REGRESSION (r173531): Use after free in WebCore::RenderStyle::fontMetrics /
WebCore::CSSPrimitiveValue::computeLengthDouble
https://bugs.webkit.org/show_bug.cgi?id=136864

Reviewed by Andreas Kling.

Source/WebCore:

FontLoader previously called updateDocumentStyleIfNeeded,
which would reset styles currently in use as part of
the tabIndex calculation. The FontLoader should instead
wait for pending stylesheets to load.

Tests: fast/css/fontloader-tab-index.html

* css/FontLoader.cpp:
(WebCore::FontLoader::notifyWhenFontsReady): Do not immediately
call loadingDone().
(WebCore::FontLoader::loadingDone): Wait for stylesheets to
finish loading rather than updating document styles.
* css/FontLoader.h:
(WebCore::FontLoader::loading): Include JS font loads when testing
for the loading state.

LayoutTests:

Test that getting the tab index on a body element with
font-relative measurements to a local @font-face do not
cause a crash.

* fast/css/fontloader-tab-index-expected.html: Added.
* fast/css/fontloader-tab-index.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@174273 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Bump up and patch dependencies to allow building for aarch64
https://bugs.webkit.org/show_bug.cgi?id=137147

Patch by Akos Kiss <akiss@inf.u-szeged.hu> on 2014-10-03
Reviewed by Martin Robinson.

The currently used versions of pixman, libffi, librsvg, glib,
glib-networking, fontconfig, libxml2, gst-plugins-base fail to configure
and/or build for aarch64, so they are bumped up and patched where
necessary. Wherever possible, the same versions and patches were used as
for the EFL port bump-up
(https://bugs.webkit.org/show_bug.cgi?id=135885).

After the bump-up, a hitherto hidden bug in gst-plugins-good caused a
regression by crashing http/tests/media/video-redirect.html . A patch
already in upstream fixes that bug.

This change does not touch xserver, which also needs bumping up, but
will be dealt with later.

* gtk/jhbuild.modules:
Specified versions and patches necessary to correctly build for aarch64.
* gtk/patches/gst-events-arent-gstobjects.patch:
Added. Patches gst-plugins-good to fix a bug in .mov file demuxing.
* gtk/patches/gst-prevent-neon-check-in-configure-from-passing-under-aarch64.patch:
Added. Patches gst-plugins-base to configure correctly for aarch64.
* gtk/patches/librsvg-2.36.1-bump-up-config.guess-to-support-aarch64.patch:
Added. Bumps up config.guess and config.sub in librsvg to recognize
aarch64.
* gtk/patches/libxml2-2.9.0-dtd.patch:
Removed. Not necessary for libxml2 v2.9.1 anymore.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@174274 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL should sink PutLocals
https://bugs.webkit.org/show_bug.cgi?id=137168

Reviewed by Oliver Hunt.
Source/JavaScriptCore:

        
We've known for a while that our PutLocal situation was sub-optimal. We emit them anytime we
"pass" arguments to an inlined function call, because we need to enable the runtime to grab
those arguments when doing foo.arguments where foo is inlined: our engine doesn't deoptimize
in that case but rather just relies on the arguments being flushed (i.e. a copy of their
values is spilled) at a well-known place in a well-known format.
        
The PutLocals incur two costs: (1) they are store instructions and stores ain't free, and (2)
they look like escaping sites and so they inhibit object allocation sinking.
        
But in most cases, the PutLocals are unnecessary because the inlined code never performs any
side effect that could transitively lead to function.arguments. Even if the inlined code
could do such a side effect, it may be on a rare path so there is no need to penalize the
entire function.
        
This patch implements one solution to the PutLocal problem: it aggressively sinks PutLocals
to the latest possible point. This is even more aggressive than the object allocation
sinking. That sinking algorithm avoids creating situations where an object could be
materialized more than one along any path. PutLocal sinking, on the other hand, doesn't avoid
this at all - both to make the phase cheaper and simpler and to make it more aggressive.
Every PutLocal is sunk no matter what.
        
The upside of this patch is that it eliminates many PutLocals: many of them are sunk "past
their death", thus eliminating them completely. Others are sunk to rare paths. This enables a
lot of object allocation sinking and it removes a lot of pointless store instructions.
        
It also has downsites. Sinking PutLocals increases register pressure because it increases the
live ranges of things like inlined arguments.
        
This patch is a net performance win in its current form: 1% SunSpider regression, 2% OctaneV2
progression, 0.6% Kraken regression, 1% AsmBench progression, and 0.5% CompressionBench
regression. The biggest win is on Octane/raytrace, which improves by 27%.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CodeBlock.h:
* bytecode/Operands.h:
(JSC::Operands::dump): Deleted.
* bytecode/OperandsInlines.h:
(JSC::Traits>::dump):
* bytecode/VirtualRegister.h:
(JSC::VirtualRegister::isHeader):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGClobberSet.h:
(JSC::DFG::ClobberSetAdd::operator()):
(JSC::DFG::ClobberSetOverlaps::operator()):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
(JSC::DFG::NoOpClobberize::operator()):
(JSC::DFG::CheckClobberize::operator()):
(JSC::DFG::AbstractHeapOverlaps::operator()):
(JSC::DFG::ReadMethodClobberize::operator()):
(JSC::DFG::WriteMethodClobberize::operator()):
(JSC::DFG::DefMethodClobberize::operator()):
* dfg/DFGFlushFormat.h:
(JSC::DFG::merge):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::Graph):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::capturedVarsFor):
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPreciseLocalClobberize.h: Added.
(JSC::DFG::PreciseLocalClobberizeAdaptor::PreciseLocalClobberizeAdaptor):
(JSC::DFG::PreciseLocalClobberizeAdaptor::read):
(JSC::DFG::PreciseLocalClobberizeAdaptor::write):
(JSC::DFG::PreciseLocalClobberizeAdaptor::def):
(JSC::DFG::PreciseLocalClobberizeAdaptor::callIfAppropriate):
(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
(JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop):
(JSC::DFG::forEachLocalReadByUnwind):
(JSC::DFG::preciseLocalClobberize):
* dfg/DFGPutLocalSinkingPhase.cpp: Added.
(JSC::DFG::performPutLocalSinking):
* dfg/DFGPutLocalSinkingPhase.h: Added.
* dfg/DFGSSACalculator.h:
(JSC::DFG::SSACalculator::computePhis):
* dfg/DFGValidate.cpp:

Source/WTF:

        
Make the set bits of a BitVector iterable.

* wtf/BitVector.h:
(WTF::BitVector::SetBitsIterable::SetBitsIterable):
(WTF::BitVector::SetBitsIterable::iterator::iterator):
(WTF::BitVector::SetBitsIterable::iterator::operator*):
(WTF::BitVector::SetBitsIterable::iterator::operator++):
(WTF::BitVector::SetBitsIterable::iterator::operator==):
(WTF::BitVector::SetBitsIterable::iterator::operator!=):
(WTF::BitVector::SetBitsIterable::begin):
(WTF::BitVector::SetBitsIterable::end):
(WTF::BitVector::setBits):

LayoutTests:


* js/regress/elidable-new-object-then-call-expected.txt: Added.
* js/regress/elidable-new-object-then-call.html: Added.
* js/regress/script-tests/elidable-new-object-then-call.js: Added.
(sumOfArithSeries):
(bar):
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@174275 268f45cc-cd09-0410-ab3c-d52691b4dbfc