[CSS Shapes] Add test for adjusted lineTop position between left and right shape-outside floats
https://bugs.webkit.org/show_bug.cgi?id=128696

Reviewed by David Hyatt.

* fast/shapes/shape-outside-floats/shape-outside-floats-linetop-adjusted-between-left-right-floats-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-linetop-adjusted-between-left-right-floats.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165063 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crashes and assertions running iOS compositing tests
https://bugs.webkit.org/show_bug.cgi?id=129688

Reviewed by Dean Jackson.

When a layer is no longer composited, we need to unregister it
from the scrolling coordinator, and remove it from m_scrollCoordinatedLayers.

Tested by compositing tests on iOS.

* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::updateBacking):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165064 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Subpixel rendering: Make border-radius painting device pixel aware.
https://bugs.webkit.org/show_bug.cgi?id=129558

Reviewed by Simon Fraser.

Snap rounded rects to device pixels right before passing them to GraphicsContext.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::clipRoundedInnerRect):
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
(WebCore::RenderBoxModelObject::paintBorder):
* rendering/RenderBoxModelObject.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::paint):
* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::paint):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165065 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix too-narrow assertion I added in r165054.

It's okay for a 1-character string to come in here. This will happen
if the VM small string optimization doesn't apply (ch > 0xFF)

* runtime/JSString.h:
(JSC::jsStringWithWeakOwner):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165066 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Build the Udis86 disassembler
https://bugs.webkit.org/show_bug.cgi?id=129679

Reviewed by Michael Saboff.

.: 

* GNUmakefile.am: Add the Udis86_nosources variable.
* Source/cmake/OptionsGTK.cmake: Enable the Udis86 disassembler.

Source/JavaScriptCore: 

* GNUmakefile.am: Generate the Udis86-related derived sources. Distribute the required files.
* GNUmakefile.list.am: Add the Udis86 disassembler files to the build.

Source/WTF: 

* wtf/Platform.h: Also enable the Udis86 disassembler for the GTK port on Linux.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165067 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move Source/WebCore/html/track/ code to std::unique_ptr
https://bugs.webkit.org/show_bug.cgi?id=129666

Reviewed by Eric Carlson.

Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/html/track/ with std::unique_ptr.

* html/track/AudioTrack.h:
* html/track/InbandWebVTTTextTrack.cpp:
(WebCore::InbandWebVTTTextTrack::parseWebVTTCueData):
* html/track/InbandWebVTTTextTrack.h:
* html/track/LoadableTextTrack.cpp:
(WebCore::LoadableTextTrack::loadTimerFired):
(WebCore::LoadableTextTrack::newCuesAvailable):
(WebCore::LoadableTextTrack::cueLoadingCompleted):
(WebCore::LoadableTextTrack::newRegionsAvailable):
* html/track/LoadableTextTrack.h:
* html/track/TextTrack.h:
* html/track/TextTrackCue.h:
* html/track/TextTrackRegion.h:
* html/track/VTTCue.cpp:
(WebCore::VTTCue::createWebVTTNodeTree):
(WebCore::VTTCue::markFutureAndPastNodes):
* html/track/VTTCue.h:
* html/track/VideoTrack.h:
* html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::WebVTTParser):
* html/track/WebVTTParser.h:
* html/track/WebVTTTokenizer.h:
* loader/TextTrackLoader.cpp:
(WebCore::TextTrackLoader::processNewCueData):
* loader/TextTrackLoader.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165068 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: Overlay scrollbars that have grown are sometimes askew in the track
https://bugs.webkit.org/show_bug.cgi?id=129691
-and corresponding-
<rdar://problem/15666846>

Reviewed by Simon Fraser.

This regression started happening after we adopted the setPresentationValue 
ScrollbarPainter API which allows us to update the position of the scrollbar knob 
from our secondary scrolling thread. The bug occurs when the scrollbar grows while 
it still thinks it is in presentation-value mode. Whenever the scrollbar grows, it 
should be in non-presentation value mode.

If the wheel event has ended or been cancelled, we can switch out of presentation 
value mode.
* page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
(WebCore::ScrollingTreeScrollingNodeMac::handleWheelEvent):

Sometimes we will grow the scrollbar before we have received a wheel event with 
the end or cancelled phase, and so automatically switch out of presentation-value 
mode whenever we start one of these animations.
* platform/mac/ScrollAnimatorMac.mm:
(-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165069 268f45cc-cd09-0410-ab3c-d52691b4dbfc
GetMyArgumentByVal in FTL
https://bugs.webkit.org/show_bug.cgi?id=128850

Reviewed by Oliver Hunt.
        
This would have been easy if the OSR exit compiler's arity checks hadn't been wrong.
They checked arity by doing "exec->argumentCount == codeBlock->numParameters", which
caused it to think that the arity check had failed if the caller had passed more
arguments than needed. This would cause the call frame copying to sort of go into
reverse (because the amount-by-which-we-failed-arity would have opposite sign,
throwing off a bunch of math) and the stack would end up being corrupted.
        
The bug was revealed by two existing tests although as far as I could tell, neither
test was intending to cover this case directly. So, I added a new test.

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
(JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated):
(JSC::FTL::LowerDFGToLLVM::checkArgumentsNotCreated):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* ftl/FTLState.h:
* tests/stress/exit-from-ftl-when-caller-passed-extra-args-then-use-function-dot-arguments.js: Added.
* tests/stress/ftl-get-my-argument-by-val-inlined-and-not-inlined.js: Added.
* tests/stress/ftl-get-my-argument-by-val-inlined.js: Added.
* tests/stress/ftl-get-my-argument-by-val.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165072 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r164812.
http://trac.webkit.org/changeset/164812
https://bugs.webkit.org/show_bug.cgi?id=129699

it made things run slower (Requested by pizlo on #webkit).

* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
* jsc.cpp:
(GlobalObject::finishCreation):
* runtime/BatchedTransitionOptimizer.h:
(JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
(JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165073 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge API shims and JSLock
https://bugs.webkit.org/show_bug.cgi?id=129650

Reviewed by Mark Lam.

Source/JavaScriptCore: 

JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.

* API/APICallbackFunction.h:
(JSC::APICallbackFunction::call):
(JSC::APICallbackFunction::construct):
* API/APIShims.h: Removed.
* API/JSBase.cpp:
(JSEvaluateScript):
(JSCheckScriptSyntax):
(JSGarbageCollect):
(JSReportExtraMemoryCost):
(JSSynchronousGarbageCollectForDebugging):
* API/JSCallbackConstructor.cpp:
* API/JSCallbackFunction.cpp:
* API/JSCallbackObjectFunctions.h:
(JSC::JSCallbackObject<Parent>::init):
(JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
(JSC::JSCallbackObject<Parent>::put):
(JSC::JSCallbackObject<Parent>::putByIndex):
(JSC::JSCallbackObject<Parent>::deleteProperty):
(JSC::JSCallbackObject<Parent>::construct):
(JSC::JSCallbackObject<Parent>::customHasInstance):
(JSC::JSCallbackObject<Parent>::call):
(JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
(JSC::JSCallbackObject<Parent>::getStaticValue):
(JSC::JSCallbackObject<Parent>::callbackGetter):
* API/JSContext.mm:
(-[JSContext setException:]):
(-[JSContext wrapperForObjCObject:]):
(-[JSContext wrapperForJSObject:]):
* API/JSContextRef.cpp:
(JSContextGroupRelease):
(JSContextGroupSetExecutionTimeLimit):
(JSContextGroupClearExecutionTimeLimit):
(JSGlobalContextCreateInGroup):
(JSGlobalContextRetain):
(JSGlobalContextRelease):
(JSContextGetGlobalObject):
(JSContextGetGlobalContext):
(JSGlobalContextCopyName):
(JSGlobalContextSetName):
* API/JSManagedValue.mm:
(-[JSManagedValue value]):
* API/JSObjectRef.cpp:
(JSObjectMake):
(JSObjectMakeFunctionWithCallback):
(JSObjectMakeConstructor):
(JSObjectMakeFunction):
(JSObjectMakeArray):
(JSObjectMakeDate):
(JSObjectMakeError):
(JSObjectMakeRegExp):
(JSObjectGetPrototype):
(JSObjectSetPrototype):
(JSObjectHasProperty):
(JSObjectGetProperty):
(JSObjectSetProperty):
(JSObjectGetPropertyAtIndex):
(JSObjectSetPropertyAtIndex):
(JSObjectDeleteProperty):
(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):
(JSObjectIsFunction):
(JSObjectCallAsFunction):
(JSObjectCallAsConstructor):
(JSObjectCopyPropertyNames):
(JSPropertyNameArrayRelease):
(JSPropertyNameAccumulatorAddName):
* API/JSScriptRef.cpp:
* API/JSValue.mm:
(isDate):
(isArray):
(containerValueToObject):
(valueToArray):
(valueToDictionary):
(objectToValue):
* API/JSValueRef.cpp:
(JSValueGetType):
(JSValueIsUndefined):
(JSValueIsNull):
(JSValueIsBoolean):
(JSValueIsNumber):
(JSValueIsString):
(JSValueIsObject):
(JSValueIsObjectOfClass):
(JSValueIsEqual):
(JSValueIsStrictEqual):
(JSValueIsInstanceOfConstructor):
(JSValueMakeUndefined):
(JSValueMakeNull):
(JSValueMakeBoolean):
(JSValueMakeNumber):
(JSValueMakeString):
(JSValueMakeFromJSONString):
(JSValueCreateJSONString):
(JSValueToBoolean):
(JSValueToNumber):
(JSValueToStringCopy):
(JSValueToObject):
(JSValueProtect):
(JSValueUnprotect):
* API/JSVirtualMachine.mm:
(-[JSVirtualMachine addManagedReference:withOwner:]):
(-[JSVirtualMachine removeManagedReference:withOwner:]):
* API/JSWeakObjectMapRefPrivate.cpp:
* API/JSWrapperMap.mm:
(constructorHasInstance):
(makeWrapper):
(tryUnwrapObjcObject):
* API/ObjCCallbackFunction.mm:
(JSC::objCCallbackFunctionCallAsFunction):
(JSC::objCCallbackFunctionCallAsConstructor):
(objCCallbackFunctionForInvocation):
* CMakeLists.txt:
* ForwardingHeaders/JavaScriptCore/APIShims.h: Removed.
* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGWorklist.cpp:
* heap/DelayedReleaseScope.h:
(JSC::DelayedReleaseScope::~DelayedReleaseScope):
* heap/HeapTimer.cpp:
(JSC::HeapTimer::timerDidFire):
(JSC::HeapTimer::timerEvent):
* heap/IncrementalSweeper.cpp:
* inspector/InjectedScriptModule.cpp:
(Inspector::InjectedScriptModule::ensureInjected):
* jsc.cpp:
(jscmain):
* runtime/GCActivityCallback.cpp:
(JSC::DefaultGCActivityCallback::doWork):
* runtime/JSGlobalObjectDebuggable.cpp:
(JSC::JSGlobalObjectDebuggable::connect):
(JSC::JSGlobalObjectDebuggable::disconnect):
(JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
* runtime/JSLock.cpp:
(JSC::JSLock::lock):
(JSC::JSLock::didAcquireLock):
(JSC::JSLock::unlock):
(JSC::JSLock::willReleaseLock):
(JSC::JSLock::DropAllLocks::DropAllLocks):
(JSC::JSLock::DropAllLocks::~DropAllLocks):
* runtime/JSLock.h:
* testRegExp.cpp:
(realMain):

Source/WebCore: 

No new tests.

JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.

* bindings/js/DOMRequestState.h:
(WebCore::DOMRequestState::Scope::Scope):
* bindings/js/JSDOMPromise.h:
(WebCore::DeferredWrapper::resolve):
(WebCore::DeferredWrapper::reject):
(WebCore::DeferredWrapper::resolve<String>):
(WebCore::DeferredWrapper::resolve<bool>):
(WebCore::char>>):
(WebCore::DeferredWrapper::reject<String>):
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::evaluateInWorld):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::SerializedScriptValue::create):
(WebCore::SerializedScriptValue::deserialize):

Source/WebKit/mac: 

JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.

* WebView/WebFrame.mm:
(-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):

Source/WebKit2: 

JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.

* DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp:
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::~UniqueIDBDatabaseBackingStoreSQLite):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::createIndex):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165074 268f45cc-cd09-0410-ab3c-d52691b4dbfc