Web Replay: capture and replay nondeterminism of Date.now() and Math.random()
https://bugs.webkit.org/show_bug.cgi?id=128633

Reviewed by Filip Pizlo.

Upstream the only two sources of script-visible nondeterminism in JavaScriptCore.

The random seed for WeakRandom is memoized when the owning JSGlobalObject is
constructed. It is deterministically initialized during replay before any
scripts execute with the global object.

The implementations of `Date.now()` and `new Date()` eventually obtain the
current time from jsCurrentTime(). When capturing, we save return values of
jsCurrentTime() into the recording. When replaying, we use memoized values from
the recording instead of obtaining values from the platform-specific currentTime()
implementation. No other code calls jsCurrentTime().

* DerivedSources.make: Add rules to make JSReplayInputs.h from JSInputs.json.
* JavaScriptCore.xcodeproj/project.pbxproj:
* replay/JSInputs.json: Added. Includes specifications for replay inputs
"GetCurrentTime" and "SetRandomSeed". Tests will be added for both input
cases once sufficient replay machinery has been added.

* replay/NondeterministicInput.h: NondeterministicInput should not have
been marked 'final'.

* runtime/DateConstructor.cpp:
(JSC::deterministicCurrentTime): Added. Load or store the current time depending
on what kind of InputCursor is attached to the JSGlobalObject.

(JSC::constructDate): Use deterministicCurrentTime().
(JSC::dateNow): Use deterministicCurrentTime().
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::setInputCursor): When setting a non-empty input cursor,
immediately store or load the "SetRandomSeed" input and initialize WeakRandom's
random seed with it. The input cursor (and thus random seed) must be set before
any scripts are evaluated with this JSGlobalObject.

* runtime/WeakRandom.h:
(JSC::WeakRandom::WeakRandom): Add JSGlobalObject as a friend class.
(JSC::WeakRandom::initializeSeed): Extract the seed initialization into a
separate method so it can be called outside of the JSGlobalObject constructor.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164007 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't crash when SerializedScriptValue deserialization fails
https://bugs.webkit.org/show_bug.cgi?id=128657

Reviewed by Oliver Hunt.

Source/WebCore: 

Test: crypto/subtle/postMessage-worker.html

* bindings/js/JSMessageEventCustom.cpp: (WebCore::JSMessageEvent::data): Added a FIXME.

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneBase::fail): Don't assert on failure.
(WebCore::SerializedScriptValue::deserialize): Never return a null JSValue, these
are not allowed.

LayoutTests: 

* crypto/subtle/postMessage-worker-expected.txt:
* crypto/subtle/resources/postMessage-worker.js:
* platform/mac/TestExpectations:
Unskip the test, and land (unimportant) failure results.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164008 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DelayedReleaseScope in MarkedAllocator::tryAllocateHelper is wrong
https://bugs.webkit.org/show_bug.cgi?id=128641

Reviewed by Michael Saboff.

We were improperly handling the case where the DelayedReleaseScope
in tryAllocateHelper would cause us to drop the API lock, allowing
another thread to sneak in and allocate a new block after we had already
concluded that there were no more blocks to allocate out of.

The fix is to call tryAllocateHelper in a loop until we know for sure
that this did not happen.

There was also a race condition with the DelayedReleaseScope in addBlock.
We would add the block to the MarkedBlock's list, sweep it, and then return,
causing us to drop the API lock momentarily. Another thread could then
grab the lock, and allocate out of the new block to the point where the
free list was empty. Then we would return to the original thread, who thinks
it's impossible to not allocate successfully at this point.
Instead we should just let tryAllocate do all the hard work with correctly
sweeping and getting a valid result.

There was another race condition in didFinishIterating. We would call resumeAllocating,
which would create a DelayedReleaseScope. The DelayedReleaseScope would then release
API lock before we set m_isIterating back to false, which would potentially confuse
other threads.

* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::tryAllocateHelper):
(JSC::MarkedAllocator::tryPopFreeList):
(JSC::MarkedAllocator::tryAllocate):
(JSC::MarkedAllocator::addBlock):
* heap/MarkedAllocator.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164009 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass the related page in the WebPageConfiguration struct
https://bugs.webkit.org/show_bug.cgi?id=128714

Reviewed by Darin Adler.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView initWithFrame:configuration:]):
* UIProcess/API/ios/WKContentView.h:
* UIProcess/API/ios/WKContentView.mm:
(-[WKContentView initWithFrame:context:WebKit::configuration:WebKit::]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164010 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IDB: TestExpectations batch - "cursor-added-bug.html to cursor-value.html"
https://bugs.webkit.org/show_bug.cgi?id=128706

Reviewed by Alexey Proskuryakov.

* platform/mac-wk2/TestExpectations:
* storage/indexeddb/cursor-continue-dir-expected.txt:
* storage/indexeddb/cursor-continue-expected.txt:
* storage/indexeddb/cursor-finished-expected.txt:
* storage/indexeddb/cursor-update-value-argument-required-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164011 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IDB: TestExpectations batch - "data-corruption.html to duplicates.html"
https://bugs.webkit.org/show_bug.cgi?id=128711

Reviewed by Alexey Proskuryakov.

* platform/mac-wk2/TestExpectations:
* storage/indexeddb/database-basics-expected.txt:
* storage/indexeddb/database-name-undefined-expected.txt:
* storage/indexeddb/deleteIndex-bug110792-expected.txt:
* storage/indexeddb/deleteObjectStore-name-argument-required-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164012 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update test expectations for Windows.

* TestExpectations:
* platform/gtk/TestExpectations:
* platform/mac/TestExpectations:
* platform/win/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164013 268f45cc-cd09-0410-ab3c-d52691b4dbfc