Multi-hop reference cycles not detected.
https://bugs.webkit.org/show_bug.cgi?id=149181

Reviewed by John Honeycutt.

Source/WebCore:

SVG's cycle detection was not picking up a
case where an element was drawing a pattern, that
referenced another pattern, that referenced another
pattern, that referenced the original pattern.

The issue was that we were forgetting to check the
children of the renderer itself, rather than just
the children of the referenced renderers.

Found by running a test from Blink.

I also took the opportunity to clean up the debugging
code that logs cycle detection.

Test: svg/custom/pattern-3-step-cycle.html

* platform/Logging.h: Add a new SVG channel. I can't believe we
didn't already have one!
* rendering/svg/SVGResourcesCycleSolver.cpp:
(WebCore::SVGResourcesCycleSolver::resourceContainsCycles): Check the referenced
resources for cycles.
(WebCore::SVGResourcesCycleSolver::resolveCycles): Logging update.

LayoutTests:

Test comes from:
https://chromium.googlesource.com/chromium/blink/+/master/LayoutTests/svg/custom/pattern-3-step-cycle.html

* svg/custom/pattern-3-step-cycle-expected.txt: Added.
* svg/custom/pattern-3-step-cycle.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189954 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Cyclic resources were not detected if the reference had deep containers
https://bugs.webkit.org/show_bug.cgi?id=149182

Reviewed by John Honeycutt.

Source/WebCore:

During our examination of the SVG rendering tree looking for cycles,
if a resource pointed to something that had a nested structure, and
one of the parent nodes in that structure was a container object
without resources itself, we were not looking into the children.

Test: svg/custom/pattern-content-cycle-w-resourceless-container.html

* rendering/svg/SVGResourcesCycleSolver.cpp:
(WebCore::SVGResourcesCycleSolver::resourceContainsCycles): We should still
check all children resources, but not exit early if there are none. Instead
we should recurse into any children.
(WebCore::SVGResourcesCycleSolver::resolveCycles): Changes to some debug
code that no longer compiled (it's still off by default, but at least
it will work now).

LayoutTests:

This test was ported from Blink. I believe it originally
came from:
https://code.google.com/p/chromium/issues/detail?id=351713

* svg/custom/pattern-content-cycle-w-resourceless-container-expected.txt: Added.
* svg/custom/pattern-content-cycle-w-resourceless-container.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189953 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CLoop build fix after r189938.

* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::unwindToMachineCodeBlockFrame):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189952 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r188871): 50% regression in page load time of Wikipedia home page
https://bugs.webkit.org/show_bug.cgi?id=149320

Reviewed by Daniel Bates.

This is due to <rdar://problem/22144016> about how language-specific
font fallback is an order of magnitude slower than regular non-language-
specific font-fallback. This performance problem has been fixed, but not
for iOS 9.

No new tests because there is no correctness change.

* platform/graphics/ios/FontCacheIOS.mm:
(WebCore::platformLookupFallbackFont):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189951 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore:
Add HTMLSlotElement, Element.slot, and NonDocumentTypeChildNode.assignedSlot
https://bugs.webkit.org/show_bug.cgi?id=149241

Reviewed by Antti Koivisto.

Implement the slotting algorithm and related features: slot element, slot attribute, and assignedSlot
as specified by https://w3c.github.io/webcomponents/spec/shadow/#slotting-algorithm
as of 8bf56e8ea5521a7a911efd1cabeb2be0d5c3ca74.

The slotting algorithm is implemented by the newly introduced SlotAssignment class which is created on
demand by ShadowRoot when a HTMLSlotElement is inserted into the shadow root. SlotAssignment contains
a HashMap of a slot name to SlotInfo structure, which holds the number of slot elements of the said name,
the first element if it's known, and an ordered list of the assigned nodes.

When there is exactly one slot element of a given name, "element" returns the slot element in O(1).
When another slot of the same name is inserted into the same shadow tree, we increment "elementCount" and
set "element" to nullptr since we don't know which slot element comes first in the tree order without O(n)
tree traversal, which is lazily done in resolveAllSlotElements.

Observe that SlotInfo's "element" can be nullptr in two occasions: (1) when there is no slot element of
the given name (SlotAssignment::assignSlots may insert such an entry), and (2) when there are more than
one slot elements of the same name and we haven't run resolveAllSlotElements.

Resolving assigned nodes, on the other hand, is always O(n) unless all assignments are up to date, and
lazily computed by assignSlots. This is because inserting or removing a node doesn't tell us the relative
ordering of the node with respect to other nodes assigned to the same slot. For example, let's say we have
child nodes (A, B, C, D) and (A, D) are assigned to slot Alpha and (B, C) are assigned to slot Beta. If we
insert a new node E between nodes B and C and this node is assigned to slot Alpha, then we must create an
ordered list (A, E, D) for slot Alpha. Unfortunately, determining where to insert E in this list can cost
O(n) child traversal in the worst case.

Tests: fast/shadow-dom/HTMLSlotElement-interface.html
       fast/shadow-dom/NonDocumentTypeChildNode-interface-assignedSlot.html

* CMakeLists.txt:
* DerivedSources.cpp:
* DerivedSources.make:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* dom/Element.cpp:
(WebCore::Element::attributeChanged): Invalidate the slot assignments when slot attribute is changed.
(WebCore::Element::childrenChanged): Ditto for when a child node is inserted or removed. We can avoid it
when there is no default slot and only text nodes are removed or added in the future.
* dom/Element.idl: Added slot attribute on Element.
* dom/Node.cpp:
(WebCore::Node::assignedSlot): Added. Returns the assigned slot if the slot is in an open shadow tree.
* dom/Node.h:
* dom/NonDocumentTypeChildNode.idl: Added assignedSlot. Only expose in JS for now to avoid generating
the binding code for HTMLSlotElement in other languages.
* dom/ShadowRoot.cpp:
(WebCore::ShadowRoot::findAssignedSlot): Added. Forwards it to the implementation in SlotAssignment.
(WebCore::ShadowRoot::addSlotElementByName): Ditto.
(WebCore::ShadowRoot::removeSlotElementByName): Ditto.
(WebCore::ShadowRoot::invalidateSlotAssignments): Ditto.
(WebCore::ShadowRoot::assignedNodesForSlot): Ditto.
* dom/ShadowRoot.h:
(WebCore::ShadowRoot): Added m_slotAssignments as a member.
* dom/SlotAssignment.cpp: Added.
(WebCore::treatNullAsEmpty): Added. See https://w3c.github.io/webcomponents/spec/shadow/#dfn-default-slot
(WebCore::SlotAssignment::findAssignedSlot): Find the slot element to which a given node is assigned.
Since there could be multiple slot elements of the same name (or lack thereof), call findFirstSlotElement
to find the first slot element.
(WebCore::SlotAssignment::addSlotElementByName): Added. Called when a new slot element is inserted into
the associated shadow tree. When a slot element's name is changed, removeSlotElementByName is called on
with the old name before addSlotElementByName is called with the new name.
(WebCore::SlotAssignment::removeSlotElementByName): Ditto for removal.
(WebCore::SlotAssignment::assignedNodesForSlot): Added. Finds the ordered list of assigned nodes for
a given slot element. When there are multiple slot elements of the same name, we return the list only if
SlotInfo::element matches the argument.
(WebCore::SlotAssignment::findFirstSlotElement): Added. Resolves SlotInfo::element if needed.
(WebCore::SlotAssignment::resolveAllSlotElements): Finds SlotInfo::element for all slots. We resolve all
slots simultaneously to avoid doing O(number of nodes) tree traversal for O(number of slots) to avoid
the worst case O(n^2) behavior when all nodes in the shadow tree are slot elements of the same name.
(WebCore::SlotAssignment::assignSlots): Added. Computes the slot assignments by traversing each child
of the shadow host and adding to the appropriate SlotInfo::assignedNodes, creating a new entry if needed.
* dom/SlotAssignment.h: Added.
(WebCore::SlotAssignment::SlotAssignment):
(WebCore::SlotAssignment::invalidate):
(WebCore::SlotAssignment::SlotInfo::SlotInfo):
(WebCore::SlotAssignment::SlotInfo::hasSlotElements):
(WebCore::SlotAssignment::SlotInfo::hasDuplicatedSlotElements):
(WebCore::SlotAssignment::SlotInfo::shouldResolveSlotElement):
* html/HTMLAttributeNames.in: Added slot attribute.
* html/HTMLSlotElement.cpp: Added.
(WebCore::HTMLSlotElement::create):
(WebCore::HTMLSlotElement::HTMLSlotElement):
(WebCore::HTMLSlotElement::insertedInto): Calls addSlotElementByName.
(WebCore::HTMLSlotElement::removedFrom): Calls removeSlotElementByName. Because the element had already
been removed from the shadow tree, we can't use containingShadowRoot() to find the ShadowRoot here.
(WebCore::HTMLSlotElement::attributeChanged): Calls removeSlotElementByName and addSlotElementByName.
(WebCore::HTMLSlotElement::getDistributedNodes): Returns an ordered list of the assigned nodes.
* html/HTMLSlotElement.h: Added.
* html/HTMLSlotElement.idl: Added.
* html/HTMLTagNames.in: Added slot element.

LayoutTests:
Add HTMLSlotElement and NonDocumentTypeChildNode.assignedSlot
https://bugs.webkit.org/show_bug.cgi?id=149241

Reviewed by Antti Koivisto.

Added new conformance tests and rebaselined tests as needed.

In particular, inspector/model/remote-object.html was rebaselined since "assignedSlot" now appears as one of the first five
properties on Comment node that this test outputs.

* fast/shadow-dom/HTMLSlotElement-interface-expected.txt: Added.
* fast/shadow-dom/HTMLSlotElement-interface.html: Added.
* fast/shadow-dom/NonDocumentTypeChildNode-interface-assignedSlot-expected.txt: Added.
* fast/shadow-dom/NonDocumentTypeChildNode-interface-assignedSlot.html: Added.
* js/dom/dom-static-property-for-in-iteration-expected.txt:
* platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
* platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
* platform/mac/inspector/model: Added.
* platform/mac/inspector/model/remote-object-expected.txt: Copied from LayoutTests/inspector/model/remote-object-expected.txt.
* platform/mac/js/dom/global-constructors-attributes-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189950 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Regression(r189881): release assertion hit in toJS(ExecState*, JSDOMGlobalObject*, DocumentFragment*)
https://bugs.webkit.org/show_bug.cgi?id=149281

Reviewed by Ryosuke Niwa.

After r189881, we started generating a toJS() function for DocumentFragment
as an optimization. DocumentFragment has a subclass (ShadowRoot) but the
default toJS() implementation should have still been acceptable given that
the subclass is not web-exposed and therefore does not have a JS wrapper.

However, the ShadowRoot interface was introduced shortly after in r189841
and to toJS() implementation for DocumentFragment is now invalid. This
patch introduces a ShadowRoot-aware custom implementation of toJS() for
DocumentFragment to address the problem.

No new tests, already covered by:
plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html

* bindings/js/JSDocumentFragmentCustom.cpp:
(WebCore::createNewDocumentFragmentWrapper):
(WebCore::toJSNewlyCreated):
(WebCore::toJS):
Provide a ShadowRoot-aware custom implementation of toJS() /
toJSNewlyCreated() for DocumentFragment.

* bindings/js/JSNodeCustom.cpp:
(WebCore::createWrapperInline):
Fix bug in toJS() implementation for Node as it was not handling
ShadowRoots properly either.

* dom/DocumentFragment.idl:
Use [CustomToJSObject] so we can provide our own custom implementation
of toJS().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189949 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Give iOS WebKitTestRunner a launch storyboard
https://bugs.webkit.org/show_bug.cgi?id=149314

Reviewed by Dan Bates.

Add a launch storyboard to iOS WebKitTestRunner so that Springboard recognizes
that it's been built for specific device configurations, and puts the window
at the top of the screen. This simplifies coordinate conversions in a future patch.

* WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
* WebKitTestRunner/WebKitTestRunnerApp/WebKitTestRunnerApp-Info.plist:
* WebKitTestRunner/ios/Launch.storyboard: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189948 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CSS WG multicol-1 tests failures with 1px differences due to baseline difference.
https://bugs.webkit.org/show_bug.cgi?id=149245

Reviewed by Ryosuke Niwa.

Turn off font-aliasing for multicol tests where the reference tests' inline content
end up on a different baseline (fractional difference). (It's not considered a bug, they don't
necessarily match.)

LayoutTests/imported/w3c:

* css/css-multicol-1/multicol-basic-001-expected.html:
* css/css-multicol-1/multicol-basic-001.html:
* css/css-multicol-1/multicol-basic-002-expected.html:
* css/css-multicol-1/multicol-basic-002.html:
* css/css-multicol-1/multicol-basic-003-expected.html:
* css/css-multicol-1/multicol-basic-003.html:
* css/css-multicol-1/multicol-basic-004-expected.html:
* css/css-multicol-1/multicol-basic-004.html:
* css/css-multicol-1/multicol-rule-002-expected.xht:
* css/css-multicol-1/multicol-rule-002.xht:
* css/css-multicol-1/multicol-rule-px-001-expected.xht:
* css/css-multicol-1/multicol-rule-px-001.xht:
* css/css-multicol-1/multicol-rule-stacking-001-expected.xht:
* css/css-multicol-1/multicol-rule-stacking-001.xht:
* css/css-multicol-1/multicol-shorthand-001-expected.xht:
* css/css-multicol-1/multicol-shorthand-001.xht:
* css/css-multicol-1/multicol-span-all-block-sibling-003-expected.xht:
* css/css-multicol-1/multicol-span-all-block-sibling-003.xht:
* css/css-multicol-1/multicol-span-all-margin-nested-firstchild-001-expected.xht:
* css/css-multicol-1/multicol-span-all-margin-nested-firstchild-001.xht:

LayoutTests:

* TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189947 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Convert return values from JavaScript functions to the expected types in WebAssembly
https://bugs.webkit.org/show_bug.cgi?id=149200

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-17
Reviewed by Mark Lam.

When a WebAssembly function calls a JavaScript function, there is no
guarantee that the JavaScript function will always return values of the
type we expect. This patch converts the return values to the expected
types.

(The reverse is also true: When a WebAssembly function is called from a
JavaScript function, there is no guarantee that the arguments to the
WebAssembly function will always be of the types we expect. We have
fixed this in Bug 149033.)

We don't need to type check the return values if the callee is a
WebAssembly function. We don't need to type check the arguments if the
caller is a WebAssembly function. This optimization will be
implemented in the future. See https://bugs.webkit.org/show_bug.cgi?id=149310

* tests/stress/wasm-type-conversion.js:
* tests/stress/wasm/type-conversion.wasm:
* wasm/WASMFunctionCompiler.h:
(JSC::WASMFunctionCompiler::startFunction):
(JSC::WASMFunctionCompiler::buildReturn):
(JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
(JSC::WASMFunctionCompiler::callAndUnboxResult):
(JSC::WASMFunctionCompiler::convertValueToInt32):
(JSC::WASMFunctionCompiler::convertValueToDouble):
(JSC::WASMFunctionCompiler::convertDoubleToValue):
(JSC::WASMFunctionCompiler::loadValueAndConvertToInt32): Deleted.
(JSC::WASMFunctionCompiler::loadValueAndConvertToDouble): Deleted.
* wasm/WASMFunctionParser.cpp:
(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseCallInternalExpressionI32): Deleted.
* wasm/WASMFunctionParser.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189946 268f45cc-cd09-0410-ab3c-d52691b4dbfc

De-template ContainerNodeAlgorithms
https://bugs.webkit.org/show_bug.cgi?id=149286

Reviewed by Andreas Kling.

These are always used with ContainerNode/Node.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::removeDetachedChildren):
(WebCore::destroyRenderTreeIfNeeded):
(WebCore::ContainerNode::takeAllChildrenFrom):
(WebCore::ContainerNode::insertBeforeCommon):
(WebCore::ContainerNode::appendChildCommon):

    Make append a member for consistency with insert.

(WebCore::ContainerNode::notifyChildInserted):
(WebCore::ContainerNode::notifyChildRemoved):
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::replaceChild):
(WebCore::ContainerNode::appendChild):
(WebCore::ContainerNode::parserAppendChild):

    Also make rest of these ownership-taking functions take Ref<>&&.

* dom/ContainerNode.h:
(WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion):
(WebCore::ContainerNode::setFirstChild):
* dom/ContainerNodeAlgorithms.cpp:
(WebCore::notifyChildNodeRemoved):
(WebCore::addChildNodesToDeletionQueue):
(WebCore::removeDetachedChildrenInContainer):
(WebCore::collectFrameOwners):
(WebCore::assertConnectedSubrameCountIsConsistent):
(WebCore::disconnectSubframes):
* dom/ContainerNodeAlgorithms.h:
(WebCore::removeDetachedChildrenInContainer): Deleted.
(WebCore::appendChildToContainer): Deleted.
(WebCore::Private::NodeRemovalDispatcher::dispatch): Deleted.
(WebCore::Private::addChildNodesToDeletionQueue): Deleted.
* html/parser/HTMLConstructionSite.cpp:
(WebCore::insert):
(WebCore::executeInsertTask):
(WebCore::executeReparentTask):
(WebCore::executeInsertAlreadyParsedChildTask):
* html/track/WebVTTParser.cpp:
(WebCore::WebVTTTreeBuilder::constructTreeFromToken):
* xml/XMLErrors.cpp:
(WebCore::XMLErrors::appendErrorMessage):
(WebCore::createXHTMLParserErrorHeader):
(WebCore::XMLErrors::insertErrorMessageBlock):
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::enterText):
(WebCore::toString):
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::startElementNs):
(WebCore::XMLDocumentParser::processingInstruction):
(WebCore::XMLDocumentParser::cdataBlock):
(WebCore::XMLDocumentParser::comment):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189945 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Heavy taps on links are sometimes interpreted as the preview gesture
https://bugs.webkit.org/show_bug.cgi?id=149304
-and corresponding-
rdar://problem/22689258

Reviewed by Tim Horton.

If the preview gesture starts and stop and less than 250 milliseconds have
passed, then call _attemptClickAtLocation to treat it as a normal tap.
* UIProcess/ios/WKContentViewInteraction.h:
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _interactionShouldBeginFromPreviewItemController:forPosition:]):
(-[WKContentView _interactionStartedFromPreviewItemController:]):
(-[WKContentView _interactionStoppedFromPreviewItemController:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189944 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update licence in r189890
https://bugs.webkit.org/show_bug.cgi?id=149306

Reviewed by Dean Jackson.

* FontWithFeatures/FontWithFeatures/FontCreator.cpp:
* FontWithFeatures/FontWithFeatures/FontCreator.h:
* FontWithFeatures/FontWithFeatures/main.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189943 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Block Objective-C exceptions in DictionaryLookup
https://bugs.webkit.org/show_bug.cgi?id=149256

Reviewed by Anders Carlsson.

* editing/mac/DictionaryLookup.mm:
(WebCore::DictionaryLookup::rangeForSelection):
(WebCore::DictionaryLookup::rangeAtHitTestResult):
(WebCore::expandSelectionByCharacters):
(WebCore::DictionaryLookup::stringForPDFSelection):
(WebCore::showPopupOrCreateAnimationController):
(WebCore::DictionaryLookup::hidePopup):
It is possible for Lookup to throw an exception if one of its
related services dies for some reason. This shouldn't take down
our UI process, so block the exceptions.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189942 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[ES6] Add more fine-grained APIs and additional hooks to control module loader from WebCore
https://bugs.webkit.org/show_bug.cgi?id=149129

Reviewed by Saam Barati.

No behavior change.

Source/JavaScriptCore:

Module tag `<script type="module>` will be executed asynchronously.
But we would like to fetch the resources before when the postTask-ed task is performed.
So instead of 1 API that fetch, instantiate and execute the module,
we need 2 fine-grained APIs.

1. Fetch and initialize a module, but not execute it yet.
2. Link and execute a module specified by the key (this will be invoked asynchronously).

And to instrument the script execution (like reporting the execution time of the module to
the inspector), we need a hook to inject code around an execution of a module body.

* builtins/ModuleLoaderObject.js:
(moduleEvaluation):
(loadAndEvaluateModule):
(loadModule):
(linkAndEvaluateModule):
* jsc.cpp:
(functionLoadModule):
(runWithScripts):
* runtime/Completion.cpp:
(JSC::identifierToJSValue):
(JSC::createSymbolForEntryPointModule):
(JSC::rejectPromise):
(JSC::loadAndEvaluateModule):
(JSC::loadModule):
(JSC::linkAndEvaluateModule):
(JSC::evaluateModule): Deleted.
* runtime/Completion.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
* runtime/JSModuleRecord.cpp:
(JSC::JSModuleRecord::evaluate):
(JSC::JSModuleRecord::execute): Deleted.
* runtime/JSModuleRecord.h:
* runtime/ModuleLoaderObject.cpp:
(JSC::ModuleLoaderObject::loadAndEvaluateModule):
(JSC::ModuleLoaderObject::linkAndEvaluateModule):
(JSC::ModuleLoaderObject::evaluate):
(JSC::moduleLoaderObjectEvaluate):
* runtime/ModuleLoaderObject.h:

Source/WebCore:

* bindings/js/JSDOMWindowBase.cpp:
* bindings/js/JSWorkerGlobalScopeBase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189941 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement try/catch in the DFG.
https://bugs.webkit.org/show_bug.cgi?id=147374

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch implements try/catch inside the DFG JIT.
It also prevents tier up to the FTL for any functions
that have an op_catch in them that are DFG compiled.

This patch accomplishes implementing try/catch inside
the DFG by OSR exiting to op_catch when an exception is thrown.
We can OSR exit from an exception inside the DFG in two ways:
1) We have a JS call (can also be via implicit getter/setter in GetById/PutById)
2) We have an exception when returing from a callOperation

In the case of (1), we get to the OSR exit from genericUnwind because
the exception was thrown in a child call frame. This means these
OSR exits must act as defacto op_catches (even though we will still OSR
exit to a baseline op_catch). That means they must restore the stack pointer
and call frame.

In the case of (2), we can skip genericUnwind because we know the exception
check will take us to a particular OSR exit. Instead, we link these
exception checks as jumps to a particular OSR exit.

Both types of OSR exits will exit into op_catch inside the baseline JIT.
Because they exit to op_catch, these OSR exits must set callFrameForCatch
to the proper call frame pointer.

We "handle" all exceptions inside the machine frame of the DFG code
block. This means the machine code block is responsible for "catching"
exceptions of any inlined frames' try/catch. OSR exit will then exit to
the proper baseline CodeBlock after reifying the inlined frames
(DFG::OSRExit::m_codeOrigin corresponds to the op_catch we will exit to).
Also, genericUnwind will never consult an inlined call frame's CodeBlock to
see if they can catch the exception because they can't. We always unwind to the
next machine code block frame. The DFG CodeBlock changes how the exception
handler table is keyed: it is now keyed by CallSiteIndex for DFG code blocks.

So, when consulting call sites that throw, we keep track of the CallSiteIndex,
and the HandlerInfo for the corresponding baseline exception handler for
that particular CallSiteIndex (if an exception at that call site will be caught).
Then, when we're inside DFG::JITCompiler::link(), we install new HandlerInfo's
inside the DFG CodeBlock and key it by the corresponding CallSiteIndex.
(The CodeBlock only has HandlerInfos for the OSR exits that are to be arrived
at from genericUnwind).

Also, each OSR exit will know if it acting as an exception handler, and
whether or not it will be arrived at from genericUnwind. When we know we
will arrive at an OSR exit from genericUnwind, we set the corresponding
HandlerInfo's nativeCode CodeLocationLabel field to be the OSR exit.

This patch also introduces a new Phase inside the DFG that ensures
that DFG CodeBlocks that handle exceptions take the necessary
steps to keep live variables at "op_catch" live according the
OSR exit value recovery machinery. We accomplish this by flushing
all live op_catch variables to the stack when inside a "try" block.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::handlerForBytecodeOffset):
(JSC::CodeBlock::handlerForIndex):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::clearExceptionHandlers):
(JSC::CodeBlock::appendExceptionHandler):
* bytecode/PreciseJumpTargets.cpp:
(JSC::computePreciseJumpTargets):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getLocal):
(JSC::DFG::ByteCodeParser::setLocal):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGCommonData.cpp:
(JSC::DFG::CommonData::addCodeOrigin):
(JSC::DFG::CommonData::lastCallSite):
(JSC::DFG::CommonData::shrinkToFit):
* dfg/DFGCommonData.h:
* dfg/DFGGraph.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::linkOSRExits):
(JSC::DFG::JITCompiler::link):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::noticeOSREntry):
(JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
(JSC::DFG::JITCompiler::willCatchExceptionInMachineFrame):
(JSC::DFG::JITCompiler::exceptionCheck):
(JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::emitStoreCodeOrigin):
(JSC::DFG::JITCompiler::emitStoreCallSiteIndex):
(JSC::DFG::JITCompiler::appendCall):
(JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
(JSC::DFG::JITCompiler::blockHeads):
(JSC::DFG::JITCompiler::exceptionCheck): Deleted.
* dfg/DFGLiveCatchVariablePreservationPhase.cpp: Added.
(JSC::DFG::FlushLiveCatchVariablesInsertionPhase::FlushLiveCatchVariablesInsertionPhase):
(JSC::DFG::FlushLiveCatchVariablesInsertionPhase::run):
(JSC::DFG::FlushLiveCatchVariablesInsertionPhase::willCatchException):
(JSC::DFG::FlushLiveCatchVariablesInsertionPhase::handleBlock):
(JSC::DFG::FlushLiveCatchVariablesInsertionPhase::newVariableAccessData):
(JSC::DFG::performLiveCatchVariablePreservationPhase):
* dfg/DFGLiveCatchVariablePreservationPhase.h: Added.
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::OSRExit):
(JSC::DFG::OSRExit::setPatchableCodeOffset):
* dfg/DFGOSRExit.h:
(JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::osrWriteBarrier):
(JSC::DFG::adjustAndJumpToTarget):
* dfg/DFGOSRExitCompilerCommon.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGSlowPathGenerator.h:
(JSC::DFG::SlowPathGenerator::SlowPathGenerator):
(JSC::DFG::SlowPathGenerator::~SlowPathGenerator):
(JSC::DFG::SlowPathGenerator::generate):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGTierUpCheckInjectionPhase.cpp:
(JSC::DFG::TierUpCheckInjectionPhase::run):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* interpreter/Interpreter.cpp:
(JSC::GetCatchHandlerFunctor::operator()):
(JSC::UnwindFunctor::operator()):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::gotoNextFrame):
(JSC::StackVisitor::unwindToMachineCodeBlockFrame):
(JSC::StackVisitor::readFrame):
* interpreter/StackVisitor.h:
(JSC::StackVisitor::operator*):
(JSC::StackVisitor::operator->):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitExceptionCheck):
(JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitCount):
* jit/JITExceptions.cpp:
(JSC::genericUnwind):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_catch):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_catch):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/VM.h:
(JSC::VM::clearException):
(JSC::VM::clearLastException):
(JSC::VM::addressOfCallFrameForCatch):
(JSC::VM::exception):
(JSC::VM::addressOfException):
* tests/stress/dfg-exception-try-catch-in-constructor-with-inlined-throw.js: Added.
(f):
(bar):
(Foo):
* tests/stress/es6-for-of-loop-exception.js: Added.
(assert):
(shouldThrowInvalidConstAssignment):
(baz):
(foo):
* tests/stress/exception-dfg-inlined-frame-not-strict-equal.js: Added.
(assert):
(o.valueOf):
(o.toString):
(read):
(bar):
(foo):
* tests/stress/exception-dfg-not-strict-equal.js: Added.
(foo):
(o.valueOf):
(o.toString):
(assert):
(shouldDoSomethingInFinally):
(catch):
* tests/stress/exception-dfg-operation-read-value.js: Added.
(assert):
(o.valueOf):
(o.toString):
(read):
(foo):
* tests/stress/exception-dfg-throw-from-catch-block.js: Added.
(assert):
(baz):
(bar):
(foo):

LayoutTests:

* js/regress/raytrace-with-empty-try-catch-expected.txt: Added.
* js/regress/raytrace-with-empty-try-catch.html: Added.
* js/regress/raytrace-with-try-catch-expected.txt: Added.
* js/regress/raytrace-with-try-catch.html: Added.
* js/regress/script-tests/raytrace-with-empty-try-catch.js: Added.
(createVector):
(sqrLengthVector):
(lengthVector):
(addVector):
(subVector):
(scaleVector):
(normaliseVector):
(add):
(sub):
(scalev):
(dot):
(scale):
(cross):
(normalise):
(transformMatrix):
(invertMatrix):
(Triangle):
(Triangle.prototype.intersect):
(Scene):
(Scene.prototype.intersect):
(Scene.prototype.blocked):
(Camera):
(Camera.prototype.generateRayPair):
(renderRows):
(Camera.prototype.render):
(raytraceScene.floorShader):
(raytraceScene):
(arrayToCanvasCommands):
* js/regress/script-tests/raytrace-with-try-catch.js: Added.
(randomException):
(createVector):
(sqrLengthVector):
(lengthVector):
(addVector):
(subVector):
(scaleVector):
(normaliseVector):
(add):
(sub):
(scalev):
(dot):
(scale):
(cross):
(normalise):
(transformMatrix):
(invertMatrix):
(Triangle):
(Triangle.prototype.intersect):
(Scene):
(Scene.prototype.intersect):
(Scene.prototype.blocked):
(Camera):
(Camera.prototype.generateRayPair):
(renderRows):
(Camera.prototype.render):
(raytraceScene.floorShader):
(raytraceScene):
(arrayToCanvasCommands):
* js/regress/script-tests/v8-raytrace-with-empty-try-catch.js: Added.
(Class.create):
(Object.extend):
(Flog.RayTracer.Color.prototype.initialize):
(Flog.RayTracer.Color.prototype.add):
(Flog.RayTracer.Color.prototype.addScalar):
(Flog.RayTracer.Color.prototype.subtract):
(Flog.RayTracer.Color.prototype.multiply):
(Flog.RayTracer.Color.prototype.multiplyScalar):
(Flog.RayTracer.Color.prototype.divideFactor):
(Flog.RayTracer.Color.prototype.limit):
(Flog.RayTracer.Color.prototype.distance):
(Flog.RayTracer.Color.prototype.blend):
(Flog.RayTracer.Color.prototype.brightness):
(Flog.RayTracer.Color.prototype.toString):
(Flog.RayTracer.Light.prototype.initialize):
(Flog.RayTracer.Light.prototype.toString):
(Flog.RayTracer.Vector.prototype.initialize):
(Flog.RayTracer.Vector.prototype.copy):
(Flog.RayTracer.Vector.prototype.normalize):
(Flog.RayTracer.Vector.prototype.magnitude):
(Flog.RayTracer.Vector.prototype.cross):
(Flog.RayTracer.Vector.prototype.dot):
(Flog.RayTracer.Vector.prototype.add):
(Flog.RayTracer.Vector.prototype.subtract):
(Flog.RayTracer.Vector.prototype.multiplyVector):
(Flog.RayTracer.Vector.prototype.multiplyScalar):
(Flog.RayTracer.Vector.prototype.toString):
(Flog.RayTracer.Ray.prototype.initialize):
(Flog.RayTracer.Ray.prototype.toString):
(Flog.RayTracer.Scene.prototype.initialize):
(Flog.RayTracer.Material.BaseMaterial.prototype.initialize):
(Flog.RayTracer.Material.BaseMaterial.prototype.getColor):
(Flog.RayTracer.Material.BaseMaterial.prototype.wrapUp):
(Flog.RayTracer.Material.BaseMaterial.prototype.toString):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.initialize):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.getColor):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.toString):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.initialize):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.getColor):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.toString):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial):
(Flog.RayTracer.Shape.Sphere.prototype.initialize):
(Flog.RayTracer.Shape.Sphere.prototype.intersect):
(Flog.RayTracer.Shape.Sphere.prototype.toString):
(Flog.RayTracer.Shape.Plane.prototype.initialize):
(Flog.RayTracer.Shape.Plane.prototype.intersect):
(Flog.RayTracer.Shape.Plane.prototype.toString):
(Flog.RayTracer.IntersectionInfo.prototype.initialize):
(Flog.RayTracer.IntersectionInfo.prototype.toString):
(Flog.RayTracer.Camera.prototype.initialize):
(Flog.RayTracer.Camera.prototype.getRay):
(Flog.RayTracer.Camera.prototype.toString):
(Flog.RayTracer.Background.prototype.initialize):
(Flog.RayTracer.Engine.prototype.initialize):
(Flog.RayTracer.Engine.prototype.setPixel):
(Flog.RayTracer.Engine.prototype.renderScene):
(Flog.RayTracer.Engine.prototype.getPixelColor):
(Flog.RayTracer.Engine.prototype.testIntersection):
(Flog.RayTracer.Engine.prototype.getReflectionRay):
(Flog.RayTracer.Engine.prototype.rayTrace):
(renderScene):
* js/regress/script-tests/v8-raytrace-with-try-catch.js: Added.
(randomException):
(Class.create):
(Object.extend):
(Flog.RayTracer.Color.prototype.initialize):
(Flog.RayTracer.Color.prototype.add):
(Flog.RayTracer.Color.prototype.addScalar):
(Flog.RayTracer.Color.prototype.subtract):
(Flog.RayTracer.Color.prototype.multiply):
(Flog.RayTracer.Color.prototype.multiplyScalar):
(Flog.RayTracer.Color.prototype.divideFactor):
(Flog.RayTracer.Color.prototype.limit):
(Flog.RayTracer.Color.prototype.distance):
(Flog.RayTracer.Color.prototype.blend):
(Flog.RayTracer.Color.prototype.brightness):
(Flog.RayTracer.Color.prototype.toString):
(Flog.RayTracer.Light.prototype.initialize):
(Flog.RayTracer.Light.prototype.toString):
(Flog.RayTracer.Vector.prototype.initialize):
(Flog.RayTracer.Vector.prototype.copy):
(Flog.RayTracer.Vector.prototype.normalize):
(Flog.RayTracer.Vector.prototype.magnitude):
(Flog.RayTracer.Vector.prototype.cross):
(Flog.RayTracer.Vector.prototype.dot):
(Flog.RayTracer.Vector.prototype.add):
(Flog.RayTracer.Vector.prototype.subtract):
(Flog.RayTracer.Vector.prototype.multiplyVector):
(Flog.RayTracer.Vector.prototype.multiplyScalar):
(Flog.RayTracer.Vector.prototype.toString):
(Flog.RayTracer.Ray.prototype.initialize):
(Flog.RayTracer.Ray.prototype.toString):
(Flog.RayTracer.Scene.prototype.initialize):
(Flog.RayTracer.Material.BaseMaterial.prototype.initialize):
(Flog.RayTracer.Material.BaseMaterial.prototype.getColor):
(Flog.RayTracer.Material.BaseMaterial.prototype.wrapUp):
(Flog.RayTracer.Material.BaseMaterial.prototype.toString):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.initialize):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.getColor):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.toString):
(Flog.RayTracer.Material.Solid.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.initialize):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.getColor):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial.toString):
(Flog.RayTracer.Material.Chessboard.prototype.Object.extend.new.Flog.RayTracer.Material.BaseMaterial):
(Flog.RayTracer.Shape.Sphere.prototype.initialize):
(Flog.RayTracer.Shape.Sphere.prototype.intersect):
(Flog.RayTracer.Shape.Sphere.prototype.toString):
(Flog.RayTracer.Shape.Plane.prototype.initialize):
(Flog.RayTracer.Shape.Plane.prototype.intersect):
(Flog.RayTracer.Shape.Plane.prototype.toString):
(Flog.RayTracer.IntersectionInfo.prototype.initialize):
(Flog.RayTracer.IntersectionInfo.prototype.toString):
(Flog.RayTracer.Camera.prototype.initialize):
(Flog.RayTracer.Camera.prototype.getRay):
(Flog.RayTracer.Camera.prototype.toString):
(Flog.RayTracer.Background.prototype.initialize):
(Flog.RayTracer.Engine.prototype.initialize):
(Flog.RayTracer.Engine.prototype.setPixel):
(Flog.RayTracer.Engine.prototype.renderScene):
(Flog.RayTracer.Engine.prototype.getPixelColor):
(Flog.RayTracer.Engine.prototype.testIntersection):
(Flog.RayTracer.Engine.prototype.getReflectionRay):
(Flog.RayTracer.Engine.prototype.rayTrace):
(renderScene):
* js/regress/v8-raytrace-with-empty-try-catch-expected.txt: Added.
* js/regress/v8-raytrace-with-empty-try-catch.html: Added.
* js/regress/v8-raytrace-with-try-catch-expected.txt: Added.
* js/regress/v8-raytrace-with-try-catch.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189938 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add the ability to skip JIT stress tests in run-javascriptcore-tests.
https://bugs.webkit.org/show_bug.cgi?id=149285

Reviewed by Saam Barati.

Just need to add an option to pass --no-jit to run-jsc-stress-test.

* Scripts/run-javascriptcore-tests:
(runJSCStressTests):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189937 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix Windows EWS build after r189934.

* Source/cmake/OptionsWin.cmake:
Use WEBKIT_LIBRARIES environment variable if it exists.
We have the WebKitLibraries directory separate from the repository copy on the EWS bots.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189936 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, revert unintended change.

* benchmarks/LockSpeedTest.cpp:
(main):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189935 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Switch AppleWin build to use CMake
https://bugs.webkit.org/show_bug.cgi?id=149163

Patch by Alex Christensen <achristensen@webkit.org> on 2015-09-17
Reviewed by Brent Fulgham.

Source/WebCore:

* bindings/scripts/preprocess-idls.pl:
(CygwinPathIfNeeded):
(WriteFileIfChanged):
* bindings/scripts/preprocessor.pm:
(applyPreprocessor):
Fix new cygwin quirks.  Cygwin is now using some paths from CMake.

Tools:

* Scripts/build-webkit:
* Scripts/run-api-tests:
(runTest):
(listAllTests):
(prepareEnvironmentForRunningTestTool):
(testToolPaths):
(testToolPath): Deleted.
Run the API tests as separate executables on Windows.
It used to be TestWebKitAPI.exe, and it is now TestWTF.exe, TestWebCore.exe, and TestWebKit.exe.
* Scripts/webkitdirs.pm:
(checkRequiredSystemConfig):
(jhbuildWrapperPrefixIfNeeded):
(generateBuildSystemFromCMakeProject):
Fix configuration quirks.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189934 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION: Web Inspector: Double clicking on an attribute second time doesn't work
https://bugs.webkit.org/show_bug.cgi?id=149259

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-17
Reviewed by Timothy Hatcher.

* UserInterface/Views/DOMTreeElement.js:
Be sure to clear the editing state when committed, even if the value did not change.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189933 268f45cc-cd09-0410-ab3c-d52691b4dbfc

After restoring tabs, swipes back to fast loading pages hang for 3 seconds
https://bugs.webkit.org/show_bug.cgi?id=148764
<rdar://problem/22568860>

Reviewed by Beth Dakin.

* UIProcess/mac/ViewGestureControllerMac.mm:
(WebKit::ViewGestureController::endSwipeGesture):
Don't wait for the render tree size threshold if we don't have one.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189932 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove integral snapping functions from InlineBox class.
https://bugs.webkit.org/show_bug.cgi?id=136419

Reviewed by Simon Fraser.

We should not integral snap inlines during layout time.

Covered by existing tests.

* rendering/InlineBox.h:
(WebCore::InlineBox::pixelSnappedLogicalLeft): Deleted.
(WebCore::InlineBox::pixelSnappedLogicalRight): Deleted.
(WebCore::InlineBox::pixelSnappedLogicalTop): Deleted.
(WebCore::InlineBox::pixelSnappedLogicalBottom): Deleted.
* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::placeBoxesInBlockDirection):
(WebCore::InlineFlowBox::addBoxShadowVisualOverflow):
(WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
(WebCore::InlineFlowBox::addTextBoxVisualOverflow):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189931 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Skip a media test that fails when an AppleTV is around.

This will be fixed soon by https://bugs.webkit.org/show_bug.cgi?id=148912

* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189930 268f45cc-cd09-0410-ab3c-d52691b4dbfc

0.0 should really be 0.0
https://bugs.webkit.org/show_bug.cgi?id=149283

Reviewed by Mark Lam.

A while ago (http://trac.webkit.org/changeset/180813) we introduced the idea that if the
user wrote a number with a decimal point (like "0.0") then we should treat that number as
a double. That's probably a pretty good idea. But, we ended up doing it inconsistently.
The DFG would indeed treat such a number as a double by consulting the
SourceCodeRepresentation, but the other execution engines would still see Int32:0.

This patch makes it consistent.

This is necessary for property type inference to perform well. Otherwise, a store of a
constant would change type from the baseline engine to the DFG, which would then cause
a storm of property type invalidations and recompilations.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addConstantValue):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189929 268f45cc-cd09-0410-ab3c-d52691b4dbfc

stress/exit-from-getter.js.ftl-eager occasionally traps in debug
https://bugs.webkit.org/show_bug.cgi?id=149096

Reviewed by Geoffrey Garen.

JS calls to getters/setters in get/put inline caches need to reset SP after the call, as our
calling convention requires.

* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::generate): Fix the bug.
* ftl/FTLLink.cpp:
(JSC::FTL::link): Adds some verbiage about why the FTL stack offset logic is correct.
* tests/stress/getter-arity.js: Added. Other tests would flaky crash before the patch. This test instacrashes before the patch.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189928 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WinCairo] Compile error, include file not found.
https://bugs.webkit.org/show_bug.cgi?id=149282

Patch by Per Arne Vollan <peavo@outlook.com> on 2015-09-17
Reviewed by Alex Christensen.

* PlatformWin.cmake:
Copy forwarding headers from new legacy directory, fixing CMake clean builds since r189746.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189927 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r189287): 2.5% PLT regression
https://bugs.webkit.org/show_bug.cgi?id=149277
<rdar://problem/22657219>

Reviewed by Anders Carlsson.

* UIProcess/API/mac/WKView.mm:
(-[WKView _takeViewSnapshot]):
Don't take an extra unused snapshot.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189926 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Added toggle options for hiding and showing certain platform families on the dashboard.
https://bugs.webkit.org/show_bug.cgi?id=148403

Patch by Dean Johnson <dean_johnson@apple.com> on 2015-09-17
Reviewed by David Kilzer.

This patch removes "hiddenPlatforms" from use in the code and local storage. We also removed
individual hide/show buttons for platforms because we've added toggle options to hide/show entire
families. Examples of these are "mac", "ios", and "linux". "Show All Platforms" was also removed
in lieu of an "all" button in the toggle menu.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/Main.js:
(parsePlatformFamily): Helper function to parse out a platform family.
(initPlatformsByFamily): Initializes platformsByFamily, which organizes platforms on the
page by platformsByFamily[<family>] = <list of platforms belonging to that family>.
(updateToggleButtons): Updates the status of the toggle buttons.
(updateHiddenPlatforms): Changed to work with the new implementation of hiding/showing platforms.
(documentReady): Added creation of toggle buttons.
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/MetricsMain.js:
(unhiddenQueues): Updated to search by platform family instead of the individual platform name.
(documentReady): Changed hiddenPlatforms => hiddenPlatformFamilies.
(updateHiddenPlatforms): Deleted. After removing the individual hide button code,
this did the exact same thing as the updateHiddenPlatforms in Scripts/Main.js so it was removed.
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/QueueView.js:
(QueueView): Updated to use hiddenPlatformFamilies.
(QueueView.prototype._updateHiddenState): Updated to use hiddenPlatformFamilies.
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/Settings.js:
(Settings.prototype.toggleHiddenPlatformFamily): Renamed function and some variables.
(Settings.prototype.clearHiddenPlatformFamilies): Now uses hiddenPlatformFamilies for events.
(Settings.prototype.toggleHiddenPlatform): Deleted.
(Settings.prototype.clearHiddenPlatforms): Deleted.
(Settings.prototype.toggleShowPlatformFamily): Deleted.
* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Styles/Main.css:
(div.cellButton, div.accessibilityButton, div.platformFamilyToggleButton):
(div.cellButton.unhide, div.accessibilityButton.unhide, div.platformFamilyToggleButton.unhide):
(.settings-visible div.settingsWrapper.hide, .settings-visible div.settingsWrapper):
(table.queue-grid tr.headers th):
(div.settingsWrapper.hide):
(div.settingsWrapper):
(div.familyToggleWrapper):
(div.platformFamilyToggleButton):
(div.platformFamilyShowToggleButton:not(:last-child)):
(div.familyShown):
(div.accessibilityButton):
(div.cellButton, div.accessibilityButton): Added platformFamilyToggleButton class.
(div.cellButton.unhide, div.accessibilityButton.unhide): Added platformFamilyToggleButton class.
(.settings-visible div.accessibilityButton.hide, .settings-visible div.accessibilityButton.unhide): Added
platformFamilyToggleButton and settingsWrapper class.
(.accessibilityButton): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Make Find / Save keyboard shortcuts work better globally
https://bugs.webkit.org/show_bug.cgi?id=149198

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-17
Reviewed by Brian Burg.

Previously find/save keyboard shortcuts required the user have the
ContentView in the ContentBrowser focused. That means nothing would
happen if you clicked / focused in the Sidebars. This change considers
the keyboard shortcuts globally, like Copy.

* UserInterface/Base/Main.js:
(WebInspector.contentLoaded):
Add global find and save keyboard shortcuts.

(WebInspector._focusChanged):
It is often useful to have the currentFocusedElement know if it is
in a TextEditor or other CodeMirror editor. When editable the <textarea>
is selected and not updating focused element.

(WebInspector._focusedContentBrowser):
(WebInspector._focusedContentView):
Provide helpers for getting a good approximation of the current focused
or visible content view that users would expect to be interacting with.
Since the focus event may not fire when clicking around to elements
like the <body>. Rather than make it explicitly focusable, check the
document.activeElement, and if it is body aim for the main content
browser instead of the currentFocusedElement which may be stale.
Likewise, if the QuickConsole is focused and the split console is
showing, treat it like the split browser is focused.

(WebInspector._focusedOrVisibleContentBrowser):
(WebInspector._focusedOrVisibleContentView):
If nothing is focused, default to the main content browser.

(WebInspector._find):
Pass on to the ContentView which typically handles Find
by showing its find banner.

(WebInspector._save):
(WebInspector._saveAs):
Check and save the current ContentView if supported.

* UserInterface/Views/LogContentView.js:
(WebInspector.LogContentView.prototype.get supportsSearch):
(WebInspector.LogContentView.prototype.handleFindEvent):
Add custom find handling for LogContentView from the routed through the
BrowserController instead of special event handlers in the controller.

(WebInspector.LogContentView.prototype.get supportsSave):
(WebInspector.LogContentView.prototype.save): Deleted.
(WebInspector.LogContentView.prototype.saveAs): Deleted.
* UserInterface/Controllers/JavaScriptLogViewController.js:
(WebInspector.JavaScriptLogViewController): Deleted.
(WebInspector.JavaScriptLogViewController.prototype._handleFindShortcut): Deleted.
(WebInspector.JavaScriptLogViewController.prototype._save): Deleted.
(WebInspector.JavaScriptLogViewController.prototype._saveAs): Deleted.
Special save handling is no longer needed in the log view controller.

* UserInterface/Views/ContentBrowser.js:
(WebInspector.ContentBrowser.prototype.handleFindEvent):
(WebInspector.ContentBrowser): Deleted.
(WebInspector.ContentBrowser.prototype._save): Deleted.
(WebInspector.ContentBrowser.prototype._saveAs): Deleted.
(WebInspector.ContentBrowser.prototype._showFindBanner): Deleted.
Save functionality moved globally, find functionality moved to a
public method called like copy event handling.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Inactive window may cause many layers to be created due to Dashboard opacity
https://bugs.webkit.org/show_bug.cgi?id=149274

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-17
Reviewed by Brian Burg.

The dashboard container gets an opacity when the window is inactive. Combined
with the animating debugger continue button this caused a cascade of slightly
overlapping content causing a cascade of a lot of small layers. The simple
approach taken here is to stop the slight pulse animation when the window
is inactive.

* UserInterface/Views/DebuggerDashboardView.css:
(body.window-inactive .dashboard.debugger .navigation-bar .item.button > .glyph):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189923 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add a test ensuring that scrolling in the middle of a page can't start a swipe gesture
https://bugs.webkit.org/show_bug.cgi?id=148904

Reviewed by Myles Maxfield.

* swipe/main-frame-pinning-requirement.html: Added.

* WebKitTestRunner/TestController.cpp:
(WTR::parseBooleanTestHeaderValue):
(WTR::updateViewOptionsFromTestHeader):
Check for the key "useThreadedScrolling".
Add some code to check for "true" and "false" for boolean options.

(WTR::TestController::viewOptionsForTest):
Apply the test's overrides last, even after the platform's.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Delete some dead code
https://bugs.webkit.org/show_bug.cgi?id=149255

Reviewed by Dan Bernstein.

No new tests, just cleanup.

* platform/RuntimeApplicationChecksIOS.h:
* platform/RuntimeApplicationChecksIOS.mm:
(WebCore::applicationIsEpicurious): Deleted.
(WebCore::applicationIsMASH): Deleted.
Nothing uses these application checks anymore.

* platform/ios/SoundIOS.mm:
(WebCore::systemBeep):
What a beep should be on iOS, I don't know.
What it should not be is a NSLog.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189921 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Interpreter::unwind() shouldn't be responsible for filtering out uncatchable exceptions
https://bugs.webkit.org/show_bug.cgi?id=149228

Reviewed by Mark Lam.

Source/JavaScriptCore:

op_catch is now responsible for filtering exceptions that
aren't catchable. When op_catch encounters an uncatchable
exception, it will call back into genericUnwind and throw
the exception further down the call stack. This is necessary
in a later patch that will implement exception handling
in the DFG, and part of that patch includes exception
handling that doesn't go through genericUnwind. The DFG try/catch
patch will not go through genericUnwind when it knows that
an exception check after a callOperation will be caught inside the
machine frame or any inlined frames. This patch enables that
patch by destroying the notion that all exception handling must
filter through genericUnwind.

This patch maintains compatibility with the debugger and
profiler by ensuring we notify the debugger when an
exception is thrown inside VM::throwException and not
in genericUnwind. It also notifies the profiler that we've
potentially changed call frames inside op_catch.

* debugger/Debugger.cpp:
(JSC::Debugger::pauseIfNeeded):
* interpreter/Interpreter.cpp:
(JSC::unwindCallFrame):
(JSC::getStackFrameCodeType):
(JSC::UnwindFunctor::operator()):
(JSC::Interpreter::unwind):
(JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
(JSC::checkedReturn):
* interpreter/Interpreter.h:
(JSC::SuspendExceptionScope::SuspendExceptionScope):
(JSC::SuspendExceptionScope::~SuspendExceptionScope):
(JSC::Interpreter::sampler):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
(JSC::JIT::callOperationNoExceptionCheck):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_catch):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_catch):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::llint_throw_stack_overflow_error):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ExceptionHelpers.cpp:
(JSC::isTerminatedExecutionException):
* runtime/VM.cpp:
(JSC::VM::throwException):
* runtime/VM.h:
(JSC::VM::targetMachinePCForThrowOffset):
(JSC::VM::restorePreviousException):
(JSC::VM::clearException):
(JSC::VM::clearLastException):
(JSC::VM::exception):
(JSC::VM::addressOfException):
(JSC::VM::setException):

Source/WebCore:

No new tests, already covered by current tests. This is not an observable behavior change.

* bindings/js/JSNodeFilterCustom.cpp:
(WebCore::JSNodeFilter::acceptNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189920 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Win][HighDPI] Windowed plugins have incorrect placement.
https://bugs.webkit.org/show_bug.cgi?id=149090

Reviewed by Alex Christensen.

We have to scale plugin dimensions with device scale factor.

* Plugins/PluginView.cpp:
(WebCore::PluginView::windowClipRect):
* Plugins/PluginView.h:
* Plugins/PluginViewWin.cpp:
(WebCore::PluginView::updatePluginWidget):
(WebCore::PluginView::setNPWindowRect):
(WebCore::PluginView::snapshot):
(WebCore::PluginView::deviceScaleFactor):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Calling a float function on x86 in WebAssembly incorrectly returns a double
https://bugs.webkit.org/show_bug.cgi?id=149254

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-17
Reviewed by Michael Saboff.

In WebAssembly on x86 (32-bit), when we call a function that returns a
float or a double, we use the FSTP instruction to read the return value
from the FPU register stack. The FSTP instruction converts the value to
single-precision or double-precision floating-point format, depending on
the destination operand. Currently, we always use double as the
destination, which is wrong. This patch uses the correct return type.
This should fix the test errors in tests/stress/wasm-arithmetic-float32.js

* assembler/X86Assembler.h:
(JSC::X86Assembler::fstps):
* wasm/WASMFunctionCompiler.h:
(JSC::WASMFunctionCompiler::appendCallSetResult):
(JSC::WASMFunctionCompiler::callOperation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189918 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Save and restore callee save registers in WebAssembly
https://bugs.webkit.org/show_bug.cgi?id=149247

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-17
Reviewed by Michael Saboff.

Save callee save registers when entering WebAssembly functions
and restore them when returning.

* jit/RegisterSet.cpp:
(JSC::RegisterSet::webAssemblyCalleeSaveRegisters):
* jit/RegisterSet.h:
* wasm/WASMFunctionCompiler.h:
(JSC::WASMFunctionCompiler::startFunction):
(JSC::WASMFunctionCompiler::endFunction):
(JSC::WASMFunctionCompiler::buildReturn):
(JSC::WASMFunctionCompiler::localAddress):
(JSC::WASMFunctionCompiler::temporaryAddress):
(JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
(JSC::WASMFunctionCompiler::callAndUnboxResult):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189917 268f45cc-cd09-0410-ab3c-d52691b4dbfc

column-rule-style: outset/inset doesn't work
https://bugs.webkit.org/show_bug.cgi?id=148815
Source/WebCore:

<rdar://problem/22582644>

Reviewed by David Hyatt.

https://drafts.csswg.org/css-multicol-1/#crs
The <‘border-style’> values are interpreted as in the collapsing border model.

Unskipped 4 multicolumn tests,

* rendering/RenderMultiColumnSet.cpp:
(WebCore::RenderMultiColumnSet::paintColumnRules):
* rendering/RenderTableCell.cpp:
(WebCore::collapsedBorderStyle): Deleted.
* rendering/style/RenderStyle.h:
(WebCore::collapsedBorderStyle):

LayoutTests:

Reviewed by David Hyatt.

https://drafts.csswg.org/css-multicol-1/#crs
The <‘border-style’> values are interpreted as in the collapsing border model.

* TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189916 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Make Windows tests green.

* platform/win/TestExpectations:
Skip new IndexedDB test on Windows after r189879 because IndexedDB is not enabled on Windows yet.
Also skip new accessibility test after r189862 because stringValue is not implemented.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189915 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Range.deleteContents cannot delete DocType
https://bugs.webkit.org/show_bug.cgi?id=148773
<rdar://problem/22571280>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C DOM test now that more checks are passing.

* web-platform-tests/dom/ranges/Range-deleteContents-expected.txt:

Source/WebCore:

Range.deleteContents() was not able to delete a DocumentType Node, and
was throwing a HIERARCHY_REQUEST_ERR. The DOM specification does not
say we should throw in such case:
https://dom.spec.whatwg.org/#dom-range-deletecontents

However, Range.extractContents() should still throw an exception
if any of the contained children in a DocumentType Node:
https://dom.spec.whatwg.org/#concept-range-extract (Step 12)

No new tests, already covered by existing test.

* dom/Range.cpp:
(WebCore::Range::deleteContents):
(WebCore::Range::extractContents):
(WebCore::Range::checkDeleteExtract):
* dom/Range.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189914 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Mac MediaStream] Cleanup capture source classes
https://bugs.webkit.org/show_bug.cgi?id=149233

Reviewed by Jer Noble.

* platform/cf/CoreMediaSoftLink.cpp: Soft-link CMAudioFormatDescriptionGetStreamBasicDescription,
  CMSampleBufferGetAudioBufferListWithRetainedBlockBuffer, and CMSampleBufferGetNumSamples.
* platform/cf/CoreMediaSoftLink.h:

* platform/mediastream/mac/AVAudioCaptureSource.h:
(WebCore::AVAudioCaptureSource::Observer::~Observer):
* platform/mediastream/mac/AVAudioCaptureSource.mm:
(WebCore::AVAudioCaptureSource::AVAudioCaptureSource): Initialize m_inputDescription.
(WebCore::AVAudioCaptureSource::capabilities): 0 -> nullptr.
(WebCore::AVAudioCaptureSource::addObserver): New, add an observer and tell it to prepare.
(WebCore::AVAudioCaptureSource::removeObserver): New.
(WebCore::operator==): Compare AudioStreamBasicDescription.
(WebCore::operator!=):
(WebCore::AVAudioCaptureSource::captureOutputDidOutputSampleBufferFromConnection): Call
  observer->prepare when passed a new stream description, call observer->process.

* platform/mediastream/mac/AVCaptureDeviceManager.mm:
(WebCore::refreshCaptureDeviceList): Set m_groupID and m_localizedName.
(WebCore::AVCaptureDeviceManager::sessionSupportsConstraint): Invalid constraint names should
  be ignored, so return true when passed one.
(WebCore::AVCaptureDeviceManager::getSourcesInfo): This just didn't work, fix it.
(WebCore::AVCaptureDeviceManager::verifyConstraintsForMediaType): Optional constraints are
  optional so they don't need to be validated.
(WebCore::AVCaptureDeviceManager::bestSourcesForTypeAndConstraints): m_audioSource -> m_audioAVMediaCaptureSource,
  m_videoSource -> m_videoAVMediaCaptureSource.
(WebCore::AVCaptureDeviceManager::sourceWithUID): Ditto.

* platform/mediastream/mac/AVMediaCaptureSource.h:
(WebCore::AVMediaCaptureSource::session):
(WebCore::AVMediaCaptureSource::device):
(WebCore::AVMediaCaptureSource::currentStates):
(WebCore::AVMediaCaptureSource::constraints):
(WebCore::AVMediaCaptureSource::statesDidChanged):
(WebCore::AVMediaCaptureSource::createWeakPtr):
(WebCore::AVMediaCaptureSource::buffer): Deleted.
(WebCore::AVMediaCaptureSource::setBuffer): Deleted.
* platform/mediastream/mac/AVMediaCaptureSource.mm:
(WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Initilize m_weakPtrFactory.
(WebCore::AVMediaCaptureSource::scheduleDeferredTask): New, call a function asynchronously on
  the main thread.
(-[WebCoreAVMediaCaptureSourceObserver captureOutput:didOutputSampleBuffer:fromConnection:]): Don't
  dispatch calls to the main thread, let the derived classes do that if necessary.

* platform/mediastream/mac/AVVideoCaptureSource.h:
(WebCore::AVVideoCaptureSource::width):
(WebCore::AVVideoCaptureSource::height):
(WebCore::AVVideoCaptureSource::previewLayer):
(WebCore::AVVideoCaptureSource::currentFrameSampleBuffer):
* platform/mediastream/mac/AVVideoCaptureSource.mm:
(WebCore::AVVideoCaptureSource::setFrameRateConstraint): Remove unwanted logging.
(WebCore::AVVideoCaptureSource::setupCaptureSession): Configure the AVCaptureVideoDataOutput so
  it delivers 32-bit BGRA samples.
(WebCore::AVVideoCaptureSource::calculateFramerate): Return bool to signal if the frame rate
  changed.
(WebCore::AVVideoCaptureSource::processNewFrame): New. Process sample buffer, invalidate cached
  image, signal when characteristics change.
(WebCore::AVVideoCaptureSource::captureOutputDidOutputSampleBufferFromConnection): Schedule
  call to processNewFrame on the main thread so we do all video processing on main thread.
(WebCore::AVVideoCaptureSource::currentFrameImage): Create and return a CVImageBuffer of the
  current video frame.
(WebCore::AVVideoCaptureSource::paintCurrentFrameInContext): Draw the current frame to a context.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Crash in WebKit::BackingStore::createBackend running under Wayland
https://bugs.webkit.org/show_bug.cgi?id=147453

Reviewed by Carlos Garcia Campos.

Except when running on X11, this function always crashes if called before the web view is
realized, as gdk_window_create_similar_surface will return null in that case. Avoid this by
simply realizing the widget before calling that.

Thanks to Carlos Garnacho for some debugging help.

* UIProcess/cairo/BackingStoreCairo.cpp:
(WebKit::BackingStore::createBackend):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189912 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Grid Layout]  Using automatic (instead of min-content) minimums for 'auto' tracks
https://bugs.webkit.org/show_bug.cgi?id=142329

Reviewed by Darin Adler.

Based on Blink's r198697 by <svillar@igalia.com> and r200478 by <jfernandez@igalia.com>

Source/WebCore:

More precisely (syntax-wise), this would allow 'auto' to be used within the
minmax() function (it's currently forbidden) and have the 'auto' keyword map
to minmax(auto, auto) instead of minmax(min-content, max-content).
- As a minimum, 'auto' would mean "use the specified minimum size, or if
that is auto, treat as 0 or min-content per Flexbox rules".
- As a maximum, 'auto' would mean "use the max-content size".

Regarding the implementation, a new phase is added to the track sizing
algorithm called ResolveIntrinsicMinimums (the former ResolveIntrinsicMinimums
is now called ResolveContentBasedMinimums which does not include 'auto'
resolution) which will be run before any other. This phase uses the minimum
size of grid items (as specified by min-width/height).

Tests: fast/css-grid-layout/grid-automatic-minimum-for-auto-columns.html
       fast/css-grid-layout/grid-automatic-minimum-for-auto-rows.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseGridBreadth):
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::computeUsedBreadthOfMinLength):
(WebCore::RenderGrid::computeUsedBreadthOfMaxLength):
(WebCore::RenderGrid::minSizeForChild):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::trackSizeForTrackSizeComputationPhase):
(WebCore::RenderGrid::shouldProcessTrackForTrackSizeComputationPhase):
(WebCore::RenderGrid::trackShouldGrowBeyondGrowthLimitsForTrackSizeComputationPhase):
(WebCore::RenderGrid::markAsInfinitelyGrowableForTrackSizeComputationPhase):
(WebCore::RenderGrid::updateTrackSizeForTrackSizeComputationPhase):
(WebCore::RenderGrid::currentItemSizeForTrackSizeComputationPhase):
* rendering/RenderGrid.h:
* rendering/style/GridTrackSize.h:
(WebCore::GridTrackSize::minTrackBreadth):
(WebCore::GridTrackSize::maxTrackBreadth):
(WebCore::GridTrackSize::cacheMinMaxTrackBreadthTypes):
(WebCore::GridTrackSize::hasIntrinsicMinTrackBreadth):
(WebCore::GridTrackSize::hasAutoMinTrackBreadth):
(WebCore::GridTrackSize::hasAutoMaxTrackBreadth):
(WebCore::GridTrackSize::hasMaxContentOrAutoMaxTrackBreadth):
(WebCore::GridTrackSize::hasAutoOrMinContentMinTrackBreadthAndIntrinsicMaxTrackBreadth):
(WebCore::GridTrackSize::hasMinContentMinTrackBreadthAndMinOrMaxContentMaxTrackBreadth): Deleted.

LayoutTests:

New tests to verify that auto is a valid keyword inside
minmax. Updated the expectations of existing tests to
reflect the new status of auto.

* fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt:
* fast/css-grid-layout/grid-auto-columns-rows-get-set.html:
* fast/css-grid-layout/grid-automatic-minimum-for-auto-columns-expected.txt: Added.
* fast/css-grid-layout/grid-automatic-minimum-for-auto-columns.html: Added.
* fast/css-grid-layout/grid-automatic-minimum-for-auto-rows-expected.txt: Added.
* fast/css-grid-layout/grid-automatic-minimum-for-auto-rows.html: Added.
* fast/css-grid-layout/grid-columns-rows-get-set-expected.txt:
* fast/css-grid-layout/grid-columns-rows-get-set-multiple-expected.txt:
* fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
* fast/css-grid-layout/grid-columns-rows-get-set.html:
* fast/css-grid-layout/non-grid-columns-rows-get-set-expected.txt:
* fast/css-grid-layout/non-grid-columns-rows-get-set-multiple-expected.txt:
* fast/css-grid-layout/non-grid-columns-rows-get-set-multiple.html:
* fast/css-grid-layout/non-grid-columns-rows-get-set.html:
* fast/css-grid-layout/resources/grid-columns-rows-get-set-multiple.js:
* fast/css-grid-layout/resources/grid-columns-rows-get-set.js:
* fast/css-grid-layout/resources/non-grid-columns-rows-get-set-multiple.js:
* fast/css-grid-layout/resources/non-grid-columns-rows-get-set.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Grid Layout] Relayout whenever Box Alignment properties change
https://bugs.webkit.org/show_bug.cgi?id=148070

Reviewed by Darin Adler.

Source/WebCore:

We were Reattaching the styles to the RenderTree whenever Content Alignment
properties (align-items and justify-items) changed their values, since the
Self Alignment properties depend on such values to resolve 'auto' values
during layout.

This patch removes such restriction, since we resolve the auto values
whenever we access the alignment properties. The only thing we need to
do is to mark a grid item for layout whenever the Default Alignment
properties change from/to stretch, since it implies a resize of the grid
items using 'auto' values for the Self Alignment properties.

Tests: fast/css-grid-layout/relayout-align-items-changed.html
       fast/css-grid-layout/relayout-align-self-changed.html
       fast/css-grid-layout/relayout-justify-items-changed.html
       fast/css-grid-layout/relayout-justify-self-changed.html
       fast/repaint/align-items-change.html
       fast/repaint/align-items-overflow-change.html
       fast/repaint/align-self-change.html
       fast/repaint/align-self-overflow-change.html
       fast/repaint/justify-items-change.html
       fast/repaint/justify-items-legacy-change.html
       fast/repaint/justify-items-overflow-change.html
       fast/repaint/justify-self-change.html
       fast/repaint/justify-self-overflow-change.html

* rendering/RenderGrid.cpp:
(WebCore::defaultAlignmentIsStretch):
(WebCore::RenderGrid::styleDidChange):
* rendering/RenderGrid.h:
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::resolveAlignmentOverflow):
(WebCore::RenderStyle::changeRequiresLayout):
* style/StyleResolveTree.cpp:
(WebCore::Style::determineChange): Deleted.

LayoutTests:

Tests to verify we force a layout of grid container or grid items, as appropriated,
whenever Box Alignment properties change their value.

This patch also adds some repaint tests, so we can ensure we generate the correct
repaint rects as well.

* fast/css-grid-layout/relayout-align-items-changed-expected.txt: Added.
* fast/css-grid-layout/relayout-align-items-changed.html: Added.
* fast/css-grid-layout/relayout-align-self-changed-expected.txt: Added.
* fast/css-grid-layout/relayout-align-self-changed.html: Added.
* fast/css-grid-layout/relayout-justify-items-changed-expected.txt: Added.
* fast/css-grid-layout/relayout-justify-items-changed.html: Added.
* fast/css-grid-layout/relayout-justify-self-changed-expected.txt: Added.
* fast/css-grid-layout/relayout-justify-self-changed.html: Added.
* fast/repaint/align-items-change-expected.txt: Added.
* fast/repaint/align-items-change.html: Added.
* fast/repaint/align-items-overflow-change-expected.txt: Added.
* fast/repaint/align-items-overflow-change.html: Added.
* fast/repaint/align-self-change-expected.txt: Added.
* fast/repaint/align-self-change.html: Added.
* fast/repaint/align-self-overflow-change-expected.txt: Added.
* fast/repaint/align-self-overflow-change.html: Added.
* fast/repaint/justify-items-change-expected.txt: Added.
* fast/repaint/justify-items-change.html: Added.
* fast/repaint/justify-items-legacy-change-expected.txt: Added.
* fast/repaint/justify-items-legacy-change.html: Added.
* fast/repaint/justify-items-overflow-change-expected.txt: Added.
* fast/repaint/justify-items-overflow-change.html: Added.
* fast/repaint/justify-self-change-expected.txt: Added.
* fast/repaint/justify-self-change.html: Added.
* fast/repaint/justify-self-overflow-change-expected.txt: Added.
* fast/repaint/justify-self-overflow-change.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189910 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r188427): Web Inspector: Extra whitespace left behind in styles sidebar after clicking in and out
https://bugs.webkit.org/show_bug.cgi?id=149197

Patch by Devin Rousso <dcrousso+webkit@gmail.com> on 2015-09-17
Reviewed by Timothy Hatcher.

In r188427, logic was added to preserve the leading whitespace of styles in a CSS file.
An unfortunate side effect of this was that extra newlines in between CSS properties
were treated as valid and left where they were.  This is undesired behaviour and often
clutters the styles sidebar.  These changes remove the extra newlines.

* UserInterface/Views/CSSStyleDeclarationTextEditor.js:
(WebInspector.CSSStyleDeclarationTextEditor.prototype._formattedContent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189909 268f45cc-cd09-0410-ab3c-d52691b4dbfc

printing does not use minimum page zoom factor
https://bugs.webkit.org/show_bug.cgi?id=108507

Reviewed by Darin Adler.

Source/WebCore:

* page/PrintContext.cpp:
(WebCore::PrintContext::beginAndComputePageRectsWithPageSize):
Helper function to share common code from numberOfPages() and
spoolAllPagesWithBoundaries().
(WebCore::PrintContext::numberOfPages): Use beginAndComputePageRectsWithPageSize().
(WebCore::PrintContext::spoolAllPagesWithBoundaries): Use
beginAndComputePageRectsWithPageSize() and don't flip the Y axis
for non Cocoa platforms.
* page/PrintContext.h:

Source/WebKit/mac:

Pass a the frame as a reference instead of using pointers.

* Misc/WebCoreStatistics.mm:
(-[WebFrame numberOfPagesWithPageWidth:pageHeight:]):
(-[WebFrame printToCGContext:pageWidth:pageHeight:]):

Source/WebKit2:

Add kWKSnapshotOptionsPrinting flag to indicate the snapshot
should be generated in printing mode.

* Shared/API/c/WKImage.h:
* Shared/API/c/WKSharedAPICast.h:
(WebKit::toSnapshotOptions):
* Shared/ImageOptions.h:
* WebProcess/InjectedBundle/InjectedBundle.cpp:
(WebKit::InjectedBundle::numberOfPages): Pass the frame as a
reference instead of a pointer.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::scaledSnapshotWithOptions): In case of printing,
calculate the bitmap height based on the number of pages.
(WebKit::WebPage::snapshotAtSize): In case of printing, use
PrintContext::spoolAllPagesWithBoundaries() and return.

Tools:

WebKitTestRunner always takes the snapshots from the UI process
(expect for IOS), so in the case of printing, the layout in the
web view is not the expected one. When printing, we need to take
the snapshot in the web process and ensure it's rendered with a
PrintContext.

* WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
(WTR::InjectedBundlePage::dump): When dumping pixels, pass
kWKSnapshotOptionsPrinting option to
WKBundlePageCreateSnapshotWithOptions() when printing. When not
printing, don't even create the snapshot, since it will be ignored
by the UI process that always creates its own from the WebView (expect for IOS platform)
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::dumpResults): Use always the snapshot image
received from the web process if any when comparing pixel
results. Now we only receive a snapshot from the web process in
case of printing, or when platform is IOS. Otherwhise, generate
the snapshot from the WebView as usual.
* WebKitTestRunner/TestInvocation.h: Add SnapshotResultType enum
parameter to dumpPixelsAndCompareWithExpected, since the snapshot
is created by the caller now, but the CG implementation needs to
know if it's a Web or UI process snapshot.
* WebKitTestRunner/cairo/TestInvocationCairo.cpp:
(WTR::TestInvocation::dumpPixelsAndCompareWithExpected): Create a
cairo surface for the given image.
* WebKitTestRunner/cg/TestInvocationCG.cpp:
(WTR::TestInvocation::dumpPixelsAndCompareWithExpected): Create a
CGContext for the given image.

LayoutTests:

Unskip printing reftests that should pass now.

* platform/gtk/TestExpectations:
* platform/mac-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189908 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Reduce Annotation Update Frequency
https://bugs.webkit.org/show_bug.cgi?id=149250

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-16
Reviewed by Saam Barati.

* UserInterface/Controllers/BasicBlockAnnotator.js:
(WebInspector.BasicBlockAnnotator.prototype._annotateBasicBlockExecutionRanges):
* UserInterface/Controllers/TypeTokenAnnotator.js:
(WebInspector.BasicBlockAnnotator.prototype.insertAnnotations):
Set a lower bound of 500ms on update frequency for both annotators.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189907 268f45cc-cd09-0410-ab3c-d52691b4dbfc

removeShadow shouldn't call ChildNodeRemovalNotifier with the shadow host as the removal point
https://bugs.webkit.org/show_bug.cgi?id=149244

Reviewed by Antti Koivisto.

Since a shadow host is in a different tree than nodes in its shadow tree, it's incorrect to call
removedFrom with the shadow host as the removal point. This causes HTMLSlotElement::removedFrom
which will be added in the bug 149241 to call methods on a wrong ShadowRoot.

We still keep the ad-hoc behavior of using the shadow host as the insertion/removal point when
calling insertedInto and removedFrom on the shadow root itself to update the InDocument node flag.
We may want to re-visit this design in the future.

No new tests since I couldn't quite create a reduction. However, tests I'm adding in the bug 149241
will crash without this change.

I separated this patch from the bug 149241 to isolate the high-risk code change here.

* dom/Element.cpp:
(WebCore::Element::addShadowRoot): Call insertedInto on ShadowRoot, and then call it on all its
children separately with the insertion point set to the shadow root since insertedInto relies on
insertion point's inDocument flag to be true when the shadow host is in the document.
(WebCore::Element::removeShadowRoot): Ditto in the reverse order.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189906 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove all uses of PassRefPtr in WebCore/inspector
https://bugs.webkit.org/show_bug.cgi?id=149156

Reviewed by Darin Adler.

* inspector/DOMEditor.cpp:
(WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
(WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
(WebCore::DOMEditor::insertBefore):
(WebCore::DOMEditor::replaceChild):
* inspector/DOMEditor.h:
* inspector/DOMPatchSupport.cpp:
(WebCore::DOMPatchSupport::removeChildAndMoveToNew):
* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::highlightSelector):
* inspector/InspectorDatabaseAgent.cpp:
(WebCore::InspectorDatabaseAgent::didOpenDatabase):
* inspector/InspectorDatabaseAgent.h:
* inspector/InspectorDatabaseInstrumentation.h:
* inspector/InspectorDatabaseResource.h:
(WebCore::InspectorDatabaseResource::setDatabase):
* inspector/InspectorFrontendHost.cpp:
(WebCore::FrontendMenuProvider::create):
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::didOpenDatabaseImpl):
* inspector/InspectorLayerTreeAgent.h:
* inspector/InspectorOverlay.cpp:
(WebCore::InspectorOverlay::highlightNodeList):
* inspector/InspectorOverlay.h:
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::sharedBufferContent):
* inspector/InspectorPageAgent.h:
* inspector/InspectorResourceAgent.cpp:
* inspector/InspectorTimelineAgent.cpp:
(WebCore::startProfiling):
(WebCore::stopProfiling):
(WebCore::InspectorTimelineAgent::stopFromConsole):
* inspector/InspectorTimelineAgent.h:
* inspector/InspectorWorkerResource.h:
(WebCore::InspectorWorkerResource::create):
* inspector/InstrumentingAgents.h:
* inspector/NetworkResourcesData.cpp:
(WebCore::createOtherResourceTextDecoder):
(WebCore::NetworkResourcesData::addResourceSharedBuffer):
* inspector/NetworkResourcesData.h:
* inspector/TimelineRecordFactory.cpp:
(WebCore::createQuad):
* inspector/WebInjectedScriptHost.h:
* inspector/WebInjectedScriptManager.cpp:
(WebCore::WebInjectedScriptManager::WebInjectedScriptManager):
* inspector/WebInjectedScriptManager.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189905 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add failing expectation to css3/font-feature-settings-rendering-2.html on Mavericks.
The test failure is tracked by webkit.org/b/149246.

Also rebaseline js/dom/global-constructors-attributes-idb.html on WK1 after r189879.

* js/dom/global-constructors-attributes-idb-expected.txt: Replaced with LayoutTests/platform/wk2/js/dom/global-constructors-attributes-idb-expected.txt.
* platform/mac/TestExpectations:
* platform/wk2/js/dom/global-constructors-attributes-idb-expected.txt: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189904 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Have window.indexedDB.open return an IDBOpenDBRequest.
https://bugs.webkit.org/show_bug.cgi?id=149234

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/indexeddb/modern/opendatabase-request.html

* Modules/indexeddb/client/IDBFactoryImpl.cpp:
(WebCore::IDBClient::IDBFactory::open):
(WebCore::IDBClient::IDBFactory::openInternal):
* Modules/indexeddb/client/IDBFactoryImpl.h:

LayoutTests:

* storage/indexeddb/modern/opendatabase-request-expected.txt: Added.
* storage/indexeddb/modern/opendatabase-request.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189901 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Turn ChildNodeInsertion/RemovalNotifier classes into functions
https://bugs.webkit.org/show_bug.cgi?id=149236

Reviewed by Ryosuke Niwa.

Less architecture, more readability.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::notifyChildInserted):
(WebCore::ContainerNode::notifyChildRemoved):
(WebCore::ContainerNode::removeChildren):
* dom/ContainerNodeAlgorithms.cpp:
(WebCore::notifyDescendantInsertedIntoDocument):
(WebCore::notifyDescendantInsertedIntoTree):
(WebCore::notifyNodeInsertedIntoDocument):
(WebCore::notifyNodeInsertedIntoTree):
(WebCore::notifyChildNodeInserted):
(WebCore::notifyNodeRemovedFromDocument):
(WebCore::notifyNodeRemovedFromTree):
(WebCore::notifyChildNodeRemoved):
(WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument): Deleted.
(WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree): Deleted.
(WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument): Deleted.
(WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromTree): Deleted.
* dom/ContainerNodeAlgorithms.h:
(WebCore::ChildNodeInsertionNotifier::ChildNodeInsertionNotifier): Deleted.
(WebCore::ChildNodeRemovalNotifier::ChildNodeRemovalNotifier): Deleted.
(WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument): Deleted.
(WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree): Deleted.
(WebCore::ChildNodeInsertionNotifier::notify): Deleted.
(WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument): Deleted.
(WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromTree): Deleted.
(WebCore::ChildNodeRemovalNotifier::notify): Deleted.
* dom/Element.cpp:
(WebCore::Element::addShadowRoot):
(WebCore::Element::removeShadowRoot):
(WebCore::Element::createShadowRoot):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189896 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove all uses of PassRefPtr in WebCore/bindings
https://bugs.webkit.org/show_bug.cgi?id=149207

Reviewed by Darin Adler.

If RefPtr<>&& argument is passed to new variable or other function, we use copyRef() or WTF::move().
copyRef() should be used when the argument continues to be used in following code. If it is final use
inside function, we have to use WTF::move().

* bridge/NP_jsobject.cpp:
* bridge/NP_jsobject.h:
* bridge/c/CRuntimeObject.cpp:
(JSC::Bindings::CRuntimeObject::CRuntimeObject):
* bridge/c/CRuntimeObject.h:
(JSC::Bindings::CRuntimeObject::create):
* bridge/c/c_instance.cpp:
(JSC::Bindings::CInstance::CInstance):
* bridge/c/c_instance.h:
(JSC::Bindings::CInstance::create):
* bridge/jsc/BridgeJSC.cpp:
(JSC::Bindings::Array::Array):
(JSC::Bindings::Instance::Instance):
* bridge/jsc/BridgeJSC.h:
* bridge/objc/ObjCRuntimeObject.h:
(JSC::Bindings::ObjCRuntimeObject::create):
* bridge/objc/ObjCRuntimeObject.mm:
(JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
* bridge/objc/WebScriptObjectProtocol.h:
* bridge/objc/objc_instance.h:
* bridge/objc/objc_instance.mm:
(ObjcInstance::ObjcInstance):
(ObjcInstance::create):
* bridge/objc/objc_runtime.h:
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcArray::ObjcArray):
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::RuntimeObject):
* bridge/runtime_object.h:
* bridge/runtime_root.cpp:
(JSC::Bindings::RootObject::create):
* bridge/runtime_root.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix for WebAssembly after r189884

* jit/JITOperations.cpp

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189894 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/imported/w3c:
Element's attribute NS API should treat defined undefined namespace as null
https://bugs.webkit.org/show_bug.cgi?id=149238
<rdar://problem/22562204>

Reviewed by Ryosuke Niwa.

Rebaseline W3C DOM test that one more check is passing.

* web-platform-tests/dom/nodes/attributes-expected.txt:

Source/WebCore:
Element's attribute NS API should defined treat undefined namespace as null
https://bugs.webkit.org/show_bug.cgi?id=149238
<rdar://problem/22562204>

Reviewed by Ryosuke Niwa.

Element's attribute NS API should treat defined undefined namespace as null
instead of converting it to the "undefined" String. This is because the
namespace parameter is a nullable String as per the DOM spec:
- https://dom.spec.whatwg.org/#element

The attribute is nullable and WebIDL says undefined should be converted
to null for nullable parameters:
- https://heycam.github.io/webidl/#es-nullable-type (step 3)

Firefox follows the specification.

No new tests, already covered by existing test.

* dom/Element.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189893 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement indirect calls in WebAssembly
https://bugs.webkit.org/show_bug.cgi?id=149100

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-16
Reviewed by Geoffrey Garen.

This patch implement indirect calls for WebAssembly files generated by
pack-asmjs <https://github.com/WebAssembly/polyfill-prototype-1>.
pack-asmjs uses the same indirect call model as asm.js. In asm.js, an
indirect call looks like this:
    t[i & n](...)
where t is a variable referring to an array of functions with the same
signature, i is an integer expression, n is an integer that is equal to
(t.length - 1), and t.length is a power of two. pack-asmjs does not
use the '&' operator nor n in the WebAssembly output, but the semantics
is still the same as asm.js.

* tests/stress/wasm-calls.js:
* tests/stress/wasm/calls.wasm:
* wasm/WASMFormat.h:
* wasm/WASMFunctionCompiler.h:
(JSC::WASMFunctionCompiler::buildCallIndirect):
* wasm/WASMFunctionParser.cpp:
(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseCallIndirect):
* wasm/WASMFunctionParser.h:
* wasm/WASMFunctionSyntaxChecker.h:
(JSC::WASMFunctionSyntaxChecker::buildCallIndirect):
* wasm/WASMModuleParser.cpp:
(JSC::WASMModuleParser::parseFunctionPointerTableSection):
(JSC::WASMModuleParser::parseFunctionDefinitionSection):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189892 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix 32-bit build issues in WebAssembly
https://bugs.webkit.org/show_bug.cgi?id=149240

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-16
Reviewed by Geoffrey Garen.

Fix the syntax error and replace the instructions that are not available on
64-bit platforms.

* wasm/WASMFunctionCompiler.h:
(JSC::WASMFunctionCompiler::startFunction):
(JSC::WASMFunctionCompiler::endFunction):
(JSC::WASMFunctionCompiler::buildReturn):
(JSC::WASMFunctionCompiler::callAndUnboxResult):
(JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189891 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Create a font which can be used for testing font features
https://bugs.webkit.org/show_bug.cgi?id=149237

Reviewed by Simon Fraser.

Tools:

This patch adds a new project in the Tools/ directory which generates a font which can
be used for testing font features. This is a standalone project consisting of two files:
1. A file which actually generates the byte vector representing the font. This file has
a single public function: std::vector<uint8_t> generateFont(). This file is not platform
specific, and only relies on the C++ STL.
2. A file with a main() which calls generateFont() and writes out the font, as well as
uses the font to render some demonstration text into a .png file. This file is platform
specific.

The font itself only supports the following characters:
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
However, the shape of these letters are either an X or a check mark.

The letter "A" always is a check mark.
The letter "B" always is an X.
Without any font features turned on, the rest of the letters are shown as X.

Each font feature has an letter associated with it. When the font feature is enabled,
that letter is shown as a check mark. For example, when "smcp" is enabled, "J" is shown
as a check mark.

Here are the mappings of font features to letters:
liga: C
clig: D
dlig: E
hlig: F
calt: G
subs: H
sups: I
smcp: J
c2sc: K
pcap: L
c2pc: M
unic: N
titl: O
onum: P
pnum: Q
tnum: R
frac: S
afrc: T
ordn: U
zero: V
hist: W
jp78: X
jp83: Y
jp90: Z
jp04: a
smpl: b
trad: c
fwid: d
pwid: e
ruby: f

* FontWithFeatures/FontWithFeatures.xcodeproj/project.pbxproj: Added.
* FontWithFeatures/FontWithFeatures/FontCreator.cpp: Added.
(integralLog2):
(roundDownToPowerOfTwo):
(isFourByteAligned):
(clampTo):
(append32):
(writeCFFEncodedNumber):
(CFFBuilder::CFFBuilder):
(CFFBuilder::takeResult):
(CFFBuilder::moveTo):
(CFFBuilder::lineTo):
(CFFBuilder::curveToCubic):
(CFFBuilder::closePath):
(CFFBuilder::writePoint):
(generateBoxCharString):
(generateCheckCharString):
(generateXCharString):
(charStringForGlyph):
(Generator::generate):
(Generator::Placeholder::Placeholder):
(Generator::Placeholder::populate):
(Generator::Placeholder::~Placeholder):
(Generator::placeholder):
(Generator::append16):
(Generator::append32):
(Generator::append32BitCode):
(Generator::overwrite16):
(Generator::overwrite32):
(Generator::appendCFFTable):
(Generator::appendSubstitutionSubtable):
(Generator::appendScriptSubtable):
(Generator::appendGSUBTable):
(Generator::appendOS2Table):
(Generator::appendFormat12CMAPTable):
(Generator::appendFormat4CMAPTable):
(Generator::appendCMAPTable):
(Generator::appendHEADTable):
(Generator::appendHHEATable):
(Generator::appendHMTXTable):
(Generator::appendMAXPTable):
(Generator::appendNAMETable):
(Generator::appendPOSTTable):
(Generator::calculateChecksum):
(Generator::appendTable):
(generateFont):
* FontWithFeatures/FontWithFeatures/FontCreator.h: Added.
* FontWithFeatures/FontWithFeatures/main.cpp: Added.
(drawTextWithFeature):
(main):

LayoutTests:

* css3/font-feature-settings-rendering-2-expected.html: Added.
* css3/font-feature-settings-rendering-2.html: Added.
* css3/resources/FontWithFeatures.otf: Added.
* platform/efl/TestExpectations:
* platform/win/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189890 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore should discard baseline code after some time
https://bugs.webkit.org/show_bug.cgi?id=149220

Reviewed by Saam Barati.

This is a bit more complicated than discarding optimized code because
the engine previously assumed that we would never discard baseline code.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock): Record creation time (and compute time since
creation) instead of install time because CodeBlocks can be installed
more than once, and we don't want to have to worry about edge cases
created by CodeBlocks seeming to get younger.

(JSC::CodeBlock::visitAggregate): Be explicit about only doing the
weak reference fixpoint for optimized CodeBlocks. We used to avoid the
fixpoint for baseline CodeBlocks implicitly, since they would always
visit themselves strongly right away. But now baseline CodeBlocks might
not visit themselves strongly, since they might choose to jettison due
to old age.

(JSC::CodeBlock::shouldVisitStrongly): Add old age as a reason not to
visit ourselves strongly, so that baseline CodeBlocks can jettison due
to old age.

(JSC::CodeBlock::shouldJettisonDueToWeakReference): Be explicit about
only jettisoning optimized CodeBlocks due to weak references so that we
don't confuse ourselves into thinking that we will jettison a baseline
CodeBlock due to weak references.

(JSC::CodeBlock::shouldJettisonDueToOldAge): Updated to use creation time.

(JSC::CodeBlock::visitOSRExitTargets): Clarify a comment and add an
ASSERT to help record some things I discovered while debugging.

(JSC::CodeBlock::jettison): Allow a baseline CodeBlock to jettison. Don't
assume that we have an alternative or a profiler.

(JSC::CodeBlock::install): Deleted.
* bytecode/CodeBlock.h:
(JSC::CodeBlock::releaseAlternative): Deleted.
(JSC::CodeBlock::setInstallTime): Deleted.
(JSC::CodeBlock::timeSinceInstall): Deleted.

* dfg/DFGOSRExitPreparation.cpp:
(JSC::DFG::prepareCodeOriginForOSRExit): Simplified the computation of
baseline CodeBlock.

* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::checkLivenessAndVisitChildren): Be sure to strongly
visit our inline callframes because we assume that an optimized CodeBlock
will keep its OSR exit targets alive, but the CodeBlock object won't be
able to mark them for itself until compilation has completed (since it
won't have a JITCode object yet).

* dfg/DFGToFTLDeferredCompilationCallback.cpp:
(JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
Updated for interface change.

* jit/JITCode.h:
(JSC::JITCode::timeToLive): Provide a time to live for interpreter and
baseline code, so they will jettison when old. Use seconds in our
code so that we don't need comments. Make DFG 2X interpreter+baseline,
and FTL 2X DFG+interpreter+baseline, also matching the time we allot
before throwing away all code.

* jit/JITToDFGDeferredCompilationCallback.cpp:
(JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::jitCompileAndSetHeuristics): Updated for interface change.

* runtime/Executable.cpp:
(JSC::ScriptExecutable::installCode): Allow our caller to install nullptr,
since we need to do this when jettisoning a baseline CodeBlock. Require
our caller to specify the details of the installation because we can't
rely on a non-null CodeBlock in order to compute them.

(JSC::ScriptExecutable::newCodeBlockFor):
(JSC::ScriptExecutable::prepareForExecutionImpl):
* runtime/Executable.h:
(JSC::ScriptExecutable::recordParse): Updated for interface change.

* runtime/Options.h: Renamed the CodeBlock liveness option since it now
controls baseline and optimized code.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189889 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove obsolete code for deleting CodeBlocks
https://bugs.webkit.org/show_bug.cgi?id=149231

Reviewed by Mark Lam.

* heap/Heap.cpp:
(JSC::Heap::deleteAllCodeBlocks): ASSERT that we're called in a valid
state, and do the compiler waiting ourselves instead of having our
caller do it. This is more appropriate to our new limited use.

(JSC::Heap::collectImpl):
(JSC::Heap::deleteOldCode): Deleted. Don't call deleteAllCodeBlocks
periodically because it's not such a good idea to delete everything
at once, and CodeBlocks now have a more precise individual policy for
when to delete. Also, this function used to fail all or nearly all of
the time because its invariants that we were not executing or compiling
could not be met.

* heap/Heap.h:

* jsc.cpp:
(GlobalObject::finishCreation):
(functionDeleteAllCompiledCode): Deleted.
* tests/stress/deleteAllCompiledCode.js: Removed. Removed this testing
code because it did not do what it thought it did. All of this code
was guaranteed to no-op since it would run JavaScript to call a function
that would return early because JavaScript was running.

* runtime/VM.cpp:
(JSC::VM::deleteAllCode): This code is simpler now becaue
heap.deleteAllCodeBlocks does some work for us.

* runtime/VMEntryScope.cpp:
(JSC::VMEntryScope::VMEntryScope): Don't delete code on VM entry. This
policy was old, and it dated back to a time when we

    (a) couldn't run in the interpreter if compilation failed;

    (b) didn't reduce the rate of compilation in response to executable
    memory pressure;

    (c) didn't throw away individual CodeBlocks automatically.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189888 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Possible small iOS PLT regression from r189537
https://bugs.webkit.org/show_bug.cgi?id=149232

Reviewed by Ryosuke Niwa.

r189537 may have regressed PLT a bit on iOS. That change added a couple
of extra branches to throw exceptions. This patch marks those branches
as UNLIKELY() as we already do for other similar checks in the JS
bindings.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
(webkit_dom_test_obj_get_property):
(webkit_dom_test_obj_class_init):
(webkit_dom_test_obj_get_strict_type_checking_attribute):
(webkit_dom_test_obj_set_strict_type_checking_attribute):
* bindings/scripts/test/GObject/WebKitDOMTestObj.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjStrictTypeCheckingAttribute):
(WebCore::setJSTestObjStrictTypeCheckingAttribute):
* bindings/scripts/test/ObjC/DOMTestObj.h:
* bindings/scripts/test/ObjC/DOMTestObj.mm:
(-[DOMTestObj strictTypeCheckingAttribute]):
(-[DOMTestObj setStrictTypeCheckingAttribute:]):
* bindings/scripts/test/TestObj.idl:
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::setTHead):
(WebCore::HTMLTableElement::setTFoot):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189887 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189886 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[ES6] Implement tail calls in the LLInt and Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=148661

Fix for the breakage of Speedometer/Full.html (https://bugs.webkit.org/show_bug.cgi?id=149162).

Reviewed by Filip Pizlo.
Changed SetupVarargsFrame.cpp::emitSetVarargsFrame to align the callframe size to be a
multiple of stackAlignmentRegisters() in addition to the location of the new frame.

Fixed Reviewed by Filip Pizlo.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* assembler/AbortReason.h:
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::Call::Call):
(JSC::AbstractMacroAssembler::repatchNearCall):
(JSC::AbstractMacroAssembler::repatchCompact):
* assembler/CodeLocation.h:
(JSC::CodeLocationNearCall::CodeLocationNearCall):
(JSC::CodeLocationNearCall::callMode):
(JSC::CodeLocationCommon::callAtOffset):
(JSC::CodeLocationCommon::nearCallAtOffset):
(JSC::CodeLocationCommon::dataLabelPtrAtOffset):
* assembler/LinkBuffer.h:
(JSC::LinkBuffer::locationOfNearCall):
(JSC::LinkBuffer::locationOf):
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::nearCall):
(JSC::MacroAssemblerARM::nearTailCall):
(JSC::MacroAssemblerARM::call):
(JSC::MacroAssemblerARM::linkCall):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::nearCall):
(JSC::MacroAssemblerARM64::nearTailCall):
(JSC::MacroAssemblerARM64::ret):
(JSC::MacroAssemblerARM64::linkCall):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::nearCall):
(JSC::MacroAssemblerARMv7::nearTailCall):
(JSC::MacroAssemblerARMv7::call):
(JSC::MacroAssemblerARMv7::linkCall):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::nearCall):
(JSC::MacroAssemblerMIPS::nearTailCall):
(JSC::MacroAssemblerMIPS::call):
(JSC::MacroAssemblerMIPS::linkCall):
(JSC::MacroAssemblerMIPS::repatchCall):
* assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::call):
(JSC::MacroAssemblerSH4::nearTailCall):
(JSC::MacroAssemblerSH4::nearCall):
(JSC::MacroAssemblerSH4::linkCall):
(JSC::MacroAssemblerSH4::repatchCall):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::linkCall):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::breakpoint):
(JSC::MacroAssemblerX86Common::nearTailCall):
(JSC::MacroAssemblerX86Common::nearCall):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::linkCall):
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::callTypeFor):
(JSC::CallLinkInfo::isVarargsCallType):
(JSC::CallLinkInfo::CallLinkInfo):
(JSC::CallLinkInfo::specializationKind):
(JSC::CallLinkInfo::callModeFor):
(JSC::CallLinkInfo::callMode):
(JSC::CallLinkInfo::isTailCall):
(JSC::CallLinkInfo::isVarargs):
(JSC::CallLinkInfo::registerPreservationMode):
* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::computeFromLLInt):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitCallInTailPosition):
(JSC::BytecodeGenerator::emitCallEval):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
(JSC::BytecodeGenerator::emitConstructVarargs):
* bytecompiler/NodesCodegen.cpp:
(JSC::CallArguments::CallArguments):
(JSC::LabelNode::emitBytecode):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
* interpreter/Interpreter.h:
(JSC::Interpreter::isCallBytecode):
(JSC::calleeFrameForVarargs):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::jumpToExceptionHandler):
(JSC::CCallHelpers::prepareForTailCallSlow):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_call):
(JSC::JIT::emit_op_tail_call):
(JSC::JIT::emit_op_call_eval):
(JSC::JIT::emit_op_call_varargs):
(JSC::JIT::emit_op_tail_call_varargs):
(JSC::JIT::emit_op_construct_varargs):
(JSC::JIT::emitSlow_op_call):
(JSC::JIT::emitSlow_op_tail_call):
(JSC::JIT::emitSlow_op_call_eval):
(JSC::JIT::emitSlow_op_call_varargs):
(JSC::JIT::emitSlow_op_tail_call_varargs):
(JSC::JIT::emitSlow_op_construct_varargs):
* jit/JITCall32_64.cpp:
(JSC::JIT::emitSlow_op_call):
(JSC::JIT::emitSlow_op_tail_call):
(JSC::JIT::emitSlow_op_call_eval):
(JSC::JIT::emitSlow_op_call_varargs):
(JSC::JIT::emitSlow_op_tail_call_varargs):
(JSC::JIT::emitSlow_op_construct_varargs):
(JSC::JIT::emit_op_call):
(JSC::JIT::emit_op_tail_call):
(JSC::JIT::emit_op_call_eval):
(JSC::JIT::emit_op_call_varargs):
(JSC::JIT::emit_op_tail_call_varargs):
(JSC::JIT::emit_op_construct_varargs):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
* jit/JITInlines.h:
(JSC::JIT::emitNakedCall):
(JSC::JIT::emitNakedTailCall):
(JSC::JIT::updateTopCallFrame):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/Repatch.cpp:
(JSC::linkVirtualFor):
(JSC::linkPolymorphicCall):
* jit/SetupVarargsFrame.cpp:
(JSC::emitSetVarargsFrame):
* jit/ThunkGenerators.cpp:
(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::slowPathFor):
(JSC::linkCallThunkGenerator):
(JSC::virtualThunkFor):
(JSC::arityFixupGenerator):
(JSC::unreachableGenerator):
(JSC::baselineGetterReturnThunkGenerator):
* jit/ThunkGenerators.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::arityCheckFor):
(JSC::CommonSlowPaths::opIn):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189884 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Fix common typo "supress" => "suppress"
https://bugs.webkit.org/show_bug.cgi?id=149199

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-16
Reviewed by Gyuyoung Kim.

Source/WebCore:

* html/shadow/ContentDistributor.h:
(WebCore::ContentDistributor::needsDistribution):
* page/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::reportViolation):
* platform/NotImplemented.h:
* platform/graphics/ca/win/LayerChangesFlusher.cpp:
(WebCore::LayerChangesFlusher::hookCallback):
* platform/mac/HIDGamepadProvider.cpp:
(WebCore::HIDGamepadProvider::deviceRemoved):
* platform/win/makesafeseh.asm:

Source/WebInspectorUI:

* UserInterface/Views/DataGrid.js:
(WebInspector.DataGridNode.prototype.select):
(WebInspector.DataGridNode.prototype.deselect):
* UserInterface/Views/SearchBar.js:
(WebInspector.SearchBar):

Source/WebKit2:

* PluginProcess/mac/PluginProcessMac.mm:
(WebKit::PluginProcess::platformInitializeProcess):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189883 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r189875 and r189878.
https://bugs.webkit.org/show_bug.cgi?id=149235

cygwin cmake build not ready yet (Requested by alexchristensen
on #webkit).

Reverted changesets:

"Switch AppleWin build to use CMake"
https://bugs.webkit.org/show_bug.cgi?id=149163
http://trac.webkit.org/changeset/189875

"Cygwin build fix after r189875"
http://trac.webkit.org/changeset/189878

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189882 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebIDL: Rename [ReturnNewObject] to [NewObject] and use it more consistently in DOM
https://bugs.webkit.org/show_bug.cgi?id=149192

Reviewed by Darin Adler.

Rename [ReturnNewObject] to [NewObject] and use it more consistently in
DOM.

This aligns our IDL extended attribute naming with standard Web IDL:
https://heycam.github.io/webidl/#NewObject

We already have [ReturnNewObject] in most places that the DOM
specification uses [NewObject] but we are missing a few so I'll
fix this as well:
https://dom.spec.whatwg.org/#interface-document

Using [NewObject] lets the bindings generator know that the API in
question always returns new objects and that we can bypass the check
for existing wrappers and directly create a new wrapper for the
returned object.

This patch also adds support for generating the toJSNewlyCreated()
utility function for most types. Previously, to use [ReturnNewObject]
for a new type, you needed to add the type to a hard-coded list in
the bindings generator then provide your own implementation for
toJSNewlyCreated() as custom bindings.

No new-exposed behavior change.

* bindings/js/JSDocumentCustom.cpp:
* bindings/js/JSEventCustom.cpp:
* bindings/js/JSNodeListCustom.cpp:
Add toJSNewlyCreated() custom implementation for Node, Event and
Document, that shares code with the existing toJS() implementation for
those types.

* bindings/js/JSCDATASectionCustom.cpp: Removed.
* bindings/js/JSTextCustom.cpp: Removed.
* bindings/js/JSTouchCustom.cpp: Removed.
* bindings/js/JSTouchListCustom.cpp: Removed.
Drop several custom bindings files as the bindings generator is
now able to generate the toJSNewlyCreated() utility function for
most types.

* bindings/scripts/CodeGeneratorJS.pm:
- Rename [ReturnNewObject] to [NewObject].
- Generate a toJSNewlyCreated() whenever we generate a toJS() already.
  Get rid of the hard-coded list of types that need a
  toJSNewlyCreated().

* bindings/scripts/IDLAttributes.txt:
Rename [ReturnNewObject] to [NewObject].

* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
* bindings/scripts/test/JS/JSTestActiveDOMObject.h:
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
* bindings/scripts/test/JS/JSTestEventConstructor.h:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
* bindings/scripts/test/JS/JSTestEventTarget.h:
* bindings/scripts/test/JS/JSTestException.cpp:
* bindings/scripts/test/JS/JSTestException.h:
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
* bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
* bindings/scripts/test/JS/JSTestInterface.cpp:
* bindings/scripts/test/JS/JSTestInterface.h:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
* bindings/scripts/test/JS/JSTestNamedConstructor.h:
* bindings/scripts/test/JS/JSTestNondeterministic.cpp:
* bindings/scripts/test/JS/JSTestNondeterministic.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/JS/JSTestObj.h:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
* bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
* bindings/scripts/test/JS/JSTestTypedefs.h:
* bindings/scripts/test/JS/JSattribute.cpp:
* bindings/scripts/test/JS/JSattribute.h:
* bindings/scripts/test/JS/JSreadonly.cpp:
* bindings/scripts/test/JS/JSreadonly.h:
Rebaseline bindings tests.

* dom/Attr.idl:
* dom/CDATASection.idl:
* dom/Comment.idl:
* dom/DocumentFragment.idl:
* dom/DocumentType.idl:
* dom/EntityReference.idl:
* dom/ProcessingInstruction.idl:
Add [JSGenerateToJSObject] so that the bindings generator generates
a toJS() / toJSNewlyCreated() for this type. While it is not strictly
needed, it avoids falling back to using the toJS() from Node which
calls the virtual nodeType() function to determine the node type.
This change was made for efficiency purposes.

* dom/DOMImplementation.idl:
Rename [ReturnNewObject] to [NewObject] and add it to createHTMLDocument()
as well, as per the specification:
https://dom.spec.whatwg.org/#interface-domimplementation

* dom/Document.idl:
Rename [ReturnNewObject] to [NewObject] and add it to more operations
as per he DOM specification:
https://dom.spec.whatwg.org/#document

* dom/Node.idl:
Add [NewObject] to cloneNode() as per the DOM specification:
https://dom.spec.whatwg.org/#node

* dom/ParentNode.idl:
Add [NewObject] to querySelectorAll() as per the DOM specification:
https://dom.spec.whatwg.org/#parentnode

* dom/Range.idl:
Add [NewObject] for several operations, as per the DOM specification:
https://dom.spec.whatwg.org/#interface-range

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed ChangeLog update

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Have window.indexedDB.deleteDatabase return an IDBOpenDBRequest.
https://bugs.webkit.org/show_bug.cgi?id=149229

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/indexeddb/modern/deletedatabase-request.html
      storage/indexeddb/modern/deletedatabase-null-name-exception.html

* CMakeLists.txt:
* WebCore.xcodeproj/project.pbxproj:

* Modules/indexeddb/IDBDatabaseIdentifier.cpp: Added.
(WebCore::IDBDatabaseIdentifier::IDBDatabaseIdentifier):
* Modules/indexeddb/IDBDatabaseIdentifier.h: Added.
(WebCore::IDBDatabaseIdentifier::IDBDatabaseIdentifier):
(WebCore::IDBDatabaseIdentifier::isHashTableDeletedValue):
(WebCore::IDBDatabaseIdentifier::hash):
(WebCore::IDBDatabaseIdentifier::isValid):
(WebCore::IDBDatabaseIdentifier::operator==):
(WebCore::IDBDatabaseIdentifier::databaseName):
(WebCore::IDBDatabaseIdentifierHash::hash):
(WebCore::IDBDatabaseIdentifierHash::equal):
(WebCore::IDBDatabaseIdentifierHashTraits::isEmptyValue):

* Modules/indexeddb/client/IDBFactoryImpl.cpp:
(WebCore::IDBClient::shouldThrowSecurityException):
(WebCore::IDBClient::IDBFactory::getDatabaseNames):
(WebCore::IDBClient::IDBFactory::open):
(WebCore::IDBClient::IDBFactory::deleteDatabase):
* Modules/indexeddb/client/IDBFactoryImpl.h:

* Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
(WebCore::IDBClient::IDBOpenDBRequest::IDBOpenDBRequest):
* Modules/indexeddb/client/IDBOpenDBRequestImpl.h: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
(WebCore::IDBClient::IDBOpenDBRequest::create):

* Modules/indexeddb/client/IDBRequestImpl.cpp: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.cpp.
(WebCore::IDBClient::IDBRequest::IDBRequest):
(WebCore::IDBClient::IDBRequest::result):
(WebCore::IDBClient::IDBRequest::errorCode):
(WebCore::IDBClient::IDBRequest::error):
(WebCore::IDBClient::IDBRequest::source):
(WebCore::IDBClient::IDBRequest::transaction):
(WebCore::IDBClient::IDBRequest::readyState):
(WebCore::IDBClient::IDBRequest::eventTargetInterface):
(WebCore::IDBClient::IDBRequest::activeDOMObjectName):
(WebCore::IDBClient::IDBRequest::canSuspendForPageCache):
* Modules/indexeddb/client/IDBRequestImpl.h: Copied from Source/WebCore/Modules/indexeddb/client/IDBFactoryImpl.h.

* platform/Logging.h:

Source/WebKit/mac:

* WebView/WebView.mm:
(-[WebView _preferencesChanged:]): Enable IDB in WK1.

LayoutTests:

* platform/mac-wk1/TestExpectations:
* platform/wk2/TestExpectations:
* storage/indexeddb/modern/deletedatabase-null-name-exception-expected.txt: Added.
* storage/indexeddb/modern/deletedatabase-null-name-exception.html: Added.
* storage/indexeddb/modern/deletedatabase-request-expected.txt: Added.
* storage/indexeddb/modern/deletedatabase-request.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189879 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Cygwin build fix after r189875

* Scripts/build-webkit:
* Scripts/webkitdirs.pm:
(jhbuildWrapperPrefixIfNeeded):
(generateBuildSystemFromCMakeProject):
Make things work with cygwin and cmake.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189878 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Inline implementation of -[WKImagePreviewViewController previewActions]
https://bugs.webkit.org/show_bug.cgi?id=149224

Reviewed by Tim Horton.

* Platform/spi/ios/UIKitSPI.h: Declare UIViewControllerPreviewAction and its factory method.
* UIProcess/WKImagePreviewViewController.mm:
(-[WKImagePreviewViewController previewActions]): Moved here.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189877 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, drop dom/xhtml/level3/core/nodegetbaseuri03.xhtml test.

This test is outdated and we have more recent DOM tests covering
the newly expected behavior.

* dom/xhtml/level3/core/nodegetbaseuri03.js: Removed.
* dom/xhtml/level3/core/nodegetbaseuri03.xhtml: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189876 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Switch AppleWin build to use CMake
https://bugs.webkit.org/show_bug.cgi?id=149163

Reviewed by Brent Fulgham.

* Scripts/build-webkit:
Build with CMake.
* Scripts/run-api-tests:
(runTest):
(listAllTests):
(prepareEnvironmentForRunningTestTool):
(testToolPaths):
(testToolPath): Deleted.
Run the API tests as separate executables on Windows.
It used to be TestWebKitAPI.exe, and it is now TestWTF.exe, TestWebCore.exe, and TestWebKit.exe.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189875 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add newer build.webkit.org pages to robots.txt
https://bugs.webkit.org/show_bug.cgi?id=149219

Reviewed by Darin Adler.

Indexing bot watcher's dashboard can't be good.

* BuildSlaveSupport/build.webkit.org-config/public_html/robots.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189874 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add initial support for [Unforgeable] IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=149147

Reviewed by Darin Adler.

Source/WebCore:

Add initial support for [Unforgeable] IDL extended attribute:
https://heycam.github.io/webidl/#Unforgeable

In particular, attributes marked as unforgeable are now:
- on the instance rather than the prototype
- non-configurable. WebKit does not match the Web IDL specification
  and most properties are currently non-configurable already. However,
  I added an extra check for [Unforgeable] so that unforgeable
  attributes stay unconfigurable if we later decide to match the spec
  and mark properties as configurable.

Operation marked as unforgeable are now non-configurable. However, this
patch does not move them from the prototype to the instance yet. This
needs to be addressed in a follow-up patch as this is a larger change.

This patch also drops support for the undocumented
[OperationsNotDeletable] IDL extended attribute. It is no longer needed
now that we support [Unforgeable] and still support [NotDeletable] for
operations.

Test: fast/dom/unforgeable-attributes.html

* Modules/plugins/QuickTimePluginReplacement.idl:
Drop [OperationsNotDeletable] on the interface and mark the only
operation on this interface as [NotDeletable]. There is no behavior
change but this allows us to drop support for a non-standard and
undocumented IDL extended attribute.

* bindings/scripts/CodeGeneratorJS.pm:
(AttributeShouldBeOnInstance):
(GenerateAttributesHashTable):
(GenerateImplementation):
Add initial support for [Unforgeable] IDL extended attribute.

* bindings/scripts/IDLAttributes.txt:
Add [Unforgeable]. Drop [OperationsNotDeletable].

* crypto/CryptoKeyPair.idl:
Drop [OperationsNotDeletable] on the interface as this interface has
no operations.

* dom/Document.idl:
* page/DOMWindow.idl:
* page/Location.idl:
Mark attributes / interfaces as [Unforgeable] as per the latest HTML
specification:
https://html.spec.whatwg.org/multipage/dom.html#document
https://html.spec.whatwg.org/multipage/browsers.html#window
https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

LayoutTests:

New test that verifies that well-known [Unforgeable] attributes
are on the instance rather than the prototype and that they are
non-configurable.

* fast/dom/unforgeable-attributes-expected.txt: Added.
* fast/dom/unforgeable-attributes.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Turn off line wrapping in resource text editors
https://bugs.webkit.org/show_bug.cgi?id=149121

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-09-16
Reviewed by Darin Adler.

* UserInterface/Views/TextEditor.js:
(WebInspector.TextEditor):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189872 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Mac] Allow reading from SubmitDiagInfo.domains in Networking process
https://bugs.webkit.org/show_bug.cgi?id=149176
rdar://problem/22483680

Reviewed by Darin Adler.

* NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189871 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Simple line layout: Glitch selecting long text.
https://bugs.webkit.org/show_bug.cgi?id=149204
rdar://problem/22646472

Reviewed by Antti Koivisto.

When long text is split into multiple RenderText objects, we ignore renderer boundaries while
collecting wrapping positions (so that we don't end up wrapping unbreakable fragments at the end of each renderer).
This patch ensures that fragments with hypen character ignore renderer boundaries too.

Source/WebCore:

Test: fast/text/multiple-renderers-with-hypen-on-boundary.html

* rendering/SimpleLineLayoutTextFragmentIterator.cpp:
(WebCore::SimpleLineLayout::TextFragmentIterator::skipToNextPosition):

LayoutTests:

* fast/text/multiple-renderers-with-hypen-on-boundary-expected.html: Added.
* fast/text/multiple-renderers-with-hypen-on-boundary.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189870 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fast/events/mouse-cursor-change.html is flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=149216

Reviewed by Darin Adler.

* fast/events/mouse-cursor-change.html: Increase the timeout. I don't see a way to make
this test 100% reliable, but this change makes it work in my local testing.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189869 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Unifiy WebKit2PlatformTouchPoint definition
https://bugs.webkit.org/show_bug.cgi?id=149221

Reviewed by Darin Adler.

* Shared/WebEventConversion.cpp:
(WebKit::touchEventType):
(WebKit::WebKit2PlatformTouchPoint::WebKit2PlatformTouchPoint):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189868 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rollout r189851 and 189853 because they didn’t actually fix the permissions issue

* BuildSlaveSupport/built-product-archive:
(unzipArchive):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189867 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rebaseline W3C html/dom test for iOS after r189842.

* platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189866 268f45cc-cd09-0410-ab3c-d52691b4dbfc

More test result fixing after r189841.

* platform/mac/js/dom/global-constructors-attributes-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Mark http/tests/css/link-css-disabled-value-with-slow-loading-sheet.html as flaky, because it is.

It was already marked as flaky on mac-wk2.

* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189864 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove stray logging string mistakenly left in r189746.

* Modules/indexeddb/legacy/LegacyFactory.cpp:
(WebCore::LegacyFactory::deleteDatabase):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189863 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore:
AX: No VoiceOver typing feedback in some search fields
https://bugs.webkit.org/show_bug.cgi?id=149177

Reviewed by Mario Sanchez Prada.

If SearchFieldRole is not marked as a TextControl, it does not end up returning the accessibilityValue,
which is needed to output the right text to VoiceOver.

Test: accessibility/ax-value-with-search.html

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::isTextControl):

LayoutTests:
AX: No VO typing feedback in some text fields
https://bugs.webkit.org/show_bug.cgi?id=149177

Reviewed by Mario Sanchez Prada.

* accessibility/ax-value-with-search-expected.txt: Added.
* accessibility/ax-value-with-search.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189862 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Fix the help message of separated web process option of MiniBrowser
https://bugs.webkit.org/show_bug.cgi?id=149212

Reviewed by Gyuyoung Kim.

* MiniBrowser/efl/main.c:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[css-grid] Grid container's height should include scrollbar
https://bugs.webkit.org/show_bug.cgi?id=149210

Reviewed by Sergio Villar Senin.

Source/WebCore:

Add scrollbar's size in the grid container's height calculation at
RenderGrid::layoutGridItems().

Test: fast/css-grid-layout/grid-container-margin-border-padding-scrollbar.html

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::layoutGridItems): Include scrollbarLogicalHeight()
while computing the grid's logical height.

LayoutTests:

Add test to check both height and width (which was already working as
expected) with margins, borders, paddings and scrollbars.

* fast/css-grid-layout/grid-container-margin-border-padding-scrollbar-expected.txt: Added.
* fast/css-grid-layout/grid-container-margin-border-padding-scrollbar.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189860 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Fix GObject DOM bindings API break after r189676.

webkit_dom_character_data_append_data() used to raise exceptions.

* bindings/scripts/CodeGeneratorGObject.pm:
(FunctionUsedToRaiseException):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Web Process crash recovery no longer works
https://bugs.webkit.org/show_bug.cgi?id=149064

Reviewed by Žan Doberšek.

After a web process crash the new DrawingArea is never resized, so
nothing is rendered into the web view.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseDidRelaunchWebProcess): Queue a widget resize to ensure
the new DrawingAreaProxy is resized.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189854 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix python syntax after r189851.

* BuildSlaveSupport/built-product-archive:
(unzipArchive):
For loops need a colon.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189853 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Mac rebaseline after r189841.

* platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189852 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix Windows test bots after changing to non-cygwin build
https://bugs.webkit.org/show_bug.cgi?id=149196

Reviewed by Daniel Bates.

* BuildSlaveSupport/built-product-archive:
(unzipArchive):
Using different versions of python makes what I think is https://bugs.python.org/issue15795
prevent us from executing files from the archive on the test bots.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189851 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r189847.
https://bugs.webkit.org/show_bug.cgi?id=149208

Asserts on all the tests (Requested by ap on #webkit).

Reverted changeset:

"Simple line layout: Glitch selecting long text."
https://bugs.webkit.org/show_bug.cgi?id=149204
http://trac.webkit.org/changeset/189847

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix for WebAssembly after r189848

* jit/JITOperations.cpp

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rollout r189774 and 189818.

Broke Speedometer/Full.html

Not reviewed.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* assembler/AbortReason.h:
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::Call::Call):
(JSC::AbstractMacroAssembler::repatchNearCall):
(JSC::AbstractMacroAssembler::repatchCompact):
* assembler/CodeLocation.h:
(JSC::CodeLocationNearCall::CodeLocationNearCall):
(JSC::CodeLocationCommon::callAtOffset):
(JSC::CodeLocationCommon::nearCallAtOffset):
(JSC::CodeLocationCommon::dataLabelPtrAtOffset):
(JSC::CodeLocationNearCall::callMode): Deleted.
* assembler/LinkBuffer.h:
(JSC::LinkBuffer::locationOfNearCall):
(JSC::LinkBuffer::locationOf):
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::nearCall):
(JSC::MacroAssemblerARM::call):
(JSC::MacroAssemblerARM::linkCall):
(JSC::MacroAssemblerARM::nearTailCall): Deleted.
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::nearCall):
(JSC::MacroAssemblerARM64::ret):
(JSC::MacroAssemblerARM64::linkCall):
(JSC::MacroAssemblerARM64::nearTailCall): Deleted.
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::nearCall):
(JSC::MacroAssemblerARMv7::call):
(JSC::MacroAssemblerARMv7::linkCall):
(JSC::MacroAssemblerARMv7::nearTailCall): Deleted.
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::nearCall):
(JSC::MacroAssemblerMIPS::call):
(JSC::MacroAssemblerMIPS::linkCall):
(JSC::MacroAssemblerMIPS::repatchCall):
(JSC::MacroAssemblerMIPS::nearTailCall): Deleted.
* assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::call):
(JSC::MacroAssemblerSH4::nearCall):
(JSC::MacroAssemblerSH4::linkCall):
(JSC::MacroAssemblerSH4::repatchCall):
(JSC::MacroAssemblerSH4::nearTailCall): Deleted.
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::linkCall):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::breakpoint):
(JSC::MacroAssemblerX86Common::nearCall):
(JSC::MacroAssemblerX86Common::nearTailCall): Deleted.
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::linkCall):
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::callTypeFor):
(JSC::CallLinkInfo::CallLinkInfo):
(JSC::CallLinkInfo::specializationKind):
(JSC::CallLinkInfo::registerPreservationMode):
(JSC::CallLinkInfo::isVarargsCallType): Deleted.
(JSC::CallLinkInfo::callModeFor): Deleted.
(JSC::CallLinkInfo::callMode): Deleted.
(JSC::CallLinkInfo::isTailCall): Deleted.
(JSC::CallLinkInfo::isVarargs): Deleted.
* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::computeFromLLInt):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitCallInTailPosition):
(JSC::BytecodeGenerator::emitCallEval):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
(JSC::BytecodeGenerator::emitConstructVarargs):
* bytecompiler/NodesCodegen.cpp:
(JSC::CallArguments::CallArguments):
(JSC::LabelNode::emitBytecode):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
* interpreter/Interpreter.h:
(JSC::Interpreter::isCallBytecode):
* jit/CCallHelpers.h:
(JSC::CCallHelpers::jumpToExceptionHandler):
(JSC::CCallHelpers::prepareForTailCallSlow): Deleted.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_call):
(JSC::JIT::emit_op_call_eval):
(JSC::JIT::emit_op_call_varargs):
(JSC::JIT::emit_op_construct_varargs):
(JSC::JIT::emitSlow_op_call):
(JSC::JIT::emitSlow_op_call_eval):
(JSC::JIT::emitSlow_op_call_varargs):
(JSC::JIT::emitSlow_op_construct_varargs):
(JSC::JIT::emit_op_tail_call): Deleted.
(JSC::JIT::emit_op_tail_call_varargs): Deleted.
(JSC::JIT::emitSlow_op_tail_call): Deleted.
(JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
* jit/JITCall32_64.cpp:
(JSC::JIT::emitSlow_op_call):
(JSC::JIT::emitSlow_op_call_eval):
(JSC::JIT::emitSlow_op_call_varargs):
(JSC::JIT::emitSlow_op_construct_varargs):
(JSC::JIT::emit_op_call):
(JSC::JIT::emit_op_call_eval):
(JSC::JIT::emit_op_call_varargs):
(JSC::JIT::emit_op_construct_varargs):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emitSlow_op_tail_call): Deleted.
(JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
(JSC::JIT::emit_op_tail_call): Deleted.
(JSC::JIT::emit_op_tail_call_varargs): Deleted.
* jit/JITInlines.h:
(JSC::JIT::emitNakedCall):
(JSC::JIT::updateTopCallFrame):
(JSC::JIT::emitNakedTailCall): Deleted.
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/Repatch.cpp:
(JSC::linkVirtualFor):
(JSC::linkPolymorphicCall):
* jit/ThunkGenerators.cpp:
(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::slowPathFor):
(JSC::linkCallThunkGenerator):
(JSC::virtualThunkFor):
(JSC::arityFixupGenerator):
(JSC::baselineGetterReturnThunkGenerator):
(JSC::unreachableGenerator): Deleted.
* jit/ThunkGenerators.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::arityCheckFor):
(JSC::CommonSlowPaths::opIn):
* tests/stress/mutual-tail-call-no-stack-overflow.js: Removed.
* tests/stress/tail-call-no-stack-overflow.js: Removed.
* tests/stress/tail-call-recognize.js: Removed.
* tests/stress/tail-call-varargs-no-stack-overflow.js: Removed.
* tests/stress/tail-calls-dont-overwrite-live-stack.js: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189848 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Simple line layout: Glitch selecting long text.
https://bugs.webkit.org/show_bug.cgi?id=149204
rdar://problem/22646472

Reviewed by Antti Koivisto.

When long text is split into multiple RenderText objects, we ignore renderer boundaries while
collecting wrapping positions (so that we don't end up wrapping unbreakable fragments at the end of each renderer).
This patch ensures that fragments with hypen character ignore renderer boundaries too.

Source/WebCore:

Test: fast/text/multiple-renderers-with-hypen-on-boundary.html

* rendering/SimpleLineLayoutTextFragmentIterator.cpp:
(WebCore::SimpleLineLayout::TextFragmentIterator::skipToNextPosition):

LayoutTests:

* fast/text/multiple-renderers-with-hypen-on-boundary-expected.html: Added.
* fast/text/multiple-renderers-with-hypen-on-boundary.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189847 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement imported global variables in WebAssembly
https://bugs.webkit.org/show_bug.cgi?id=149206

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-15
Reviewed by Filip Pizlo.

Values can now be imported to a WebAssembly module through properties of
the imports object that is passed to loadWebAssembly(). In order to
avoid any side effect when accessing the imports object, we check that
the properties are data properties. We also check that each value is a
primitive and is not a Symbol. According to the ECMA262 6.0 spec,
calling ToNumber() on a primitive that is not a Symbol should not cause
any side effect.[1]

[1]: http://www.ecma-international.org/ecma-262/6.0/#sec-tonumber

* tests/stress/wasm-globals.js:
* tests/stress/wasm/globals.wasm:
* wasm/WASMModuleParser.cpp:
(JSC::WASMModuleParser::parseModule):
(JSC::WASMModuleParser::parseGlobalSection):
* wasm/WASMModuleParser.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189846 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Picking unchanged for font-size does not reset back to the unchanged value
https://bugs.webkit.org/show_bug.cgi?id=148351

Patch by Devin Rousso <dcrousso+webkit@gmail.com> on 2015-09-15
Reviewed by Brian Burg.

Visual number editors now save any new values in the special placeholder element
to display it whenever the "Unchanged" option is selected by the user.

* UserInterface/Views/VisualStyleNumberInputBox.js:
(WebInspector.VisualStyleNumberInputBox.prototype.set value):
(WebInspector.VisualStyleNumberInputBox.prototype.set units):
(WebInspector.VisualStyleNumberInputBox.prototype._setNumberInputIsEditable):
(WebInspector.VisualStyleNumberInputBox.prototype._keywordChanged):
(WebInspector.VisualStyleNumberInputBox.prototype._valueNumberInputKeyDown.adjustValue):
(WebInspector.VisualStyleNumberInputBox.prototype._valueNumberInputKeyDown):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189845 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix asm.js errors in WebAssembly tests
https://bugs.webkit.org/show_bug.cgi?id=149203

Patch by Sukolsak Sakshuwong <sukolsak@gmail.com> on 2015-09-15
Reviewed by Geoffrey Garen.

Our WebAssembly implementation uses asm.js for testing. Using Firefox to
parse asm.js reveals many errors that are not caught by pack-asmjs. For
example,
- asm.js does not allow the use of the multiplication operator (*) to
  multiply two integers, because the result can be so large that some
  lower bits of precision are lost. Math.imul is used instead.
- an int variable must be coerced to either signed (via x|0) or unsigned
  (via x>>>0) before it's returned.

* tests/stress/wasm-arithmetic-int32.js:
* tests/stress/wasm-calls.js:
* tests/stress/wasm-control-flow.js:
* tests/stress/wasm-globals.js:
* tests/stress/wasm-locals.js:
* tests/stress/wasm-relational.js:
* tests/stress/wasm/control-flow.wasm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189844 268f45cc-cd09-0410-ab3c-d52691b4dbfc

GTK+ build fix attempt after r189841.

* PlatformGTK.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Document.createElement(localName) does not handle correctly missing or null parameter
https://bugs.webkit.org/show_bug.cgi?id=149184
<rdar://problem/22565070>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

* web-platform-tests/dom/interfaces-expected.txt:
* web-platform-tests/dom/nodes/Document-createElement-expected.txt:
* web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Document.createElement(localName) does not handle correct missing or
null parameter:
- https://dom.spec.whatwg.org/#interface-document

As per the specification, the parameter is a non-nullable DOMString and
is mandatory. Therefore, as per Web IDL, we should have the following
behavior:
1. If the parameter is missing, we should throw an exception
2. If the parameter is null, we should convert it to the "null" string
   and create a <null> element.

Chrome and Firefox behave according to the specification. However,
WebKit was doing:
1. Create a <undefined> element
2. Throw an InvalidCharacterError

This patch aligns WebKit's behavior with the specification and other
major browsers.

No new tests, already covered by existing tests.

* dom/Document.idl:

LayoutTests:

Update / rebaseline existing tests now that our behavior has changed.

* fast/dom/Document/createElementNS-namespace-err-expected.txt:
* fast/dom/Document/script-tests/createElementNS-namespace-err.js:
* fast/dom/dom-method-document-change.html:
* fast/dom/element-removed-while-inserting-parent-crash.html:
* fast/inspector-support/uncaught-dom3-exception-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189842 268f45cc-cd09-0410-ab3c-d52691b4dbfc