Progressive JPEG outputScanlines() calls should handle failure
https://bugs.webkit.org/show_bug.cgi?id=116701

Reviewed by Brent Fulgham.

outputScanlines() can fail and delete |this|. Copy the decoder pointer
member and use that copy to detect and handle the failure case.

* platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
(WebCore::JPEGImageReader::decode):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix JSC Debug Regressions on Windows
https://bugs.webkit.org/show_bug.cgi?id=131182

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-04-16
Reviewed by Brent Fulgham.

The cast static_cast<int64_t>(number) in JSValue::isMachineInt() can generate a floating point error,
and set the st floating point register tags, if the value of the number parameter is infinite.
If the st floating point register tags are not cleared, this can cause strange floating point behavior later on.
This can be avoided by checking for infinity first.

* runtime/JSCJSValueInlines.h:
(JSC::JSValue::isMachineInt): Avoid floating point error by checking for infinity first.
* runtime/Options.cpp:
(JSC::recomputeDependentOptions): Re-enable jit for Windows.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167382 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a way to cache never-changing IDL attributes in the wrapper.
<https://webkit.org/b/131759>

Some IDL attributes will always return the same value when queried
on an object, so let's have a way to avoid calling into C++ code
every time they are queried.

This patch adds a custom IDL thingy called "ReturnsCacheableValue"
which causes the code generator to emit code to cache the returned
value directly in the JS wrapper object.

Reviewed by Oliver Hunt.

* bindings/scripts/IDLAttributes.txt:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):

    Add ReturnsCacheableValue custom attribute.

* dom/Element.idl:
* dom/Node.idl:

    Annotate some attributes that return fully cacheable values.

* bindings/scripts/test/*:

    Rebaseline.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167383 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix CodeGenerator.pm to only write files if the generated content has changed
https://bugs.webkit.org/show_bug.cgi?id=131756

Reviewed by Sam Weinig.

To improve build speed, don't touch generated files unless the newly
generated content is actually different.

* bindings/scripts/CodeGenerator.pm:
(UpdateFile):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][CMAKE] build-webkit doesn't detect when the build fails
https://bugs.webkit.org/show_bug.cgi?id=130148

Reviewed by Martin Robinson.

* Source/cmake/OptionsGTK.cmake: Replace CMake's automatic make -i with make -k, which still continues after errors, but correctly reports tha the build failed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167385 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: PCE.js is 20x slower in WebKit2 because timers are throttled
https://bugs.webkit.org/show_bug.cgi?id=131189

Unreviewed rollout of r166754

This change is no longer necessary.

* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::connectToService):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167386 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Improve security mitigation added in webkit r94001.
We missed the case where attachLine was called when we already had an inline box wrapper.
https://bugs.webkit.org/show_bug.cgi?id=127285

Reviewed by Brent Fulgham.

Merged from Blink: https://src.chromium.org/viewvc/blink?revision=150697&view=revision

* rendering/RenderBox.cpp:
(WebCore::RenderBox::positionLineBox):
* rendering/RenderBox.h:
(WebCore::RenderBox::setInlineBoxWrapper):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167387 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Minor include sanity in WebPage.h
https://bugs.webkit.org/show_bug.cgi?id=131752

Reviewed by Simon Fraser.

* WebProcess/WebPage/WebPage.h:
Remove a bunch of unnecessary includes.
Un-indent some stuff.

* WebProcess/WebCoreSupport/WebEditorClient.cpp:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebPage/FindController.cpp:
* WebProcess/WebPage/WebPage.cpp:
* WebProcess/WebPage/mac/WebPageMac.mm:
Add back more specific includes, into implementation files.

* WebProcess/WebPage/WebUndoStep.cpp:
(WebKit::WebUndoStep::~WebUndoStep):
* WebProcess/WebPage/WebUndoStep.h:
Add an out-of-line destructor.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167388 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win] run-javascriptcore-tests fails to run.
https://bugs.webkit.org/show_bug.cgi?id=131761

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-04-16
Reviewed by Brent Fulgham.

* Scripts/build-jsc: For now, don't try to build bmalloc on Windows.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Failing to decode a layer tree commit message resulted in silent and mysterious failure
https://bugs.webkit.org/show_bug.cgi?id=131766
<rdar://problem/16520894>

Reviewed by Sam Weinig.

If the message decode failed, we should have already marked the message as invalid.
Failing to do so indicates in a decode code coding error.

* Platform/IPC/HandleMessage.h:
(IPC::handleMessage):
(IPC::handleMessageVariadic):
(IPC::handleMessageDelayed):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167390 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert direct caching of tagName and nodeName from r167383.

Ryosuke tells me this is not entirely safe, will need to rethink.

* dom/Element.idl:
* dom/Node.idl:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167391 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Enable system library calls in FTL for ARM64
https://bugs.webkit.org/show_bug.cgi?id=130154

Patch by Juergen Ributzka <juergen@apple.com> on 2014-04-16
Reviewed by Geoffrey Garen and Filip Pizlo.

* ftl/FTLIntrinsicRepository.h:
* ftl/FTLOutput.h:
(JSC::FTL::Output::doubleRem):
(JSC::FTL::Output::doubleSin):
(JSC::FTL::Output::doubleCos):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167392 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't build LayerTreeHost on Mac (and clean it up)
https://bugs.webkit.org/show_bug.cgi?id=131769

Reviewed by Simon Fraser.

* WebKit2.xcodeproj/project.pbxproj:
Don't include it in the project.

* WebProcess/InjectedBundle/InjectedBundle.cpp:
(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):
* WebProcess/WebPage/CoordinatedGraphics/CoordinatedDrawingArea.cpp:
(WebKit::CoordinatedDrawingArea::updatePreferences):
* WebProcess/WebPage/DrawingAreaImpl.cpp:
(WebKit::DrawingAreaImpl::updatePreferences):
* WebProcess/WebPage/LayerTreeHost.h:
(WebKit::LayerTreeHost::setLayerHostingMode): Deleted.
(WebKit::LayerTreeHost::supportsAcceleratedCompositing): Deleted.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):
* WebProcess/WebPage/ios/WebPageIOS.mm:
Get rid of LayerTreeHost::supportsAcceleratedCompositing, which always returns true everywhere.
Remove some LayerTreeHost.h includes.
Remove LayerTreeHost::setLayerHostingMode, which is PLATFORM(COCOA) and not needed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167393 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Discern between NaNs that would be safe to tag and NaNs that need some purification before tagging
https://bugs.webkit.org/show_bug.cgi?id=131420

Reviewed by Oliver Hunt.
        
Rationalizes our handling of NaNs. We now have the notion of pureNaN(), or PNaN, which
replaces QNaN and represents a "safe" NaN for our tagging purposes. NaN purification now
goes through the purifyNaN() API.
        
SpeculatedType and its clients can now distinguish between a PureNaN and an ImpureNaN.
        
Prediction propagator is made slightly more cautious when dealing with NaNs. It doesn't
have to be too cautious since most prediction-based logic only cares about whether or not
a value could be an integer.
        
AI is made much more cautious when dealing with NaNs. We don't yet introduce ImpureNaN
anywhere in the compiler, but when we do, we ought to be able to trust AI to propagate it
soundly and precisely.
        
No performance change because this just unblocks
https://bugs.webkit.org/show_bug.cgi?id=131419.

* API/JSValueRef.cpp:
(JSValueMakeNumber):
(JSValueToNumber):
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
(JSC::speculationFromValue):
(JSC::typeOfDoubleSum):
(JSC::typeOfDoubleDifference):
(JSC::typeOfDoubleProduct):
(JSC::polluteDouble):
(JSC::typeOfDoubleQuotient):
(JSC::typeOfDoubleMinMax):
(JSC::typeOfDoubleNegation):
(JSC::typeOfDoubleAbs):
(JSC::typeOfDoubleFRound):
(JSC::typeOfDoubleBinaryOp):
(JSC::typeOfDoubleUnaryOp):
* bytecode/SpeculatedType.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseCodeBlock):
* dfg/DFGCriticalEdgeBreakingPhase.cpp:
(JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
* dfg/DFGLoopPreHeaderCreationPhase.cpp:
(JSC::DFG::createPreHeader):
* dfg/DFGNode.h:
(JSC::DFG::BranchTarget::BranchTarget):
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileArrayPush):
(JSC::FTL::LowerDFGToLLVM::compileArrayPop):
(JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
(JSC::FTL::LowerDFGToLLVM::numberOrNotCellToInt32):
(JSC::FTL::LowerDFGToLLVM::allocateJSArray):
* ftl/FTLValueFormat.cpp:
(JSC::FTL::reboxAccordingToFormat):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::purifyNaN):
(JSC::AssemblyHelpers::sanitizeDouble): Deleted.
* jit/AssemblyHelpers.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitFloatTypedArrayGetByVal):
* runtime/DateConstructor.cpp:
(JSC::constructDate):
* runtime/DateInstanceCache.h:
(JSC::DateInstanceData::DateInstanceData):
(JSC::DateInstanceCache::reset):
* runtime/ExceptionHelpers.cpp:
(JSC::TerminatedExecutionError::defaultValue):
* runtime/JSArray.cpp:
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::sortVector):
(JSC::JSArray::compactForSorting):
* runtime/JSArray.h:
(JSC::JSArray::create):
(JSC::JSArray::tryCreateUninitialized):
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toNumberSlowCase):
* runtime/JSCJSValue.h:
* runtime/JSCJSValueInlines.h:
(JSC::jsNaN):
(JSC::JSValue::JSValue):
(JSC::JSValue::getPrimitiveNumber):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::parseInt):
(JSC::jsStrDecimalLiteral):
(JSC::toDouble):
(JSC::jsToNumber):
(JSC::parseFloat):
* runtime/JSObject.cpp:
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::ensureLengthSlow):
* runtime/MathObject.cpp:
(JSC::mathProtoFuncMax):
(JSC::mathProtoFuncMin):
* runtime/PureNaN.h: Added.
(JSC::pureNaN):
(JSC::isImpureNaN):
(JSC::purifyNaN):
* runtime/TypedArrayAdaptors.h:
(JSC::FloatTypedArrayAdaptor::toJSValue):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167394 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Vanish unnecessary includes from Shapes.{h|cpp}
https://bugs.webkit.org/show_bug.cgi?id=131762

Reviewed by Andreas Kling.

No new tests, no behavior change.

* rendering/shapes/BoxShape.h:
* rendering/shapes/Shape.cpp:
* rendering/shapes/Shape.h:
* rendering/shapes/ShapeOutsideInfo.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167395 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in CodeBlock::setOptimizationThresholdBasedOnCompilationResult() when the debugger activates.
<https://webkit.org/b/131747>

Reviewed by Filip Pizlo.

When the debugger is about to activate (e.g. enter stepping mode), it first
waits for all DFG compilations to complete.  However, when the DFG completes,
if compilation is successful, it will install a new DFG codeBlock.  The
CodeBlock installation process is required to register codeBlocks with the
debugger.  Debugger::registerCodeBlock() will eventually call
CodeBlock::setSteppingMode() which may jettison the DFG codeBlock that we're
trying to install.  Thereafter, chaos ensues.

This jettison'ing only happens because the debugger currently set its
m_steppingMode flag before waiting for compilation to complete.  The fix is
simply to set that flag only after compilation is complete.

* debugger/Debugger.cpp:
(JSC::Debugger::setSteppingMode):
(JSC::Debugger::registerCodeBlock):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167396 268f45cc-cd09-0410-ab3c-d52691b4dbfc