Crash in platform/mac/accessibility/table-visible-rows.html
https://bugs.webkit.org/show_bug.cgi?id=132146

Reviewed by Filip Pizlo.

Instead of creating a local JSValueRef array on the stack and passing that to
JSObjectMakeArray(), changed to create an empty JSArray and then populate the
values using the JSObjectSetPropertyAtIndex() API.

* DumpRenderTree/AccessibilityUIElement.cpp:
(elementsForRangeCallback):
(convertElementsToObjectArray):
* DumpRenderTree/mac/TestRunnerMac.mm:
(originsArrayToJS):
* WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
(WTR::EventSendingController::contextClick):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::stringArrayToJS):
* WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:
(WTR::convertElementsToObjectArray):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167913 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS][WK2] iOS fix after r167867
https://bugs.webkit.org/show_bug.cgi?id=132302

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

iOS Touch Points uses "phase" for describing the touch points state for historical reasons.
This patch adds state() as a synonym for phase, and revert r167893.

* Shared/WebEvent.h:
(WebKit::WebPlatformTouchPoint::state):
* UIProcess/WebPageProxy.cpp:
(WebKit::areAllTouchPointsReleased):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167914 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed EFL gardening.

Skip editing/pasteboard which EFL port does not support.

* platform/efl-wk1/TestExpectations:
* platform/efl-wk2/TestExpectations:
* platform/efl/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167915 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS][WK2] Restore the scroll position and scale from the HistoryItem (mostly)
https://bugs.webkit.org/show_bug.cgi?id=132307

Source/WebCore: 

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

* WebCore.exp.in:

Source/WebKit2: 
<rdar://problem/16031704>

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-04-28
Reviewed by Simon Fraser.

Restore the scroll position and scale on back-forward by restoring the values from HistoryItem.
This covers the common cases, see <rdar://problem/16031704>.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _didCommitLayerTree:WebKit::]):
(-[WKWebView _didCommitLoadForMainFrame]): Deleted.
* UIProcess/API/Cocoa/WKWebViewInternal.h:
* UIProcess/ios/WKContentView.mm:
(-[WKContentView _didCommitLoadForMainFrame]):
Get rid of the old code restoring the scroll position. This is now done by the WebProcess.

* UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
Update the scrolling tree after invoking didCommitLayerTree() on the WebPageProxy.

WKContentView and WKWebView states are updated in response to didCommitLayerTree(), the content size
and scale in particular are set there.

After that, the content size/scale is in the same state as the layerTree update, and we can scroll
the content as needed.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm:
(WebKit::WebFrameLoaderClient::restoreViewState):
iOS WebKit1 uses a custom restoreViewState(), do the same for WebKit2 since the generic code is #ifdefed out.
This is also necessary for the main frame's state update.

* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::restorePageState):
Restore the scale and position of the main frame. For now, we assume m_userHasChangedPageScaleFactor is set otherwise
the initial-scale would override the restored value. We will need to fix that, the value should probably be saved with
the history.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167916 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r153142) ASSERT from CodeBlock::dumpBytecode dumping String Switch Jump Tables
https://bugs.webkit.org/show_bug.cgi?id=132315

Reviewed by Mark Hahnenberg.

Used the StringImpl version of utf8() instead of creating a String first.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167917 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Versioning.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167919 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSS JIT: backtracking with current / parent element for child
https://bugs.webkit.org/show_bug.cgi?id=132057

Patch by Yusuke Suzuki <utatane.tea@gmail.com> on 2014-04-28
Reviewed by Benjamin Poulain.

Calculate appropriate backtracking start height from the closest
descendant. And at first, we use it for a simple optimization.

1. When backtracking start height equals to current height, we
can simply jump to a descendant element check phase.
2. When backtracking start height equals to current height + 1, we
can simply jump to a descendant element traversing phase.

We can apply this optimization to fragments with adjacent combinators.
But, in the meantime, we start to implement it for a fragment with
child combinator.

Source/WebCore:
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
(WebCore::SelectorCompiler::TagNamePattern::TagNamePattern):
(WebCore::SelectorCompiler::solveDescendantBacktrackingActionForChild):
(WebCore::SelectorCompiler::solveBacktrackingAction):
(WebCore::SelectorCompiler::equalTagNames):
(WebCore::SelectorCompiler::equalTagNamePatterns):
(WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant):
(WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
(WebCore::SelectorCompiler::requiresAdjacentTail):
(WebCore::SelectorCompiler::requiresDescendantTail):
(WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentNode):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateParentElementTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateAncestorTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):

LayoutTests:
* fast/selectors/backtracking-child-combinator-with-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-with-tail.html: Added.
* fast/selectors/backtracking-child-combinator-without-tail-expected.txt: Added.
* fast/selectors/backtracking-child-combinator-without-tail.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167920 268f45cc-cd09-0410-ab3c-d52691b4dbfc