Merge r162830 - [SOUP] WebProcess sometimes crashes when a download is cancelled
https://bugs.webkit.org/show_bug.cgi?id=127650

Reviewed by Martin Robinson.

The problem is that when the download is cancelled, the download
manager removes the download from the map and it's deleted. The
Download destructor calls platformInvalidate() that cancels the
resource handle if there's still one. We set to nullptr the
ResourceHandle when the download is cancelled to avoid cancelling
it twice, but it's done after calling Download::didCancel(). It
should be done before, because at that moment, when the download
is deleted, the resource handle pointer is still valid.

* Shared/Downloads/soup/DownloadSoup.cpp:
(WebKit::Download::cancel):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] webkit_web_view_load_html reads UTF8 css files as UTF16
https://bugs.webkit.org/show_bug.cgi?id=127481

Patch by Sami Wagiaalla <swagiaal@redhat.com> on 2014-02-18
Reviewed by Carlos Garcia Campos.

Partial merge of r160572.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadString):
(WebKit::WebPage::loadHTMLString):
(WebKit::WebPage::loadAlternateHTMLString):
(WebKit::WebPage::loadPlainTextString):
(WebKit::WebPage::loadWebArchiveData):
* WebProcess/WebPage/WebPage.h:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164280 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r155466 - SpecType should have SpecInt48AsDouble
https://bugs.webkit.org/show_bug.cgi?id=121065

Reviewed by Oliver Hunt.

* bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):
* bytecode/SpeculatedType.h:
(JSC::isInt48AsDoubleSpeculation):
(JSC::isIntegerSpeculation):
(JSC::isDoubleRealSpeculation):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r155480 - Introduce a SpecInt48 type and be more careful about what we mean by "Top" https://bugs.webkit.org/show_bug.cgi?id=121116

Reviewed by Oliver Hunt.

SpecInt48 will mean that we have something that would be a double if it was a JSValue,
but it's profitable to represent it as something other than a double.

SpecInt48AsDouble means that it has a value that could have been represented like
SpecInt48, but we're making a heuristic decision not to do it.

* bytecode/SpeculatedType.h:
(JSC::isInt48Speculation):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
(JSC::DFG::::clobberCapturedVars):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::filter):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::makeHeapTop):
(JSC::DFG::AbstractValue::makeBytecodeTop):
(JSC::DFG::AbstractValue::isHeapTop):
(JSC::DFG::AbstractValue::heapTop):
(JSC::DFG::AbstractValue::validateType):
(JSC::DFG::AbstractValue::validate):
(JSC::DFG::AbstractValue::makeTop):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::initialize):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::noticeOSREntry):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164282 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r155730 - DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
https://bugs.webkit.org/show_bug.cgi?id=121330

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg and Oliver Hunt.

Also print whether a function is strict mode in debug dumps.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpAssumingJITType):
* bytecode/CodeOrigin.cpp:
(JSC::InlineCallFrame::dumpInContext):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

Tools:

Reviewed by Mark Hahnenberg and Oliver Hunt.

We should run tests even if they don't have expected files yet.

* Scripts/run-layout-jsc:

LayoutTests:

Reviewed by Mark Hahnenberg and Oliver Hunt.

* js/dfg-strict-mode-to-this-expected.txt: Added.
* js/dfg-strict-mode-to-this.html: Added.
* js/jsc-test-list:
* js/script-tests/dfg-strict-mode-to-this.js: Added.
(thingy.bar):
(thingy.foo):
(thingy):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163292 - Fix wrong mix of fcntl commands and flags
https://bugs.webkit.org/show_bug.cgi?id=127842

Reviewed by Darin Adler.

We are mixing the commands to set file descriptor and file status
flags in a couple of fcntl() calls. FD_CLOEXEC must be set using
F_SETFD, and the access mode flags (O_RDONLY, O_WRONLY, O_RDWR)
with F_SETFL.

This combines patches by Guillem Jover and Sergio Correia.

* Platform/IPC/unix/ConnectionUnix.cpp:
(IPC::readBytesFromSocket):
* Platform/unix/SharedMemoryUnix.cpp:
(WebKit::SharedMemory::createHandle):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164284 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163875 - O_CLOEXEC in shm_open does not work on FreeBSD
https://bugs.webkit.org/show_bug.cgi?id=128572

Reviewed by Darin Adler.

The O_CLOEXEC is not supported by shm_open() and is also not
necessary since FD_CLOEXEC is already set by default when the new
file descriptor is created.

* Platform/unix/SharedMemoryUnix.cpp:
(WebKit::SharedMemory::create):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164285 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163954 - 'ar T' is not portable and breaks the build on FreeBSD
https://bugs.webkit.org/show_bug.cgi?id=128596

Patch by Ryan Lortie <desrt@desrt.ca> on 2014-02-12
Reviewed by Gustavo Noronha Silva.

Create thin archives only if we are using GNU ar.

* Source/autotools/SetupLibtool.m4:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164286 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163435 - MediaPlayerPrivateGStreamerBase should have virtual destructor
https://bugs.webkit.org/show_bug.cgi?id=128238

Reviewed by Carlos Garcia Campos.

MediaPlayerPrivateGStreamer inherit MediaPlayerPrivateGStreamerBase.
So MediaPlayerPrivateGStreamerBase should have virtual destructor.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h: Made destructor as virtual.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r163871 - [GStreamer] High playback rate causes crash
https://bugs.webkit.org/show_bug.cgi?id=128453

Patch by Piotr Grad <p.grad@samsung.com> on 2014-02-11
Reviewed by Philippe Normand.

Source/WebCore:

To high playback rate passed to GStreamer was causing crash.
Added guard in setRate method.

Test: media/video-extreme-playbackrate-crash.html

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::setRate):

LayoutTests:

Test checks if passing high playback rate causes crash.

* media/video-extreme-playbackrate-crash-expected.txt: Added.
* media/video-extreme-playbackrate-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164288 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164167 - [GTK] Fix marshaller used in WebKitWebPage::document-loaded signal
https://bugs.webkit.org/show_bug.cgi?id=128808

Reviewed by Sergio Villar Senin.

* WebProcess/InjectedBundle/API/gtk/WebKitWebPage.cpp:
(webkit_web_page_class_init): Use g_cclosure_marshal_VOID__VOID
instead of g_cclosure_marshal_VOID__OBJECT.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164289 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Update NEWS and Versions.m4 for 2.2.5 release.

.:

* Source/autotools/Versions.m4: Bump version numbers.

Source/WebKit/gtk:

* NEWS: Add release notes.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@164305 268f45cc-cd09-0410-ab3c-d52691b4dbfc