Unreviewed EFL gardening.

* platform/efl-wk2/plugins/npruntime/object-from-destroyed-plugin-expected.txt: Added.
* platform/efl-wk2/plugins/npruntime/object-from-destroyed-plugin-in-subframe-expected.txt: Added.
* platform/efl/fast/forms/control-restrict-line-height-expected.png: Rebaseline after r155408.
* platform/efl/fast/forms/control-restrict-line-height-expected.txt: Rebaseline after r155408.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157616 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Don't add an include for return type of a [Custom] function in generated bindings code
https://bugs.webkit.org/show_bug.cgi?id=122972

Reviewed by Sam Weinig.

* bindings/scripts/CodeGeneratorJS.pm: (GenerateImplementation): Don't.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157615 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Pass VM instead of JSGlobalObject to JSONObject constructor.
<https://webkit.org/b/122999>

JSONObject was only use the JSGlobalObject to grab at the VM.
Dodge a few loads by passing the VM directly instead.

Reviewed by Geoffrey Garen.

* runtime/JSONObject.cpp:
(JSC::JSONObject::JSONObject):
(JSC::JSONObject::finishCreation):
* runtime/JSONObject.h:
(JSC::JSONObject::create):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157614 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CTTE: RenderMathMLSpace always has a MathMLTextElement.
<https://webkit.org/b/122992>

The renderer is never anonymous and always has a corresponding
MathMLTextElement. Overload element() with a tighter return type.

Also marked the class FINAL and made most methods private.

Reviewed by Antti Koivisto.

* rendering/mathml/RenderMathMLSpace.cpp:
(WebCore::RenderMathMLSpace::RenderMathMLSpace):
(WebCore::RenderMathMLSpace::updateFromElement):
* rendering/mathml/RenderMathMLSpace.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157613 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Removed the JITStackFrame struct
https://bugs.webkit.org/show_bug.cgi?id=123001

Reviewed by Anders Carlsson.

* jit/JITStubs.h: JITStackFrame and JITStubArg are unused now, since all
our helper functions obey the C function call ABI.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157612 268f45cc-cd09-0410-ab3c-d52691b4dbfc

PlatformCALayer constructor should take layer type as an argument
https://bugs.webkit.org/show_bug.cgi?id=122915

Reviewed by Anders Carlsson.

No new tests, just restoring old code.

Un-do part of the patch for bug 122915; we can't early-return
in the constructor, there's still more work to do.

* platform/graphics/ca/mac/PlatformCALayerMac.mm:
(PlatformCALayerMac::PlatformCALayerMac):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157611 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Removed an unused #define
https://bugs.webkit.org/show_bug.cgi?id=123000

Reviewed by Anders Carlsson.

* jit/JITStubs.h: Removed the concept of JITSTACKFRAME_ARGS_INDEX,
since it is unused now. This is a step toward using the C stack.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157610 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Eliminate uses of JITSTACKFRAME_ARGS_INDEX as scratch area for thunks
https://bugs.webkit.org/show_bug.cgi?id=122973

Reviewed by Michael Saboff.

* jit/ThunkGenerators.cpp:
(JSC::throwExceptionFromCallSlowPathGenerator): This was all dead code,
so I removed it.

The code acted as if it needed to pass an argument to
lookupExceptionHandler, and as if it passed that argument to itself
through JITStackFrame. However, lookupExceptionHandler does not take
an argument (other than the default ExecState argument), and the code
did not initialize the thing that it thought it passed to itself!

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157609 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash fix for Windows XP.
https://bugs.webkit.org/show_bug.cgi?id=122790

Patch by Anthony Johnson <anthony.johnson@flexsim.com> on 2013-10-17
Reviewed by Geoffrey Garen.

* win/tools/vsprops/common.props:
Replaced stack and heap sizes of zero with blank stack and heap sizes.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157608 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Run JavaScriptCore tests again on Windows.
https://bugs.webkit.org/show_bug.cgi?id=122787

Patch by Alex Christensen <achristensen@webkit.org> on 2013-10-17
Reviewed by Tim Horton.

Source/JavaScriptCore:

* JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
* jit/JITStubsMSVC64.asm: Removed reference to cti_vm_throw unused since r157581.

Tools:

* Scripts/build-jsc:
(buildMyProject): Use JavaScriptCore.sln to build JavaScriptCore and WTF.
* Scripts/run-javascriptcore-tests: Don't run stress tests on WinCairo.
* Scripts/webkitdirs.pm:
(determineConfigurationForVisualStudio):
(determineConfigurationProductDir):
Build directory should end with bin64 and configuration should end with |x64 on Win64.
(isAppleWinWebKit):
(copyInspectorFrontendFiles):
(setPathForRunningWebKitApp):
Separated WinCairo directories and options from AppleWin.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157607 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Tidied up the Vector<T> move constructor
https://bugs.webkit.org/show_bug.cgi?id=122998

Reviewed by Anders Carlsson.

* wtf/Vector.h:
(WTF::::Vector): Don't call swap() "weird". It's the way most std types
implement move constructors.

Do inline this function, so the compiler can optimize away a logical
move into a physical no-op.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157606 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: [CSS Regions] Crash when highlighting a node of a flow with no regions
https://bugs.webkit.org/show_bug.cgi?id=122993

Reviewed by Joseph Pecoraro.

Source/WebCore:

Test: inspector-protocol/dom/highlight-flow-with-no-region.html

Even if a named flow has no regions the content of the flow will still have renderer objects created.
Removed the assumption that all renderers inside a RenderFlowThread will always have an enclosing RenderRegion.

* inspector/InspectorOverlay.cpp:
(WebCore::buildObjectForRendererFragments):
(WebCore::InspectorOverlay::buildObjectForHighlightedNode):

LayoutTests:

Added test to check that DOM.highlightNode is not crashing WebCore when the node is inside
a flow with no associated regions.

* inspector-protocol/dom/highlight-flow-with-no-region-expected.txt: Added.
* inspector-protocol/dom/highlight-flow-with-no-region.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157605 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Removed restoreArgumentReference (another use of JITStackFrame)
https://bugs.webkit.org/show_bug.cgi?id=122997

Reviewed by Oliver Hunt.

* jit/JSInterfaceJIT.h: Removed an unused function. This is a step
toward using the C stack.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157604 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove JITStubCall.h
https://bugs.webkit.org/show_bug.cgi?id=122991

Reviewed by Geoff Garen.

Happily this is no longer used

* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* jit/JIT.cpp:
* jit/JITArithmetic.cpp:
* jit/JITArithmetic32_64.cpp:
* jit/JITCall.cpp:
* jit/JITCall32_64.cpp:
* jit/JITOpcodes.cpp:
* jit/JITOpcodes32_64.cpp:
* jit/JITPropertyAccess.cpp:
* jit/JITPropertyAccess32_64.cpp:
* jit/JITStubCall.h: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157603 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[BlackBerry] Improve the viewport of some websites like mobilesyrup.com/2013/08/25/moto-x-review/
https://bugs.webkit.org/show_bug.cgi?id=122995

Patch by Jacky Jiang <zhajiang@blackberry.com> on 2013-10-17.
Reviewed by George Staikos.
Internally reviewed by George Staikos and Eli Fidler.

JIRA 523949
Force to respect the viewport when there is viewport meta tag but width
is not specified even though the viewport is broken. By doing that, We
want to improve the user experience of some websites that use a reasonable
initial-scale, but have some overly-wide contents

The contents of those websites like mobilesyrup.com/2013/08/25/moto-x-review
should be improved by the contents provider eventually.

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157602 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Go to line keyboard command and dialog
https://bugs.webkit.org/show_bug.cgi?id=122893

Reviewed by Timothy Hatcher.

Add a text input over source code text editors, centered within the width of the editor
and towards the top of the editor, upon pressing Command+L or Control+G to match the
behavior in Chrome.

* Localizations/en.lproj/localizedStrings.js:
New localized string "Line Number".

* UserInterface/GoToLineDialog.css: Added.
Styling for the go-to-line dialog.

* UserInterface/GoToLineDialog.js: Added.
(WebInspector.GoToLineDialog):
Generate the DOM structure for the dialog.

(WebInspector.GoToLineDialog.prototype.present):
Present the dialog as a child of a parent element. The dialog's text field automatically
gets focus and resets to be empty.

(WebInspector.GoToLineDialog.prototype.dismiss):
Dismiss the dialog if visible, this triggers the goToLineDialogWasDismissed delegate method.

(WebInspector.GoToLineDialog.prototype.handleEvent):
Route the various events registered in the dialog's DOM tree: input, keydown, blur, mousedown
and click.

(WebInspector.GoToLineDialog.prototype._handleInputEvent):
Update the "non-empty" class on the dialog's element depending on the content of the dialog's
text field. If there is content in the text field, this will make the clear icon visible.

(WebInspector.GoToLineDialog.prototype._handleKeydownEvent):
If the Esc. key is pressed when there is text in the dialog's input field, clear the input field.
If no text is in the input field, dismiss the input field. When the Enter key is pressed, we call
the isGoToLineDialogValueValid() method on the delegate to figure out if the text field value is
valid. If it's not, we select the text field value so that it may be easily replaced and play
en error sound. If it's valid, we call the goToLineDialogValueWasValidated() delegate method
and dismiss the dialog.

(WebInspector.GoToLineDialog.prototype._handleBlurEvent):
Dismiss the dialog when its text field loses focus. This ensures that clicking anywhere outside
of the dialog removes it from display.

(WebInspector.GoToLineDialog.prototype._handleMousedownEvent):
Upon pressing the mouse down on the clear icon, select the entire text field content (matches
the behavior of Xcode) and prevent the default event action that would blur the text field
which would dismiss the dialog.

(WebInspector.GoToLineDialog.prototype._handleClickEvent):
Clear the content of the dialog's text field upon clicking on its clear button.

(WebInspector.GoToLineDialog.prototype._clear):
Reset the dialog's text field's value to an empty string and remove the "non-empty" CSS class name
controlling the display of the clear button.

* UserInterface/Images/CloseWhite.svg: Added.
Variation of the Close.svg icon with a white cross.

* UserInterface/Main.html:
Link to the newly added resources for GoToLineDialog.

* UserInterface/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor):
Register the Command+L and Control+G keyboard shortcuts to bring up the go-to-line dialog.

(WebInspector.SourceCodeTextEditor.prototype.showGoToLineDialog):
Method called upon pressing the Command+L and Control+G keyboard shorcuts creating an instance
of a GoToDialog if necessary, becoming its delegate and presenting it in the context of the
editor's root element.

(WebInspector.SourceCodeTextEditor.prototype.isGoToLineDialogValueValid):
Delegate method called to validate the line number presently set in the go-to-dialog's text field,
checking it's a number between 1 and the number of lines in the source code.

(WebInspector.SourceCodeTextEditor.prototype.goToLineDialogValueWasValidated):
Delegate method called when the line number set in the go-to-dialog's text field has been validated.
We reveal and select the line at the number provided.

(WebInspector.SourceCodeTextEditor.prototype.goToLineDialogWasDismissed):
Ensure the source code editor regains focus upon dismissing the go-to-dialog.

* UserInterface/TextEditor.js:
(WebInspector.TextEditor.prototype.revealPosition):
Add a new opt-in option to not highlight the revealed position. The code in goToLineDialogValueWasValidated()
sets that new flag to true to avoid an unnecessary highlight on top of the selection.

(WebInspector.TextEditor.prototype.get lineCount):
Expose the lineCount() method on the private CodeMirror instance.

(WebInspector.TextEditor.prototype.focus):
Expose the focus() method on the private CodeMirror instance.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157601 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: logged objects are highlighted in blue
https://bugs.webkit.org/show_bug.cgi?id=122897

Reviewed by Joseph Pecoraro.

Switch to using the system highlight color for the background selected messages.
Also removing SVG assets no longer needed since we won't be showing white prompt
and result icons anymore as well as a few generated canvas states.

* UserInterface/Images/UserInputPromptPreviousSelected.svg: Removed.
* UserInterface/Images/UserInputResultSelected.svg: Removed.
* UserInterface/LogContentView.css:
(.console-messages:focus .console-item.selected):
* UserInterface/Main.js:
(WebInspector._generateDisclosureTriangleImages):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157600 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CTTE: RenderMathMLOperator always has a MathMLElement.
<https://webkit.org/b/122988>

Reviewed by Antti Koivisto.

The renderer is never anonymous and always has a corresponding
MathMLElement. Overload element() with a tighter return type.

Also marked the class FINAL and made most methods private.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157599 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix three bugs in the equals() implementations for css gradients.
https://bugs.webkit.org/show_bug.cgi?id=122987

Reviewed by Andreas Kling.

1. Linear gradients were considered equal if the first gradient has no x and y
   position and the second has no x but does have y.
2. Same as 1, for radial gradients. (This doesn't happen in practice as
   CSSParser::parseRadialGradient rejects such input, so no test for this case.)
3. Radial gradients without x and y position weren't considered equal even if
   they were.

Source/WebCore:

* css/CSSGradientValue.cpp:
(WebCore::CSSLinearGradientValue::equals):
(WebCore::CSSRadialGradientValue::equals):

LayoutTests:

Merges https://codereview.chromium.org/26147006/

* cssom/cssvalue-comparison-expected.txt:
* cssom/cssvalue-comparison.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157598 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: allow front-end to trigger the system beep sound to signal an error
https://bugs.webkit.org/show_bug.cgi?id=122955

Reviewed by Timothy Hatcher.

Source/WebCore:

New beep() method exposed on InspectorFrontendHost calling into WebCore's systemBeep().

* inspector/InspectorFrontendHost.cpp:
(WebCore::InspectorFrontendHost::beep):
* inspector/InspectorFrontendHost.h:
* inspector/InspectorFrontendHost.idl:

Source/WebInspectorUI:

Provide a stub method for the new InspectorFrontendHost.beep() method.

* UserInterface/InspectorFrontendHostStub.js:
(WebInspector.InspectorFrontendHostStub.prototype.beep):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157597 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2] Speculative buildfixes for GTK and EFL after r157582.

* CMakeLists.txt:
* GNUmakefile.am:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157596 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Refactor stored website data APIs
https://bugs.webkit.org/show_bug.cgi?id=122781

Patch by Martin Hock <mhock@apple.com> on 2013-10-17
Reviewed by Brady Eidson.

Add WebOriginDataManager along with corresponding class
WebOriginDataManagerProxy and API WKOriginDataManager.

Currently, the new files are unused.

WKOriginDataManager should subsume the functionality of:
WKApplicationCacheManager, WKCookieManager, WKDatabaseManager,
WKKeyValueStorageManager, WKMediaCacheManager,
WKPluginSiteDataManager, and WKResourceCacheManager.

* CMakeLists.txt:
* DerivedSources.make:
* GNUmakefile.am:
* GNUmakefile.list.am:
* Shared/API/c/WKBase.h:
* Shared/APIObject.h:
* UIProcess/API/C/WKAPICast.h:
* UIProcess/API/C/WKContext.cpp:
(WKContextGetOriginDataManager):
* UIProcess/API/C/WKContext.h:
* UIProcess/API/C/WKOriginDataManager.cpp: Added.
(WKOriginDataManagerGetTypeID):
(WKOriginDataManagerGetOrigins):
(WKOriginDataManagerDeleteEntriesForOrigin):
(WKOriginDataManagerDeleteAllEntries):
(WKOriginDataManagerStartObservingChanges):
(WKOriginDataManagerStopObservingChanges):
(WKOriginDataManagerSetChangeClient):
* UIProcess/API/C/WKOriginDataManager.h: Added.
* UIProcess/WebOriginDataManagerProxy.cpp: Added.
(WebKit::WebOriginDataManagerProxy::supplementName):
(WebKit::WebOriginDataManagerProxy::create):
(WebKit::WebOriginDataManagerProxy::WebOriginDataManagerProxy):
(WebKit::WebOriginDataManagerProxy::~WebOriginDataManagerProxy):
(WebKit::WebOriginDataManagerProxy::contextDestroyed):
(WebKit::WebOriginDataManagerProxy::processDidClose):
(WebKit::WebOriginDataManagerProxy::shouldTerminate):
(WebKit::WebOriginDataManagerProxy::refWebContextSupplement):
(WebKit::WebOriginDataManagerProxy::derefWebContextSupplement):
(WebKit::WebOriginDataManagerProxy::getOrigins):
(WebKit::WebOriginDataManagerProxy::didGetOrigins):
(WebKit::WebOriginDataManagerProxy::deleteEntriesForOrigin):
(WebKit::WebOriginDataManagerProxy::deleteAllEntries):
(WebKit::WebOriginDataManagerProxy::startObservingChanges):
(WebKit::WebOriginDataManagerProxy::stopObservingChanges):
(WebKit::WebOriginDataManagerProxy::setChangeClient):
(WebKit::WebOriginDataManagerProxy::didChange):
* UIProcess/WebOriginDataManagerProxy.h: Added.
* UIProcess/WebOriginDataManagerProxy.messages.in: Added.
* UIProcess/WebOriginDataManagerProxyChangeClient.cpp: Added.
(WebKit::WebOriginDataManagerProxyChangeClient::didChange):
* UIProcess/WebOriginDataManagerProxyChangeClient.h: Added.
* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/OriginData/WebOriginDataManager.cpp: Added.
(WebKit::WebOriginDataManager::supplementName):
(WebKit::WebOriginDataManager::WebOriginDataManager):
(WebKit::WebOriginDataManager::getOrigins):
(WebKit::WebOriginDataManager::deleteEntriesForOrigin):
(WebKit::WebOriginDataManager::deleteAllEntries):
(WebKit::WebOriginDataManager::startObservingChanges):
(WebKit::WebOriginDataManager::stopObservingChanges):
* WebProcess/OriginData/WebOriginDataManager.h: Added.
* WebProcess/OriginData/WebOriginDataManager.messages.in: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157595 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove PlatformCAAnimation::supportsValueFunction()
https://bugs.webkit.org/show_bug.cgi?id=122990

Reviewed by Tim Horton.

PlatformCAAnimation::supportsValueFunction always returns true now, so there's no need for it to exist anymore.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
* platform/graphics/ca/PlatformCAAnimation.h:
* platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
* platform/graphics/ca/win/PlatformCAAnimationWin.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157594 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CTTE: RenderMathMLFenced always has a MathMLInlineContainerElement.
<https://webkit.org/b/122986>

This renderer is never anonymous and always has a corresponding
MathMLInlineContainerElement. Overload element() with a tighter
return type.

Also marked the class FINAL and made most methods private.

Reviewed by Anders Carlsson.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157593 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Removed a use of JITSTACKFRAME_ARGS_INDEX
https://bugs.webkit.org/show_bug.cgi?id=122989

Reviewed by Oliver Hunt.

* jit/JITStubCall.h: Removed an unused function. This is one step closer
to using the C stack.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157592 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change emit_op_catch to use another method to materialize VM
https://bugs.webkit.org/show_bug.cgi?id=122977

Reviewed by Oliver Hunt.

* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_catch):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_catch): Use a constant. It removes our dependency
on JITStackFrame. It is also faster and simpler.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157591 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Eliminate emitGetJITStubArg() - dead code
https://bugs.webkit.org/show_bug.cgi?id=122975

Reviewed by Anders Carlsson.

* jit/JIT.h:
* jit/JITInlines.h: Removed unused, deprecated function.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157590 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Comment AffineTransform::xScale() and yScale() to make their meanings clearer
https://bugs.webkit.org/show_bug.cgi?id=122981

Patch by Myles C. Maxfield <mmaxfield@apple.com> on 2013-10-17
Reviewed by Simon Fraser.

* platform/graphics/transforms/AffineTransform.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157589 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Eliminate all ASSERT references to OBJECT_OFFSETOF(struct JITStackFrame,...) in JITStubsXXX.h.
https://bugs.webkit.org/show_bug.cgi?id=122979.

Reviewed by Michael Saboff.

* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/JITStubsARM.h:
* jit/JITStubsARM64.h:
* jit/JITStubsARMv7.h:
* jit/JITStubsMIPS.h:
* jit/JITStubsSH4.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86_64.h:
* runtime/VM.cpp:
(JSC::VM::VM):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157588 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove unnecessary check for RenderLayer and rename ensureLayer to createLayer in RenderLayerModelObject.
https://bugs.webkit.org/show_bug.cgi?id=122928

Reviewed by Darin Adler.

No new tests due to code refactoring.

RenderLayerModelObject::styleDidChange invokes the ensureLayer() only in case of !layer().
Again checking for layer existence would be deemed redundant in ensureLayer.
Replacing it with an ASSERT(!m_layer) and also renaming it to createLayer.

Blink review URL: https://codereview.chromium.org/27246003/

* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::createLayer):
(WebCore::RenderLayerModelObject::styleDidChange):
* rendering/RenderLayerModelObject.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157587 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove saving callFrameRegister to JITStackFrame in JITCompiler::compileFunction()
https://bugs.webkit.org/show_bug.cgi?id=122974

Reviewed by Geoffrey Garen.

Eliminated unneeded storing to JITStackFrame.

* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileFunction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157586 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed gardening of Apple Windows port.

* platform/win/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157585 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove PlatformCALayerMac workaround for <rdar://problem/7390716>
https://bugs.webkit.org/show_bug.cgi?id=122983

Reviewed by Simon Fraser.

Remove a workaround for a bug fixed in Lion.

* platform/graphics/ca/mac/PlatformCALayerMac.mm:
(PlatformCALayerMac::setSublayers):
(PlatformCALayerMac::removeAllSublayers):
(PlatformCALayerMac::adoptSublayers):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157584 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Blind attempt at gtk-wk2 build fix.

* GNUmakefile.am:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157583 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add scaffolding for IDBDatabaseBackends in Web and Database processes
https://bugs.webkit.org/show_bug.cgi?id=122971

Reviewed by Tim Horton.

This patch:
- Adds a WebProcessIDBDatabaseBackend
- Adds a DatabaseProcessIDBDatabaseBackend
- Establishes the basic messaging between them
- Actually creates those backends as the result of an indexedDB.open() call from javascript

* DerivedSources.make:
* WebKit2.xcodeproj/project.pbxproj:
* Platform/Logging.h:

Hook up messaging so (Web/Database)ProcessIDBDatabaseBackends can message each other:
* DatabaseProcess/DatabaseToWebProcessConnection.cpp:
(WebKit::DatabaseToWebProcessConnection::didReceiveMessage):
(WebKit::DatabaseToWebProcessConnection::establishIDBDatabaseBackend):
* DatabaseProcess/DatabaseToWebProcessConnection.h:
(WebKit::DatabaseToWebProcessConnection::connection):
* DatabaseProcess/DatabaseToWebProcessConnection.messages.in: Added.

DatabaseProcess side of an IDBDatabaseBackend:
* DatabaseProcess/IndexedDB/DatabaseProcessIDBDatabaseBackend.cpp:
(WebKit::DatabaseProcessIDBDatabaseBackend::DatabaseProcessIDBDatabaseBackend):
(WebKit::DatabaseProcessIDBDatabaseBackend::~DatabaseProcessIDBDatabaseBackend):
(WebKit::DatabaseProcessIDBDatabaseBackend::openConnection):
(WebKit::DatabaseProcessIDBDatabaseBackend::messageSenderConnection):
* DatabaseProcess/IndexedDB/DatabaseProcessIDBDatabaseBackend.h: Added.
(WebKit::DatabaseProcessIDBDatabaseBackend::create):
* DatabaseProcess/IndexedDB/DatabaseProcessIDBDatabaseBackend.messages.in: Added.

WebProcess side of an IDBDatabaseBackend:
* WebProcess/Databases/IndexedDB/WebProcessIDBDatabaseBackend.cpp: Added.
(WebKit::generateBackendIdentifier):
(WebKit::WebProcessIDBDatabaseBackend::WebProcessIDBDatabaseBackend):
(WebKit::WebProcessIDBDatabaseBackend::~WebProcessIDBDatabaseBackend):
(WebKit::WebProcessIDBDatabaseBackend::openConnection):
(WebKit::WebProcessIDBDatabaseBackend::createObjectStore):
(WebKit::WebProcessIDBDatabaseBackend::deleteObjectStore):
(WebKit::WebProcessIDBDatabaseBackend::createTransaction):
(WebKit::WebProcessIDBDatabaseBackend::close):
(WebKit::WebProcessIDBDatabaseBackend::commit):
(WebKit::WebProcessIDBDatabaseBackend::abort):
(WebKit::WebProcessIDBDatabaseBackend::createIndex):
(WebKit::WebProcessIDBDatabaseBackend::deleteIndex):
(WebKit::WebProcessIDBDatabaseBackend::get):
(WebKit::WebProcessIDBDatabaseBackend::put):
(WebKit::WebProcessIDBDatabaseBackend::setIndexKeys):
(WebKit::WebProcessIDBDatabaseBackend::setIndexesReady):
(WebKit::WebProcessIDBDatabaseBackend::openCursor):
(WebKit::WebProcessIDBDatabaseBackend::count):
(WebKit::WebProcessIDBDatabaseBackend::deleteRange):
(WebKit::WebProcessIDBDatabaseBackend::clear):
(WebKit::WebProcessIDBDatabaseBackend::messageSenderConnection):
(WebKit::WebProcessIDBDatabaseBackend::establishDatabaseProcessBackend):
* WebProcess/Databases/IndexedDB/WebProcessIDBDatabaseBackend.h: Added.
(WebKit::WebProcessIDBDatabaseBackend::create):

Basic shared utilities that multiple processes will need going forward:
* Shared/Databases/IndexedDB/IDBUtilities.cpp:
(WebKit::uniqueDatabaseIdentifier):
* Shared/Databases/IndexedDB/IDBUtilities.h:

* WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp:
(WebKit::sharedDatabaseBackendMap):
(WebKit::WebIDBFactoryBackend::open): Actually establish an IDBDatabaseBackend in the DatabaseProcess
  when indexedDB.open() is called, even if it does nothing for now.

* WebProcess/Databases/WebToDatabaseProcessConnection.cpp:
* WebProcess/Databases/WebToDatabaseProcessConnection.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157582 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Transition cti_op_throw and cti_vm_throw to a JIT operation
https://bugs.webkit.org/show_bug.cgi?id=122931

Reviewed by Filip Pizlo.

Moved cti_op_throw to operationThrow.  Made the caller responsible for jumping to the
catch handler.  Eliminated cti_op_throw_static_error, cti_vm_throw, ctiVMThrowTrampoline()
and their callers as it is now dead code.  There is some work needed on the Microsoft X86
callOperation to handle the need to provide space for structure return value.

* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_throw):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_catch):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/JITStubsARM.h:
* jit/JITStubsARM64.h:
* jit/JITStubsARMv7.h:
* jit/JITStubsMIPS.h:
* jit/JITStubsMSVC64.asm:
* jit/JITStubsSH4.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86_64.h:
* jit/JSInterfaceJIT.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157581 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2] REGRESSION(r156472): scrolling coordinator is always enabled incorrectly.
https://bugs.webkit.org/show_bug.cgi?id=122958

Patch by Attila Dusnoki <h047679@stud.u-szeged.hu> on 2013-10-17
Reviewed by Tim Horton.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::WebPage): Missing ENABLE(THREADED_SCROLLING) guard added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157580 268f45cc-cd09-0410-ab3c-d52691b4dbfc

"border-collapse: collapse;" for table removes part of its border (was: Border disappears when close to some elements)
https://bugs.webkit.org/show_bug.cgi?id=8914

Reviewed by David Hyatt.

Source/WebCore:

The table section's side of a collapsed border won't get painted if there are no cells there to paint it. So instead
of relying solely on cells to paint the collapsed border paint the appropriate section of the border if there's no
cell to take care of it.

Tests: fast/table/paint-section-borders-without-cells-rtl.html
       fast/table/paint-section-borders-without-cells-vertical-lr-rtl.html
       fast/table/paint-section-borders-without-cells-vertical-lr.html
       fast/table/paint-section-borders-without-cells-vertical-rl.html
       fast/table/paint-section-borders-without-cells.html

* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::paintRowGroupBorder):
(WebCore::RenderTableSection::offsetLeftForRowGroupBorder):
(WebCore::RenderTableSection::offsetTopForRowGroupBorder):
(WebCore::RenderTableSection::verticalRowGroupBorderHeight):
(WebCore::RenderTableSection::horizontalRowGroupBorderWidth):
(WebCore::RenderTableSection::paintRowGroupBorderIfRequired):
(WebCore::physicalBorderForDirection):
(WebCore::RenderTableSection::paintObject):
* rendering/RenderTableSection.h:

LayoutTests:

* fast/table/paint-section-borders-without-cells-expected.html: Added.
* fast/table/paint-section-borders-without-cells-rtl-expected.html: Added.
* fast/table/paint-section-borders-without-cells-rtl.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-lr-expected.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-lr-rtl-expected.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-lr-rtl.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-lr.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-rl-expected.html: Added.
* fast/table/paint-section-borders-without-cells-vertical-rl.html: Added.
* fast/table/paint-section-borders-without-cells.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157579 268f45cc-cd09-0410-ab3c-d52691b4dbfc

certain http media tests doesn't receive the expected "Content-Length" header
https://bugs.webkit.org/show_bug.cgi?id=122965

Patch by Andres Gomez <agomez@igalia.com> on 2013-10-17
Reviewed by Eric Carlson.

Fixed PHP syntax so "Content-Length" HTTP Header is included in
the response.

* http/tests/media/resources/serve-video.php:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157577 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore: Remove JITStackFrame references in the C Loop LLINT.
https://bugs.webkit.org/show_bug.cgi?id=122950.

Patch by Mark Lam <mark.lam@apple.com> on 2013-10-17
Reviewed by Michael Saboff.

* jit/JITStubs.h:
* llint/LowLevelInterpreter.cpp:
(JSC::CLoop::execute):
* offlineasm/cloop.rb:

Source/WTF: Introduce WTF::Bag and start using it for InlineCallFrameSet
https://bugs.webkit.org/show_bug.cgi?id=122941

Reviewed by Geoffrey Garen.

Introduce WTF::Bag, which is basically an allocation pool. No POD restrictions. Does one
malloc per entry. No need to shrink afterwards.

* GNUmakefile.list.am:
* WTF.vcxproj/WTF.vcxproj:
* WTF.xcodeproj/project.pbxproj:
* wtf/Bag.h: Added.
(WTF::Bag::Bag):
(WTF::Bag::~Bag):
(WTF::Bag::add):
(WTF::Bag::iterator::iterator):
(WTF::Bag::iterator::operator!):
(WTF::Bag::iterator::operator*):
(WTF::Bag::iterator::operator++):
(WTF::Bag::iterator::operator==):
(WTF::Bag::begin):
(WTF::Bag::end):
(WTF::Bag::isEmpty):
* wtf/CMakeLists.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157576 268f45cc-cd09-0410-ab3c-d52691b4dbfc

StyleRuleFoo::mutableProperties() should return a reference.
<https://webkit.org/b/122962>

The mutableProperties() functions always return objects, so make
them return MutableStylePropertySet&.

Also tweaked the StyleRuleCSSStyleDeclaration constructor to take
references to both the properties and the owner rule since both
are required.

Reviewed by Antti Koivisto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157575 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Shapes] Improve the performance of image valued shapes with large shape-margins
https://bugs.webkit.org/show_bug.cgi?id=122613

Reviewed by Andreas Kling.

The cost of computing the shape-margin boundary of an image-valued shape-outside
is now proportional to (2 * shape-margin + image.height) rather than
(2 * shape-margin * image.height). The performance improvement comes from skipping
sequences of rounded-rectangle intervals that will not contribute to the final
result. Each non-empty row in the original image contributes one rounded-rectangle
whose corner radius is shape-margin, height is 2 * shape-margin, and width is
2 * shape-margin plus the width of the limits of the intervals on the row.

Renamed private method RasterShape::getIntervals() to intervalsAt() to be a little
more consistent with WebKit naming conventions.

There are no new tests since is just an internal refactoring.

* rendering/shapes/RasterShape.cpp:
(WebCore::MarginIntervalGenerator::set): Changed the x1,x2 parameters to an IntShapeInterval.
(WebCore::RasterShapeIntervals::contains): Refactor for the getIntervals() => intervalsAt() rename.
(WebCore::RasterShapeIntervals::getIntervalX1Values): Ditto.
(WebCore::RasterShapeIntervals::getIncludedIntervals): Ditto.
(WebCore::RasterShapeIntervals::getExcludedIntervals): Ditto.
(WebCore::RasterShapeIntervals::computeShapeMarginIntervals): Performance tuning.
* rendering/shapes/RasterShape.h:
(WebCore::RasterShapeIntervals::intervalsAt): Renamed getIntervals().
(WebCore::RasterShapeIntervals::limitIntervalAt): Return the min/max limits of the intervals at Y.
* rendering/shapes/ShapeInterval.h:
(WebCore::ShapeInterval::isEmpty): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157574 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Add URLMediaStream in the build
https://bugs.webkit.org/show_bug.cgi?id=122833

Reviewed by Carlos Garcia Campos.

* GNUmakefile.am: Add mediastream/gstreamer in include directories list.
* GNUmakefile.list.am: Add DOMURLMediaStream files in the build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157573 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove JITStackFrame references in the C Loop LLINT.
https://bugs.webkit.org/show_bug.cgi?id=122950.

Reviewed by Michael Saboff.

* jit/JITStubs.h:
* llint/LowLevelInterpreter.cpp:
(JSC::CLoop::execute):
* offlineasm/cloop.rb:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157572 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove JITStackFrame references in JIT probes.
https://bugs.webkit.org/show_bug.cgi?id=122947.

Reviewed by Michael Saboff.

* assembler/MacroAssemblerARM.cpp:
(JSC::MacroAssemblerARM::ProbeContext::dump):
* assembler/MacroAssemblerARM.h:
* assembler/MacroAssemblerARMv7.cpp:
(JSC::MacroAssemblerARMv7::ProbeContext::dump):
* assembler/MacroAssemblerARMv7.h:
* assembler/MacroAssemblerX86Common.cpp:
(JSC::MacroAssemblerX86Common::ProbeContext::dump):
* assembler/MacroAssemblerX86Common.h:
* jit/JITStubsARM.h:
* jit/JITStubsARMv7.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86Common.h:
* jit/JITStubsX86_64.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157571 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Massage the Gtk build.

* WebCoreSupport/EditorClientGtk.cpp:
(WebKit::EditorClient::shouldApplyStyle):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157570 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Use PassRef for constructing StylePropertySets.
<https://webkit.org/b/122948>

Make functions that construct StylePropertySets return PassRef
instead of PassRefPtr. Since they never return null, this gets rid
of the extra branch in ~PassRefPtr everywhere.

Also StyleRule* classes now hold a Ref<StylePropertySet>, codifying
the fact that they always have a property set.

Reviewed by Antti Koivisto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157569 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DataRef<T> should use Ref<T> internally.
<https://webkit.org/b/122953>

DataRef is used to hold RenderStyle substructures, and due to the
way style inheritance is implemented, DataRef will always point to
a live object.

Codify this by making DataRef::m_data a Ref, and making all methods
that create substructure objects return PassRef.

Reviewed by Antti Koivisto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157568 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Regions] Anonymous nested regions
https://bugs.webkit.org/show_bug.cgi?id=119135

Reviewed by David Hyatt.

Source/WebCore:

Tests: fast/regions/table-caption-as-region.html
       fast/regions/table-cell-as-region.html

This patch allows any non-replaced block to behave like a region. When an element is styled with the
-webkit-flow-from property, instead of making the renderer a RenderRegion, we let the original
renderer be created the same way and we add a region as an anonymous child for the renderer.
The anonymous block child, modeled by the new RenderNamedFlowFragment class, will be responsible
for the fragmentation of the named flow thread content.

A RenderBlockFlow object will keep a reference to a RenderNamedFlowFragment(RenderRegion) inside its
rare data structures.

Contains code contributed by Catalin Badea.

* CMakeLists.txt:
* GNUmakefile.list.am:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.xcodeproj/project.pbxproj:
* dom/Element.cpp: Changed to take the anonymous region into account.
(WebCore::Element::renderRegion):
(WebCore::Element::webkitGetRegionFlowRanges):
* dom/WebKitNamedFlow.cpp: Ditto.
(WebCore::WebKitNamedFlow::firstEmptyRegionIndex):
(WebCore::WebKitNamedFlow::getRegionsByContent):
(WebCore::WebKitNamedFlow::getRegions):
* inspector/InspectorOverlay.cpp: Take into account the new model for regions, with an anonymous region inside a block.
(WebCore::buildObjectForRegionHighlight):
(WebCore::buildObjectForElementInfo):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::computeShapeSize): For a render named flow fragment, there is no need to recompute the shape inside
we can take it from the parent.
(WebCore::RenderBlock::renderName): Make the block that contains a render named flow fragment (region) report RenderRegion.
A future patch that will change this will need to rebase a lot of tests.
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::insertedIntoTree): Create the anonymous region if needed (change of -webkit-flow-from determines Node reattach).
(WebCore::RenderBlockFlow::willBeDestroyed): Clean-up the anonymous region if necessary.
(WebCore::RenderBlockFlow::clearFloats): Small style change to make sure that check-webkit-style reports 0 failures on RenderBlockFlow.cpp.
(WebCore::RenderBlockFlow::layoutBlock):
(WebCore::RenderBlockFlow::styleDidChange): Update the style of the anonymous region too.
(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded): Helper function to create the anonymous region
and to add it as a child to the block.
(WebCore::RenderBlockFlow::canHaveChildren):
(WebCore::RenderBlockFlow::canHaveGeneratedChildren):
(WebCore::RenderBlockFlow::namedFlowFragmentNeedsUpdate): Force a layout of the anonymous region if the
parent block has percentage height (similar to RenderBlock::updateBlockChildDirtyBitsBeforeLayout)
(WebCore::RenderBlockFlow::updateLogicalHeight): Update the logical height of anonymous region when the height of parent is updated.
(WebCore::RenderBlockFlow::setRenderNamedFlowFragment):
* rendering/RenderBlockFlow.h:
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::RenderBlockFlowRareData):
(WebCore::RenderBlockFlow::renderNamedFlowFragment):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::createFor): Remove the direct creation of RenderRegion objects since they will be
created as anonymous children of block flow objects.
* rendering/RenderElement.h:
(WebCore::RenderElement::generatingElement): Account for anonymous region if necessary.
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent): Take anonymous region into account
and use the anonymous region parent offset/border.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::shouldBeNormalFlowOnly): Check for style instead of isRenderRegion since
the parent of the anonymous region will get the layer.
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::insertedIntoTree): Call RenderBlockFlow method instead.
* rendering/RenderNamedFlowFragment.cpp: Added. Model the behaviour of the anonymous region.
Has RenderRegion as a base class.
(WebCore::RenderNamedFlowFragment::RenderNamedFlowFragment):
(WebCore::RenderNamedFlowFragment::~RenderNamedFlowFragment):
(WebCore::RenderNamedFlowFragment::setStyleForNamedFlowFragment):
(WebCore::RenderNamedFlowFragment::styleDidChange):
(WebCore::RenderNamedFlowFragment::shouldHaveAutoLogicalHeight):
(WebCore::RenderNamedFlowFragment::maxPageLogicalHeight):
* rendering/RenderNamedFlowFragment.h: Added.
(WebCore::RenderNamedFlowFragment::isPseudoElementRegion):
(WebCore::RenderNamedFlowFragment::renderName):
(WebCore::toRenderNamedFlowFragment):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::isRenderNamedFlowFragmentContainer):
* rendering/RenderObject.h:
(WebCore::RenderObject::isRenderNamedFlowFragment):
* rendering/RenderRegion.h:
* rendering/RenderTableCaption.cpp: Call RenderBlockFlow method instead.
(WebCore::RenderTableCaption::insertedIntoTree):
* rendering/RenderTreeAsText.cpp:
(WebCore::write):
(WebCore::writeRenderRegionList):
* rendering/shapes/ShapeInfo.h:
(WebCore::ShapeInfo::shapeSize):
* style/StyleResolveTree.cpp:
(WebCore::Style::elementInsideRegionNeedsRenderer):

LayoutTests:

Add new tests for making a table-cell and a table-caption a region.
Change expected results for repaint tests of fixed elements since the parent of the region gets layer.

* fast/regions/element-in-named-flow-absolute-from-fixed-expected.txt:
* fast/regions/element-in-named-flow-fixed-from-absolute-expected.txt:
* fast/regions/element-inflow-fixed-from-outflow-static-expected.txt:
* fast/regions/element-outflow-static-from-inflow-fixed-expected.txt:
* fast/regions/table-caption-as-region-expected.html: Added.
* fast/regions/table-caption-as-region.html: Added.
* fast/regions/table-cell-as-region-expected.html: Added.
* fast/regions/table-cell-as-region.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157567 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix build when NUMBER_OF_ARGUMENT_REGISTERS == 4.
https://bugs.webkit.org/show_bug.cgi?id=122949

Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-17
Reviewed by Andreas Kling.

* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157566 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Add myself as a reviewer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157565 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Properly expose tables in accessibility
https://bugs.webkit.org/show_bug.cgi?id=122894

Patch by Krzysztof Czech <k.czech@samsung.com> on 2013-10-17
Reviewed by Chris Fleizach.

Source/WebCore:

All tables should exposed as tables.

* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
(WebCore::AccessibilityTable::addChildren):
* accessibility/AccessibilityTableColumn.cpp:
(WebCore::AccessibilityTableColumn::computeAccessibilityIsIgnored):
* accessibility/AccessibilityTableHeaderContainer.cpp:
(WebCore::AccessibilityTableHeaderContainer::computeAccessibilityIsIgnored):

LayoutTests:

Added new accessibility expectations after r153432.

* platform/efl-wk2/TestExpectations:
* platform/efl-wk2/accessibility/table-detection-expected.txt: Added.
* platform/efl-wk2/accessibility/table-one-cell-expected.txt: Added.
* platform/efl-wk2/accessibility/table-with-rules-expected.txt: Added.
* platform/efl/accessibility/table-detection-expected.txt: Added.
* platform/efl/accessibility/table-one-cell-expected.txt: Added.
* platform/efl/accessibility/table-with-rules-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157564 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Make it possible to assign a PassRef to a RefPtr.
<https://webkit.org/b/122943>

Source/WTF:

We have to use std::move when constructing a RefPtr from a PassRef
since there is no copy constructor for the latter.

Reviewed by Antti Koivisto.

Tools:

Added a small API test for RefPtr=(PassRef) so we know this code
will compile (and work.)

Reviewed by Antti Koivisto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157563 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CMAKE] Update code to take advantage of CMake version 2.8.3+.
https://bugs.webkit.org/show_bug.cgi?id=97516

Patch by Afonso R. Costa Jr. <afonso.costa@samsung.com> on 2013-10-17
Reviewed by Gyuyoung Kim.

CMake's version was changed to 2.8.3. So, these files below
can be simplified to take advantage of CMake's new version.

* Source/cmake/FindCairo.cmake: Simplified according to CMake 2.8.3+.
* Source/cmake/FindGStreamer.cmake: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157562 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/15183901> WebKit2 XPC services load the wrong frameworks when running
from the staged frameworks location.

Build the XPC services with DYLD_VERSIONED_FRAMEWORK_PATH when USE_STAGING_INSTALL_PATH
is set to YES. This is necessary because there's no way to specify environment variables
to be used when an XPC service is launched.

Reviewed by Anders Carlsson.

* Configurations/BaseTarget.xcconfig: Set OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH to contain the
DYLD_VERSIONED_FRAMEWORK_PATH value when USE_STAGING_INSTALL_PATH is YES.
* Configurations/BaseXPCService.xcconfig: Include OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH in the
value of OTHER_LDFLAGS.
* Configurations/PluginService.32.xcconfig: Ditto.
* Configurations/PluginService.64.xcconfig: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157561 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GStreamer] Too many arguments for format in WebKitWebAudioSourceGStreamer.cpp
https://bugs.webkit.org/show_bug.cgi?id=122932

Patch by Brendan Long <b.long@cablelabs.com> on 2013-10-17
Reviewed by Philippe Normand.

No new tests because this just fixes a build warning.

* platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
(webKitWebAudioSrcLoop): Add another %s for the second part of the pad name.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157560 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Transition remaining op_get* JITStubs to JIT operations.
https://bugs.webkit.org/show_bug.cgi?id=122925.

Reviewed by Geoffrey Garen.

Transitioning:
    cti_op_get_by_id_generic
    cti_op_get_by_val
    cti_op_get_by_val_generic
    cti_op_get_by_val_string

* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOpcodes.cpp:
(JSC::JIT::emitSlow_op_get_arguments_length):
(JSC::JIT::emitSlow_op_get_argument_by_val):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emitSlow_op_get_arguments_length):
(JSC::JIT::emitSlow_op_get_argument_by_val):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_pname):
(JSC::JIT::privateCompileGetByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_pname):
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* runtime/Executable.cpp:
(JSC::setupLLInt): Added some UNUSED_PARAMs to fix the no LLINT build.
* runtime/Options.cpp:
(JSC::Options::initialize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157559 268f45cc-cd09-0410-ab3c-d52691b4dbfc

libllvmForJSC shouldn't call exit(1) on report_fatal_error()
https://bugs.webkit.org/show_bug.cgi?id=122905
<rdar://problem/15237856>

Source/JavaScriptCore:

Reviewed by Michael Saboff.

Expose the new LLVMInstallFatalErrorHandler() API through the soft linking magic and
then always call it to install something that calls CRASH().

* llvm/InitializeLLVM.cpp:
(JSC::llvmCrash):
(JSC::initializeLLVMOnce):
(JSC::initializeLLVM):
* llvm/LLVMAPIFunctions.h:

WebKitLibraries:

Reviewed by Michael Saboff.

* LLVMIncludesMountainLion.tar.bz2:
* LLVMLibrariesMountainLion.tar.bz2:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157558 268f45cc-cd09-0410-ab3c-d52691b4dbfc

We need test coverage for just the Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=122929

Reviewed by Sam Weinig.

Adds no-LLInt versions of all tests. For the Mozilla tests, also add a BaselineJIT-only
variant.

* Scripts/run-jsc-stress-tests:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157557 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Prototype chain repatching in the polymorphic case fails to check if the receiver is a dictionary
https://bugs.webkit.org/show_bug.cgi?id=122938

Reviewed by Sam Weinig.

This fixes jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.

* jit/Repatch.cpp:
(JSC::tryBuildGetByIDList):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157556 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add a new flakiness dashboard clone
https://bugs.webkit.org/show_bug.cgi?id=122936

Reviewed by Anders Carlsson.

Added the initial prototype.

* Websites/test-results: Added.
* Websites/test-results/.htaccess: Added.
* Websites/test-results/admin: Added.
* Websites/test-results/admin/index.php: Added.
* Websites/test-results/api: Added.
* Websites/test-results/api/manifest.php: Added.
* Websites/test-results/api/report.php: Added.
* Websites/test-results/api/results.php: Added.
* Websites/test-results/include: Added.
* Websites/test-results/include/config.json: Added.
* Websites/test-results/include/db.php: Added.
* Websites/test-results/include/init-database.sql: Added.
* Websites/test-results/include/json-shared.php: Added.
* Websites/test-results/include/test-results.php: Added.
* Websites/test-results/index.html: Added.
* Websites/test-results/js: Added.
* Websites/test-results/js/autocompleter.js: Added.
* Websites/test-results/js/build.js: Added.
* Websites/test-results/js/dom.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157555 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JIT::appendCall() needs to killLastResultRegister() or equivalent since there's some really bad code that expects it
https://bugs.webkit.org/show_bug.cgi?id=122937

Reviewed by Geoffrey Garen.

JITStubCall used to do it.

This makes mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline pass.

* jit/JIT.h:
(JSC::JIT::appendCall):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157554 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Support multiple repositories in submitting results to --results-server-host
https://bugs.webkit.org/show_bug.cgi?id=122935

Reviewed by Anders Carlsson.

Remoevd --got-revision and added the logic to extract revision information
from multiple repositories as done in run-perf-tests.

* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager.upload_results):
* Scripts/webkitpy/layout_tests/run_webkit_tests.py:
(parse_args):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157553 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed EFL gardening. Rebaselining after r155607.

* platform/efl-wk2/compositing/overflow/clipping-behaviour-change-is-not-propagated-to-descendants-expected.txt: Added.
* platform/efl-wk2/compositing/overflow/clipping-behaviour-change-is-not-propagated-to-descendants2-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157552 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Attempt to fix the Windows build after trac.webkit.org/changeset/157547.

Apparently some *more* Windows code uses setFrame and I missed it.

* FullscreenVideoController.cpp:
(FullscreenVideoController::LayerClient::platformCALayerLayoutSublayersOfLayer):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157551 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Attempt to fix the Windows build after trac.webkit.org/changeset/157547.

The relevant conversion doesn't happen implicitly.

* platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
(WebCore::MediaPlayerPrivateFullscreenWindow::setRootChildLayer):
(WebCore::MediaPlayerPrivateFullscreenWindow::wndProc):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157550 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed EFL gardening. Rebaselining after r156527.

* platform/efl/compositing/contents-opaque/hidden-with-visible-text-expected.txt:
* platform/efl/svg/text/append-text-node-to-tspan-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157549 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Attempt to fix the Windows build after trac.webkit.org/changeset/157547.

Apparently some Windows code uses setFrame and I missed it.

* platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
(WebCore::MediaPlayerPrivateFullscreenWindow::setRootChildLayer):
(WebCore::MediaPlayerPrivateFullscreenWindow::wndProc):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157548 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remote Layer Tree: Complete support for simple layer properties
https://bugs.webkit.org/show_bug.cgi?id=122933

Reviewed by Anders Carlsson.

Add remote layer tree support for maskLayer, contentsRect, contentsScale,
minificationFilter, magnificationFilter, speed, and timeOffset.

No new tests, not yet testable.

* Shared/mac/RemoteLayerTreeTransaction.h:
* Shared/mac/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):
(WebKit::dumpProperty):
(WebKit::dumpChangedLayers):
Add the new properties.

* UIProcess/mac/RemoteLayerTreeHost.mm:
(WebKit::toCAFilterType):
(WebKit::RemoteLayerTreeHost::commit):
Apply the new properties.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(PlatformCALayerRemote::setSublayers):
(PlatformCALayerRemote::appendSublayer):
(PlatformCALayerRemote::insertSublayer):
Ensure that passed-in sublayers are always also PlatformCALayerRemote instances.
These are ASSERT_WITH_SECURITY_IMPLICATION as we will later unconditionally static_cast
them to PlatformCALayerRemote.

(PlatformCALayerRemote::setMask):
(PlatformCALayerRemote::setContentsRect):
(PlatformCALayerRemote::setMinificationFilter):
(PlatformCALayerRemote::setMagnificationFilter):
(PlatformCALayerRemote::setSpeed):
(PlatformCALayerRemote::setTimeOffset):
(PlatformCALayerRemote::contentsScale):
(PlatformCALayerRemote::setContentsScale):
Remove setFrame, store the new properties.

* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
Remove setFrame, add isRemote, fix pointer side on playerLayer.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::setName):
Don't dump the CALayer pointer if we own a PlatformCALayerRemote.

(WebCore::GraphicsLayerCA::recursiveCommitChanges):
Fix the visible tile wash (my fault!), and make it use setPosition and
setBounds instead of setFrame; while more convenient, it is the only
caller of setFrame, so we'll remove it.

* platform/graphics/ca/PlatformCALayer.h:
(WebCore::PlatformCALayer::isRemote): Added.

* platform/graphics/ca/mac/PlatformCALayerMac.h:
* platform/graphics/ca/mac/PlatformCALayerMac.mm:
(nullActionsDictionary):
(toCAFilterType):
(PlatformCALayerMac::synchronouslyDisplayTilesInRect):
(PlatformCALayerMac::playerLayer):
Remove setFrame, fix some pointer sides.

* platform/graphics/ca/win/PlatformCALayerWin.cpp:
* platform/graphics/ca/win/PlatformCALayerWin.h:
Remove setFrame.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157547 268f45cc-cd09-0410-ab3c-d52691b4dbfc

transition void cti_op_put_by_val* stubs to JIT operations
https://bugs.webkit.org/show_bug.cgi?id=122903

Reviewed by Geoffrey Garen.

Transitioned cti_op_put_by_val and cti_op_put_by_val_generic to operationPutByVal and
operationPutByValGeneric.

* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::privateCompilePutByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitSlow_op_put_by_val):
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/JSInterfaceJIT.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157546 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore: Implement ES6 spread operator
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Implement the ES6 spread operator

This has a little bit of refactoring to move the enumeration logic out ForOfNode
and into BytecodeGenerator, and then adds the logic to make it nicely callback
driven.

The rest of the logic is just the addition of the SpreadExpressionNode, the parsing,
and actually handling the spread.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitNewArray):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitEnumeration):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::emitBytecode):
(JSC::ForOfNode::emitBytecode):
(JSC::SpreadExpressionNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::createSpreadExpression):
* parser/Lexer.cpp:
(JSC::::lex):
* parser/NodeConstructors.h:
(JSC::SpreadExpressionNode::SpreadExpressionNode):
* parser/Nodes.h:
(JSC::ExpressionNode::isSpreadExpression):
(JSC::SpreadExpressionNode::expression):
* parser/Parser.cpp:
(JSC::::parseArrayLiteral):
(JSC::::parseArguments):
(JSC::::parseMemberExpression):
* parser/Parser.h:
(JSC::Parser::getTokenName):
(JSC::Parser::updateErrorMessageSpecialCase):
* parser/ParserTokens.h:
* parser/SyntaxChecker.h:
(JSC::SyntaxChecker::createSpreadExpression):

LayoutTests: Implement spread
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Add testcases

* js/basic-spread-expected.txt: Added.
* js/basic-spread.html: Added.
* js/parser-syntax-check-expected.txt:
* js/script-tests/basic-spread.js: Added.
(f):
(o.f.o.f.o.f.o.f.h.eval.o.h.o.h.o.h.o.h.g):
* js/script-tests/parser-syntax-check.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157545 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed build fix attempt on EFL port after r157520 and r157523

Source/WebKit2:

* Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
* Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h:
Removed ArgumentCoder<TransformationMatrix> which caused redefinition build error
in EFL port.

Source/WTF:

* wtf/PassRef.h: includes <utility>

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157544 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add a useLLInt option to jsc
https://bugs.webkit.org/show_bug.cgi?id=122930

Reviewed by Geoffrey Garen.

* runtime/Executable.cpp:
(JSC::setupLLInt):
(JSC::setupJIT):
(JSC::ScriptExecutable::prepareForExecutionImpl):
* runtime/Options.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157543 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix.

Forgot to svn add DeferGC.cpp

* heap/DeferGC.cpp: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157542 268f45cc-cd09-0410-ab3c-d52691b4dbfc

r157411 fails run-javascriptcore-tests when run with Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=122902

Reviewed by Mark Hahnenberg.

It turns out that this was a long-standing bug in the DFG PutById repatching logic. It's
not legal to patch if the typeInfo tells you that you can't patch. The old JIT's patching
logic did this right, and the DFG's GetById patching logic did it right; but DFG PutById
didn't. Turns out that there's even a helpful method,
Structure::propertyAccessesAreCacheable(), that will even do all of the checks for you!

* jit/Repatch.cpp:
(JSC::tryCachePutByID):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157541 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Publish SunSpider 1.0.2
https://bugs.webkit.org/show_bug.cgi?id=122923

Reviewed by Darin Adler.

* perf/sunspider/sunspider.html:
* perf/sunspider/versions.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157540 268f45cc-cd09-0410-ab3c-d52691b4dbfc

llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
https://bugs.webkit.org/show_bug.cgi?id=122667

Reviewed by Geoffrey Garen.

The issue this patch is attempting to fix is that there are places in our codebase
where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
operations that can initiate a garbage collection. Garbage collection then calls
some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
always necessarily run during garbage collection). This causes a deadlock.

To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores
into a thread-local field that indicates that it is unsafe to perform any operation
that could trigger garbage collection on the current thread. In debug builds,
ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly
detect deadlocks.

This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
which uses the DeferGC mechanism to prevent collections from occurring while the
lock is held.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.h:
(JSC::DisallowGC::DisallowGC):
(JSC::DisallowGC::~DisallowGC):
(JSC::DisallowGC::isGCDisallowedOnCurrentThread):
(JSC::DisallowGC::initialize):
* jit/Repatch.cpp:
(JSC::repatchPutByID):
(JSC::buildPutByIdList):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
(JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::unlockEarly):
(JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
(JSC::GCSafeConcurrentJITLocker::~GCSafeConcurrentJITLocker):
(JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer):
(JSC::ConcurrentJITLocker::ConcurrentJITLocker):
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/JSSymbolTableObject.h:
(JSC::symbolTablePut):
* runtime/Structure.cpp: materializePropertyMapIfNecessary* now has a problem in that it
can start a garbage collection when the GCSafeConcurrentJITLocker goes out of scope, but
before the caller has a chance to use the newly created PropertyTable. The garbage collection
clears the PropertyTable, and then the caller uses it assuming it's valid. To avoid this,
we must DeferGC until the caller is done getting the newly materialized PropertyTable from
the Structure.
(JSC::Structure::materializePropertyMap):
(JSC::Structure::despecifyDictionaryFunction):
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::isSealed):
(JSC::Structure::isFrozen):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::get):
(JSC::Structure::despecifyFunction):
(JSC::Structure::despecifyAllFunctions):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
(JSC::Structure::getPropertyNamesFromStructure):
* runtime/Structure.h:
(JSC::Structure::materializePropertyMapIfNecessary):
(JSC::Structure::materializePropertyMapIfNecessaryForPinning):
* runtime/StructureInlines.h:
(JSC::Structure::get):
* runtime/SymbolTable.h:
(JSC::SymbolTable::find):
(JSC::SymbolTable::end):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157539 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove Qt sandbox process code
https://bugs.webkit.org/show_bug.cgi?id=122920

Reviewed by Geoffrey Garen.

This code was only used by the Qt port, and the other Linux-based ports are using the seccomp based sandbox.

* Shared/linux/SandboxProcess/SandboxEnvironmentLinux.cpp: Removed.
* Shared/linux/SandboxProcess/SandboxEnvironmentLinux.h: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157538 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add SPI to disable the garbage collector timer
https://bugs.webkit.org/show_bug.cgi?id=122921

Reviewed by Geoffrey Garen.

Based on a patch by Mark Hahnenberg.

* API/JSBase.cpp:
(JSDisableGCTimer): Added; SPI function.
* API/JSBasePrivate.h:
* heap/BlockAllocator.cpp:
(JSC::createBlockFreeingThread): Added.
(JSC::BlockAllocator::BlockAllocator): Modified to use JSC::createBlockFreeingThread()
to conditionally create the "block freeing" thread depending on the value of
GCActivityCallback::s_shouldCreateGCTimer.
(JSC::BlockAllocator::~BlockAllocator):
* heap/BlockAllocator.h:
(JSC::BlockAllocator::deallocate):
* heap/Heap.cpp:
(JSC::Heap::didAbandon):
(JSC::Heap::collect):
(JSC::Heap::didAllocate):
* heap/HeapTimer.cpp:
(JSC::HeapTimer::timerDidFire):
* runtime/GCActivityCallback.cpp:
* runtime/GCActivityCallback.h:
(JSC::DefaultGCActivityCallback::create): Only instantiate a DefaultGCActivityCallback object
when GCActivityCallback::s_shouldCreateGCTimer is true so as to prevent allocating a HeapTimer
object (since DefaultGCActivityCallback ultimately extends HeapTimer).

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157537 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r157529.
http://trac.webkit.org/changeset/157529
https://bugs.webkit.org/show_bug.cgi?id=122919

Caused score test failures and some build failures. (Requested
by rfong on #webkit).

Source/JavaScriptCore:

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitNewArray):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::emitBytecode):
(JSC::CallArguments::CallArguments):
(JSC::ForOfNode::emitBytecode):
(JSC::BindingNode::collectBoundIdentifiers):
* parser/ASTBuilder.h:
* parser/Lexer.cpp:
(JSC::::lex):
* parser/NodeConstructors.h:
(JSC::DotAccessorNode::DotAccessorNode):
* parser/Nodes.h:
* parser/Parser.cpp:
(JSC::::parseArrayLiteral):
(JSC::::parseArguments):
(JSC::::parseMemberExpression):
* parser/Parser.h:
(JSC::Parser::getTokenName):
(JSC::Parser::updateErrorMessageSpecialCase):
* parser/ParserTokens.h:
* parser/SyntaxChecker.h:

LayoutTests:

* js/basic-spread-expected.txt: Removed.
* js/basic-spread.html: Removed.
* js/parser-syntax-check-expected.txt:
* js/script-tests/basic-spread.js: Removed.
* js/script-tests/parser-syntax-check.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157536 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Take RenderObjects out of the arena.
<https://webkit.org/b/122895>

Reviewed by Antti Koivisto.

Stop arena-allocating renderers so we can move forward on improving
render tree memory management. This will also allow rendering code
to take advantage of malloc optimizations.

Line boxes and BiDi runs remain in the arena for now.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157535 268f45cc-cd09-0410-ab3c-d52691b4dbfc

A page should exit fullscreen mode if it opens a new popup
https://bugs.webkit.org/show_bug.cgi?id=122865

Reviewed by Jer Noble.

Source/WebKit/blackberry:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebCoreSupport/ChromeClientBlackBerry.cpp:
(WebCore::ChromeClientBlackBerry::createWindow):

Source/WebKit/efl:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebCoreSupport/ChromeClientEfl.cpp:
(WebCore::ChromeClientEfl::createWindow):

Source/WebKit/gtk:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebCoreSupport/ChromeClientGtk.cpp:
(WebKit::ChromeClient::createWindow):

Source/WebKit/mac:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebCoreSupport/WebChromeClient.mm:
(WebChromeClient::createWindow):

Source/WebKit/win:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebCoreSupport/WebChromeClient.cpp:
(WebChromeClient::createWindow):

Source/WebKit2:

If a fullscreen page opens a popup, the popup would be hidden and
therefore invisible to the user. To avoid this, exit fullscreen mode
before opening a new window.

* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createWindow):

LayoutTests:

* fullscreen/full-screen-exit-when-popup-expected.txt: Added.
* fullscreen/full-screen-exit-when-popup.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157534 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Windows] Speculative fix for test, media/video-canvas-drawing-output.html.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::createImageForTimeInRect):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157533 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove useless architecture specific implementation in DFG.
https://bugs.webkit.org/show_bug.cgi?id=122917.

Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-16
Reviewed by Michael Saboff.

With CPU(ARM) && CPU(ARM_HARDFP) architecture, the fallback implementation is fine
as FPRInfo::argumentFPR0 == FPRInfo::returnValueFPR in this case.

* dfg/DFGSpeculativeJIT.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157532 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Blind attempt to fix non-DATABASE_PROCESS builds.

* WebProcess/WebProcess.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157531 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove unused JIT::restoreArgumentReferenceForTrampoline function.
https://bugs.webkit.org/show_bug.cgi?id=122916.

Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-16
Reviewed by Michael Saboff.

This architecture specific function is not used anymore, so get rid of it.

* jit/JIT.h:
* jit/JITInlines.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157530 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore: Implement ES6 spread operator
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Implement the ES6 spread operator

This has a little bit of refactoring to move the enumeration logic out ForOfNode
and into BytecodeGenerator, and then adds the logic to make it nicely callback
driven.

The rest of the logic is just the addition of the SpreadExpressionNode, the parsing,
and actually handling the spread.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitNewArray):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitEnumeration):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::emitBytecode):
(JSC::ForOfNode::emitBytecode):
(JSC::SpreadExpressionNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::createSpreadExpression):
* parser/Lexer.cpp:
(JSC::::lex):
* parser/NodeConstructors.h:
(JSC::SpreadExpressionNode::SpreadExpressionNode):
* parser/Nodes.h:
(JSC::ExpressionNode::isSpreadExpression):
(JSC::SpreadExpressionNode::expression):
* parser/Parser.cpp:
(JSC::::parseArrayLiteral):
(JSC::::parseArguments):
(JSC::::parseMemberExpression):
* parser/Parser.h:
(JSC::Parser::getTokenName):
(JSC::Parser::updateErrorMessageSpecialCase):
* parser/ParserTokens.h:
* parser/SyntaxChecker.h:
(JSC::SyntaxChecker::createSpreadExpression):

LayoutTests: Implement spread
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Add testcases

* js/basic-spread-expected.txt: Added.
* js/basic-spread.html: Added.
* js/parser-syntax-check-expected.txt:
* js/script-tests/basic-spread.js: Added.
(f):
(o.f.o.f.o.f.o.f.h.eval.o.h.o.h.o.h.o.h.g):
* js/script-tests/parser-syntax-check.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157529 268f45cc-cd09-0410-ab3c-d52691b4dbfc

PlatformCALayer constructor should take layer type as an argument
https://bugs.webkit.org/show_bug.cgi?id=122915

Reviewed by Simon Fraser.

No new tests, just a minor refactoring.

* platform/graphics/ca/PlatformCALayer.h:
(WebCore::PlatformCALayer::PlatformCALayer):
Add a LayerType argument.

* platform/graphics/ca/mac/PlatformCALayerMac.mm:
(PlatformCALayerMac::PlatformCALayerMac):
* platform/graphics/ca/win/PlatformCALayerWin.cpp:
(PlatformCALayerWin::PlatformCALayerWin):
Use the new LayerType argument, and early-return in the case where we
are wrapping a custom PlatformLayer.
Drive-by un-indent the switch in the Mac version.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(PlatformCALayerRemote::PlatformCALayerRemote):
Use the new LayerType argument.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157528 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remote Layer Tree: Use a default instead of an environment variable
https://bugs.webkit.org/show_bug.cgi?id=122913

Reviewed by Anders Carlsson.

* UIProcess/API/mac/WKView.mm:
(-[WKView std::WebKit::]):
Use the default 'WebKit2UseRemoteLayerTreeDrawingArea' instead of
the environment variable 'WK_USE_REMOTE_LAYER_TREE_DRAWING_AREA'
to indicate that WKViews should make RemoteLayerTreeDrawingAreas.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157527 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157526 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Flesh out the DatabaseProcess (and launch it!)
https://bugs.webkit.org/show_bug.cgi?id=122884

Reviewed by Tim Horton.

Source/WebCore:

* English.lproj/Localizable.strings: Add a localizable string.
* WebCore.xcodeproj/project.pbxproj: Export some more headers.

Source/WebKit2:

This patch adds actual process launching and basic messaging infrastructure for the DatabaseProcess.

It still does very little except exist.

Project file stuff:
* WebKit2.xcodeproj/project.pbxproj:
* DerivedSources.make:

WebContext owns the DatabaseProcess (much like the NetworkProcess):
* UIProcess/WebContext.cpp:
(WebKit::WebContext::ensureDatabaseProcess):
(WebKit::WebContext::getDatabaseProcessConnection):
* UIProcess/WebContext.h:

Add a basic DatabaseProcess that - for now - can only return a new Connection for a WebProcess:
* DatabaseProcess/DatabaseProcess.cpp:
(WebKit::DatabaseProcess::createDatabaseToWebProcessConnection):
* DatabaseProcess/DatabaseProcess.h:
* DatabaseProcess/DatabaseProcess.messages.in: Added.

Add an object to represent a single connection to a single WebProcess:
* DatabaseProcess/DatabaseToWebProcessConnection.cpp:
(WebKit::DatabaseToWebProcessConnection::create):
(WebKit::DatabaseToWebProcessConnection::DatabaseToWebProcessConnection):
(WebKit::DatabaseToWebProcessConnection::~DatabaseToWebProcessConnection):
(WebKit::DatabaseToWebProcessConnection::didReceiveMessage):
(WebKit::DatabaseToWebProcessConnection::didClose):
(WebKit::DatabaseToWebProcessConnection::didReceiveInvalidMessage):
* DatabaseProcess/DatabaseToWebProcessConnection.h:

Basic DatabaseProcessProxy with the ability to ask the DatabaseProcess for a connection to hand back to a WebProcess:
* UIProcess/Databases/DatabaseProcessProxy.cpp:
(WebKit::DatabaseProcessProxy::DatabaseProcessProxy):
(WebKit::DatabaseProcessProxy::getDatabaseProcessConnection):
(WebKit::DatabaseProcessProxy::didCreateDatabaseToWebProcessConnection):
(WebKit::DatabaseProcessProxy::didFinishLaunching):
* UIProcess/Databases/DatabaseProcessProxy.h:
* UIProcess/Databases/DatabaseProcessProxy.messages.in: Added.

Add an object to represent a WebProcess’s connection to a DatabaseProcess:
* WebProcess/Databases/WebToDatabaseProcessConnection.cpp:
(WebKit::WebToDatabaseProcessConnection::WebToDatabaseProcessConnection):
(WebKit::WebToDatabaseProcessConnection::~WebToDatabaseProcessConnection):
(WebKit::WebToDatabaseProcessConnection::didReceiveMessage):
(WebKit::WebToDatabaseProcessConnection::didClose):
(WebKit::WebToDatabaseProcessConnection::didReceiveInvalidMessage):
* WebProcess/Databases/WebToDatabaseProcessConnection.h:
(WebKit::WebToDatabaseProcessConnection::create):
(WebKit::WebToDatabaseProcessConnection::connection):

Give WebProcess(Proxy) an accessor for a Web -> Database process connection:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::webToDatabaseProcessConnectionClosed):
(WebKit::WebProcess::webToDatabaseProcessConnection):
(WebKit::WebProcess::ensureWebToDatabaseProcessConnection):
* WebProcess/WebProcess.h:
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::getDatabaseProcessConnection):
* UIProcess/WebProcessProxy.h:
* UIProcess/WebProcessProxy.messages.in:

* WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp:
(WebKit::WebIDBFactoryBackend::open): Access the database process connection to test that it works.

* WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
(WebKit::WebPlatformStrategies::createIDBFactoryBackend): Keep non-DATABASE_PROCESS builds working.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157524 268f45cc-cd09-0410-ab3c-d52691b4dbfc

RemoteLayerTree: Add support for more layer properties and transform layers
https://bugs.webkit.org/show_bug.cgi?id=122906

Reviewed by Anders Carlsson.

Add support for name, border width, border color, opacity, transform, sublayer transform,
hidden, geometry flipped, double sided, masks to bounds, and opaque layer properties.

Factor layer creation out from layer changes, so that we can create layers of the correct
type. Use this mechanism to create CATransformLayers when handed a LayerTypeTransformLayer.

No new tests, this code is not yet testable.

* WebCore.exp.in:
Export some TextStream and TransformationMatrix stuff.

* Shared/WebCoreArgumentCoders.cpp:
(CoreIPC::::encode):
(CoreIPC::::decode):
* Shared/WebCoreArgumentCoders.h:
Add coders for TransformationMatrix.

* Shared/mac/RemoteLayerTreeTransaction.h:
Add the new LayerChange values.

(WebKit::RemoteLayerTreeTransaction::LayerProperties::notePropertiesChanged):
LayerProperties::layerChanges should be a LayerChange.

(WebKit::RemoteLayerTreeTransaction::createdLayers):
Expose the list of newly created layers (for RemoteLayerTreeHost's consumption).

* Shared/mac/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::LayerCreationProperties):
(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::decode):
Add (and support coding) a new LayerCreationProperties struct, which is currently
just a pair of LayerID and PlatformCALayer::LayerType. Additional properties may follow.

(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):
Encode and decode all of the new layer properties.
Encode changedProperties as an enum, not an unsigned.

(WebKit::RemoteLayerTreeTransaction::encode):
(WebKit::RemoteLayerTreeTransaction::decode):
Encode and decode the list of newly created layers.

(WebKit::RemoteLayerTreeTransaction::setCreatedLayers):
Setter for the list of newly created layers, which comes from the
RemoteLayerTreeContext at commit time.

(WebKit::dumpProperty):
Helper function to dump TransformationMatrix instances.

(WebKit::dumpChangedLayers):
Dump all of the new layer properties.

(WebKit::RemoteLayerTreeTransaction::dump):
Dump the list of newly created layers.

* UIProcess/mac/RemoteLayerTreeHost.h:
* UIProcess/mac/RemoteLayerTreeHost.mm:
(WebKit::cgColorFromColor):
Factor out the code to make a CGColor from a WebCore::Color, as we need it
for both border and background color.

(WebKit::RemoteLayerTreeHost::commit):
Create layers before applying changes, using the new list of newly created layers.
When applying changes, ensure that the layer we're interested in was already created.
Rename "sublayer" to "layer", and use dot notation everywhere.
Apply all the new layer properties to the layers.

(WebKit::RemoteLayerTreeHost::getLayer):
(WebKit::RemoteLayerTreeHost::createLayer):
Separate creating a new layer from retrieving it by ID.
Ensure that a layer doesn't already exist when creating it.
Support creating CATransformLayers.

* WebProcess/WebPage/mac/GraphicsLayerCARemote.h:
Disable accelerated animations, as we don't support proxying animations yet.
This makes GraphicsLayer fall back to software animations, which already work wonderfully remotely.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(PlatformCALayerRemote::PlatformCALayerRemote):
Inform the RemoteLayerTreeContext of the creation of every PlatformCALayerRemote.

(PlatformCALayerRemote::removeFromSuperlayer):
(PlatformCALayerRemote::replaceSublayer):
(PlatformCALayerRemote::adoptSublayers):
Assert when we hit a few critical unimplemented methods that would
leave the layer tree in a broken state.

(PlatformCALayerRemote::isOpaque):
(PlatformCALayerRemote::setOpaque):
(PlatformCALayerRemote::transform):
(PlatformCALayerRemote::setTransform):
(PlatformCALayerRemote::sublayerTransform):
(PlatformCALayerRemote::setSublayerTransform):
(PlatformCALayerRemote::setHidden):
(PlatformCALayerRemote::setGeometryFlipped):
(PlatformCALayerRemote::isDoubleSided):
(PlatformCALayerRemote::setDoubleSided):
(PlatformCALayerRemote::masksToBounds):
(PlatformCALayerRemote::setMasksToBounds):
(PlatformCALayerRemote::setBorderWidth):
(PlatformCALayerRemote::setBorderColor):
(PlatformCALayerRemote::opacity):
(PlatformCALayerRemote::setOpacity):
(PlatformCALayerRemote::setName):
Proxy all of these properties via RemoteLayerTreeTransaction.

* WebProcess/WebPage/mac/RemoteLayerTreeContext.h:
Add storage for the list of newly created layers.
Use LayerID for the list of destroyed layers.

* WebProcess/WebPage/mac/RemoteLayerTreeContext.mm:
(WebKit::RemoteLayerTreeContext::layerWasCreated):
Store the ID and type of the newly created layer to be pushed to the UI process later.

(WebKit::RemoteLayerTreeContext::flushLayers):
Push the created and destroyed layers to the transaction *after* flushing
GraphicsLayers, so that any changes to e.g. structural layers will not be missed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157523 268f45cc-cd09-0410-ab3c-d52691b4dbfc

During editing, merge inline style with overriding other author styles
https://bugs.webkit.org/show_bug.cgi?id=122874

Patch by KyungTae Kim <ktf.kim@samsung.com> on 2013-10-16
Reviewed by Ryosuke Niwa.

Source/WebCore:

Inline styles need to override other author styles even on DoNotOverrideValues mode.
So, merge and override inline styles to other author styles before merging them to m_mutableStyle.

Test: editing/deleting/merge-div-with-inline-style.html

* editing/EditingStyle.cpp:
(WebCore::EditingStyle::mergeInlineAndImplicitStyleOfElement):

LayoutTests:

Add a test for merging inline styles of parents.

* editing/deleting/merge-div-with-inline-style.html: Added.
* editing/deleting/merge-div-with-inline-style-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157522 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Transition void cti_op_tear_off* methods to JIT operations for 32 bit.
https://bugs.webkit.org/show_bug.cgi?id=122899.

Reviewed by Michael Saboff.

* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_tear_off_activation):
(JSC::JIT::emit_op_tear_off_arguments):
* jit/JITStubs.cpp:
* jit/JITStubs.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157521 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add PassRef and createRefCounted so we can improve creation of RefCounted objects
https://bugs.webkit.org/show_bug.cgi?id=122904

Reviewed by Anders Carlsson.

Source/WTF:

* GNUmakefile.list.am: Added PassRef.h.
* WTF.vcxproj/WTF.vcxproj: Ditto.
* WTF.vcxproj/WTF.vcxproj.filters: Ditto.
* WTF.xcodeproj/project.pbxproj: Ditto.
* wtf/CMakeLists.txt: Ditto.

* wtf/Forward.h: Added PassRef. Also re-sorted and un-indented to match what
the style-checking script expects.

* wtf/PassRef.h: Added. Includes the createRefCounted function template, which
is analogous to make_unique, but is for reference counted objects, and also
assumes that new will never return null. Also includes an overload of adoptRef
that takes a reference rather than a pointer.

* wtf/PassRefPtr.h: Include "PassRef.h" so we can share the adopted function.
Got rid of declarations that duplicate ones in there.
(WTF::refIfNotNull): Use nullptr.
(WTF::derefIfNotNull): Use nullptr.
(WTF::PassRefPtr::PassRefPtr): Use nullptr. Added an overload that takes a PassRef.
(WTF::PassRefPtr::operator UnspecifiedBoolType): Use nullptr.
(WTF::PassRefPtr::operator=): Made this deleted instead of compile time assertion.
(WTF::PassRefPtr::PassRefPtr): Made adopting constructor use an adopt tag instead
of an unused boolean.
(WTF::PassRefPtr::leakRef): Use nullptr.
(WTF::adoptRef): Use the adopt tag.

* wtf/Ref.h: Use Noncopyable instead of rolling our own.
(WTF::Ref::Ref): Add an overload that takes a PassRef.
(WTF::Ref::operator=): Ditto.

* wtf/RefPtr.h: Removed unneeded forward declaration of PassRefPtr.
(WTF::RefPtr::RefPtr): Use nullptr. Added overload that takes a PassRef.
(WTF::RefPtr::release): Use nullptr.
(WTF::RefPtr::operator UnspecifiedBoolType): Use nullptr.
(WTF::RefPtr::operator=): Added overload that takes a PassRef.
(WTF::RefPtr::clear): Use nullptr.

* wtf/StdLibExtras.h: Added inline keyword to isPointerTypeAlignmentOkay,
reinterpret_cast_ptr, and make_unique. Seems like a simple oversight that these
were missing before.

Tools:

* TestWebKitAPI/Tests/WTF/Ref.cpp: Added some basic tests for adoptRef and PassRef.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157520 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Need tests for RefPtr self-assignment and self-move-assignment.

* TestWebKitAPI/Tests/WTF/RefPtr.cpp: Added tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157519 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Emphasis marks has wrong color.
https://bugs.webkit.org/show_bug.cgi?id=122829

Patch by peavo@outlook.com <peavo@outlook.com> on 2013-10-16
Reviewed by Antti Koivisto.

Source/WebCore:

Tests: fast/text/text-emphasis.html.
       fast/text/text-emphasis-expected.html.

Emphasis color should be set as fill color, not stroke color.

* rendering/TextPaintStyle.cpp:
(WebCore::updateGraphicsContext):
* rendering/TextPaintStyle.h:

LayoutTests:

* fast/text/text-emphasis-expected.html: Added.
* fast/text/text-emphasis.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157518 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move code for finding rendered character offset to RenderTextLineBoxes
https://bugs.webkit.org/show_bug.cgi?id=122892

Reviewed by Andreas Kling.

* rendering/RenderText.cpp:
(WebCore::RenderText::countRenderedCharacterOffsets):
(WebCore::RenderText::containsRenderedCharacterOffset):

    Renamed for consistency.

* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::countCharacterOffsets):

    This used to be Position::renderedPosition.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157517 268f45cc-cd09-0410-ab3c-d52691b4dbfc

RenderElement::removeChild() should take child as a reference.
<https://webkit.org/b/122888>

We can't remove a child without a child to remove.

Reviewed by Antti Koivisto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157515 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move test for contained caret offset to RenderTextLineBoxes
https://bugs.webkit.org/show_bug.cgi?id=122887

Reviewed by Andreas Kling.

* dom/Position.cpp:
(WebCore::Position::renderedOffset):
(WebCore::Position::isCandidate):

    Remove isRenderedText, call RenderText::containsCaretOffset instead.

(WebCore::Position::isRenderedCharacter):
(WebCore::Position::rendersInDifferentPosition):
* dom/Position.h:
* dom/PositionIterator.cpp:
(WebCore::PositionIterator::isCandidate):
* rendering/InlineTextBox.cpp:
* rendering/InlineTextBox.h:
* rendering/RenderText.cpp:
(WebCore::RenderText::containsCharacterOffset):
(WebCore::RenderText::containsCaretOffset):
* rendering/RenderText.h:
* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::containsOffset):

    Combined implementations of Position::isRenderedCharacter and Position::isRenderedText.

* rendering/RenderTextLineBoxes.h:

    Remove containsCaretOffset(), functionality is now in RenderTextLineBoxes::containsOffset.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@157514 268f45cc-cd09-0410-ab3c-d52691b4dbfc