Unreviewed, rolling out r164859.
http://trac.webkit.org/changeset/164859
https://bugs.webkit.org/show_bug.cgi?id=129483

caused WK1 crashes (DumpRenderTree) (Requested by zalan on
#webkit).

Tools:

* DumpRenderTree/mac/DumpRenderTree.mm:
(createWebViewAndOffscreenWindow):
(dumpRenderTree):
(runTest):
* DumpRenderTree/mac/DumpRenderTreeWindow.h:
* DumpRenderTree/mac/DumpRenderTreeWindow.mm:
(-[DumpRenderTreeWindow initWithContentRect:styleMask:backing:defer:]):
* WebKitTestRunner/PlatformWebView.h:
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::invoke):
* WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
* WebKitTestRunner/gtk/PlatformWebViewGtk.cpp:
* WebKitTestRunner/ios/PlatformWebViewIOS.mm:
* WebKitTestRunner/mac/PlatformWebViewMac.mm:
(-[WebKitTestRunnerWindow frameRespectingFakeOrigin]):

LayoutTests:

* fast/borders/hidpi-simple-hairline-border-painting-expected.html: Removed.
* fast/borders/hidpi-simple-hairline-border-painting.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164860 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
https://bugs.webkit.org/show_bug.cgi?id=119626

Source/WebCore:

SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
in the incorrect order. Specifically, it would attempt to apply its
localToParentTransform before its localToBorderBoxTransform. This
was causing an ASSERT to fail when the computed transforms didn't
match up to those computed by RenderGeometryMap.

Backported from Blink: https://codereview.chromium.org/143363004

Patch by Martin Hodovan <mhodovan@inf.u-szeged.hu> on 2014-02-28
Reviewed by Simon Fraser.

Test: svg/transforms/svg-geometry-crash.html

* rendering/svg/SVGRenderSupport.cpp:
(WebCore::SVGRenderSupport::mapLocalToContainer):

LayoutTests:

Backported from Blink: https://codereview.chromium.org/143363004

Patch by Martin Hodovan <mhodovan@inf.u-szeged.hu> on 2014-02-28
Reviewed by Simon Fraser.

* svg/transforms/svg-geometry-crash-expected.txt: Added.
* svg/transforms/svg-geometry-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164861 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Clean up Heap::collect and Heap::markRoots
https://bugs.webkit.org/show_bug.cgi?id=129464

Reviewed by Geoffrey Garen.

These functions have built up a lot of cruft recently. 
We should do a bit of cleanup to make them easier to grok.

* heap/Heap.cpp:
(JSC::Heap::finalizeUnconditionalFinalizers):
(JSC::Heap::gatherStackRoots):
(JSC::Heap::gatherJSStackRoots):
(JSC::Heap::gatherScratchBufferRoots):
(JSC::Heap::clearLivenessData):
(JSC::Heap::visitSmallStrings):
(JSC::Heap::visitConservativeRoots):
(JSC::Heap::visitCompilerWorklists):
(JSC::Heap::markProtectedObjects):
(JSC::Heap::markTempSortVectors):
(JSC::Heap::markArgumentBuffers):
(JSC::Heap::visitException):
(JSC::Heap::visitStrongHandles):
(JSC::Heap::visitHandleStack):
(JSC::Heap::traceCodeBlocksAndJITStubRoutines):
(JSC::Heap::converge):
(JSC::Heap::visitWeakHandles):
(JSC::Heap::clearRememberedSet):
(JSC::Heap::updateObjectCounts):
(JSC::Heap::resetVisitors):
(JSC::Heap::markRoots):
(JSC::Heap::copyBackingStores):
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::collect):
(JSC::Heap::collectIfNecessaryOrDefer):
(JSC::Heap::suspendCompilerThreads):
(JSC::Heap::willStartCollection):
(JSC::Heap::deleteOldCode):
(JSC::Heap::flushOldStructureIDTables):
(JSC::Heap::flushWriteBarrierBuffer):
(JSC::Heap::stopAllocation):
(JSC::Heap::reapWeakHandles):
(JSC::Heap::sweepArrayBuffers):
(JSC::Heap::snapshotMarkedSpace):
(JSC::Heap::deleteSourceProviderCaches):
(JSC::Heap::notifyIncrementalSweeper):
(JSC::Heap::rememberCurrentlyExecutingCodeBlocks):
(JSC::Heap::resetAllocators):
(JSC::Heap::updateAllocationLimits):
(JSC::Heap::didFinishCollection):
(JSC::Heap::resumeCompilerThreads):
* heap/Heap.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164862 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SubresourceLoader::didFinishLoading() should not assert when a decode error occurs
https://bugs.webkit.org/show_bug.cgi?id=127029

Reviewed by Darin Adler.

Source/WebCore:

SubresourceLoader::didFinishLoading() can be called for a resource (e.g. an image) that
failed to be decoded or, in the case of an image, whose estimated decoded size exceeds
the maximum decoded size (Settings::maximumDecodedImageSize()).

Test: fast/images/decoded-size-exceeds-max-decoded-size.html

* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::didFinishLoading):

LayoutTests:

Added a test to ensure that we don't cause an assertion failure when an image fails
to load because of a decode error. In particular, the estimated decoded image size
exceeds the maximum decoded image size.

* fast/images/decoded-size-exceeds-max-decoded-size-expected.txt: Added.
* fast/images/decoded-size-exceeds-max-decoded-size.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164863 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix !ENABLE(GGC) builds

* heap/Heap.cpp:
(JSC::Heap::markRoots):
(JSC::Heap::gatherJSStackRoots): Also fix one of the names of the GC phases.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164864 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] DumpRenderTree Perl Support may build against wrong SDK and toolchain
https://bugs.webkit.org/show_bug.cgi?id=129163

Reviewed by David Kilzer.

Fixes an issue where DumpRenderTree Perl Support may build with the specified
iOS Simulator SDK and toolchain instead of using the OS X SDK and toolchain.
This issue manifests itself in a build failure when building the IPhoneSimulatorNotification
bundle.

Currently we build DumpRenderTree Perl Support with respect to the variable SDKROOT,
which is specified either explicitly when building with MAKE(1) or implicitly by
build-{dumprendertree, webkit}. Instead we should always build Perl Support using
the OS X SDK and toolchain since the built products are only applicable to OS X.

* DumpRenderTree/ios/PerlSupport/Makefile:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164865 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update meta-referrer behavior for invalid policies
https://bugs.webkit.org/show_bug.cgi?id=129475

Source/WebCore:

This patch aligns the behavior with the CSP 1.1 referrer directive,
where the fallback for an invalid value is the "never" policy.

Original patch from Mike West: https://src.chromium.org/viewvc/blink?view=rev&revision=165627

Reviewed by Alexey Proskuryakov.

Test: http/tests/security/referrer-policy-invalid.html

* dom/Document.cpp:
(WebCore::Document::processReferrerPolicy):

LayoutTests:

Reviewed by Alexey Proskuryakov.

* http/tests/security/referrer-policy-invalid-expected.txt: Added.
* http/tests/security/referrer-policy-invalid.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164866 268f45cc-cd09-0410-ab3c-d52691b4dbfc