runSvnUpdateAndResolveChangeLogs() doesn’t work when invoked from a script outside Tools/Scripts
https://bugs.webkit.org/show_bug.cgi?id=136254

Reviewed by Tim Horton.

* Scripts/webkitdirs.pm:
(runSvnUpdateAndResolveChangeLogs): Locate resolve-ChangeLogs relative to the source tree,
not the invoking script.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172960 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r172940.
https://bugs.webkit.org/show_bug.cgi?id=136256

Caused assertions on fast/storage/serialized-script-
value.html, and possibly flakiness on more tests (Requested by
ap on #webkit).

Reverted changeset:

"FTL should be able to do polymorphic call inlining"
https://bugs.webkit.org/show_bug.cgi?id=135145
http://trac.webkit.org/changeset/172940

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172961 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result
https://bugs.webkit.org/show_bug.cgi?id=136187

Reviewed by Mark Hahnenberg.

Added two arg version for 32 bit builds of callOperation(J_JITOperation_ECJ, ...) that
doesn't require a tag for the second argument, instead it fills in a CellTag.  This is
used for the slow case of the GetDirectPname case in SpeculativeJIT::compile since we
haven't set up a register with a tag and we know that argument 2 is a cell.

* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): New version with implicit CellTag.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Eliminated extraneous filling of the scratchGPR
with CellTag as it wasn't in the control flow for the slow path that needed the tag.
Instead changed to calling new version of callOperation with an implicit CellTag.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172962 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DOMTimer may be deleted during timer fire
https://bugs.webkit.org/show_bug.cgi?id=136198

Reviewed by Geoff Garen.

Consequentially ScheduledActions may also be deleted mid execution.
This is fairly surprising & fragile, let's make this simpler.

Currently DOMTimer instances are effectively owned by the ScriptExecutionContext.
There is a 1-1 mapping between timers and contexts, all timers are help in a map
on the context and if the context goes away all timers are deleted. Rather than
being implemented in a straightforward fashion (a smart pointer type for the map
value) this is currently implemented by having the timer objects listen for the
context going away using contextDestroyed, and deleting themselves if so.

Switch to using a smart pointer for values of m_timeouts in ScriptExecutionContext.
By using a RefCounted object we can also extend the lifetime of the DOMTimer instance
from within the DOMTimer::fired method, so the object is not destroyed while the
member function is still on the stack.

* WebCore.xcodeproj/project.pbxproj:
    - project -> private since DOMTimer could no longer be a forward declare in ScriptExecutionContext.h.
* dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::adjustMinimumTimerInterval):
(WebCore::ScriptExecutionContext::didChangeTimerAlignmentInterval):
    - auto* -> auto& since value type in map is no longer a raw pointer.
* dom/ScriptExecutionContext.h:
(WebCore::ScriptExecutionContext::addTimeout):
    - DOMTimer* -> PassRefPtr<DOMTimer>
* page/DOMTimer.cpp:
(WebCore::DOMTimer::DOMTimer):
    - adopt the initial ref, and pass to addTimeout.
(WebCore::DOMTimer::install):
    - updated comment.
(WebCore::DOMTimer::removeById):
    - instead of explicitly deleting the timer and assuming this will implicitly remove it from the context map,
      we explicitly remove it from the context map and assume this will implicitly deleting the timer!
(WebCore::DOMTimer::fired):
    - Add a RefPtr to keep the DOMTimer object alive until the fired method completes; to cancel a one-shot timer
      just remove it from the context's map, rather than explicitly deleting it.
(WebCore::DOMTimer::~DOMTimer): Deleted.
(WebCore::DOMTimer::contextDestroyed): Deleted.
    - no need! object lifetime management now handled by smart pointers.
* page/DOMTimer.h:
    - added parent class RefCounted<DOMTimer>.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172963 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the build after r172963

* page/DOMTimer.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@172964 268f45cc-cd09-0410-ab3c-d52691b4dbfc