.cgi?id=135325
<rdar://problem/17682120>

Reviewed by Sam Weinig.

WKContentView now implements moveByOffset to support the
protocol for 3rd party keyboards.

* UIProcess/WebPageProxy.h:
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView moveByOffset:]):
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::moveSelectionByOffset):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::moveSelectionByOffset):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171651 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.

Source/JavaScriptCore: 
        
This fixes the previous mismerge and adds test coverage for the thing that went wrong.
        
Additional changes listed here:

* jsc.cpp:
(functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!
* runtime/Structure.cpp:
(JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.
* tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.

    2014-06-27  Michael Saboff  <msaboff@apple.com>
    
    Unreviewed build fix after r169795.
    
    Fixed ASSERT for 32 bit build.
    
    * dfg/DFGSpeculativeJIT.cpp:
    (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
    
    2014-06-24  Saam Barati  <sbarati@apple.com>
    
    Web Inspector: debugger should be able to show variable types
    https://bugs.webkit.org/show_bug.cgi?id=133395
    
    Reviewed by Filip Pizlo.
    
    Increase the amount of type information the VM gathers when directed
    to do so. This initial commit is working towards the goal of
    capturing, and then showing (via the Web Inspector) type information for all
    assignment and load operations. This patch doesn't have the feature fully 
    implemented, but it ensures the VM has no performance regressions
    unless the feature is specifically turned on.
    
    * JavaScriptCore.xcodeproj/project.pbxproj:
    * bytecode/BytecodeList.json:
    * bytecode/BytecodeUseDef.h:
    (JSC::computeUsesForBytecodeOffset):
    (JSC::computeDefsForBytecodeOffset):
    * bytecode/CodeBlock.cpp:
    (JSC::CodeBlock::dumpBytecode):
    (JSC::CodeBlock::CodeBlock):
    (JSC::CodeBlock::finalizeUnconditionally):
    * bytecode/CodeBlock.h:
    * bytecode/Instruction.h:
    * bytecode/TypeLocation.h: Added.
    (JSC::TypeLocation::TypeLocation):
    * bytecompiler/BytecodeGenerator.cpp:
    (JSC::BytecodeGenerator::emitMove):
    (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
    (JSC::BytecodeGenerator::emitPutToScope):
    (JSC::BytecodeGenerator::emitPutById):
    (JSC::BytecodeGenerator::emitPutByVal):
    * bytecompiler/BytecodeGenerator.h:
    (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
    * bytecompiler/NodesCodegen.cpp:
    (JSC::PostfixNode::emitResolve):
    (JSC::PrefixNode::emitResolve):
    (JSC::ReadModifyResolveNode::emitBytecode):
    (JSC::AssignResolveNode::emitBytecode):
    (JSC::ConstDeclNode::emitCodeSingle):
    (JSC::ForInNode::emitBytecode):
    * heap/Heap.cpp:
    (JSC::Heap::collect):
    * inspector/agents/InspectorRuntimeAgent.cpp:
    (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
    * inspector/agents/InspectorRuntimeAgent.h:
    * inspector/protocol/Runtime.json:
    * jsc.cpp:
    (GlobalObject::finishCreation):
    (functionDumpTypesForAllVariables):
    * llint/LLIntSlowPaths.cpp:
    (JSC::LLInt::LLINT_SLOW_PATH_DECL):
    (JSC::LLInt::putToScopeCommon):
    * llint/LLIntSlowPaths.h:
    * llint/LowLevelInterpreter.asm:
    * runtime/HighFidelityLog.cpp: Added.
    (JSC::HighFidelityLog::initializeHighFidelityLog):
    (JSC::HighFidelityLog::~HighFidelityLog):
    (JSC::HighFidelityLog::recordTypeInformationForLocation):
    (JSC::HighFidelityLog::processHighFidelityLog):
    (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
    * runtime/HighFidelityLog.h: Added.
    (JSC::HighFidelityLog::HighFidelityLog):
    * runtime/HighFidelityTypeProfiler.cpp: Added.
    (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
    (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
    (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
    (JSC::HighFidelityTypeProfiler::insertNewLocation):
    (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
    * runtime/HighFidelityTypeProfiler.h: Added.
    * runtime/Options.h:
    * runtime/Structure.cpp:
    (JSC::Structure::toStructureShape):
    * runtime/Structure.h:
    * runtime/SymbolTable.cpp:
    (JSC::SymbolTable::SymbolTable):
    (JSC::SymbolTable::cloneCapturedNames):
    (JSC::SymbolTable::uniqueIDForVariable):
    (JSC::SymbolTable::uniqueIDForRegister):
    (JSC::SymbolTable::globalTypeSetForRegister):
    (JSC::SymbolTable::globalTypeSetForVariable):
    * runtime/SymbolTable.h:
    (JSC::SymbolTable::add):
    (JSC::SymbolTable::set):
    * runtime/TypeSet.cpp: Added.
    (JSC::TypeSet::TypeSet):
    (JSC::TypeSet::getRuntimeTypeForValue):
    (JSC::TypeSet::addTypeForValue):
    (JSC::TypeSet::removeDuplicatesInStructureHistory):
    (JSC::TypeSet::seenTypes):
    (JSC::TypeSet::dumpSeenTypes):
    (JSC::StructureShape::StructureShape):
    (JSC::StructureShape::markAsFinal):
    (JSC::StructureShape::addProperty):
    (JSC::StructureShape::propertyHash):
    (JSC::StructureShape::leastUpperBound):
    (JSC::StructureShape::stringRepresentation):
    * runtime/TypeSet.h: Added.
    (JSC::StructureShape::create):
    (JSC::TypeSet::create):
    * runtime/VM.cpp:
    (JSC::VM::VM):
    (JSC::VM::getTypesForVariableInRange):
    (JSC::VM::updateHighFidelityTypeProfileState):
    (JSC::VM::dumpHighFidelityProfilingTypes):
    * runtime/VM.h:
    (JSC::VM::isProfilingTypesWithHighFidelity):
    (JSC::VM::highFidelityLog):
    (JSC::VM::highFidelityTypeProfiler):
    (JSC::VM::nextLocation):
    (JSC::VM::getNextUniqueVariableID):
    
    2014-06-26  Mark Lam  <mark.lam@apple.com>
    
    Remove unused instantiation of the WithScope structure.
    <https://webkit.org/b/134331>
    
    Reviewed by Oliver Hunt.
    
    The WithScope structure instance is the VM is unused, and is now removed.
    
    * runtime/VM.cpp:
    (JSC::VM::VM):
    * runtime/VM.h:
    
    2014-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
    
    Structure bit fields should have a consistent format
    https://bugs.webkit.org/show_bug.cgi?id=134307
    
    Reviewed by Filip Pizlo.
    
    Currently we use C-style bit fields for a number of member variables in Structure to save space. 
    This makes it difficult to load these fields in the JIT. We should instead use our own bitfield 
    format to make it easy to load and test these variables in JIT code.
    
    * runtime/JSObject.cpp:
    (JSC::JSObject::putDirectNonIndexAccessor):
    (JSC::JSObject::reifyStaticFunctionsForDelete):
    * runtime/Structure.cpp:
    (JSC::StructureTransitionTable::contains):
    (JSC::StructureTransitionTable::get):
    (JSC::StructureTransitionTable::add):
    (JSC::Structure::Structure):
    (JSC::Structure::materializePropertyMap):
    (JSC::Structure::addPropertyTransition):
    (JSC::Structure::despecifyFunctionTransition):
    (JSC::Structure::toDictionaryTransition):
    (JSC::Structure::freezeTransition):
    (JSC::Structure::preventExtensionsTransition):
    (JSC::Structure::takePropertyTableOrCloneIfPinned):
    (JSC::Structure::nonPropertyTransition):
    (JSC::Structure::flattenDictionaryStructure):
    (JSC::Structure::addPropertyWithoutTransition):
    (JSC::Structure::pin):
    (JSC::Structure::allocateRareData):
    (JSC::Structure::cloneRareDataFrom):
    (JSC::Structure::getConcurrently):
    (JSC::Structure::putSpecificValue):
    (JSC::Structure::getPropertyNamesFromStructure):
    (JSC::Structure::visitChildren):
    (JSC::Structure::checkConsistency):
    * runtime/Structure.h:
    (JSC::Structure::isExtensible):
    (JSC::Structure::isDictionary):
    (JSC::Structure::isUncacheableDictionary):
    (JSC::Structure::propertyAccessesAreCacheable):
    (JSC::Structure::previousID):
    (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
    (JSC::Structure::setContainsReadOnlyProperties):
    (JSC::Structure::disableSpecificFunctionTracking):
    (JSC::Structure::objectToStringValue):
    (JSC::Structure::setObjectToStringValue):
    (JSC::Structure::setPreviousID):
    (JSC::Structure::clearPreviousID):
    (JSC::Structure::previous):
    (JSC::Structure::rareData):
    (JSC::Structure::didTransition): Deleted.
    (JSC::Structure::hasGetterSetterProperties): Deleted.
    (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
    (JSC::Structure::setHasGetterSetterProperties): Deleted.
    (JSC::Structure::hasNonEnumerableProperties): Deleted.
    (JSC::Structure::staticFunctionsReified): Deleted.
    (JSC::Structure::setStaticFunctionsReified): Deleted.
    * runtime/StructureInlines.h:
    (JSC::Structure::setEnumerationCache):
    (JSC::Structure::enumerationCache):
    (JSC::Structure::checkOffsetConsistency):
    
    2014-06-24  Mark Lam  <mark.lam@apple.com>
    
    [ftlopt] Renamed DebuggerActivation to DebuggerScope.
    <https://webkit.org/b/134273>
    
    Reviewed by Michael Saboff.
    
    * CMakeLists.txt:
    * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
    * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
    * JavaScriptCore.xcodeproj/project.pbxproj:
    * debugger/DebuggerActivation.cpp: Removed.
    * debugger/DebuggerActivation.h: Removed.
    * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
    (JSC::DebuggerScope::DebuggerScope):
    (JSC::DebuggerScope::finishCreation):
    (JSC::DebuggerScope::visitChildren):
    (JSC::DebuggerScope::className):
    (JSC::DebuggerScope::getOwnPropertySlot):
    (JSC::DebuggerScope::put):
    (JSC::DebuggerScope::deleteProperty):
    (JSC::DebuggerScope::getOwnPropertyNames):
    (JSC::DebuggerScope::defineOwnProperty):
    (JSC::DebuggerActivation::DebuggerActivation): Deleted.
    (JSC::DebuggerActivation::finishCreation): Deleted.
    (JSC::DebuggerActivation::visitChildren): Deleted.
    (JSC::DebuggerActivation::className): Deleted.
    (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
    (JSC::DebuggerActivation::put): Deleted.
    (JSC::DebuggerActivation::deleteProperty): Deleted.
    (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
    (JSC::DebuggerActivation::defineOwnProperty): Deleted.
    * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
    (JSC::DebuggerScope::create):
    (JSC::DebuggerActivation::create): Deleted.
    * runtime/VM.cpp:
    (JSC::VM::VM):
    * runtime/VM.h:
    
    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
    https://bugs.webkit.org/show_bug.cgi?id=134265
    
    Reviewed by Geoffrey Garen.
            
    More assertion fallout from the PutById folding work.
    
    * dfg/DFGNode.h:
    (JSC::DFG::Node::convertToPutByOffset):
    
    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] GC should notify us if it resets to_this
    https://bugs.webkit.org/show_bug.cgi?id=128231
    
    Reviewed by Geoffrey Garen.
    
    * CMakeLists.txt:
    * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
    * JavaScriptCore.xcodeproj/project.pbxproj:
    * bytecode/BytecodeList.json:
    * bytecode/CodeBlock.cpp:
    (JSC::CodeBlock::dumpBytecode):
    (JSC::CodeBlock::finalizeUnconditionally):
    * bytecode/Instruction.h:
    * bytecode/ToThisStatus.cpp: Added.
    (JSC::merge):
    (WTF::printInternal):
    * bytecode/ToThisStatus.h: Added.
    * bytecompiler/BytecodeGenerator.cpp:
    (JSC::BytecodeGenerator::BytecodeGenerator):
    * dfg/DFGByteCodeParser.cpp:
    (JSC::DFG::ByteCodeParser::parseBlock):
    * llint/LowLevelInterpreter32_64.asm:
    * llint/LowLevelInterpreter64.asm:
    * runtime/CommonSlowPaths.cpp:
    (JSC::SLOW_PATH_DECL):
    
    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
    https://bugs.webkit.org/show_bug.cgi?id=134256
    
    Reviewed by Michael Saboff.
            
    This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
    point is to be able to precisely model what goes on in the snippets of code between a
    side-effect and an InvalidationPoint.
            
    This patch also cleans up onlyStructure() by delegating more work to
    StructureSet::onlyStructure().
    
    * dfg/DFGStructureAbstractValue.h:
    (JSC::DFG::StructureAbstractValue::onlyStructure):
    
    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
    https://bugs.webkit.org/show_bug.cgi?id=134260
    
    Reviewed by Geoffrey Garen.
            
    This was causing loads of assertion failures in debug builds.
    
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    
    2014-06-21  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
    https://bugs.webkit.org/show_bug.cgi?id=134090
    
    Reviewed by Oliver Hunt.
            
    This pretty much finishes off the work to eliminate the special-casing of singleton
    structure sets by making it possible to fold GetById and PutById to various polymorphic
    forms of the ByOffset nodes.
            
    * bytecode/GetByIdStatus.cpp:
    (JSC::GetByIdStatus::computeForStubInfo):
    (JSC::GetByIdStatus::computeFor):
    * bytecode/GetByIdStatus.h:
    * bytecode/PutByIdStatus.cpp:
    (JSC::PutByIdStatus::computeFor):
    * bytecode/PutByIdStatus.h:
    * bytecode/PutByIdVariant.h:
    (JSC::PutByIdVariant::constantChecks):
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    * dfg/DFGByteCodeParser.cpp:
    (JSC::DFG::ByteCodeParser::parseBlock):
    * dfg/DFGConstantFoldingPhase.cpp:
    (JSC::DFG::ConstantFoldingPhase::foldConstants):
    (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
    (JSC::DFG::ConstantFoldingPhase::addChecks):
    * dfg/DFGNode.h:
    (JSC::DFG::Node::convertToMultiGetByOffset):
    (JSC::DFG::Node::convertToMultiPutByOffset):
    * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
    (JSC::DFG::SpeculativeJIT::fillJSValue):
    (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
    (JSC::DFG::SpeculativeJIT::emitCall):
    (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
    (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
    (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
    (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
    (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
    (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
    (JSC::DFG::SpeculativeJIT::compileLogicalNot):
    (JSC::DFG::SpeculativeJIT::emitBranch):
    (JSC::DFG::SpeculativeJIT::compile):
    * dfg/DFGStructureAbstractValue.h:
    (JSC::DFG::StructureAbstractValue::set):
    
    2014-06-19  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
    https://bugs.webkit.org/show_bug.cgi?id=134077
    
    Reviewed by Sam Weinig.
            
    This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
    in the abstract interpreter.
    
    * bytecode/StructureSet.h:
    (JSC::StructureSet::onlyStructure):
    
    2014-06-18  Filip Pizlo  <fpizlo@apple.com>
    
    DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
    https://bugs.webkit.org/show_bug.cgi?id=133918
    
    Reviewed by Mark Hahnenberg.
            
    This also adds pruning of PutStructure, since I basically had no choice but
    to implement such logic within MultiPutByOffset.
            
    Also adds a bunch of PutById cache status dumping to bytecode dumping.
    
    * bytecode/GetByIdVariant.cpp:
    (JSC::GetByIdVariant::dumpInContext):
    * bytecode/GetByIdVariant.h:
    (JSC::GetByIdVariant::structureSet):
    * bytecode/PutByIdVariant.h:
    (JSC::PutByIdVariant::oldStructure):
    * bytecode/StructureSet.cpp:
    (JSC::StructureSet::filter):
    (JSC::StructureSet::filterArrayModes):
    * bytecode/StructureSet.h:
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    * dfg/DFGAbstractValue.cpp:
    (JSC::DFG::AbstractValue::changeStructure):
    (JSC::DFG::AbstractValue::contains):
    * dfg/DFGAbstractValue.h:
    (JSC::DFG::AbstractValue::couldBeType):
    (JSC::DFG::AbstractValue::isType):
    * dfg/DFGConstantFoldingPhase.cpp:
    (JSC::DFG::ConstantFoldingPhase::foldConstants):
    (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
    (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
    (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
    * dfg/DFGGraph.cpp:
    (JSC::DFG::Graph::freezeStrong):
    * dfg/DFGGraph.h:
    * dfg/DFGStructureAbstractValue.h:
    (JSC::DFG::StructureAbstractValue::operator=):
    * ftl/FTLLowerDFGToLLVM.cpp:
    (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
    * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
    (foo):
    (fu):
    (bar):
    (baz):
    (.bar):
    (.baz):
    * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
    (foo):
    (fu):
    (bar):
    (baz):
    (.bar):
    (.baz):
    * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
    (foo):
    (fu):
    (bar):
    (baz):
    (.bar):
    (.baz):
    
    2014-06-18  Mark Hahnenberg  <mhahnenberg@apple.com>
    
    Remove CompoundType and LeafType
    https://bugs.webkit.org/show_bug.cgi?id=134037
    
    Reviewed by Filip Pizlo.
    
    We don't use them for anything. We'll replace them with a generic CellType type for all 
    the objects that are JSCells, aren't JSObjects, and for which we generally don't care about 
    their JSType at runtime.
    
    * llint/LLIntData.cpp:
    (JSC::LLInt::Data::performAssertions):
    * runtime/ArrayBufferNeuteringWatchpoint.cpp:
    (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
    * runtime/Executable.h:
    (JSC::ExecutableBase::createStructure):
    (JSC::NativeExecutable::createStructure):
    * runtime/JSPromiseDeferred.h:
    (JSC::JSPromiseDeferred::createStructure):
    * runtime/JSPromiseReaction.h:
    (JSC::JSPromiseReaction::createStructure):
    * runtime/JSPropertyNameIterator.h:
    (JSC::JSPropertyNameIterator::createStructure):
    * runtime/JSType.h:
    * runtime/JSTypeInfo.h:
    (JSC::TypeInfo::TypeInfo):
    * runtime/MapData.h:
    (JSC::MapData::createStructure):
    * runtime/PropertyMapHashTable.h:
    (JSC::PropertyTable::createStructure):
    * runtime/RegExp.h:
    (JSC::RegExp::createStructure):
    * runtime/SparseArrayValueMap.cpp:
    (JSC::SparseArrayValueMap::createStructure):
    * runtime/Structure.cpp:
    (JSC::Structure::Structure):
    * runtime/StructureChain.h:
    (JSC::StructureChain::createStructure):
    * runtime/StructureRareData.cpp:
    (JSC::StructureRareData::createStructure):
    * runtime/SymbolTable.h:
    (JSC::SymbolTable::createStructure):
    * runtime/WeakMapData.h:
    (JSC::WeakMapData::createStructure):
    
    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
    https://bugs.webkit.org/show_bug.cgi?id=134002
    
    Reviewed by Mark Hahnenberg.
            
    The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
    JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
    of the structure if that structure was watchable.
            
    Also kill PhantomPutStructure.
    
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
    * dfg/DFGClobberize.h:
    (JSC::DFG::clobberize):
    * dfg/DFGDoesGC.cpp:
    (JSC::DFG::doesGC):
    * dfg/DFGFixupPhase.cpp:
    (JSC::DFG::FixupPhase::fixupNode):
    * dfg/DFGGraph.cpp:
    (JSC::DFG::Graph::visitChildren):
    * dfg/DFGNode.h:
    (JSC::DFG::Node::hasTransition):
    * dfg/DFGNodeType.h:
    * dfg/DFGPredictionPropagationPhase.cpp:
    (JSC::DFG::PredictionPropagationPhase::propagate):
    * dfg/DFGSafeToExecute.h:
    (JSC::DFG::safeToExecute):
    * dfg/DFGSpeculativeJIT32_64.cpp:
    (JSC::DFG::SpeculativeJIT::compile):
    * dfg/DFGSpeculativeJIT64.cpp:
    (JSC::DFG::SpeculativeJIT::compile):
    * dfg/DFGStructureAbstractValue.cpp:
    (JSC::DFG::StructureAbstractValue::observeTransition):
    (JSC::DFG::StructureAbstractValue::observeTransitions):
    * dfg/DFGValidate.cpp:
    (JSC::DFG::Validate::validate):
    * dfg/DFGWatchableStructureWatchingPhase.cpp:
    (JSC::DFG::WatchableStructureWatchingPhase::run):
    * ftl/FTLCapabilities.cpp:
    (JSC::FTL::canCompile):
    * ftl/FTLLowerDFGToLLVM.cpp:
    (JSC::FTL::LowerDFGToLLVM::compileNode):
    (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
    
    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
    
    [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
    https://bugs.webkit.org/show_bug.cgi?id=133964
    
    Reviewed by Mark Hahnenberg.
    
    * bytecode/PutByIdStatus.cpp:
    (JSC::PutByIdStatus::appendVariant):
    (JSC::PutByIdStatus::computeForStubInfo):
    * bytecode/PutByIdVariant.cpp:
    (JSC::PutByIdVariant::oldStructureForTransition):
    (JSC::PutByIdVariant::writesStructures):
    (JSC::PutByIdVariant::reallocatesStorage):
    (JSC::PutByIdVariant::attemptToMerge):
    (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
    (JSC::PutByIdVariant::dumpInContext):
    * bytecode/PutByIdVariant.h:
    (JSC::PutByIdVariant::PutByIdVariant):
    (JSC::PutByIdVariant::replace):
    (JSC::PutByIdVariant::transition):
    (JSC::PutByIdVariant::structure):
    (JSC::PutByIdVariant::oldStructure):
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    * dfg/DFGByteCodeParser.cpp:
    (JSC::DFG::ByteCodeParser::handlePutById):
    (JSC::DFG::ByteCodeParser::parseBlock):
    * dfg/DFGConstantFoldingPhase.cpp:
    (JSC::DFG::ConstantFoldingPhase::foldConstants):
    (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
    * dfg/DFGGraph.cpp:
    (JSC::DFG::Graph::visitChildren):
    * dfg/DFGNode.cpp:
    (JSC::DFG::MultiPutByOffsetData::writesStructures):
    (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
    * ftl/FTLAbbreviations.h:
    (JSC::FTL::getLinkage):
    * ftl/FTLLowerDFGToLLVM.cpp:
    (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
    (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):

Source/WebCore: 
        
This fixes the previous mismerge and adds test coverage for the thing that went wrong.
Also, this adds some helpers for making it easier to inspect JavaScript values.

* testing/Internals.cpp:
(WebCore::Internals::description):
* testing/Internals.h:
* testing/Internals.idl:

    2014-07-25  Mark Lam  <mark.lam@apple.com>
    
    [ftlopt] Renamed DebuggerActivation to DebuggerScope.
    <https://webkit.org/b/134273>
    
    Reviewed by Michael Saboff.
    
    No new tests.
    
    * ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
    - Removed because this is not used.

Source/WebKit/mac: 

    2014-07-25  Mark Lam  <mark.lam@apple.com>
    
    [ftlopt] Renamed DebuggerActivation to DebuggerScope.
    <https://webkit.org/b/134273>
    
    Reviewed by Michael Saboff.
    
    * WebView/WebScriptDebugDelegate.mm:
    - Removed unneeded #include.

Source/WTF: 

* wtf/text/WTFString.h:

LayoutTests: 

* js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
* js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
* js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
* js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
* js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
* js/regress/fold-put-structure-expected.txt: Added.
* js/regress/fold-put-structure.html: Added.
* js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
* js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
* js/regress/hoist-poly-check-structure-expected.txt: Added.
* js/regress/hoist-poly-check-structure.html: Added.
* js/regress/put-by-id-replace-and-transition-expected.txt: Added.
* js/regress/put-by-id-replace-and-transition.html: Added.
* js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
* js/regress/put-by-id-slightly-polymorphic.html: Added.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.
(foo):
(fu):
(bar):
(.bar):
(Number):
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
(Number):
* js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-put-structure.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.
(foo):
(test):
* js/regress/script-tests/hoist-poly-check-structure.js: Added.
(foo):
(test):
* js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
* js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171660 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] Crash when accessing window.localStorage after calling window.close()
https://bugs.webkit.org/show_bug.cgi?id=135328
<rdar://problem/17315237>

Reviewed by Sam Weinig.

Source/WebCore:
Fixes an issue where accessing local storage for the first time after calling window.close()
causes a crash.

For now, we should disallow accessing local storage after calling window.close() regardless of
whether it's the first access to local storage as this seems like a bad idiom to support. Note,
this represents a change in behavior from WebKit1. If such usage of window.localStorage turns
out to be reasonable then we can visit this decision again in <https://bugs.webkit.org/show_bug.cgi?id=135330>.

Tests: storage/domstorage/localstorage/access-storage-after-window-close.html
       storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close.html
       storage/domstorage/localstorage/set-value-in-storage-after-window-close.html

* page/DOMWindow.cpp:
(WebCore::DOMWindow::localStorage): Modified to only return the cached local storage or
create a new local storage so long as the page isn't being closed. Also, substitute nullptr
for 0.
(WebCore::DOMWindow::close): Call Page::setIsClosing() to mark that the page is closing.
* page/Page.cpp:
(WebCore::Page::Page): Initialize m_isClosing to false.
* page/Page.h:
(WebCore::Page::setIsClosing): Added.
(WebCore::Page::isClosing): Added.

LayoutTests:
Added test by Andy Estes, LayoutTests/storage/domstorage/localstorage/access-storage-after-window-close.html,
to ensure that we don't crash when accessing local storage for the first time after calling window.close().

Additionally added tests that ensure that updates to local storage are ignored after calling
window.close() regardless of whether local storage was accessed before the call to window.close().

* storage/domstorage/localstorage/access-storage-after-window-close-expected.txt: Added.
* storage/domstorage/localstorage/access-storage-after-window-close.html: Added.
* storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close-expected.txt: Added.
* storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close.html: Added.
* storage/domstorage/localstorage/resources/access-storage-close-window-and-set-value-in-storage.html: Added.
* storage/domstorage/localstorage/resources/close-window-and-access-storage.html: Added.
* storage/domstorage/localstorage/resources/close-window-and-set-value-in-storage.html: Added.
* storage/domstorage/localstorage/set-value-in-storage-after-window-close-expected.txt: Added.
* storage/domstorage/localstorage/set-value-in-storage-after-window-close.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171661 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[REGRESSION][ftlopt merge][32-bit] stress/prune-multi-put-by-offset-replace-or-transition-variant.js.dfg-eager hits an assertion in SpeculativeJIT::silentSavePlanForGPR
https://bugs.webkit.org/show_bug.cgi?id=135323

Reviewed by Oliver Hunt.
        
SpeculativeJIT::silentSavePlanForGPR likes to believe that if a node is a constant,
then it's a constant that can be represented using that node's current DataFormat.
This doesn't work if the constant had been filled as a JSValue, and then one of the
fillSpeculateBlah() methods had speculated that it's of some type that the constant
isn't. Unless fillSpeculateBlah() specifically defends against this case, we'll have
a constant that claims to have a contradictory data format.
        
This patch fixes such a bug in the 32-bit fillSpeculateCell(). The 64-bit
fillSpeculateCell() appears to not have this bug, but I added a similar defense
mechanism anyway just in case, since this is one of those mistakes that keeps
reappearing.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't rely on reading applicationState from within DidEnterBackground/WillEnterForeground
https://bugs.webkit.org/show_bug.cgi?id=135329
rdar://problem/17818308

Reviewed by Sam Weinig.

API may not be stable.

* UIProcess/ios/PageClientImplIOS.mm:
(WebKit::PageClientImpl::isViewVisible):
    - changed to use -[WKContentView isBackground]
* UIProcess/ios/ProcessAssertionIOS.mm:
(-[WKProcessAssertionBackgroundTaskManager init]):
    - split notification handlers
(-[WKProcessAssertionBackgroundTaskManager _applicationWillEnterForeground:]):
(-[WKProcessAssertionBackgroundTaskManager _applicationDidEnterBackground:]):
(-[WKProcessAssertionBackgroundTaskManager _applicationDidEnterBackgroundOrWillEnterForeground:]): Deleted.
    - Assume application is background is after DidEnterBackground, and not after WillEnterForeground
* UIProcess/ios/WKContentView.h:
    - added isBackground.
* UIProcess/ios/WKContentView.mm:
(-[WKContentView initWithFrame:context:configuration:webView:]):
    - check applicationState at init.
(-[WKContentView isBackground]):
    - accessor
(-[WKContentView _applicationDidEnterBackground:]):
(-[WKContentView _applicationWillEnterForeground:]):
    - update isBackground



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171663 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix on the EFL port

Build break because of -Werror=return-type

* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::oldStructureForTransition):
* dfg/DFGValueStrength.h:
(JSC::DFG::merge):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171666 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Keep non-DATABASE_PROCESS build
https://bugs.webkit.org/show_bug.cgi?id=135321

Patch by Yusuke Suzuki <utatane.tea@gmail.com> on 2014-07-27
Reviewed by Gyuyoung Kim.

This is the patch for r171622 in non-DATABASE_PROCESS builds.
Change sendToDatabaseProcessRelaunchingIfNecessary to support non-DATABASE_PROCESS implementation.

* CMakeLists.txt:
* UIProcess/WebContext.h:
(WebKit::WebContext::sendToDatabaseProcessRelaunchingIfNecessary):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Support for :enabled selector on Anchor & Area elements
https://bugs.webkit.org/show_bug.cgi?id=134826

Reviewed by Darin Adler.

Source/WebCore:
Updates the PseudoClassEnabled selector checker to check for Anchor & Area
elements with a 'href' attribute.

Spec: http://html.spec.whatwg.org/#selector-enabled

Test: fast/css/css-selector-enabled-links.html

* css/SelectorCheckerTestFunctions.h:
(WebCore::isEnabled): Added check for anchor & area elements.

LayoutTests:
Added tests for :enabled CSS selector on Anchor & Area elements.

* fast/css/css-selector-enabled-links-expected.txt: Added.
* fast/css/css-selector-enabled-links.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171671 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove GraphicsSurfaceGLX.cpp
https://bugs.webkit.org/show_bug.cgi?id=135279

Reviewed by Darin Adler.

GraphicsSurfaceGLX.cpp is not used since Qt dropped and Efl port changed at r146458

* platform/graphics/surfaces/glx/GraphicsSurfaceGLX.cpp: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unused preference keys
https://bugs.webkit.org/show_bug.cgi?id=135280

Reviewed by Darin Adler.

Source/WebKit/mac:
* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences _setPageCacheSize:]): Deleted.
(-[WebPreferences _pageCacheSize]): Deleted.
(-[WebPreferences _setObjectCacheSize:]): Deleted.
(-[WebPreferences _objectCacheSize]): Deleted.
* WebView/WebPreferencesPrivate.h:

Source/WebKit/win:
* WebPreferenceKeysPrivate.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Followup fix after r171594
https://bugs.webkit.org/show_bug.cgi?id=135048

Patch by Renato Nagy <nagy.renato@stud.u-szeged.hu> on 2014-07-28
Reviewed by Csaba Osztrogonác.

* Scripts/sort-export-file: Removed extra newlines from help.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS: Fix :visited behavior for SubSelectors
https://bugs.webkit.org/show_bug.cgi?id=135324

Reviewed by Benjamin Poulain.

Disable :visited match for the selectors that has SubSelectors.

Source/WebCore:

Tests: fast/history/nested-visited-test-complex.html
       fast/history/sibling-visited-test-complex.html

* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::matchRecursively):

LayoutTests:
This `isSubSelector` (`context.firstSelectorOfTheFragment == context.selector`) is intended to
check `relation != CSSSelector::SubSelector`.
But since this value belongs to the previous selector and it is tested inside the branch that checks
the next selector isn't SubSelector `relation != CSSSelector::SubSelector`,
this only matches when the previous selector doesn't has SubSelectors.

* fast/history/nested-visited-test-complex-expected.txt: Added.
* fast/history/nested-visited-test-complex.html: Added.
* fast/history/sibling-visited-test-complex-expected.txt: Added.
* fast/history/sibling-visited-test-complex.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r169105): Crash in selection
https://bugs.webkit.org/show_bug.cgi?id=134303

Patch by Radu Stavila <stavila@adobe.com> on 2014-07-28
Reviewed by Mihnea Ovidenie.

Source/WebCore:

When splitting the selection between different subtrees, all subtrees must have their selection cleared before
starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
we get inconsistent data.

To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
method first iterates through all subtrees and performs the "clear" method and then starts all over again
and performs the "apply" method.

Test: fast/regions/selection/crash-deselect.html

* WebCore.xcodeproj/project.pbxproj:
* rendering/RenderSelectionInfo.h:
* rendering/RenderView.cpp:
(WebCore::RenderView::setSelection):
(WebCore::RenderView::splitSelectionBetweenSubtrees):
(WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
(WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
(WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
(WebCore::RenderView::setSubtreeSelection): Deleted.
* rendering/RenderView.h:
* rendering/SelectionSubtreeRoot.cpp:
(WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
* rendering/SelectionSubtreeRoot.h:
(WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

LayoutTests:

Added test for the crash that occurred in some cases when selecting.

Reviewed by NOBODY (OOPS!).

* fast/regions/selection/crash-deselect-expected.txt: Added.
* fast/regions/selection/crash-deselect.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS3-Text] Adjust text-justify implementation to the latest spec
https://bugs.webkit.org/show_bug.cgi?id=135317

Reviewed by Darin Adler.

Source/WebCore:
Text-justify no longer accepts the following values: Inter-ideograph, inter-
cluster, and kashida. This patch removes them and updates the tests as well.

[1] http://dev.w3.org/csswg/css-text-3/#propdef-text-justify

Updated existing tests.

* css/CSSParser.cpp:
(WebCore::isValidKeywordPropertyAndValue):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator TextJustify):
* css/CSSValueKeywords.in:
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::changeRequiresLayout):
* rendering/style/RenderStyleConstants.h:
* rendering/style/StyleRareInheritedData.h:

LayoutTests:
* fast/css3-text/css3-text-justify/getComputedStyle/script-tests/getComputedStyle-text-justify-inherited.js:
* fast/css3-text/css3-text-justify/getComputedStyle/script-tests/getComputedStyle-text-justify.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed 'merge' fix.

* platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
Correct line endings to allow EWS merges again.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win] Unreviewed build fix.

* JavaScriptCore.vcxproj/JavaScriptCore.proj: Switch from the 'Rebuild' target for MSBuild
builds to the 'Build' target to avoid a spurious 'clean' in between build steps.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS3-Text] Update text-expectations after r171677

Unreviewed.

* fast/css3-text/css3-text-justify/getComputedStyle/getComputedStyle-text-justify-expected.txt:
* fast/css3-text/css3-text-justify/getComputedStyle/getComputedStyle-text-justify-inherited-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Replay: vectors of characters should be base64-encoded
https://bugs.webkit.org/show_bug.cgi?id=135341

Reviewed by Timothy Hatcher.

Without this specialization, encode/decode methods try to create an
array of single characters in JSON, rather than treating the
vector as a binary blob.

* replay/EncodedValue.cpp:
(JSC::EncodingTraits<Vector<char>>::encodeValue): Added.
(JSC::EncodingTraits<Vector<char>>::decodeValue): Added.
* replay/EncodedValue.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171682 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Replay: incorrect serialization code generated for enum classes inside class scope
https://bugs.webkit.org/show_bug.cgi?id=135342

Reviewed by Timothy Hatcher.

If an enum class is defined inside of a class scope, then the enum class
cannot be forward-declared and the relevant header should be included.
Some generated code used incorrectly-scoped enum values in this situation.

* replay/scripts/CodeGeneratorReplayInputs.py:
(Generator.generate_includes.declaration.is):
(Generator.generate_enum_trait_implementation.is):
(Generator.generate_enum_trait_implementation):

Tests:

* replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp: Rebaselined.
* replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h: Rebaselined.
* replay/scripts/tests/generate-enums-with-same-base-name.json: Add enum
class types to this test case.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171683 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Replay: auto-decoding of parameterized vector's elements is incorrect
https://bugs.webkit.org/show_bug.cgi?id=135343

Reviewed by Timothy Hatcher.

Fix an incorrect type argument in EncodingTraits<Vector<T>>::encodeValue
that was using the element's decoded type as the type parameter to
EncodedValue::append<T>. It should instead be the raw type T. This
causes problems when encoding Vector<RefPtr<T>>, as it later tries to
use encoding traits for RefPtr<T> rather than for T.

Fix incorrect generated encoding traits argument for vectors of
RefCounted objects. Updated test to cover this scenario.

* replay/scripts/CodeGeneratorReplayInputs.py:
(Type.encoding_type_argument):
(VectorType.type_name):
(VectorType):
(VectorType.encoding_type_argument):
(Generator.generate_input_encode_implementation):
(Generator.generate_input_decode_implementation):
* replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp:
* replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
* replay/scripts/tests/generate-input-with-vector-members.json: Updated.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@171684 268f45cc-cd09-0410-ab3c-d52691b4dbfc