compileMakeRope does not emit necessary bounds checks

https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2^31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.

* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMakeRope):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
* runtime/JSString.cpp:
(JSC::JSRopeString::RopeBuilder::expand):
* runtime/JSString.h:
(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
* tests/stress/make-large-string-jit-strcat.js: Added.
(foo):
* tests/stress/make-large-string-jit.js: Added.
(foo):
* tests/stress/make-large-string-strcat.js: Added.
* tests/stress/make-large-string.js: Added.

Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Unreviewed, ARMv7 build fix after r167336.

* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchAdd32):

Change-Id: Ia16f8dce00ce660cf5f7b9eb1c3496e08cbdb603
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167354 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[ARM] Unreviewed build fix after r167336.

* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branchAdd32):

Change-Id: I919df8301e69cca630f475afcc0c4311d713f10e
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Add missing branchAdd32 implementations to fix sh4 and mips builds

sh4 implementation has been taken from WebKit r173222.

Change-Id: I1c188e88e9fd8772f97cac94d7ee31945b538b71
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
Fix uninitialized access in RenderTable

WTF::Vector's do not initialize primitive types, so we need to do so,
especially for the last columnpos which needs be the highest.

Change-Id: Iec68e12352b76d304faa59d3233cbbb38691d78d
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix uninitialized access

When an identifier is made from an empty string, the constructor still
tries accessing the first character to populate a cache. This leads to
access of uninitialized data, and wrong data in the cache. This causes
no wrong behavior though except unuseful data in the cache.

Change-Id: Ice9f10b08306799b160f8b95b76bd056f29d228d
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Support building QtTestBrowser without QtTestSupport

Use the same flags for QtTestBrowser that MiniBrowser uses to build
without webkit's QtTestSupport.

Change-Id: I0b31b1253b5014393a472286ffc6674efc64e753
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Do not let TexureMapper create backing stores that are too large

TextureMapper without Coordinated Graphics will preallocate all tiles
for a backing store. This makes it impossible to handle very large
backing stores as they will cause memory exhaution.

This patch disables composited layers with more pixels than 8192
squared, unless the ChromeClient has allowed large accelerated
layers.

Task-number: QTBUG-41404
Change-Id: Id71628da139f886aceb00732ae59dac2600ef863
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Load flags used by Qt modules when compile testing for a module

In order to pick-up the include path and library path passed
to Qt configure, the configure tests needs to load the Qt
build config.

Change-Id: I881d5e87a08bf8dab5058802dc80ca58d0eed5b1
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Fix crash when a network-request is aborted while forwarding data

Since we forward data block-wise a network request may be aborted while
we are still forwarding received data. In that case we should stop the
forwarding.

Task-number: QTBUG-41877
Change-Id: Ia34bbdcacdc4eb70a2e814d3b4bada9844abbb83
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix CLoop on big-endian machines

Callee and ScopeChain are JSObject pointers and saved in the 64bit
structure for JS registers. On a 32bit big-endian machine the actual
pointer is offset by the PayloadOffset of 4 bytes, but on little-endian
and 64bit architectures there is no offset.

This patch fixes four places the payloadOffset was not correctly added
on 32bit big-endian, and six places it was added on 64big big-endian
when it shouldn't.

Task-number: QTBUG-41896
Change-Id: I46b474bee9822b8040d1b7b2e8f31ce42e0adefe
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Do not use JIT on big endian architectures

All the JIT implementations targets the little-endian versions of ARM,
MIPS and SH4 respectively. So in case anyone builds on those platforms
we should not enable JIT.

Task-number: QTBUG-41896
Change-Id: I5be167511e2c3eac6c63e603b82da84fb6b29eaa
Reviewed-by: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Check for ICU at configure time the same way we add it later

Use pkg-config to get the right ICU library when searching for it at
config time. This matches how it is build with later.

Task-number: QTBUG-41750
Change-Id: I134ecdeb523eab225ef66f4dcc14ae4e25ea4eca
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Get rid of old harmattan workaround hurting Qt on ARM

Change-Id: Ieecee7c05e78117e8c9fc335f60970e2144ede81
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Merge remote-tracking branch 'origin/5.3' into 5.4

Change-Id: I509f0440296df39aece8133382aacc43a4e05f99
Crash in HTMLMediaElement::contextDestroyed

https://bugs.webkit.org/show_bug.cgi?id=123963

Reviewed by Eric Carlson.

Merge https://chromium.googlesource.com/chromium/blink/+/177999cdb34b707465670f0feff723922939f278

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement):

Change-Id: If730e758410f18ae86aca5a92cb7c48b12b8c7ae
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158870 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Merge "Merge remote-tracking branch 'origin/5.3' into 5.4" into refs/staging/5.4
Crash in WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine

https://bugs.webkit.org/show_bug.cgi?id=122776

Reviewed by Darin Adler.

Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248

Fix modification of whitespace endpoints to not assume it's operating on RenderTexts

During line layout, we use midpoints to identify RenderObjects, or parts of
RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.

Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
checkMidpoints to fix up our lineMidpointState to handle the case where we start
ignoring spaces in our line, but don't stop until somewhere on the following line.
Previously, this function assumed that the final midpoint (called an endpoint)
was a RenderText, but this assumption is wrong if we have a beginning midpoint
created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
markers) and no endpoint on that line. In that case, we'd instead adjust the
position backwards on the beginning midpoint, which would cause us to fail to
create an InlineBox for the inline or list marker. In the new test added, this
would actually trigger a crash due to an assumption when visually re-ordering
BidiRuns that a non-empty line would actually contain at least one such run.

Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::checkMidpoints):

Change-Id: I894bd9da4250dc2c79a55a8014e54df7dcbec719
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157436 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Fix LLInt vector offsets on Windows 64

Derived classes on Windows x64 are 64bit aligned placing the m_size
property of Vector slightly differently than on other platforms.

Change-Id: I186de5ea200abfbdd3bdf7502f3f427cb6890f3c
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Fix android compile.

Change-Id: I9848c2b384e6fa85a5224ce0691456105d2fe8a1
Reviewed-by: BogDan Vatra <bogdan@kde.org>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>