css3/compositing/isolation-isolate-blended-child.html fails
https://bugs.webkit.org/show_bug.cgi?id=129468

* platform/mac-wk2/TestExpectations: Marked as failing on OS X 10.8 Debug WK2.
Not sure if it's hardware related or dependent on confuguration in some other way.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164850 268f45cc-cd09-0410-ab3c-d52691b4dbfc
indexOf and lastIndexOf shouldn't resolve ropes when needle is longer than haystack
https://bugs.webkit.org/show_bug.cgi?id=129466

Reviewed by Michael Saboff.

Refactored the code to avoid calling JSString::value when needle is longer than haystack.

* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncLastIndexOf):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164851 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Compile attribute value matching
https://bugs.webkit.org/show_bug.cgi?id=129228

Reviewed by Geoffrey Garen.

Source/WebCore: 

Add support for compiling value matching when matching attributes in Selector.
This patch only adds exact matching, the other cases will follow.

There is a little infrastructure changes since FunctionCall now needs to support
calls taking 2 arguments. The fun begins when the arguments are not in the right
registers and need to be moved to the right place. Otherwise the code is straightforward.

In SelectorCompiler, it is necessary to handle two different cases of matching: case sensitive
and case insensitive. The choice is done in part at compilation time by asking HTMLDocument
if the name filter can include case insensitive attribute. The other part is done at runtime
by querying the element for its type and document.

Test: fast/selectors/case-insensitive-value-matching.html

* css/SelectorChecker.cpp:
(WebCore::attributeValueMatches): Null values matching should never happen, when an attribute
has no value, its value is empty.

* cssjit/FunctionCall.h:
(WebCore::FunctionCall::FunctionCall):
Add support for calls with two arguments.
(WebCore::FunctionCall::setOneArgument):
(WebCore::FunctionCall::setTwoArguments):
(WebCore::FunctionCall::swapArguments):
Here we need to swap two registers, but we cannot allocate a new register (because the context
of the function call may have taken all the available registers already).

On x86, the solution is simple, we can swap the two registers without side effects.

On other platforms, it is a little more complex. If there is any available register, we can just
use it as a temporary to make the swap.
If there are no available registers, we know that all the registers are taken. Since swapArguments()
was called after pushing all the arguments on the stack, we can safely trash the value of any of those.
We take the first available register that is not a function argument and use it as a temporary.

(WebCore::FunctionCall::prepareAndCall):
This is the fun part, we have two registers where the values must go before the function call. The values
can be in any combination of the allocated registers. The code here needs to move the two values to
their target register while avoiding conflicts.

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::AttributeMatchingInfo::AttributeMatchingInfo):
(WebCore::SelectorCompiler::AttributeMatchingInfo::canDefaultToCaseSensitiveValueMatch):
(WebCore::SelectorCompiler::AttributeMatchingInfo::selector):
The value of HTMLDocument::isCaseSensitiveAttribute is needed at compilation time to compute the number
of required registers. As a result, we need to keep it along in the selector fragment.

(WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
(WebCore::SelectorCompiler::attributeNameTestingRequiresNamespaceRegister):
(WebCore::SelectorCompiler::attributeValueTestingRequiresExtraRegister):
(WebCore::SelectorCompiler::minimumRegisterRequirements):
(WebCore::SelectorCompiler::SelectorCodeGenerator::markParentElementIfResolvingStyle):
(WebCore::SelectorCompiler::canMatchStyleAttribute):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSynchronizeStyleAttribute):
(WebCore::SelectorCompiler::canMatchAnimatableSVGAttribute):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSynchronizeAllAnimatedSVGAttribute):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeMatching):
The matching code is moved in a local scope. This is done to recover the register of qualifiedNameImpl
before doing any value matching. That register can then be used to store the expected value when matching
an attribute value.
It is unfortunate there is so much register pressure in this part.

Value matching is done outside the loop. The idea is to keep the loop really small since in the vast majority
of cases, name matching fails.
If the value matching fails, we jump back into the tight loop.

This is not ideal in all situation. For example trivial name matching with trivial value matching should
be done in loop. There is a FIXME to improve those cases later.

(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueMatching):
(WebCore::SelectorCompiler::testIsHTMLClassOnDocument):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueExactMatching):
In the case sensitive branch, things are really simple. We have to AtomicStringImpl pointers, if they
don't match, it is a failure.

The case sensitive branch start by comparing the pointers in case the values are equal. This is a common
case and it simplifies the cases for SVG, XHTML, etc.
If the two values are not equal, we must first find if the context requires case insensitive comparison
(HTMLElement in HTMLDocument). If the conditions require case insensitive matching, we then fall back
to a function call.

(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementFunctionCallTest):
* dom/Attribute.h:
(WebCore::Attribute::valueMemoryOffset):
* dom/Document.h:
(WebCore::Document::documentClassesMemoryOffset):
(WebCore::Document::isHTMLDocumentClassFlag):
* dom/Node.h:
(WebCore::Node::treeScopeMemoryOffset):
* dom/TreeScope.h:
(WebCore::TreeScope::documentScopeMemoryOffset):

LayoutTests: 

* fast/selectors/case-insensitive-value-matching-expected.txt: Added.
* fast/selectors/case-insensitive-value-matching.html: Added.
Test the various cases that require more register than the common case.

The values match Firefox behavior.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164852 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSC ignores the extra memory cost of HTMLCollection after a major GC
https://bugs.webkit.org/show_bug.cgi?id=129450

Reviewed by Andreas Kling.

Report the extra memory cost of HTMLCollection to JSC.

Unfortunately, the existing mechanism to report the extra memory cost in toJS is insufficient for
HTMLCollection since collection caches are populated later when HTMLCollection is accessed. Also,
the extra memory cost reported by Heap::reportExtraMemoryCost will be thrown away after a major GC.

To work around this limitation, added a visitor.reportExtraMemoryUsage call inside visitChildren
for interfaces with a newly added ReportExtraMemoryCost IDL extension flag to report the extra cost.

Since we may need to generate visitChildren when this flag is set, we can't automatically detect
and generate calls using C++ template as done in r148648.

* CMakeLists.txt:
* GNUmakefile.list.am:
* Modules/webaudio/AudioBuffer.idl:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSDOMBinding.h:
* bindings/scripts/CodeGeneratorJS.pm:
(InstanceNeedsVisitChildren):
(GenerateHeader):
(GenerateImplementation):
* bindings/scripts/IDLAttributes.txt:
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::toJS):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::toJS):
* dom/ChildNodeList.h:
* dom/CollectionIndexCache.cpp: Added.
(WebCore::reportExtraMemoryCostForCollectionIndexCache):
* dom/CollectionIndexCache.h:
(WebCore::CollectionIndexCache::memoryCost):
(WebCore::NodeType>::CollectionIndexCache):
(WebCore::NodeType>::nodeCount):
(WebCore::NodeType>::computeNodeCountUpdatingListCache):
(WebCore::NodeType>::nodeAt):
(WebCore::NodeType>::invalidate):
* dom/DOMAllInOne.cpp:
* dom/LiveNodeList.cpp:
(WebCore::LiveNodeList::memoryCost):
* dom/LiveNodeList.h:
* dom/NodeList.h:
(WebCore::NodeList::memoryCost):
* dom/NodeList.idl:
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::updateNamedElementCache):
* html/HTMLCollection.h:
(WebCore::CollectionNamedElementCache::didPopulate):
(WebCore::CollectionNamedElementCache::memoryCost):
(WebCore::CollectionNamedElementCache::find):
(WebCore::HTMLCollection::memoryCost):
* html/HTMLCollection.idl:
* html/HTMLFormControlsCollection.cpp:
(WebCore::HTMLFormControlsCollection::updateNamedElementCache):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164853 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unify the three call sites of SelectorQueryCache
https://bugs.webkit.org/show_bug.cgi?id=129249

Reviewed by Andreas Kling.

The three call sites of SelectorQueryCache were doing the exact same thing.
That code is mvoed to a new function Document::selectorQueryForString().

Also use String instead of AtomicString for querySelector() and querySelectorAll().
This prevent the call sites from creating AtomicString just for the time of the call.
This causes a tiny slow down on microbenchmarks that continuously query the same string
but has no negative impact on realistic/good test cases (and the bindings are simplified).

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::querySelector):
(WebCore::ContainerNode::querySelectorAll):
* dom/ContainerNode.h:
* dom/Document.cpp:
(WebCore::Document::selectorQueryForString):
* dom/Document.h:
* dom/Element.cpp:
(WebCore::Element::webkitMatchesSelector):
* dom/SelectorQuery.cpp:
(WebCore::SelectorQueryCache::add):
* dom/SelectorQuery.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164854 268f45cc-cd09-0410-ab3c-d52691b4dbfc