<rdar://problem/5974306> CanvasRenderingContext2D becomes invalid when source canvas element is collected

Reviewed by Geoff Garen.

In order to fix this we now make the rendering context and the canvas element
share the same reference count, ensuring that references to the rendering
context will force the canvas element to remain live as well.

Test: fast/canvas/canvas-longlived-context.html

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34949 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Non-AllInOne build fix.

        * kjs/interpreter.cpp: Include JSLock.h.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34948 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin.

        Disable JSLock for per-thread contexts.

        No change on SunSpider.

        * kjs/JSGlobalData.h:
        * kjs/JSGlobalData.cpp:
        (KJS::JSGlobalData::JSGlobalData):
        (KJS::JSGlobalData::sharedInstance):
        Added isSharedInstance as a better way to tell whether the instance is shared (legacy).

        * kjs/JSLock.cpp:
        (KJS::createJSLockCount):
        (KJS::JSLock::lockCount):
        (KJS::setLockCount):
        (KJS::JSLock::JSLock):
        (KJS::JSLock::lock):
        (KJS::JSLock::unlock):
        (KJS::JSLock::currentThreadIsHoldingLock):
        (KJS::JSLock::DropAllLocks::DropAllLocks):
        (KJS::JSLock::DropAllLocks::~DropAllLocks):
        * kjs/JSLock.h:
        (KJS::JSLock::JSLock):
        (KJS::JSLock::~JSLock):
        Made JSLock and JSLock::DropAllLocks constructors take a parameter to decide whether to
        actually lock a mutex, or only to increment recursion count. We cannot turn it into no-op
        if we want to keep existing assertions working.
        Made recursion count per-thread, now that locks may not lock.

        * API/JSBase.cpp:
        (JSEvaluateScript): Take JSLock after casting JSContextRef to ExecState* (which doesn't need
        locking in any case), so that a decision whether to actually lock can be made.
        (JSCheckScriptSyntax): Ditto.
        (JSGarbageCollect): Only lock while collecting the shared heap, not the per-thread one.

        * API/JSObjectRef.cpp:
        (JSClassCreate): Don't lock, as there is no reason to.
        (JSClassRetain): Ditto.
        (JSClassRelease): Ditto.
        (JSPropertyNameArrayRetain): Ditto.
        (JSPropertyNameArrayRelease): Only lock while deleting the array, as that may touch
        identifier table.
        (JSPropertyNameAccumulatorAddName): Adding a string also involves an identifier table
        lookup, and possibly modification.

        * API/JSStringRef.cpp:
        (JSStringCreateWithCharacters):
        (JSStringCreateWithUTF8CString):
        (JSStringRetain):
        (JSStringRelease):
        (JSStringGetUTF8CString):
        (JSStringIsEqual):
        * API/JSStringRefCF.cpp:
        (JSStringCreateWithCFString):
        JSStringRef operations other than releasing do not need locking.

        * VM/Machine.cpp: Don't include unused JSLock.h.

        * kjs/CollectorHeapIntrospector.cpp: (KJS::CollectorHeapIntrospector::statistics):
        Don't take the lock for real, as heap introspection pauses the process anyway. It seems that
        the existing code could cause deadlocks.

        * kjs/Shell.cpp:
        (functionGC):
        (main):
        (jscmain):
        The test tool uses a per-thread context, so no real locking is required.

        * kjs/collector.h:
        (KJS::Heap::setGCProtectNeedsLocking): Optionally protect m_protectedValues access with a
        per-heap mutex. This is only needed for WebCore Database code, which violates the "no data
        migration between threads" by using ProtectedPtr on a background thread.
        (KJS::Heap::isShared): Keep a shared flag here, as well.

        * kjs/protect.h:
        (KJS::::ProtectedPtr):
        (KJS::::~ProtectedPtr):
        (KJS::::operator):
        (KJS::operator==):
        (KJS::operator!=):
        ProtectedPtr is ony used from WebCore, so it doesn't need to take JSLock. An assertion in
        Heap::protect/unprotect guards agains possible future unlocked uses of ProtectedPtr in JSC.

        * kjs/collector.cpp:
        (KJS::Heap::Heap): Initialize m_isShared.
        (KJS::Heap::~Heap): No need to lock for real during destruction, but must keep assertions
        in sweep() working.
        (KJS::destroyRegisteredThread): Registered thread list is only accessed for shared heap,
        so locking is always needed here.
        (KJS::Heap::registerThread): Ditto.
        (KJS::Heap::markStackObjectsConservatively): Use m_isShared instead of comparing to a shared
        instance for a small speedup.
        (KJS::Heap::setGCProtectNeedsLocking): Create m_protectedValuesMutex. There is currently no
        way to undo this - and ideally, Database code will be fixed to lo longer require this quirk.
        (KJS::Heap::protect): Take m_protectedValuesMutex (if it exists) while accessing
        m_protectedValues.
        (KJS::Heap::unprotect): Ditto.
        (KJS::Heap::markProtectedObjects): Ditto.
        (KJS::Heap::protectedGlobalObjectCount): Ditto.
        (KJS::Heap::protectedObjectCount): Ditto.
        (KJS::Heap::protectedObjectTypeCounts): Ditto.

        * kjs/ustring.cpp:
        * kjs/ustring.h:
        Don't include JSLock.h, which is no longer used here. As a result, an explicit include had
        to be added to many files in JavaScriptGlue, WebCore and WebKit.

        * kjs/JSGlobalObject.cpp:
        (KJS::JSGlobalObject::init):
        * API/JSCallbackConstructor.cpp:
        (KJS::constructJSCallback):
        * API/JSCallbackFunction.cpp:
        (KJS::JSCallbackFunction::call):
        * API/JSCallbackObjectFunctions.h:
        (KJS::::init):
        (KJS::::getOwnPropertySlot):
        (KJS::::put):
        (KJS::::deleteProperty):
        (KJS::::construct):
        (KJS::::hasInstance):
        (KJS::::call):
        (KJS::::getPropertyNames):
        (KJS::::toNumber):
        (KJS::::toString):
        (KJS::::staticValueGetter):
        (KJS::::callbackGetter):
        * API/JSContextRef.cpp:
        (JSGlobalContextCreate):
        (JSGlobalContextRetain):
        (JSGlobalContextRelease):
        * API/JSValueRef.cpp:
        (JSValueIsEqual):
        (JSValueIsStrictEqual):
        (JSValueIsInstanceOfConstructor):
        (JSValueMakeNumber):
        (JSValueMakeString):
        (JSValueToNumber):
        (JSValueToStringCopy):
        (JSValueToObject):
        (JSValueProtect):
        (JSValueUnprotect):
        * JavaScriptCore.exp:
        * kjs/PropertyNameArray.h:
        (KJS::PropertyNameArray::globalData):
        * kjs/interpreter.cpp:
        (KJS::Interpreter::checkSyntax):
        (KJS::Interpreter::evaluate):
        Pass a parameter to JSLock/JSLock::DropAllLocks to decide whether the lock needs to be taken.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34947 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin.

        https://bugs.webkit.org/show_bug.cgi?id=19834
        Failed assertion in JavaScriptCore/VM/SegmentedVector.h:82

        Creating a global object with a custom prototype resets it twice (wasteful!).
        So, addStaticGlobals() was called twice, but JSGlobalObject::reset() didn't reset
        the register array.

        * kjs/JSGlobalObject.cpp: (KJS::JSGlobalObject::reset): Call setRegisterArray(0, 0).

        * kjs/JSVariableObject.h: Changed registerArray to OwnArrayPtr. Also, added private copy
        constructor and operator= to ensure that no one attempts to copy this object (for whatever
        reason, I couldn't make Noncopyable work).

        * kjs/JSGlobalObject.h: (KJS::JSGlobalObject::addStaticGlobals): Allocate registerArray
        with new[].

        * kjs/JSVariableObject.cpp:
        (KJS::JSVariableObject::copyRegisterArray): Allocate registerArray with new[].
        (KJS::JSVariableObject::setRegisterArray): Avoid hitting an assertion in OwnArrayPtr when
        "changing" the value from 0 to 0.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34946 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Removed and/or reordered exception checks in array-style a[n] access.

        SunSpider says 1.4% faster.

        * VM/Machine.cpp:
        (KJS::Machine::privateExecute): No need to check for exceptions before
        calling toString, toNumber and/or get. If the call ends up being observable
        through toString, valueOf, or a getter, we short-circuit it there, instead.
        In the op_del_by_val case, I removed the incorrect comment without actually
        removing the code, since I didn't want to tempt the GCC fates!

        * kjs/JSObject.cpp:
        (KJS::callDefaultValueFunction): Added exception check to prevent
        toString and valueOf functions from observing execution after an exception
        has been thrown. This removes some of the burden of exception checking
        from the machine.

        (KJS::JSObject::defaultValue): Removed redundant exception check here.

        * kjs/PropertySlot.cpp:
        (KJS::PropertySlot::functionGetter): Added exception check to prevent
        getter functions from observing execution after an exception has been
        thrown. This removes some of the burden of exception checking from the
        machine.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34945 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Oliver Hunt.

        - fix a CSSParserValueList leak seen on the build bot

        * css/CSSParser.cpp:
        (WebCore::BorderImageParseContext::commitBorderImage):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34944 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Optimized a[n] get and put for cases where n is an immediate unsigned
        value.

        SunSpider says 3.5% faster.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34943 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Alex Mathews  <possessedpenguinbob@gmail.com>

Reviewed by Oliver Hunt.

Prep for more Filter class name changes. Added the first few files for
the new Filter architecture to come.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34942 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update the path to the configuration file.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34941 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Darin.

        Bug 19844: JavaScript Switch statement modifies "this"
        <https://bugs.webkit.org/show_bug.cgi?id=19844>

        Use a temporary when generating code for switch clauses to avoid
        overwriting 'this' or a local variable.

        JavaScriptCore:

        * kjs/nodes.cpp:
        (KJS::CaseBlockNode::emitCodeForBlock):

        LayoutTests:

        * fast/js/codegen-temporaries-expected.txt:
        * fast/js/resources/codegen-temporaries.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34940 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Bump version numbers.

        Reviewed by Mark Rowe.

        * win/tools/scripts/PRODUCTVERSION:
        * win/tools/scripts/VERSION:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34939 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Gtk+ build fix.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34938 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-07-01  Kevin McCullough  <kmccullough@apple.com>

        Build fix.

        * JavaScriptCore.xcodeproj/project.pbxproj:

WebKit/mac:

2008-07-01  Kevin McCullough  <kmccullough@apple.com>

        Build fix.

        * WebView/WebView.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34937 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-07-01  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin.

        Add PluginMainThreadScheduler.{cpp|h} to build.

        * WebCore.base.exp:
        * WebCore.xcodeproj/project.pbxproj:
        * plugins/PluginMainThreadScheduler.cpp:

WebKit/mac:

2008-07-01  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin.

        Use the PluginMainThreadScheduler, and implement NPN_PluginThreadAsyncCall.

        * Plugins/WebBaseNetscapePluginView.mm:
        (-[WebBaseNetscapePluginView _createPlugin]):
        Register the plug-in instance.

        (-[WebBaseNetscapePluginView _destroyPlugin]):
        Unegister the plug-in instance.

        * Plugins/WebNetscapePluginPackage.m:
        (-[WebNetscapePluginPackage load]):
        Set NPN_PluginThreadAsyncCall.

        * Plugins/npapi.mm:
        (NPN_PluginThreadAsyncCall):
        Implement this.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34936 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

        Reviewed by Darin Adler.

        - move the method to set the base writing direction from Frame to Editor

        * WebCore.base.exp: Updated.
        * editing/Editor.cpp:
        (WebCore::Editor::setBaseWritingDirection): Changed the parameter to a
        WritingDirection enum value and added the special behavior when the
        focused node is a text field or a text area.
        * editing/Editor.h:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected): Changed back
        to call the Editor method.
        * page/Frame.cpp: Removed setSelectionBaseWritingDirection().
        * page/Frame.h:

WebKit/mac:

        Reviewed by Darin Adler.

        - WebKit part of moving the method to set the base writing direction from Frame to Editor

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView toggleBaseWritingDirection:]): Changed back to call the
        Editor method.
        (-[WebHTMLView changeBaseWritingDirection:]): Ditto.
        (-[WebHTMLView _changeBaseWritingDirectionTo:]): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34935 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Darin Adler  <darin@apple.com>

        Reviewed by Oliver.

        - slight tweak of the setHash fix

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::setHash): Use oldRef instead of recomputing url.ref().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34934 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

        Reviewed by Anders Carlsson.

        - Mac release build fix

        * JavaScriptCore.exp:

WebCore:

        Reviewed by Anders Carlsson.

        - Mac release build fix

        * page/Console.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34933 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Anders Carlsson.

        - fix <rdar://problem/6045896> REGRESSION: Leak in WebCore::StringImpl::create

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::cleanup):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34932 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Sam Weinig  <sam@webkit.org>

        Try and fix mac builds.

        * JavaScriptCore.exp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34931 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Anders Carlsson  <andersca@apple.com>

        Reviewed by Jon.

        Don't add the Mozilla user agent quirk for Flash 10.

        * plugins/win/PluginPackageWin.cpp:
        (WebCore::PluginPackage::isPluginBlacklisted):
        (WebCore::PluginPackage::determineQuirks):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34930 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Move data: URL parsing code in HTMLObjectElement to KURL

        Reviewed by Ada and Darin.

        No test cases added since there is no change in behavior.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::isImageType): Extracted data: URL
        parsing code into WebCore::mimeTypeFromDataURL() in KURL.cpp.
        * platform/KURL.cpp:
        (WebCore::mimeTypeFromDataURL): Added.
        * platform/KURL.h:
        (WebCore::mimeTypeFromDataURL): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34929 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Dave Hyatt.

        - fix <rdar://problem/6045890> REGRESSION: Leak in WebCore::CSSParser::createFloatingValueList()

        * css/CSSParser.cpp:
        (WebCore::CSSParser::addUnresolvedProperty):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34928 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Brady Eidson.

        Bug 19822: REGRESSION (r30243): setting location.hash to "#" causes a reload
        <https://bugs.webkit.org/show_bug.cgi?id=19822>

        Change JSLocation::setHash() to not schedule navigation in the case
        where the old fragment is the null String and the new fragment is an
        empty String.

        WebCore:

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::setHash):

        LayoutTests:

        * http/tests/loading/location-hash-reload-cycle-expected.txt: Added.
        * http/tests/loading/location-hash-reload-cycle.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34927 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Anders Carlsson  <andersca@apple.com>

        Reviewed by Adam.

        Add PluginMainThreadScheduler, a singleton which is responsible for scheduling plug-in
        callbacks on the main thread. Use this to implement NPN_PluginThreadAsyncCall on Windows.

        * WebCore.vcproj/WebCore.vcproj:
        Add PluginMainThreadScheduler.{cpp|h}

        * plugins/PluginMainThreadScheduler.cpp: Added.
        * plugins/PluginMainThreadScheduler.h: Added.

        * plugins/PluginView.cpp:
        (WebCore::PluginView::start):
        Register with the thread scheduler.

        * plugins/npapi.cpp:
        (NPN_PluginThreadAsyncCall):
        Call the thread scheduler.

        * plugins/win/PluginPackageWin.cpp:
        (WebCore::PluginPackage::load):
        Initialize the NPN_PluginThreadAsyncCall callback.

        * plugins/win/PluginViewWin.cpp:
        (WebCore::PluginView::stop):
        Unregister with the scheduler. This makes sure that we won't try to deliver callbacks
        after the plug-in has been destroyed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34926 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Roll out r34913, as it broke the Windows build due to bad casting

WebCore:

        Roll out r34913, as it broke the Windows build due to bad casting

        r34913 introduced code that assigned pointers-to-member from a derived
        class into a base class pointer-to-member type (e.g., assigned a void
        (SVGUseElement::*)() into a void (SVGElement::*)()). This is bad
        because it could allow us to call SVGUseElement member functions on a
        different SVGElement-derived class. MSVC rightly flagged this as an
        error.

        Rubberstamped by Anders Carlsson.

LayoutTests:

        Roll out r34913, as it broke the Windows build due to bad casting

        Rubberstamped by Anders Carlsson.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Darin Adler  <darin@apple.com>

        - fix build

        * bindings/scripts/CodeGeneratorJS.pm: Fix warnings that indicate this was
        not working propertly.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin Adler.

        - fix <rdar://problem/6045893> REGRESSION: Leak in WebCore::HTMLCanvasElement::createPlatformImage() const

        * html/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::createPattern):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34923 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Sam Weinig  <sam@webkit.org>

        Fix non-AllInOne builds.

        * kjs/DateMath.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-07-01  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin Adler.

        Split JSCell and JSNumberCell class declarations out of JSValue.h

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * VM/JSPropertyNameIterator.h:
        * kjs/AllInOneFile.cpp:
        * kjs/JSCell.cpp: Copied from JavaScriptCore/kjs/JSValue.cpp.
        * kjs/JSCell.h: Copied from JavaScriptCore/kjs/JSValue.h.
        (KJS::JSValue::getJSNumber):
        * kjs/JSNumberCell.cpp:
        * kjs/JSNumberCell.h: Copied from JavaScriptCore/kjs/JSValue.h.
        * kjs/JSObject.h:
        * kjs/JSString.cpp:
        (KJS::jsString):
        (KJS::jsOwnedString):
        * kjs/JSString.h:
        (KJS::JSValue::toThisJSString):
        * kjs/JSValue.cpp:
        * kjs/JSValue.h:

WebCore:

2008-07-01  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin Adler.

        Split JSCell and JSNumberCell class declarations out of JSValue.h

        * ForwardingHeaders/kjs/JSNumberCell.h: Added.
        * bindings/scripts/CodeGeneratorJS.pm:
        * bridge/c/c_instance.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34921 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/6041580> REGRESSION: AX: AXSize of radio buttons is 0,0

Fixed incorrect AXSize of radio buttons and checkboxes when they don't have labels

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34920 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Anders Carlsson  <andersca@apple.com>

        Build fixes.

        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * kjs/JSGlobalObject.h:
        (KJS::JSGlobalObject::addStaticGlobals):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Antti Koivisto.

        - fix SVG pointer-events layout test failures

        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGValue):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34918 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Tor Arne Vestbø  <tavestbo@trolltech.com>

        Reviewed by Simon.

        Don't show the tooltip instantly in the QtLauncher.

        Let the QWebView handle tooltips by itself, so we get
        the expected delay as everywhere else.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34917 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Antti.

Fixes: https://bugs.webkit.org/show_bug.cgi?id=19841
Fix two small problems in the gradient & pattern code.

Added 12 new layout tests: svg/dynamic-updates/SVGLinearGradientElement*.html

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34916 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Simon Hausmann  <hausmann@webkit.org>

        Fix the build, include SVGTransformList.h instead of
        SVGTransformlist.h

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34915 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Antti.

        <rdar://problem/6033080> REGRESSION: Some CH characters display as garbage on webpage for
        the first time.

        Test: fast/encoding/preload-encoding.html

        * html/PreloadScanner.cpp:
        (WebCore::PreloadScanner::tokenize): Reset charset when entering a tag, not just when
        starting a load.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34914 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Antti & Eric.

Fixes: http://bugs.webkit.org/show_bug.cgi?id=17779 (SVG 1.1 Errata demands "SVG JavaScript Liveness" support)

SVG Errata states: "All SVG DOM objects that directly correspond to an
attribute, e.g. the SVGAnimatedLength 'ry' in an SVGRectElement, are live. This
means that any changes made to the attribute are immediately reflected in the
corresponding SVG DOM object." (see linked URL on bug report)

Until now only XML -> SVG DOM changes took affect, aka. changing the 'rx' attribute of a <rect>
element resuted in changes when accessing 'rx' through SVG DOM (rx.baseVal.value).

Add a new synchronization layer to handle SVG DOM -> XML changes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Class name changes for SVG Light Effect files.

Reviewed by Nikolas Zimmermann.

The class names that changed :

SVGLightSource -> LightSource
SVGDistantLightSource -> DistantLightSource
SVGPointLightSource -> PointLightSource
SVGSpotLightSource -> SpotLightSource

Every other file that is changed is just propagating the class name changes to
dependent files.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34912 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Alp Toker  <alp@nuanti.com>

        Rubber-stamped by Holger.

        autotools cleanup: move some GTK+-specific sources from libwebcore to
        libwebcoregtk.

        * GNUmakefile.am:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Oliver Hunt.

        - fix the non-SVG build

        * css/CSSValueKeywords.in: Added 'all'.
        * css/SVGCSSValueKeywords.in: Removed 'all'.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34910 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-07-01  Geoffrey Garen  <ggaren@apple.com>

        Build fix: forgot to check in this file.

        * WebView/WebScriptDebugger.mm:
        (WebScriptDebugger::WebScriptDebugger):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34909 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fixes, include OwnPtr.h and DateInstance.h

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34908 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Fixed a global object leak caused by the switch to one register file.

        Don't unconditionally mark the register file, since that logically
        makes all global variables GC roots, even when their global object is
        no longer reachable.

        Instead, make the global object associated with the register file
        responsible for marking the register file.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34907 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Removed the "registerBase" abstraction. Since the register file never
        reallocates, we can keep direct pointers into it, instead of
        <registerBase, offset> tuples.

        SunSpider says 0.8% faster.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34906 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-06-30  Adele Peterson  <adele@apple.com>

        Reviewed by Oliver.

        Fix for <rdar://problem/5882050> clicking in hidden close box area of empty searchfield causes mousedown to stop firing

        Test: fast/forms/search-hidden-cancel-button.html

        * html/HTMLTextFieldInnerElement.cpp: (WebCore::HTMLSearchFieldCancelButtonElement::defaultEventHandler):
          Don't start capturing mouse events if the cancel button isn't visible.  This was causing the button to start but never stop capturing mouse events.

LayoutTests:

2008-06-30  Adele Peterson  <adele@apple.com>

        Reviewed by Oliver.

        Test for <rdar://problem/5882050> clicking in hidden close box area of empty searchfield causes mousedown to stop firing

        * fast/forms/search-hidden-cancel-button-expected.txt: Added.
        * fast/forms/search-hidden-cancel-button.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34905 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix build by adding all (hopefully) the missing includes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34904 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Oliver.

        Bug 19830: REGRESSION (r34883): Google Reader doesn't show up feed list on sidebar
        <https://bugs.webkit.org/show_bug.cgi?id=19830>

        Ensure that we do not eliminate a write to a local register when doing
        peephole optimizations.

        JavaScriptCore:

        * VM/CodeGenerator.cpp:
        (KJS::CodeGenerator::emitJumpIfTrue):
        (KJS::CodeGenerator::emitJumpIfFalse):

        LayoutTests:

        * fast/js/codegen-peephole-locals-expected.txt: Added.
        * fast/js/codegen-peephole-locals.html: Added.
        * fast/js/resources/codegen-peephole-locals.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34903 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fixing * placement

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34902 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-06-30  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Alder.

        Split InternalFunction into its own header file.

        * API/JSCallbackFunction.h:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * kjs/ArrayConstructor.h:
        * kjs/BooleanConstructor.h:
        * kjs/DateConstructor.h:
        * kjs/ErrorConstructor.h:
        * kjs/FunctionConstructor.h:
        * kjs/FunctionPrototype.h:
        * kjs/InternalFunction.h: Copied from kjs/JSFunction.h.
        * kjs/JSFunction.h:
        * kjs/NativeErrorConstructor.h:
        * kjs/NumberConstructor.h:
        * kjs/ObjectConstructor.h:
        * kjs/RegExpConstructor.h:
        * kjs/StringConstructor.h:
        * profiler/Profiler.cpp:

WebCore:

2008-06-30  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Split InternalFunction into its own header file.

        * ForwardingHeaders/kjs/InternalFunction.h: Added.
        * bridge/runtime_method.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34901 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-06-30  Adele Peterson  <adele@apple.com>

        Reviewed by Anders.

        Fix for <rdar://problem/5301322> REGRESSION: Select All selects the whole page when used in readonly textareas

        Test: editing/selection/select-all-textarea.html

        * dom/Node.cpp:
        (WebCore::Node::shadowAncestorNode): Break out code to find the root of the shadow tree into a new helper function.
        (WebCore::Node::shadowTreeRootNode): Added helper function.
        * dom/Node.h:
        * dom/Range.cpp: (WebCore::Range::shadowTreeRootNode): Added helper function.
        * dom/Range.h:
        * editing/Selection.cpp: (WebCore::Selection::shadowTreeRootNode): ditto.
        * editing/Selection.h:
        * editing/SelectionController.h: (WebCore::SelectionController::shadowTreeRootNode): ditto.
        * editing/SelectionController.cpp: (WebCore::SelectionController::selectAll):
        If the selection is in a shadow tree, only select the contents of that shadow tree, not the whole document.
        * page/Frame.cpp:
        (WebCore::Frame::findString): Use the new shadowTreeRootNode helper functions.
        (WebCore::Frame::markAllMatchesForText): ditto.

LayoutTests:

2008-06-30  Adele Peterson  <adele@apple.com>

        Reviewed by Anders.

        Test for <rdar://problem/5301322> REGRESSION: Select All selects the whole page when used in readonly textareas

        * editing/selection/select-all-textarea-expected.txt: Added.
        * editing/selection/select-all-textarea.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34900 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/4180780> Add attribute to get all the radio buttons in a set

Adds ability for radio buttons to return an array of the other radio buttons in its radio group.
Updates DumpRenderTree to support the linked ui elements attribute

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34899 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Sam Weinig  <sam@webkit.org>

        Reviewed by Kevin McCullough.

        Remove empty files Instruction.cpp, LabelID.cpp, Register.cpp and RegisterID.cpp.

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * VM/Instruction.cpp: Removed.
        * VM/LabelID.cpp: Removed.
        * VM/Register.cpp: Removed.
        * VM/RegisterID.cpp: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34898 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Sam Weinig  <sam@webkit.org>

        Rubber-stamped (reluctantly) by Kevin McCullough.

        Rename date_object.h/cpp to DateInstance.h/cpp

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        * kjs/DateConstructor.cpp:
        * kjs/DateInstance.cpp: Copied from kjs/date_object.cpp.
        * kjs/DateInstance.h: Copied from kjs/date_object.h.
        * kjs/DatePrototype.cpp:
        * kjs/DatePrototype.h:
        * kjs/date_object.cpp: Removed.
        * kjs/date_object.h: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34897 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

        Reviewed by Adele Peterson.

        - WebCore part of <rdar://problem/3881497> Writing direction context menu item has no effect on text typed in Safari

        * WebCore.base.exp: Removed Editor::setBaseWritingDirection() and added
        Frame::setSelectionBaseWritingDirection().
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected): Changed to
        call Frame::setSelectionBaseWritingDirection().
        * page/Frame.cpp:
        (WebCore::Frame::setSelectionBaseWritingDirection): Added. If the
        focused node is a text field or text area, changes its 'dir' attribute.
        This is what IE does when the user changes the writing direction in a
        text control. Otherwise, calls down to Editor::setBaseWritingDirection().
        * page/Frame.h:

WebKit/mac:

        Reviewed by Adele Peterson.

        - WebKit/mac part of <rdar://problem/3881497> Writing direction context menu item has no effect on text typed in Safari

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView toggleBaseWritingDirection:]): Changed to call
        WebCore::Frame::setSelectionBaseWritingDirection() instead of
        WebCore::Editor::setBaseWritingDirection().
        (-[WebHTMLView changeBaseWritingDirection:]): Ditto.
        (-[WebHTMLView _changeBaseWritingDirectionTo:]): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34896 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Improve HTMLObjectElement data encapsulation

        Reviewed by Dave Hyatt.

        HTMLObjectElement has some public member variables that should be
        private with accessor methods.

        No test cases added since there is no change in behavior.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::HTMLObjectElement): Reorder
        initialization of member variables to match defined order in header.
        * html/HTMLObjectElement.h:
        (WebCore::HTMLObjectElement::classId): Added.
        (WebCore::HTMLObjectElement::url): Added.
        (WebCore::HTMLObjectElement::serviceType): Added.
        * rendering/RenderPartObject.cpp:
        (WebCore::RenderPartObject::updateWidget): Use new accessor methods
        in HTMLObjectElement now that its member variables are private.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Anders Carlsson.

        - remove unused member variable

        * page/Page.h: Removed Page::m_focusedNode.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34894 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Remove internal.cpp and move its contents to there own .cpp files.

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        * kjs/GetterSetter.cpp: Copied from kjs/internal.cpp.
        * kjs/InternalFunction.cpp: Copied from kjs/internal.cpp.
        * kjs/JSNumberCell.cpp: Copied from kjs/internal.cpp.
        * kjs/JSString.cpp: Copied from kjs/internal.cpp.
        * kjs/JSString.h:
        * kjs/LabelStack.cpp: Copied from kjs/internal.cpp.
        * kjs/NumberConstructor.cpp:
        * kjs/NumberObject.cpp:
        (KJS::constructNumber):
        (KJS::constructNumberFromImmediateNumber):
        * kjs/internal.cpp: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34893 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Anders Carlsson  <andersca@apple.com>

        Reviewed by Adam.

        <rdar://problem/6014209>
        Crash when loading manifest from application cache fails

        There is no need to set any handles to 0 after calling cacheUpdateFailed(), since
        that is done inside the function. Furthermore, after calling cacheUpdateFailed() the cache
        group could be deleted causing us to access freed memory and then crashing.

        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didReceiveResponse):
        (WebCore::ApplicationCacheGroup::didFail):
        (WebCore::ApplicationCacheGroup::didFailToLoadManifest):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34892 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix <rdar://5954749> Assertion failure due to HashTable's use of operator&

JavaScriptCore:

        Fix <rdar://5954749> Assertion failure due to HashTable's use of
        operator&

        HashTable was passing &value to constructDeletedValue, which in
        classes like WebCore::COMPtr would cause an assertion. We now pass
        value by reference instead of by address so that the HashTraits
        implementations have more flexibility in constructing the deleted
        value.

        Reviewed by Ada Chan.

        * VM/CodeGenerator.h: Updated for changes to HashTraits.
        * wtf/HashTable.h:
        (WTF::::deleteBucket): Changed to pass bucket by reference instead of
        by address.
        (WTF::::checkKey): Ditto.
        * wtf/HashTraits.h:
        (WTF::): Updated HashTraits for HashTable change.

WebCore:

        Fix <rdar://5954749> Assertion failure due to HashTable's use of
        operator&

        Reviewed by Ada Chan.

        * bindings/js/JSSVGPODTypeWrapper.h:
        * dom/Document.h:
        * dom/StyledElement.cpp:
        * platform/graphics/FontCache.cpp:
        * platform/graphics/IntSizeHash.h:
        (WTF::):
        * platform/text/StringHash.h:
        * platform/win/COMPtr.h:
        * svg/SVGAnimatedTemplate.h:
        Updated all custom HashTraits for HashTable changes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34891 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34890 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Simon Hausmann  <hausmann@webkit.org>

        Rubber-stamped by Niko.

        Removed the obsolete and unmaintained WebKitPart. The integration of
        QtWebKit into KDE is now done in the webkitkde component inside KDE.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34888 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Antti.

Fix all existing tests in svg/dynamic-updates to actually reflect repainting changes, by
removing the timing dependency. Instead model them like frame-getSVGDocument.html by
not including the <script src="js-test-post.js"> element within the TEMPLATE.html but
by dynamically injecting it, if the test actually finished.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34887 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Cameron Zwarich.

        Make RegisterFile really unmap memory on destruction.

        This fixes run-webkit-tests --threaded, which ran out of address space in a few seconds.

        * VM/RegisterFile.cpp: (KJS::RegisterFile::~RegisterFile): Unmap all the memory, not just
        1/4 of it.

        * kjs/JSGlobalObject.h: Don't include RegisterFile.h, so that changes to it don't make
        half of WebCore rebuild.

        * VM/Machine.h: Don't forward declare RegisterFile, as RegisterFile.h is included already.

        * VM/RegisterFile.h: (KJS::RegisterFile::RegisterFile): Assert that the allocation succeeded.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34886 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Rubber-stamped by Oliver.

        Correct the documentation for op_put_by_index.

        * VM/Machine.cpp:
        (KJS::Machine::privateExecute):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34885 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-30  Simon Hausmann  <hausmann@webkit.org>

        Fix the Qt build.

        Added missing includes and changed getItem array calls to use get()
        instead.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34884 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Oliver.

        Bug 19821: Merge the instruction pair (less, jfalse)
        <https://bugs.webkit.org/show_bug.cgi?id=19821>

        This is a 2.4% win on SunSpider. I needed to add an ALWAYS_INLINE
        intrinisc to CodeGenerator::rewindBinaryOp() to avoid a massive
        regression in regexp-dna.

        * VM/CodeBlock.cpp:
        (KJS::CodeBlock::dump):
        * VM/CodeGenerator.cpp:
        (KJS::CodeGenerator::rewindBinaryOp):
        (KJS::CodeGenerator::emitJumpIfFalse):
        * VM/Machine.cpp:
        (KJS::Machine::privateExecute):
        * VM/Opcode.cpp:
        (KJS::):
        * VM/Opcode.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34883 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  David Smith  <catfish.man@gmail.com>

        Rubberstamped by Sam Weinig.

        Change a redundant node->isElement() check to an ASSERT for a 1.3% speedup on getElementsByTagName.

        * dom/TagNodeList.cpp:
        (WebCore::TagNodeList::nodeMatches):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34882 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin Adler.

        - fix SVG layout test regressions

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Made this function work
        again with primitive values, because the @font-face rules SVG fonts
        create still use a single primitive value rather than a value list.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Dan Bernstein  <mitz@apple.com>

        - add a missing file from the last check-in

        * fast/css/resources/font-face-descriptor-multiple-values-parsing.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

        Reviewed by Sam Weinig.

        - fix <rdar://problem/5734440> Specifying a font-weight for @font-face not working

        Tests: fast/css/font-face-descriptor-multiple-values-parsing.html
               fast/css/font-face-descriptor-multiple-values.html

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Changed to work with value
        lists for the descriptor properties.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::CSSParser): Initialize m_hasFontFaceOnlyValues.
        (WebCore::CSSParser::parseValue): Added a call to
        deleteFontFaceOnlyValues() if necessary.
        (WebCore::CSSParser::parseDeclaration): Ditto.
        (WebCore::CSSParser::clearProperties): Added code to reset
        m_hasFontFaceOnlyValues to false.
        (WebCore::CSSParser::parseFontStyle): Added. If there is a single
        valid identifier other than 'all', creates a CSSPrimitiveValue and
        assigns it to the property. If 'all' is the only value, or if there are
        multiple valid identifiers that are not 'all', creates a CSSValueList
        and assigns it to the property, and sets m_hasFontFaceOnlyValues to
        true.
        (WebCore::CSSParser::parseFontVariant): Ditto.
        (WebCore::CSSParser::parseFontWeight): Ditto.
        (WebCore::CSSParser::createStyleRule): Added a call to
        deleteFontFaceOnlyValues().
        (WebCore::CSSParser::createFontFaceRule): Added code to change
        font descriptor properties that had only one value, and therefore were
        assigned a CSSPrimitiveValue, into CSSValueLists containing that value.
        (WebCore::CSSParser::deleteFontFaceOnlyValues): Added. Retroactively
        invalidates font descriptor properties that had values that are only
        allowed in @font-face. Those are identified by having CSSValueLists
        rather than CSSPrimitiveValues as their values.
        * css/CSSParser.h: Added m_hasFontFaceOnlyValues, a flag that says that
        font descriptor property values that are only valid in @font-face were
        encountered. This is used when the style declaration is created (and we
        finally know if it is @font-face or not) to delete invalid properties
        if needed.

LayoutTests:

        Reviewed by Sam Weinig.

        - tests for <rdar://problem/5734440> Specifying a font-weight for @font-face not working

        * fast/css/font-face-descriptor-multiple-values-parsing-expected.txt: Added.
        * fast/css/font-face-descriptor-multiple-values-parsing.html: Added.
        * fast/css/font-face-descriptor-multiple-values.html: Added.
        * platform/mac/fast/css/font-face-descriptor-multiple-values-expected.checksum: Added.
        * platform/mac/fast/css/font-face-descriptor-multiple-values-expected.png: Added.
        * platform/mac/fast/css/font-face-descriptor-multiple-values-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34879 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Fix non-AllInOne builds.

        * kjs/JSObject.cpp:
        * kjs/JSValue.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34878 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Build fix for Qt.

        * kjs/DateMath.cpp:
        * kjs/DatePrototype.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34877 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Cameron Zwarich.

        Splits ErrorConstructor, ErrorPrototype,  NativeErrorConstructor and
        NativeErrorPrototype out of error_object.h/cpp and renames it ErrorInstance.

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        * kjs/ArrayConstructor.cpp:
        * kjs/ArrayPrototype.cpp:
        * kjs/BooleanPrototype.cpp:
        * kjs/DatePrototype.cpp:
        * kjs/ErrorConstructor.cpp: Copied from kjs/error_object.cpp.
        * kjs/ErrorConstructor.h: Copied from kjs/error_object.h.
        * kjs/ErrorInstance.cpp: Copied from kjs/error_object.cpp.
        * kjs/ErrorInstance.h: Copied from kjs/error_object.h.
        * kjs/ErrorPrototype.cpp: Copied from kjs/error_object.cpp.
        * kjs/ErrorPrototype.h: Copied from kjs/error_object.h.
        * kjs/JSGlobalObject.cpp:
        * kjs/JSObject.cpp:
        * kjs/JSValue.cpp:
        * kjs/NativeErrorConstructor.cpp: Copied from kjs/error_object.cpp.
        * kjs/NativeErrorConstructor.h: Copied from kjs/error_object.h.
        * kjs/NativeErrorPrototype.cpp: Copied from kjs/error_object.cpp.
        * kjs/NativeErrorPrototype.h: Copied from kjs/error_object.h.
        * kjs/NumberPrototype.cpp:
        * kjs/RegExpConstructor.cpp:
        * kjs/RegExpObject.cpp:
        * kjs/RegExpPrototype.cpp:
        * kjs/StringPrototype.cpp:
        * kjs/error_object.cpp: Removed.
        * kjs/error_object.h: Removed.
        * kjs/internal.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34876 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Fix Tiger build.

        * DumpRenderTree/mac/EventSendingController.mm:
        (eventTypeForMouseButtonAndAction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34874 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Fix non-AllInOne build.

        * kjs/DateConstructor.cpp:
        * kjs/DateMath.cpp:
        * kjs/JSObject.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Oliver Hunt.

        Splits DateConstructor and DatePrototype out of date_object.h/cpp
        Moves shared Date code into DateMath.

        * DerivedSources.make:
        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        * kjs/DateConstructor.cpp: Copied from kjs/date_object.cpp.
        * kjs/DateConstructor.h: Copied from kjs/date_object.h.
        * kjs/DateMath.cpp:
        (KJS::ymdhmsToSeconds):
        (KJS::):
        (KJS::skipSpacesAndComments):
        (KJS::findMonth):
        (KJS::parseDate):
        (KJS::timeClip):
        (KJS::formatDate):
        (KJS::formatDateUTCVariant):
        (KJS::formatTime):
        * kjs/DateMath.h:
        (KJS::gmtoffset):
        * kjs/DatePrototype.cpp: Copied from kjs/date_object.cpp.
        * kjs/DatePrototype.h: Copied from kjs/date_object.h.
        * kjs/JSGlobalObject.cpp:
        * kjs/JSObject.cpp:
        * kjs/date_object.cpp:
        * kjs/date_object.h:
        * kjs/internal.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34872 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by darin.

        Add multi-button mouseevent support to DRT
        https://bugs.webkit.org/show_bug.cgi?id=15173

        It's now possible to specify the mouse button with:
        eventSender.mouseDown(1); eventSender.mouseUp(1); etc.

        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
        * DumpRenderTree/mac/EventSendingController.h:
        * DumpRenderTree/mac/EventSendingController.mm:
        (+[EventSendingController isSelectorExcludedFromWebScript:]):
        (+[EventSendingController webScriptNameForSelector:]):
        (eventTypeForMouseButtonAndAction):
        (-[EventSendingController updateClickCountForButton:]):
        (-[EventSendingController mouseDown:]):
        (-[EventSendingController mouseUp:]):
        (-[EventSendingController mouseMoveToX:Y:]):
        (-[EventSendingController contextClick]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34871 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-29  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Rubber-stamped by Cameron Zwarich

        Fix Gtk non-AllInOne build

        * GNUmakefile.am: include JSVariableObject.cpp
        * kjs/RegExpConstructor.cpp: include RegExpObject.h
        * kjs/RegExpObject.h: forward declare RegExpPrototype

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34870 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        - fix build

        * WebView/WebView.mm:
        (aeDescFromJSValue): Use get instead of getItem, which no longer exists.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34869 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Sam and Cameron.

        - fix https://bugs.webkit.org/show_bug.cgi?id=19805
          Array.concat turns missing array elements into "undefined"

        Test: fast/js/array-holes.html

        * JavaScriptCore.exp: No longer export JSArray::getItem.

        * kjs/ArrayPrototype.cpp:
        (KJS::arrayProtoFuncConcat): Changed to use getProperty instead of
        JSArray::getItem -- need to handle properties from the prototype chain
        instead of ignoring them.

        * kjs/JSArray.cpp: Removed getItem.
        * kjs/JSArray.h: Ditto.

WebCore:

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Sam and Cameron.

        - fix https://bugs.webkit.org/show_bug.cgi?id=19805
          Array.concat turns missing array elements into "undefined"

        * bridge/jni/jni_utility.cpp:
        (KJS::Bindings::convertArrayInstanceToJavaArray):
        Use get instead of getItem, since we always want to consider values from the
        prototypes when looking at JavaScript arrays.

LayoutTests:

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Sam and Cameron.

        - test for https://bugs.webkit.org/show_bug.cgi?id=19805
          Array.concat turns missing array elements into "undefined"

        * fast/js/array-holes-expected.txt: Added.
        * fast/js/array-holes.html: Added.
        * fast/js/resources/array-holes.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34868 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Cameron.

        - https://bugs.webkit.org/show_bug.cgi?id=19804
          optimize access to arrays without "holes"

        SunSpider says 1.8% faster.

        * kjs/JSArray.cpp:
        (KJS::JSArray::JSArray): Initialize m_fastAccessCutoff when creating
        arrays. Also updated for new location of m_vectorLength.
        (KJS::JSArray::getItem): Updated for new location of m_vectorLength.
        (KJS::JSArray::getSlowCase): Added. Broke out the non-hot parts of
        getOwnPropertySlot to make the hot part faster.
        (KJS::JSArray::getOwnPropertySlot): Added a new faster case for
        indices lower than m_fastAccessCutoff. We can do theese with no
        additional checks or branches.
        (KJS::JSArray::put): Added a new faster case for indices lower than
        m_fastAccessCutoff. We can do theese with no additional checks or
        branches. Moved the maxArrayIndex handling out of this function.
        Added code to set m_fastAccessCutoff when the very last hole in
        an array is filled; this is how the cutoff gets set for most arrays.
        (KJS::JSArray::putSlowCase): Moved the rest of the put function logic
        in here, to make the hot part of the put function faster.
        (KJS::JSArray::deleteProperty): Added code to lower m_fastAccessCutoff
        when a delete makes a new hole in the array.
        (KJS::JSArray::getPropertyNames): Updated for new location of
        m_vectorLength.
        (KJS::JSArray::increaseVectorLength): Ditto.
        (KJS::JSArray::setLength): Added code to lower m_fastAccessCutoff
        when setLength makes the array smaller.
        (KJS::JSArray::mark): Updated for new location of m_vectorLength.
        (KJS::JSArray::sort): Ditto. Set m_fastAccessCutoff after moving
        all the holes to the end of the array.
        (KJS::JSArray::compactForSorting): Ditto.
        (KJS::JSArray::checkConsistency): Added consistency checks fro
        m_fastAccessCutoff and updated for the new location of m_vectorLength.

        * kjs/JSArray.h: Added declarations for slow case functions.
        Replaced m_vectorLength with m_fastAccessCutoff.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34867 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Sam.

        When executing a native call, check for an exception before writing the
        return value.

        JavaScriptCore:

        * VM/Machine.cpp:
        (KJS::Machine::privateExecute):

        LayoutTests:

        * fast/js/exception-sequencing-expected.txt:
        * fast/js/exception-sequencing.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34866 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Mark Rowe  <mrowe@apple.com>

        Build fix.  Flag headers as private or public as is appropriate.
        These settings were accidentally removed during some project file cleanup.

        * JavaScriptCore.xcodeproj/project.pbxproj:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin Adler.

        - allow document markers to touch or overlap if they are not of the same type

        Cannot be tested in DumpRenderTree

        * dom/Document.cpp:
        (WebCore::Document::addMarker):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintDocumentMarkers):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34864 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Splits RegExpConstructor and RegExpPrototype out of RegExpObject.h/cpp

        * DerivedSources.make:
        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * VM/Machine.cpp:
        * kjs/AllInOneFile.cpp:
        * kjs/JSGlobalObject.cpp:
        * kjs/RegExpConstructor.cpp: Copied from kjs/RegExpObject.cpp.
        * kjs/RegExpConstructor.h: Copied from kjs/RegExpObject.h.
        * kjs/RegExpObject.cpp:
        * kjs/RegExpObject.h:
        * kjs/RegExpPrototype.cpp: Copied from kjs/RegExpObject.cpp.
        * kjs/RegExpPrototype.h: Copied from kjs/RegExpObject.h.
        * kjs/StringPrototype.cpp:
        * kjs/internal.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34863 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Sam Weinig  <sam@webkit.org>

        Fix non-AllInOne builds.

        * kjs/StringConstructor.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34862 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Rename string_object.h/cpp to StringObject.h/cpp and split out StringObjectThatMasqueradesAsUndefined,
        StringConstructor and StringPrototype.

        * DerivedSources.make:
        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        * kjs/JSGlobalObject.cpp:
        * kjs/StringConstructor.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
        * kjs/StringConstructor.h: Copied from JavaScriptCore/kjs/string_object.h.
        * kjs/StringObject.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
        * kjs/StringObject.h: Copied from JavaScriptCore/kjs/string_object.h.
        * kjs/StringObjectThatMasqueradesAsUndefined.h: Copied from JavaScriptCore/kjs/string_object.h.
        * kjs/StringPrototype.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
        * kjs/StringPrototype.h: Copied from JavaScriptCore/kjs/string_object.h.
        * kjs/internal.cpp:
        * kjs/string_object.cpp: Removed.
        * kjs/string_object.h: Removed.

WebCore:

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Update includes after remaming string_object.h to StringObject.h and
        splitting out StringObjectThatMasqueradesAsUndefined, StringConstructor
        and StringPrototype.

        * ForwardingHeaders/kjs/StringObject.h: Copied from WebCore/ForwardingHeaders/kjs/string_object.h.
        * ForwardingHeaders/kjs/StringObjectThatMasqueradesAsUndefined.h: Added.
        * ForwardingHeaders/kjs/StringPrototype.h: Added.
        * ForwardingHeaders/kjs/string_object.h: Removed.
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Gtk build fix: JSVariableObject is now part of AllInOne

        * GNUmakefile.am:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34860 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Oliver.

        - https://bugs.webkit.org/show_bug.cgi?id=19801
          add a feature so we can tell what regular expressions are taking time

        * pcre/pcre_compile.cpp:
        (jsRegExpCompile): Compile in the string if REGEXP_HISTOGRAM is on.

        * pcre/pcre_exec.cpp:
        (jsRegExpExecute): Add hook to time execution.
        (Histogram::~Histogram): Print a sorted list of what took time.
        (Histogram::add): Accumulate records of what took time.
        (HistogramTimeLogger::~HistogramTimeLogger): Hook that calls
        Histogram::add at the right moment and creates the global histogram
        object.

        * pcre/pcre_internal.h: Define REGEXP_HISTOGRAM.

        * pcre/pcre_tables.cpp: Added missing include of "config.h". Not needed
        any more, but an omissions an earlier version of this patch detected.
        * pcre/pcre_ucp_searchfuncs.cpp: Ditto.
        * pcre/pcre_xclass.cpp: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34858 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Sam Weinig  <sam@webkit.org>

        Try and fix the Windows build again.

        * kjs/RegExpObject.cpp:
        * kjs/date_object.cpp:
        * kjs/error_object.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34857 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Darin Adler.

        Remove unused StringConstructorFunction class.

        * kjs/string_object.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34856 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Sam Weinig  <sam@webkit.org>

        Fix windows build.

        * kjs/ArrayPrototype.cpp:
        * kjs/BooleanPrototype.cpp:
        * kjs/BooleanPrototype.h:
        * kjs/FunctionPrototype.cpp:
        * kjs/JSImmediate.cpp:
        * kjs/JSObject.cpp:
        * kjs/MathObject.cpp:
        * kjs/NumberPrototype.cpp:
        * kjs/NumberPrototype.h:
        * kjs/ObjectConstructor.cpp:
        * kjs/RegExpObject.h:
        * kjs/error_object.h:
        * kjs/string_object.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Oliver Hunt.

        Splits FunctionConstructor out of FunctionPrototype.h/cpp
        Splits NumberConstructor and NumberPrototype out of NumberObject.h/cpp
        Rename object_object.h/cpp to ObjectPrototype.h/cpp and split out ObjectConstructor.

        * API/JSCallbackConstructor.cpp:
        * API/JSClassRef.cpp:
        * API/JSObjectRef.cpp:
        * DerivedSources.make:
        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * VM/Machine.cpp:
        * kjs/AllInOneFile.cpp:
        * kjs/ArrayConstructor.cpp:
        * kjs/ArrayConstructor.h:
        * kjs/FunctionConstructor.cpp: Copied from JavaScriptCore/kjs/FunctionPrototype.cpp.
        * kjs/FunctionConstructor.h: Copied from JavaScriptCore/kjs/FunctionPrototype.h.
        * kjs/FunctionPrototype.cpp:
        * kjs/FunctionPrototype.h:
        * kjs/JSFunction.cpp:
        * kjs/JSGlobalObject.cpp:
        * kjs/JSImmediate.cpp:
        * kjs/MathObject.h:
        * kjs/NumberConstructor.cpp: Copied from JavaScriptCore/kjs/NumberObject.cpp.
        * kjs/NumberConstructor.h: Copied from JavaScriptCore/kjs/NumberObject.h.
        * kjs/NumberObject.cpp:
        * kjs/NumberObject.h:
        * kjs/NumberPrototype.cpp: Copied from JavaScriptCore/kjs/NumberObject.cpp.
        * kjs/NumberPrototype.h: Copied from JavaScriptCore/kjs/NumberObject.h.
        * kjs/ObjectConstructor.cpp: Copied from JavaScriptCore/kjs/object_object.cpp.
        * kjs/ObjectConstructor.h: Copied from JavaScriptCore/kjs/object_object.h.
        * kjs/ObjectPrototype.cpp: Copied from JavaScriptCore/kjs/object_object.cpp.
        * kjs/ObjectPrototype.h: Copied from JavaScriptCore/kjs/object_object.h.
        * kjs/RegExpObject.h:
        * kjs/Shell.cpp:
        * kjs/error_object.h:
        * kjs/internal.cpp:
        * kjs/nodes.cpp:
        * kjs/object_object.cpp: Removed.
        * kjs/object_object.h: Removed.
        * kjs/string_object.h:

WebCore:

2008-06-28  Sam Weinig  <sam@webkit.org>

        Rubber-stamped by Oliver Hunt.

        Update includes after remaming object_object.h to ObjectPrototype.h and
        splitting FunctionConstructor out of FunctionPrototype.h

        * ForwardingHeaders/kjs/FunctionConstructor.h: Added.
        * ForwardingHeaders/kjs/ObjectPrototype.h: Copied from WebCore/ForwardingHeaders/kjs/object_object.h.
        * ForwardingHeaders/kjs/object_object.h: Removed.
        * bindings/js/JSEventListener.cpp:
        * bindings/scripts/CodeGeneratorJS.pm:
        * bridge/qt/qt_instance.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34854 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

        Reviewed by Darin Adler.

        - fix <rdar://problem/5994621> REGRESSION (r31090-r31114): Weather widget shows missing image icons briefly when (re)loaded

        * html/HTMLImageLoader.cpp:
        (WebCore::HTMLImageLoader::updateFromElement): Changed to not load an
        image if the 'src' attribute is the empty string and the document's base
        URI is a file: URL.

LayoutTests:

        Reviewed by Darin Adler.

        - updated test and results for <rdar://problem/5994621> REGRESSION (r31090-r31114): Weather widget shows missing image icons briefly when (re)loaded

        * fast/images/load-img-with-empty-src-expected.txt:
        * fast/images/load-img-with-empty-src.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34853 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Oliver.

        - fix https://bugs.webkit.org/show_bug.cgi?id=19796
          optimize expressions with ignored results (especially post-increment)

        SunSpider says 0.9% faster.

        * VM/CodeGenerator.h:
        (KJS::CodeGenerator::tempDestination): Create a new temporary for
        ignoredResult() too, just as we would for 0.
        (KJS::CodeGenerator::finalDestination): Use the temporary if the
        register passed in is ignoredResult() too, just as we would for 0.
        (KJS::CodeGenerator::destinationForAssignResult): Return 0 if the
        passed in register is ignoredResult(), just as we would for 0.
        (KJS::CodeGenerator::moveToDestinationIfNeeded): Return 0 if the
        register passed in is ignoredResult(). What matters is that we
        don't want to emit a move. The return value won't be looked at.
        (KJS::CodeGenerator::emitNode): Allow ignoredResult() and pass it
        through to the node's emitCode function.

        * VM/RegisterID.h:
        (KJS::ignoredResult): Added. Special value to indicate the result of
        a node will be ignored and need not be put in any register.

        * kjs/nodes.cpp:
        (KJS::NullNode::emitCode): Do nothing if dst == ignoredResult().
        (KJS::BooleanNode::emitCode): Ditto.
        (KJS::NumberNode::emitCode): Ditto.
        (KJS::StringNode::emitCode): Ditto.
        (KJS::RegExpNode::emitCode): Ditto.
        (KJS::ThisNode::emitCode): Ditto.
        (KJS::ResolveNode::emitCode): Do nothing if dst == ignoredResult() and
        the identifier resolves to a local variable.
        (KJS::ObjectLiteralNode::emitCode): Do nothing if dst == ignoredResult()
        and the object is empty.
        (KJS::PostIncResolveNode::emitCode): If dst == ignoredResult(), then do
        nothing for the local constant case, and do a pre-increment in all the
        other cases.
        (KJS::PostDecResolveNode::emitCode): Ditto.
        (KJS::PostIncBracketNode::emitCode): Ditto.
        (KJS::PostDecBracketNode::emitCode): Ditto.
        (KJS::PostIncDotNode::emitCode): Ditto.
        (KJS::PostDecDotNode::emitCode): Ditto.
        (KJS::DeleteValueNode::emitCode): Pass ignoredResult() when evaluating
        the expression.
        (KJS::VoidNode::emitCode): Ditto.
        (KJS::TypeOfResolveNode::emitCode): If dst == ignoredResult(), do nothing
        if the identifier resolves to a local variable, and don't bother generating
        a typeof opcode in the other case.
        (KJS::TypeOfValueNode::emitCode): Ditto.
        (KJS::PreIncResolveNode::emitCode): Do nothing if dst == ignoredResult() and
        the identifier resolves to a local constant.
        (KJS::PreDecResolveNode::emitCode): Ditto.
        (KJS::AssignResolveNode::emitCode): Turn ignoredResult() into 0 in a couple
        places, because we need to put the result into a register so we can assign
        it. At other sites this is taken care of by functions like finalDestination.
        (KJS::CommaNode::emitCode): Pass ignoredResult() when evaluating the first
        expression.
        (KJS::ForNode::emitCode): Pass ignoredResult() when evaluating the first and
        third expressions.
        (KJS::ForInNode::emitCode): Pass ignoredResult() when evaluating the first
        expression.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34852 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Oliver.

        - https://bugs.webkit.org/show_bug.cgi?id=19787
          create most arrays from values in registers rather than with multiple put operations

        SunSpider says 0.8% faster.

        * VM/CodeBlock.cpp:
        (KJS::CodeBlock::dump): Added argv and argc parameters to new_array.
        * VM/Machine.cpp:
        (KJS::Machine::privateExecute): Ditto.

        * VM/CodeGenerator.cpp:
        (KJS::CodeGenerator::emitNewArray): Added.
        * VM/CodeGenerator.h: Added ElementNode* argument to emitNewArray.

        * kjs/nodes.cpp:
        (KJS::ArrayNode::emitCode): Pass the ElementNode to emitNewArray so it can be
        initialized with as many elements as possible. If the array doesn't have any
        holes in it, that's all that's needed. If there are holes, then emit some separate
        put operations for the other values in the array and for the length as needed.

        * kjs/nodes.h: Added some accessors to ElementNode so the code generator can
        iterate through elements and generate code to evaluate them. Now ArrayNode does
        not need to be a friend. Also took out some unused PlacementNewAdoptType
        constructors.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34851 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        * kjs/nodes.h: Remove obsolete PlacementNewAdopt constructors.
        We no longer mutate the AST in place.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-06-28  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Reviewed by Oliver Hunt.

        Build fix

        * VM/Machine.cpp: include stdio.h

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Oliver.

Update all (except four) SVG pixel tests, after a long time.
Four tests are broken in trunk, filed bugs 19798 & 19799.

Add all missing png/checksum files, and move files around which were misplaced.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34848 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Oliver.

Copy <test>-expected.png from the right location to /tmp/layout-test-results.
Use $expectedPixelDir instead of $expectedDir. Allows using SVG pixel tests again.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34847 268f45cc-cd09-0410-ab3c-d52691b4dbfc