Bump version

Change-Id: Icd62ad6ca89ac8039272d9b3caaacabc571e0c8d
QWidgetPluginImpl: fix build with QT_NO_STYLE_STYLESHEET

Change-Id: Ia96efd95ff5f92e5b6569b343764c337fb1a8d41
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
compileMakeRope does not emit necessary bounds checks

https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2^31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.

* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMakeRope):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
* runtime/JSString.cpp:
(JSC::JSRopeString::RopeBuilder::expand):
* runtime/JSString.h:
(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
* tests/stress/make-large-string-jit-strcat.js: Added.
(foo):
* tests/stress/make-large-string-jit.js: Added.
(foo):
* tests/stress/make-large-string-strcat.js: Added.
* tests/stress/make-large-string.js: Added.

Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Unreviewed, ARMv7 build fix after r167336.

* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchAdd32):

Change-Id: Ia16f8dce00ce660cf5f7b9eb1c3496e08cbdb603
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167354 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[ARM] Unreviewed build fix after r167336.

* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branchAdd32):

Change-Id: I919df8301e69cca630f475afcc0c4311d713f10e
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Add missing branchAdd32 implementations to fix sh4 and mips builds

sh4 implementation has been taken from WebKit r173222.

Change-Id: I1c188e88e9fd8772f97cac94d7ee31945b538b71
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>