[Cocoa] Expose more WKWebProcessPlugInNodeHandle properties
https://bugs.webkit.org/show_bug.cgi?id=128219

Reviewed by Anders Carlsson.

* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.h: Declared new
properties.
* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.mm:
(-[WKWebProcessPlugInNodeHandle elementBounds]): Added.
(-[WKWebProcessPlugInNodeHandle HTMLInputElementIsAutoFilled]): Added.
(-[WKWebProcessPlugInNodeHandle setHTMLInputElementIsAutoFilled:]): Added.
(-[WKWebProcessPlugInNodeHandle HTMLInputELementIsUserEdited]): Added.
(-[WKWebProcessPlugInNodeHandle HTMLTextAreaELementIsUserEdited]): Added.
(-[WKWebProcessPlugInNodeHandle HTMLTableCellElementCellAbove]): Added.
* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandleInternal.h: Rolled
Internal category into the class extension.

* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInScriptWorld.h: Declared
-clearWrappers.
* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInScriptWorld.mm:
(-[WKWebProcessPlugInScriptWorld clearWrappers]): Added. Calls through to clearWrappers().
* WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInScriptWorldInternal.h: Rolled
Internal category into the class extension.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rolled out <http://trac.webkit.org/changeset/163280>:

Source/WebCore: 

    Push DOM attributes into the prototype chain
    ​https://bugs.webkit.org/show_bug.cgi?id=127969

It caused performance regressions, and broken websites on iOS.

Reviewed by Geoffrey Garen.

* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching):
* bindings/js/JSStorageCustom.cpp:
(WebCore::JSStorage::nameGetter):
(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::putDelegate):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody):
(InstanceOverridesGetOwnPropertySlot):
(PrototypeOverridesGetOwnPropertySlot):
(GenerateAttributesHashTable):
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::jsTestActiveDOMObjectConstructor):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::jsTestCustomNamedGetterConstructor):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructor::getOwnPropertySlot):
(WebCore::jsTestEventConstructorConstructor):
* bindings/scripts/test/JS/JSTestEventConstructor.h:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetConstructor):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::jsTestExceptionConstructor):
* bindings/scripts/test/JS/JSTestException.h:
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::JSTestGenerateIsReachable::getOwnPropertySlot):
(WebCore::jsTestGenerateIsReachableConstructor):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::jsTestInterfaceConstructor):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListenerPrototype::getOwnPropertySlot):
(WebCore::JSTestMediaQueryListListener::getOwnPropertySlot):
(WebCore::jsTestMediaQueryListListenerConstructor):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructor::getOwnPropertySlot):
(WebCore::jsTestNamedConstructorConstructor):
* bindings/scripts/test/JS/JSTestNamedConstructor.h:
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNode::getOwnPropertySlot):
(WebCore::jsTestNodeConstructor):
* bindings/scripts/test/JS/JSTestNode.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::JSTestOverloadedConstructors::getOwnPropertySlot):
(WebCore::jsTestOverloadedConstructorsConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterface::getOwnPropertySlot):
(WebCore::jsTestSerializedScriptValueInterfaceConstructor):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsPrototype::getOwnPropertySlot):
(WebCore::jsTestTypedefsConstructor):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::JSattribute::getOwnPropertySlot):
(WebCore::jsattributeConstructor):
* bindings/scripts/test/JS/JSattribute.h:
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::JSreadonly::getOwnPropertySlot):
(WebCore::jsreadonlyConstructor):
* bindings/scripts/test/JS/JSreadonly.h:

LayoutTests: 

    Push DOM attributes into the prototype chain
    https://bugs.webkit.org/show_bug.cgi?id=127969

It caused performance regressions, and broken websites on iOS.

Reviewed by Geoffrey Garen.

* fast/dom/Geolocation/enabled-expected.txt:
* fast/dom/Geolocation/script-tests/enabled.js:
* fast/dom/wrapper-classes-expected.txt:
* http/tests/security/cross-frame-access-enumeration-expected.txt:
* js/dom/constructor-attributes-expected.txt:
* js/dom/delete-syntax-expected.txt:
* js/dom/dom-attributes-on-mismatch-type-expected.txt:
* js/dom/dom-attributes-on-mismatch-type.html:
* js/dom/dom-static-property-for-in-iteration-expected.txt:
* js/dom/script-tests/constructor-attributes.js:
* js/dom/script-tests/delete-syntax.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163413 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refactor MarkStackArray to allow more than JSCells to be stored
https://bugs.webkit.org/show_bug.cgi?id=128203

Reviewed by Geoffrey Garen.

This patch refactors MarkStackArray into a separate template class named GCSegmentedArray.
This class allows subclassing to add functionality that only MarkStackArray wants.
Since it uses the JSC BlockAllocator instead of FastMalloc, this class can be used during
conservative stack scanning, which disallows using FastMalloc.

* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/BlockAllocator.h:
* heap/GCSegmentedArray.h: Added.
(JSC::GCArraySegment::GCArraySegment):
(JSC::GCArraySegment::data):
* heap/GCSegmentedArrayInlines.h: Added.
(JSC::GCSegmentedArray<T>::GCSegmentedArray):
(JSC::GCSegmentedArray<T>::~GCSegmentedArray):
(JSC::GCSegmentedArray<T>::clear):
(JSC::GCSegmentedArray<T>::expand):
(JSC::GCSegmentedArray<T>::refill):
(JSC::GCSegmentedArray<T>::fillVector):
(JSC::GCArraySegment<T>::create):
(JSC::GCSegmentedArray<T>::postIncTop):
(JSC::GCSegmentedArray<T>::preDecTop):
(JSC::GCSegmentedArray<T>::setTopForFullSegment):
(JSC::GCSegmentedArray<T>::setTopForEmptySegment):
(JSC::GCSegmentedArray<T>::top):
(JSC::GCSegmentedArray<T>::validatePrevious):
(JSC::GCSegmentedArray<T>::append):
(JSC::GCSegmentedArray<T>::canRemoveLast):
(JSC::GCSegmentedArray<T>::removeLast):
(JSC::GCSegmentedArray<T>::isEmpty):
(JSC::GCSegmentedArray<T>::size):
* heap/MarkStack.cpp:
(JSC::MarkStackArray::MarkStackArray):
(JSC::MarkStackArray::~MarkStackArray):
(JSC::MarkStackArray::donateSomeCellsTo):
(JSC::MarkStackArray::stealSomeCellsFrom):
* heap/MarkStack.h:
* heap/MarkStackInlines.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use srcset's pixel density to determine intrinsic size
https://bugs.webkit.org/show_bug.cgi?id=123832

Patch by Yoav Weiss <yoav@yoav.ws> on 2014-02-04
Reviewed by Dean Jackson.

The patch is a port of a similar Blink patch: https://codereview.chromium.org/25105004
According to the spec "When an img element has a current pixel density that is not 1.0,
the element's image data must be treated as if its resolution, in device pixels per CSS pixels,
was the current pixel density."

Source/WebCore:

I've added that support using the following changes:
- bestFitSourceForImageAttributes now returns the image candidate to HTMLImageElement.
- HTMLImageElement passes the devicePixelRatio data to RenderImage, which stores it.
- Bitmap images are scaled using the devicePixelRatio at RenderImageResource's intrinsicSize() and imageSize().
- SVG images are scaled using the devicePixelRatio at RenderReplaced::computeAspectRatioInformationForRenderBox.
- Canvas support added at CanvasRenderingContext2D::size.

Tests: fast/hidpi/image-srcset-intrinsic-size.html
       fast/hidpi/image-srcset-png-canvas.html
       fast/hidpi/image-srcset-png.html
       fast/hidpi/image-srcset-relative-svg-canvas-2x.html
       fast/hidpi/image-srcset-relative-svg.html
       fast/hidpi/image-srcset-space-left-nomodifier.html
       fast/hidpi/image-srcset-svg-canvas-2x.html
       fast/hidpi/image-srcset-svg-canvas.html
       fast/hidpi/image-srcset-svg.html
       fast/hidpi/image-srcset-svg2.html

* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::HTMLImageElement):
(WebCore::HTMLImageElement::parseAttribute):
(WebCore::HTMLImageElement::createRenderer):
* html/HTMLImageElement.h:
* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::size):
(WebCore::CanvasRenderingContext2D::drawImage):
* html/parser/HTMLParserIdioms.cpp:
(WebCore::compareByScaleFactor):
(WebCore::parseImagesWithScaleFromSrcsetAttribute):
(WebCore::bestFitSourceForImageAttributes):
* html/parser/HTMLParserIdioms.h:
(WebCore::ImageWithScale::ImageWithScale):
(WebCore::ImageWithScale::imageURL):
(WebCore::ImageWithScale::scaleFactor):
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
* rendering/RenderImage.cpp:
(WebCore::RenderImage::RenderImage):
* rendering/RenderImage.h:
(WebCore::RenderImage::setImageDevicePixelRatio):
(WebCore::RenderImage::imageDevicePixelRatio):
* rendering/RenderImageResource.cpp:
(WebCore::RenderImageResource::imageSize):
(WebCore::RenderImageResource::intrinsicSize):
(WebCore::RenderImageResource::getImageSize):
* rendering/RenderImageResource.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):

LayoutTests:

Layout test changes include modifications of existing tests to accomodate the new image dimensions, as well as new tests for this
specific functionality.

* fast/hidpi/image-srcset-change-dynamically-from-js-2x-expected.txt:
* fast/hidpi/image-srcset-change-dynamically-from-js-2x.html:
* fast/hidpi/image-srcset-data-escaped-srcset-expected.txt:
* fast/hidpi/image-srcset-data-escaped-srcset.html:
* fast/hidpi/image-srcset-data-src.html:
* fast/hidpi/image-srcset-data-srcset.html:
* fast/hidpi/image-srcset-fraction.html:
* fast/hidpi/image-srcset-intrinsic-size-expected.txt: Added.
* fast/hidpi/image-srcset-intrinsic-size.html: Added.
* fast/hidpi/image-srcset-invalid-inputs-correct-src-expected.txt:
* fast/hidpi/image-srcset-invalid-inputs-correct-src.html:
* fast/hidpi/image-srcset-invalid-inputs.html:
* fast/hidpi/image-srcset-invalid-inputs-expected.txt: Added.
* fast/hidpi/image-srcset-only-src-attribute-expected.txt: Added.
* fast/hidpi/image-srcset-only-src-attribute.html:
* fast/hidpi/image-srcset-png-canvas-expected.html: Added.
* fast/hidpi/image-srcset-png-canvas.html: Added.
* fast/hidpi/image-srcset-png-expected.html: Added.
* fast/hidpi/image-srcset-png.html: Added.
* fast/hidpi/image-srcset-relative-svg-expected.html: Added.
* fast/hidpi/image-srcset-relative-svg.html: Added.
* fast/hidpi/image-srcset-remove-dynamically-from-js.html:
* fast/hidpi/image-srcset-simple-2x-expected.txt:
* fast/hidpi/image-srcset-simple-2x.html:
* fast/hidpi/image-srcset-space-left-nomodifier-expected.txt: Added.
* fast/hidpi/image-srcset-space-left-nomodifier.html: Copied from LayoutTests/fast/hidpi/image-srcset-data-srcset.html.
* fast/hidpi/image-srcset-svg-expected.html: Added.
* fast/hidpi/image-srcset-svg.html: Added.
* fast/hidpi/image-srcset-svg2-expected.html: Added.
* fast/hidpi/image-srcset-svg2.html: Added.
* fast/hidpi/resources/green-400-px-square.png: Added.
* fast/hidpi/resources/relativesrcset.svg: Added.
* fast/hidpi/resources/srcset-helper.js:
(runTest):
* fast/hidpi/resources/srcset.png: Added.
* fast/hidpi/resources/srcset.svg: Added.
* fast/hidpi/resources/srcset_100px.svg: Added.
* fast/hidpi/resources/svg_canvas_helper.js: Added.
(drawCanvas):
* fast/hidpi/resources/svg_tests.css: Added.
(.test):
(.test img, .test canvas):
(.test .stats):
(.expected, .actual):
* platform/mac/fast/hidpi/image-srcset-only-src-attribute-expected.png: Removed.
* platform/mac/fast/hidpi/image-srcset-only-src-attribute-expected.txt: Removed.

The following tests were added, but skipped, since they reveal an unrelated SVG on canvas rendering issue:
* fast/hidpi/image-srcset-svg-canvas-2x-expected.html: Added.
* fast/hidpi/image-srcset-svg-canvas-2x.html: Added.
* fast/hidpi/image-srcset-svg-canvas-expected.html: Added.
* fast/hidpi/image-srcset-svg-canvas.html: Added.
* fast/hidpi/image-srcset-relative-svg-canvas-2x-expected.html: Added.
* fast/hidpi/image-srcset-relative-svg-canvas-2x.html: Added.
* fast/hidpi/image-srcset-relative-svg-canvas-expected.html: Added.
* fast/hidpi/image-srcset-relative-svg-canvas.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Store StringImpl substring backpointers as tail data
https://bugs.webkit.org/show_bug.cgi?id=128220

Reviewed by Geoffrey Garen.

This lets us get rid of m_substringBuffer from the union.

* wtf/text/StringImpl.cpp:
(WTF::StringImpl::~StringImpl):
(WTF::StringImpl::getData16SlowCase):
* wtf/text/StringImpl.h:
(WTF::StringImpl::StringImpl):
(WTF::StringImpl::createSubstringSharingImpl8):
(WTF::StringImpl::createSubstringSharingImpl):
(WTF::StringImpl::cost):
(WTF::StringImpl::costDuringGC):
(WTF::StringImpl::substringBuffer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IDB: indexeddb/mozilla/add-twice-failure.html fails
<rdar://problem/15982569> and https://bugs.webkit.org/show_bug.cgi?id=128208

Reviewed by Tim Horton.

Source/WebCore:

Covered specifically by indexeddb/mozilla/add-twice-failure.html and a handful of others.

* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::onError): Improve logging.

* Modules/indexeddb/IDBTransactionBackend.cpp:
(WebCore::IDBTransactionBackend::abort): Improve logging.

* Modules/indexeddb/IDBTransactionBackendOperations.cpp:
(WebCore::PutOperation::perform): Don’t abort the transaction when an error occurred.

* WebCore.exp.in:

Source/WebKit2:

Note that besides making indexeddb/mozilla/add-twice-failure.html pass this also makes some other tests
pass and also improves the failure modes of others.

A full accounting of which tests pass is coming soon.

* DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp:
(WebKit::UniqueIDBDatabase::putRecordInBackingStore): After checking for existence of the key and before
  adding the record, remove any previous record. (Defined by the spec, found exploring this test).

* DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h:
* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp:
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::keyExistsInObjectStore): Implement this.
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::deleteRecord): Add a form to be used as mentioned above in
  UniqueIDBDatabase::putRecordInBackingStore.
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::getKeyRecordFromObjectStore): CAST the key argument properly.
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::getKeyRangeRecordFromObjectStore): Ditto.
* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h:

LayoutTests:

* platform/mac-wk2/TestExpectations: Reenable this test for WK2

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG PutByVal on typed arrays should detect OutOfBounds sooner
https://bugs.webkit.org/show_bug.cgi?id=128162

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Just wire the m_outOfBounds flag in ArrayProfile into the OutOfBounds speculation in
DFG::ArrayMode for typed arrays.
        
Also make it possible to have tests for convergence.
        
Also turn one of the LayoutTests/js/dfg- tests into a stress test because it
was relying on a specific number of recompiles. Stress tests instead take
the approach of just running for a while. That's more robust.

* bytecode/CodeBlock.h:
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::fromObserved):
(JSC::DFG::ArrayMode::refine):
* dfg/DFGArrayMode.h:
(JSC::DFG::ArrayMode::withSpeculationFromProfile):
(JSC::DFG::ArrayMode::withProfile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):
* jsc.cpp:
(GlobalObject::finishCreation):
(functionReoptimizationRetryCount):
* runtime/TestRunnerUtils.cpp:
(JSC::getExecutableForFunction):
(JSC::getSomeBaselineCodeBlockForFunction):
(JSC::numberOfDFGCompiles):
(JSC::setNeverInline):
* runtime/TestRunnerUtils.h:
* tests/stress/float32-repeat-out-of-bounds.js: Added.
(foo):
* tests/stress/int8-repeat-out-of-bounds.js: Added.
(foo):
* tests/stress/string-out-of-bounds-negative-proto-value.js: Added.
(foo):

Tools: 

Reviewed by Mark Hahnenberg.
        
Add a defautNoEagerRun, which is intended to be used for convergence tests.

* Scripts/run-jsc-stress-tests:

LayoutTests: 

Reviewed by Mark Hahnenberg.
        
dfg-string-out-of-blahblah was moved to JSC/tests/stress.
        
dfg-convert-this-dom-window was using dfgShouldBe() incorrectly and this got revealed
by my TestRunnerUtils refactoring.
        
* js/dfg-string-out-of-bounds-negative-proto-value-expected.txt: Removed.
* js/dfg-string-out-of-bounds-negative-proto-value.html: Removed.
* js/script-tests/dfg-convert-this-dom-window.js:
* js/script-tests/dfg-string-out-of-bounds-negative-proto-value.js: Removed.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163418 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reduce boilerplate in BlockAllocator.h
https://bugs.webkit.org/show_bug.cgi?id=128222

Reviewed by Filip Pizlo.

There are a lot of template specializations for the various types of HeapBlocks 
in BlockAllocator.h. We could reduce the spew by using a macro.

* heap/BlockAllocator.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163419 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix !ENABLE(JIT) builds after r163418

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::reoptimizationRetryCounter): Return 0 if there's no way for us to reoptimize.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Some tests introduced by 163415 need ImageOnlyFailure tag.

Unreviewed gardering.

* TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@163421 268f45cc-cd09-0410-ab3c-d52691b4dbfc