Simplified some JSObject methods for converting arrays to ArrayStorage shape.
<https://webkit.org/b/138119>

Reviewed by Filip Pizlo.

Currently, for each Undecided, Int32, Double, and Contiguous array shapes,
there are 3 JSObject methods to convert them to ArrayStorage shape:
    ArrayStorage* convert<shape>ToArrayStorage(VM&, NonPropertyTransition, unsigned neededLength);
    ArrayStorage* convert<shape>ToArrayStorage(VM&, NonPropertyTransition);
    ArrayStorage* convert<shape>ToArrayStorage(VM&);

However, the neededLength that is passed is always m_butterfly->vectorLength().
Hence, the method that takes a neededLength is really not needed.  This patch
removes this unneeded verbosity.

* runtime/JSObject.cpp:
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToArrayStorage):
- Also reordered the placement of the DeferGC statement so this Int32 function
  will look more similar to the others.
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
* runtime/JSObject.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: input type=hidden is being exposed when aria-hidden=false
https://bugs.webkit.org/show_bug.cgi?id=138106

Reviewed by Benjamin Poulain.

Source/WebCore:

If an input type=hidden was inside an aria-hidden=false, it would appear because
the lack of a RenderObject behind that object was not blocking its adoption into the AX tree.
We should explicity check for whether the type is hidden and then return an appropriate role. 

Test: accessibility/input-type-hidden-in-aria-hidden-false.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::determineAccessibilityRole):
(WebCore::AccessibilityNodeObject::computeAccessibilityIsIgnored):

LayoutTests:

* accessibility/input-type-hidden-in-aria-hidden-false-expected.txt: Added.
* accessibility/input-type-hidden-in-aria-hidden-false.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175241 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move RenderBlock::beingDestroyed() to RenderObject.
<https://webkit.org/b/138116>

Reviewed by Antti Koivisto.

Make "is being destroyed" a RenderObject concept instead of restricting
it to RenderBlocks. I'm guessing that this was specific to blocks due to
lack of bitfield space in RenderObject, and that's no longer an issue.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::RenderBlock):
(WebCore::RenderBlock::willBeDestroyed):
* rendering/RenderBlock.h:
(WebCore::RenderBlock::beingDestroyed): Deleted.
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::destroy):
* rendering/RenderObject.h:
(WebCore::RenderObject::beingDestroyed):
(WebCore::RenderObject::RenderObjectBitfields::RenderObjectBitfields):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@175242 268f45cc-cd09-0410-ab3c-d52691b4dbfc