Make sure range based iteration of Vector<> still receives bounds checking
https://bugs.webkit.org/show_bug.cgi?id=138821

Reviewed by Mark Lam.

Source/JavaScriptCore:

There are a few uses of begin()/end() that explicitly require pointers,
so we use getPtr() to extract the underlying pointer generically.

* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::visitChildren):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitComplexPopScopes):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
* ftl/FTLAbbreviations.h:
(JSC::FTL::mdNode):
(JSC::FTL::buildCall):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* parser/Parser.h:
(JSC::Scope::Scope):
* profiler/ProfileNode.cpp:
(JSC::ProfileNode::debugPrintRecursively):
* runtime/JSArray.cpp:
(JSC::JSArray::setLengthWithArrayStorage):
(JSC::JSArray::sortCompactedVector):
* tools/ProfileTreeNode.h:
(JSC::ProfileTreeNode::dumpInternal):
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::matchCharacterClass):

Source/WebCore:

There are a few uses of begin()/end() that explicitly require pointers,
so we use getPtr() to extract the underlying pointer generically.

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::deserializeString):
* editing/TextIterator.cpp:
(WebCore::SearchBuffer::isBadMatch):
* page/mac/ServicesOverlayController.mm:
(WebCore::ServicesOverlayController::buildSelectionHighlight):
* platform/graphics/SegmentedFontData.cpp:
(WebCore::SegmentedFontData::fontDataForCharacter):
(WebCore::SegmentedFontData::containsCharacter):
(WebCore::SegmentedFontData::isLoading):
* platform/graphics/WOFFFileFormat.cpp:
(WebCore::convertWOFFToSfnt):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::paintFillLayers):
* rendering/style/GridResolvedPosition.cpp:
(WebCore::firstNamedGridLineBeforePosition):
(WebCore::GridResolvedPosition::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
* svg/SVGFontElement.cpp:
(WebCore::kerningForPairOfStringsAndGlyphs):
* svg/SVGPathByteStream.h:
(WebCore::SVGPathByteStream::append):
* xml/XPathNodeSet.h:
(WebCore::XPath::NodeSet::begin):
(WebCore::XPath::NodeSet::end):

Source/WTF:

Add a new IndexedIterator struct to WTF that wraps a
Vector type and index to provide pointer like semantics
while still performing runtime bounds checking, even in
release builds. We store a simple index into the vector
which means that this iterator allows vector resizing
during iteration. If the vector is resized such that the
iterator is out of bounds, then any attempt to dereference
the iterator will crash safely. Any other errors, including
overflows, and over extending the iterator will likewise
crash.

For the purpose of retaining semantically equivalent
behaviour, the iterator can be moved to m_index == size()
as that is the standard "end" terminator for these types.
Attempting to dereference at that point will still crash
rather than perform an unsafe memory operation.

In order to maintain the validity of all the bounds checking,
we perform full integer range checking prior to any mutation
of the iterator location. If we detect an arithmetic overflow
we will crash rather than attempting to carry on.

By necessity there are many overrides for operator + and - as
we otherwise hit many different type promotion ambiguities when
performing arithmetic with iterators. These ambiguities are also
different for 32- vs. 64-bit, so duplicating the functions
and then forwarding to the core implementations that performed
the bounds checking and mutation seemed like the right call.

* WTF.xcodeproj/project.pbxproj:
* wtf/IndexedIterator.h: Added.
(WTF::IndexedIterator::IndexedIterator):
(WTF::IndexedIterator::operator->):
(WTF::IndexedIterator::operator*):
(WTF::IndexedIterator::get):
(WTF::IndexedIterator::operator++):
(WTF::IndexedIterator::operator--):
(WTF::IndexedIterator::operator UnspecifiedBoolType):
(WTF::IndexedIterator::operator+=):
(WTF::IndexedIterator::operator-=):
(WTF::IndexedIterator::operator+):
(WTF::IndexedIterator::operator-):
(WTF::IndexedIterator::operator=):
(WTF::IndexedIterator::operator==):
(WTF::IndexedIterator::operator!=):
(WTF::IndexedIterator::operator<):
(WTF::IndexedIterator::operator<=):
(WTF::IndexedIterator::operator>):
(WTF::IndexedIterator::operator>=):
(WTF::IndexedIterator::operator const_iterator):
(WTF::IndexedIterator::isSafeToCompare):
(WTF::IndexedIterator::unsafeGet):
(WTF::getPtr):
(WTF::operator-):
(WTF::operator==):
(WTF::operator!=):
(WTF::operator<=):
(WTF::operator>=):
(WTF::operator<):
(WTF::operator>):
(WTF::IndexedIteratorSelector::makeIterator):
(WTF::IndexedIteratorSelector::makeConstIterator):
* wtf/RefCountedArray.h:
(WTF::RefCountedArray::RefCountedArray):
* wtf/Vector.h:
(WTF::Vector::Vector):
(WTF::Vector::begin):
(WTF::Vector::end):
(WTF::OverflowHandler>::Vector):
(WTF::=):
(WTF::OverflowHandler>::fill):
(WTF::OverflowHandler>::expandCapacity):
(WTF::OverflowHandler>::tryExpandCapacity):
(WTF::OverflowHandler>::resize):
(WTF::OverflowHandler>::shrink):
(WTF::OverflowHandler>::grow):
(WTF::OverflowHandler>::reserveCapacity):
(WTF::OverflowHandler>::tryReserveCapacity):
(WTF::OverflowHandler>::shrinkCapacity):
(WTF::OverflowHandler>::append):
(WTF::OverflowHandler>::tryAppend):
(WTF::OverflowHandler>::appendSlowCase):
(WTF::OverflowHandler>::uncheckedAppend):
(WTF::OverflowHandler>::appendVector):
(WTF::OverflowHandler>::insert):
(WTF::OverflowHandler>::insertVector):
(WTF::OverflowHandler>::remove):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@176592 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Transform StyleBuilderCustom into a class and mark it as a friend of RenderStyle
https://bugs.webkit.org/show_bug.cgi?id=138999

Reviewed by Sam Weinig.

Transform StyleBuilderCustom into a class and mark it as a friend of
RenderStyle. This is needed because some of the StyleBuilderCustom
functions need to access RenderStyle's private API.

No new tests, no behavior change.

* css/StyleBuilderCustom.h:
  Move functions from StyleBuilderFunctions namespace to
  StyleBuilderCustom class.

* css/makeprop.pl:
  Use StyleBuilderCustom scope instead of StyleBuilderFunctions for
  custom implementation.

* rendering/style/RenderStyle.h:
  Mark StyleBuilderCustom class as a friend, similarly to what was
  already done for DeprecatedStyleBuilder and StyleResolver.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@176593 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[MSE] Unset timestamps of trackbuffers during Reset Parser State algorithm.
https://bugs.webkit.org/show_bug.cgi?id=139075.

Patch by Bartlomiej Gajda <b.gajda@samsung.com> on 2014-12-01
Reviewed by Jer Noble.

Source/WebCore:

Specification requires from us to unset timestamps for trackBuffers
during abort() method.

Test: media/media-source/media-source-append-nonsync-sample-after-abort.html

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::resetParserState):
(WebCore::SourceBuffer::abort):
* Modules/mediasource/SourceBuffer.h:

LayoutTests:

Specification requires from us to unset timestamps for trackBuffers during abort() method.
Tests appendBuffer() with first sync sample, then aborts after a few more samples, and emits
a few more non-sync samples, so they should be dropped, as trackBuffer will have
needRandomAccessFlag set.

* media/media-source/media-source-append-nonsync-sample-after-abort-expected.txt: Added.
* media/media-source/media-source-append-nonsync-sample-after-abort.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@176594 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: DOMExceptions do not show the error message string in Pause Reason section
https://bugs.webkit.org/show_bug.cgi?id=138988

Reviewed by Timothy Hatcher.

Source/WebCore:

* inspector/WebInjectedScriptHost.cpp:
(WebCore::WebInjectedScriptHost::type):
Give all DOM Exception types the "error" RemoteObject subtype.

LayoutTests:

* inspector/debugger/command-line-api-exception-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@176595 268f45cc-cd09-0410-ab3c-d52691b4dbfc