Merge r174929 - [GTK] Several labels are white instead of black
https://bugs.webkit.org/show_bug.cgi?id=137803

Reviewed by Martin Robinson.

Recent GTK+ versions require to explicitly set the state before
getting a color.

* rendering/RenderThemeGtk.cpp:
(WebCore::styleColor): Helper function to get a color from a
GtkStylecontext that explicitly sets the state before getting the color.
(WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor): Use styleColor().
(WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor): Ditto.
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor): Ditto.
(WebCore::RenderThemeGtk::systemColor): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174932 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174025, r174121, r174749, r174856, r174899 - DFG shouldn't insert store barriers when it has it on good authority that we're not storing a cell
https://bugs.webkit.org/show_bug.cgi?id=137161

Reviewed by Mark Hahnenberg.

This looks like a 1% Octane speed-up.

* bytecode/SpeculatedType.h:
(JSC::isNotCellSpeculation):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertStoreBarrier):
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateNotCell):

REGRESSION (r174025): Invalid cast in JSC::asString
https://bugs.webkit.org/show_bug.cgi?id=137224

Reviewed by Geoffrey Garen.

Store barrier elision in fixup depends on checking the type of the value being stored. It's very important that
when we speak of "the value being stored" we are really referring to the right value.

The bug here was that the PutClosureVar case was assuming that child2 is the value being stored. It's actually
child3. So we were incorrectly removing all barriers from PutClosureVar.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript
https://bugs.webkit.org/show_bug.cgi?id=137758

Rubber stamped by Filip Pizlo.

Reverted r174025 for just PutByOffset Nodes.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

Web Process crash when starting the web inspector after r174025.
<https://webkit.org/b/137340>

Reviewed by Filip Pizlo.

After r174025, we can generate a bad graph in the DFG fixup phase like so:

    102:<!0:-> StoreBarrier(Check:KnownCell:@19, ..., bc#44)
    60:<!0:->  PutStructure(Check:KnownCell:@19, ..., bc#44)
    103:<!0:-> Check(Check:NotCell:@54, ..., bc#44)
            // ^-- PutByOffset's StoreBarrier has been elided and replaced
            //     with a speculation check which can OSR exit.
    61:<!0:->  PutByOffset(Check:KnownCell:@19, ..., bc#44)

As a result, the structure change will get executed even if we end up OSR
exiting before the PutByOffset.  In the baseline JIT code, the structure now
erroneously tells the put operation that there is a value in that property
slot when it is actually uninitialized (hence, the crash).

The fix is to insert the Check at the earliest point possible:

1. If the checked node is in the same bytecode as the PutByOffset, then
   the earliest point where we can insert the Check is right after the
   checked node.

2. If the checked node is from a preceding bytecode (before the PutByOffset),
   then the earliest point where we can insert the Check is at the start
   of the current bytecode.

Also reverted the workaround from r174749: https://webkit.org/b/137758.

Benchmark results appear to be a wash on aggregate.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::indexOfNode):
(JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertOutOfOrder):
(JSC::DFG::InsertionSet::insertOutOfOrderNode):

[Follow up] Web Process crash when starting the web inspector after r174025.
<https://webkit.org/b/137340>

Reviewed by Geoffrey Garen.

Applied Geoff's feedback to clean up some code for better clarity after
r174856.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertOutOfOrder):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174934 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174926 - [GTK] Test TestWebKitAPI/WebKit2Gtk/TestInspectorServer fails
https://bugs.webkit.org/show_bug.cgi?id=132044

Reviewed by Brian Burg.

Source/WebInspectorUI:

Make sure Protocol/InspectorFrontendHostStub.js is loaded before
Base/Platform.js, because Platform uses the InspectorFrontendHost
object.

* UserInterface/Main.html:

Tools:

* TestWebKitAPI/Tests/WebKit2Gtk/TestInspectorServer.cpp:
(openRemoteDebuggingSession): Remove trailing slash when
concatenating base inspector URL with the page, because the
inspector returns the relative paths with a leading slash.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174935 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174818 - [GLIB] Add API to GMainLoopSource to schedule sources after a delay in microseconds
https://bugs.webkit.org/show_bug.cgi?id=137782

Reviewed by Sergio Villar Senin.

Source/WebCore:

* platform/gtk/SharedTimerGtk.cpp:
(WebCore::setSharedTimerFireInterval): Use microseconds instead of
milliseconds.

Source/WebKit2:

* WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
(WebKit::LayerTreeHostGtk::layerFlushTimerFired): Use microseconds
instead of milliseconds.

Source/WTF:

In some cases when we have a double with the time in seconds, the
conversion to milliseconds ends up truncating the value to 0, and
the source scheduled immediately.

* wtf/gobject/GMainLoopSource.cpp:
(WTF::createMicrosecondsTimeoutSource): Use a custom timeout
source that handles the interval in microseconds instead of milliseconds.
(WTF::GMainLoopSource::scheduleAfterDelay): Use MicrosecondsTimeoutSource.
(WTF::GMainLoopSource::scheduleAfterDelayAndDeleteOnDestroy): Ditto.
* wtf/gobject/GMainLoopSource.h:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174936 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174812 - REGRESSION(CMake): [GTK] WebKitSettings:enable-smooth-scrolling does nothing
https://bugs.webkit.org/show_bug.cgi?id=137781

Reviewed by Martin Robinson.

We used to enable smooth scrolling unconditionally in autotools
(via WebKitFeatures.m4), but since the switch to CMake it's
unconditionally disabled, so changing the setting doesn't have any
effect.

* Source/cmake/OptionsGTK.cmake: Enable smooth scrolling.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174937 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r173805 - Web Inspector: fix TypeSet hierarchy in TypeTokenView
https://bugs.webkit.org/show_bug.cgi?id=136982

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

TypeSet was computing the set of type booleans in the Inspector::Protocol::Runtime::TypeSet
object incorrectly because it was calling TypeSet::doesTypeConformTo(T) which checks if the
type set has only been of type T. It now checks '(m_seenTypes & T) != TypeNothing' to see
if type T is in the set of seen types, but not the entire set itself.

* runtime/TypeSet.cpp:
(JSC::TypeSet::inspectorTypeSet):

Source/WebInspectorUI:

The protocol object representation of TypeSet was being computed
incorrectly in JSC::TypeSet. This patch fixes that problem
and also asserts that the type information that the Web Inspector
receives is not empty.

* UserInterface/Models/TypeSet.js:
(WebInspector.TypeSet):
* UserInterface/Views/TypeTokenView.js:
(WebInspector.TypeTokenView.prototype._displayTypeName):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174938 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r173792 - Web Inspector: Option+Click on CSS url(...) should jump to resource view
https://bugs.webkit.org/show_bug.cgi?id=136965

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-09-20
Reviewed by Timothy Hatcher.

* UserInterface/Views/CodeMirrorAdditions.js:
When parsing CSS url(...) tokens, the contents of url(...)
are a "string" type, not "atom".

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174939 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174094 - Web Inspector: InspectorValues should use references for out parameters
https://bugs.webkit.org/show_bug.cgi?id=137190

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

Use references for out parameters in asType() and getType() methods.
Also convert to references in some miscellaneous code where we don't
expect or handle null values.

Remove variants of asObject() and asArray() that return a nullable RefPtr.
Now, client code is forced to use out parameters and check for cast failure.

Iron out control flow in some functions and fix some style issues.

* inspector/InjectedScript.cpp:
(Inspector::InjectedScript::getFunctionDetails):
(Inspector::InjectedScript::wrapObject):
(Inspector::InjectedScript::wrapTable):
* inspector/InjectedScriptBase.cpp:
(Inspector::InjectedScriptBase::makeEvalCall):
* inspector/InjectedScriptManager.cpp:
(Inspector::InjectedScriptManager::injectedScriptForObjectId): Simplify control flow.
* inspector/InspectorBackendDispatcher.cpp:
(Inspector::InspectorBackendDispatcher::dispatch):
(Inspector::getPropertyValue):
(Inspector::AsMethodBridges::asInteger):
(Inspector::AsMethodBridges::asDouble):
(Inspector::AsMethodBridges::asString):
(Inspector::AsMethodBridges::asBoolean):
(Inspector::AsMethodBridges::asObject):
(Inspector::AsMethodBridges::asArray):
* inspector/InspectorProtocolTypes.h:
(Inspector::Protocol::BindingTraits<Protocol::Array<T>>::runtimeCast):
(Inspector::Protocol::BindingTraits<Protocol::Array<T>>::assertValueHasExpectedType):
* inspector/InspectorValues.cpp: Use more by-reference out parameters. Add more spacing.
(Inspector::InspectorValue::asBoolean):
(Inspector::InspectorValue::asDouble):
(Inspector::InspectorValue::asInteger):
(Inspector::InspectorValue::asString):
(Inspector::InspectorValue::asValue):
(Inspector::InspectorValue::asObject):
(Inspector::InspectorValue::asArray):
(Inspector::InspectorValue::parseJSON):
(Inspector::InspectorValue::toJSONString):
(Inspector::InspectorValue::writeJSON):
(Inspector::InspectorBasicValue::asBoolean):
(Inspector::InspectorBasicValue::asDouble):
(Inspector::InspectorBasicValue::asInteger):
(Inspector::InspectorBasicValue::writeJSON):
(Inspector::InspectorString::asString):
(Inspector::InspectorString::writeJSON):
(Inspector::InspectorObjectBase::asObject):
(Inspector::InspectorObjectBase::openAccessors):
(Inspector::InspectorObjectBase::getBoolean):
(Inspector::InspectorObjectBase::getString):
(Inspector::InspectorObjectBase::getObject):
(Inspector::InspectorObjectBase::getArray):
(Inspector::InspectorObjectBase::writeJSON):
(Inspector::InspectorArrayBase::asArray):
(Inspector::InspectorArrayBase::writeJSON):
* inspector/InspectorValues.h:
* inspector/agents/InspectorDebuggerAgent.cpp:
(Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
(Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
(Inspector::parseLocation):
(Inspector::InspectorDebuggerAgent::setBreakpoint):
(Inspector::InspectorDebuggerAgent::continueToLocation):
(Inspector::InspectorDebuggerAgent::didParseSource):
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
* inspector/scripts/codegen/generate_protocol_types_implementation.py:
(ProtocolTypesImplementationGenerator):
(ProtocolTypesImplementationGenerator._generate_assertion_for_enum):
* inspector/scripts/codegen/generator_templates.py:
* inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
* replay/EncodedValue.cpp:
(JSC::EncodedValue::asObject):
(JSC::EncodedValue::asArray):
(JSC::EncodedValue::convertTo<bool>):
(JSC::EncodedValue::convertTo<double>):
(JSC::EncodedValue::convertTo<float>):
(JSC::EncodedValue::convertTo<int32_t>):
(JSC::EncodedValue::convertTo<int64_t>):
(JSC::EncodedValue::convertTo<uint32_t>):
(JSC::EncodedValue::convertTo<uint64_t>):
(JSC::EncodedValue::convertTo<String>):

Source/WebCore:

Clean up some call sites to explicitly check for cast success, and simplify
some exceptional control flows.

No new tests, no behavior changed.

* inspector/CommandLineAPIHost.cpp:
(WebCore::CommandLineAPIHost::inspectImpl):
* inspector/InspectorCSSAgent.cpp:
(WebCore::computePseudoClassMask):
* inspector/InspectorDOMAgent.cpp:
(WebCore::parseColor):
(WebCore::parseConfigColor):
(WebCore::parseQuad):
(WebCore::InspectorDOMAgent::performSearch):
(WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
(WebCore::InspectorDOMAgent::innerHighlightQuad):
(WebCore::InspectorDOMAgent::highlightFrame):
* inspector/InspectorDOMStorageAgent.cpp:
(WebCore::InspectorDOMStorageAgent::findStorageArea):
* inspector/InspectorIndexedDBAgent.cpp: Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL.
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
* inspector/InspectorReplayAgent.cpp:
(WebCore::InspectorReplayAgent::replayToPosition):
* inspector/InspectorResourceAgent.cpp:
(WebCore::InspectorResourceAgent::willSendRequest):
* inspector/InspectorStyleSheet.cpp:
(WebCore::InspectorStyle::styleWithProperties):
* inspector/InspectorStyleSheet.h:
(WebCore::InspectorCSSId::InspectorCSSId):
* inspector/InspectorTimelineAgent.cpp:
(WebCore::InspectorTimelineAgent::startFromConsole):
(WebCore::InspectorTimelineAgent::stopFromConsole):
* inspector/InspectorWorkerAgent.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174941 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174090 - Don't use GPRResult unless you're flushing registers and making a runtime function call
https://bugs.webkit.org/show_bug.cgi?id=137234

Rubber stamped by Andreas Kling.

Rename GPRResult to GPRFlushedCallResult, in an attempt to dissuade people from using it for results in the
general case.

Replace GPRResult with GPRTemporary in those places where it was causing bugs: particularly in GetDirectPname it
would cause us to spill the register that has the base, and the code was assuming (rightly) that the base and the
result were in different registers. That's a valid assumption when using GPRTemporary but not with GPRResult.
Also this code wasn't getting any benefit from using GPRResult because it wasn't doing flushRegisters().

I don't know how to test this. A test would require setting up a particularly awkward register allocation state.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
(JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
(JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
(JSC::DFG::SpeculativeJIT::compileRegExpExec):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileToStringOnCell):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::GPRFlushedCallResult::GPRFlushedCallResult):
(JSC::DFG::GPRFlushedCallResult2::GPRFlushedCallResult2):
(JSC::DFG::GPRResult::GPRResult): Deleted.
(JSC::DFG::GPRResult2::GPRResult2): Deleted.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174942 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174091 - DFG HasStructureProperty codegen should use one fewer registers
https://bugs.webkit.org/show_bug.cgi?id=137235

Reviewed by Andreas Kling.

This was an obvious source of inefficiency and it was causing us to run out of registers on
x86-32.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174122 - Label some asserts as having security implications.
<https://webkit.org/b/137260>

Reviewed by Filip Pizlo.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::handleAssertionFailure):
* runtime/JSCell.h:
(JSC::jsCast):
* runtime/StructureIDTable.h:
(JSC::StructureIDTable::get):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174944 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174142 - CSS JIT: Enable multiple stack references allocation by allocateUninitialized
https://bugs.webkit.org/show_bug.cgi?id=135293

Reviewed by Benjamin Poulain.

* cssjit/StackAllocator.h:
(WebCore::StackAllocator::stackTop):
    Add stackTop method to check references are allocated easily.
(WebCore::StackAllocator::allocateUninitialized):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174945 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174204 - Minor bug in UIClient::exceededDatabaseQuota()
https://bugs.webkit.org/show_bug.cgi?id=137213

Patch by JinYoung Hur <hurims@gmail.com> on 2014-10-02
Reviewed by Anders Carlsson.

Make sure not to call the completion handler twice if exceededDatabaseQuota is null.

* UIProcess/API/C/WKPage.cpp:
(WKPageSetPageUIClient):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174947 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174206 - Fix minimal build warnings
https://bugs.webkit.org/show_bug.cgi?id=137066

Reviewed by Daniel Bates.

No new tests, no behavior change.

* css/CSSParser.cpp:
(WebCore::isValidKeywordPropertyAndValue):
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
* page/Page.cpp:
(WebCore::Page::setPageScaleFactor):
* platform/graphics/WidthIterator.cpp:
(WebCore::WidthIterator::glyphDataForCharacter):
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174948 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174209 - [GTK] [JHBuild] Switch sourceware.org mirror to http.

Unreviewed.

The ftp access is recently failing to work as expected, and the
bots fail to download the file.
The same mirror is available via http and seems to work better.

* gtk/jhbuild.modules:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174949 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174217 - AX: Default orientation for aria scrollbars should be vertical
https://bugs.webkit.org/show_bug.cgi?id=137341

Reviewed by Chris Fleizach.

Source/WebCore:

Default orientation for aria scrollbars regarding w3c spec should be vertical

No new tests, covering by existing one.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::orientation):

LayoutTests:

Update expectation and test for having new test case.

* accessibility/aria-scrollbar-role-expected.txt:
* accessibility/aria-scrollbar-role.html:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174219 - Use variadic templates for jsMakeNontrivialString
https://bugs.webkit.org/show_bug.cgi?id=137325

Reviewed by Sam Weinig.

* runtime/JSString.h:
(JSC::jsNontrivialString):
Add an overload that takes an rvalue reference to a String so we can transfer ownership easily.

* runtime/JSStringBuilder.h:
(JSC::jsMakeNontrivialString):
Make this a variadic function template, with a single-parameter version that can steal the string if it's OK to do so.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174951 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174235 - XMLHttpRequestProgressEventThrottle shouldn't throttle / defer progress events if there are no listeners
https://bugs.webkit.org/show_bug.cgi?id=137346

Reviewed by Alexey Proskuryakov.

Previously XMLHttpRequestProgressEventThrottle would throttle / defer
progress events, which involves queueing events and starting timers,
even if there were no listeners for those events (which is fairly
common case).

This patch updates XMLHttpRequestProgressEventThrottle to make sure
there are actual progress event listeners *before* attempting to
throttle and do extra processing, to avoid doing unnecessary work.

This patch also makes XMLHttpRequestProgressEventThrottle::dispatchEvent()
private as this method is only called from other dispatch methods of
the class and never from the outside.

No new tests, no behavior change.

* xml/XMLHttpRequestProgressEventThrottle.cpp:
(WebCore::XMLHttpRequestProgressEventThrottle::dispatchThrottledProgressEvent):
(WebCore::XMLHttpRequestProgressEventThrottle::dispatchProgressEvent):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174952 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174260 - Change how 32-bit JSValues check if they are a Boolean

Rubber stamped by Filip Pizlo.

32-bit JSValue::isBoolean can simply check if its tag corresponds
to the boolean tag instead of checking if it's either true or false.

* runtime/JSCJSValueInlines.h:
(JSC::JSValue::isBoolean):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174953 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r174273 - REGRESSION (r173531): Use after free in WebCore::RenderStyle::fontMetrics /
WebCore::CSSPrimitiveValue::computeLengthDouble
https://bugs.webkit.org/show_bug.cgi?id=136864

Reviewed by Andreas Kling.

Source/WebCore:

FontLoader previously called updateDocumentStyleIfNeeded,
which would reset styles currently in use as part of
the tabIndex calculation. The FontLoader should instead
wait for pending stylesheets to load.

Tests: fast/css/fontloader-tab-index.html

* css/FontLoader.cpp:
(WebCore::FontLoader::notifyWhenFontsReady): Do not immediately
call loadingDone().
(WebCore::FontLoader::loadingDone): Wait for stylesheets to
finish loading rather than updating document styles.
* css/FontLoader.h:
(WebCore::FontLoader::loading): Include JS font loads when testing
for the loading state.

LayoutTests:

Test that getting the tab index on a body element with
font-relative measurements to a local @font-face do not
cause a crash.

* fast/css/fontloader-tab-index-expected.html: Added.
* fast/css/fontloader-tab-index.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@174954 268f45cc-cd09-0410-ab3c-d52691b4dbfc