Bug 19968: Slow Script at www.huffingtonpost.com
<https://bugs.webkit.org/show_bug.cgi?id=19968>

Reviewed by Maciej Stachowiak

Finally found the cause of this accursed issue.  It is triggered
by synchronous creation of a new global object from JS.  The new
global object resets the timer state in this execution group's
Machine, taking timerCheckCount to 0.  Then when JS returns the
timerCheckCount is decremented making it non-zero.  The next time
we execute JS we will start the timeout counter, however the non-zero
timeoutCheckCount means we don't reset the timer information. This
means that the timeout check is now checking the cumulative time
since the creation of the global object rather than the time since
JS was last entered.  At this point the slow script dialog is guaranteed
to eventually be displayed incorrectly unless a page is loaded
asynchronously (which will reset everything into a sane state).

The fix for this is rather trivial -- the JSGlobalObject constructor
should not be resetting the machine timer state.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-23  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Fixed https://bugs.webkit.org/show_bug.cgi?id=21038 | <rdar://problem/6240812>
        Uncaught exceptions in regex replace callbacks crash webkit

        This was a combination of two problems:

        (1) the replace function would continue execution after an exception
        had been thrown.

        (2) In some cases, the Machine would return 0 in the case of an exception,
        despite the fact that a few clients dereference the Machine's return
        value without first checking for an exception.

        * VM/Machine.cpp:
        (JSC::Machine::execute):

        ^ Return jsNull() instead of 0 in the case of an exception, since some
        clients depend on using our return value.

        ^ ASSERT that execution does not continue after an exception has been
        thrown, to help catch problems like this in the future.

        * kjs/StringPrototype.cpp:
        (JSC::stringProtoFuncReplace):

        ^ Stop execution if an exception has been thrown.

LayoutTests:

2008-09-23  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Oliver Hunt.

        Test for https://bugs.webkit.org/show_bug.cgi?id=21038
        Uncaught exceptions in regex replace callbacks crash webkit

        * fast/js/string-replace-exception-crash-expected.txt: Added.
        * fast/js/string-replace-exception-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36842 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Geoffrey Garen  <ggaren@apple.com>

        Try to fix the windows build.

        * VM/CTI.cpp:
        (JSC::CTI::compileOpCall):
        (JSC::CTI::privateCompileMainPass):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36841 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Alp Toker  <alp@nuanti.com>

        Build fix.

        * VM/CTI.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36840 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Matt Lilek  <webkit@mattlilek.com>

        Reviewed by Tim Hatcher.

        Inspector search field style tweaks.

        * page/inspector/inspector.css:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36839 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Eric.

Fixes: https://bugs.webkit.org/show_bug.cgi?id=21046 (Several LayoutTests crash)

Fix missing negation in EventTargetNode::insertedIntoDocument.
Made handleLocalEvents() virtual again, HTMLFormElement overrides it.
Remove code, that wasn't supposed to go in in dispatchGenericEvent().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36838 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Adds search support to the Profiles panel.

        The Profiles panel supports a few types of queries:
         * Standard string matching for function names and file URLs.
         * Greater than and less than search for numeric columns.
           So a query of ">24" will match all rows that have calls
           greater than 24. Or "<=42" will match all 42 or less.
         * Percent and time units. Adding a unit of "s", "ms" or "%"
           is supported and will match only the Self and Total columns.
           So a query of ">1.25s" will match all rows that took longer
           than 1.25 seconds.

        Reviewed by Oliver Hunt.

        * page/inspector/ProfileView.js:
        (WebInspector.ProfileView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
        it will start at the first result.
        (WebInspector.ProfileView.prototype.refreshShowAsPercents): Moved from the bottom of the file.
        (WebInspector.ProfileView.prototype.searchCanceled): Clear the search properties and refresh highlighted
        data grid nodes.
        (WebInspector.ProfileView.prototype.performSearch): Search the profile nodes.
        (WebInspector.ProfileView.prototype.jumpToFirstSearchResult): Does what the function says. Calls _jumpToSearchResult.
        (WebInspector.ProfileView.prototype.jumpToLastSearchResult): Ditto.
        (WebInspector.ProfileView.prototype.jumpToNextSearchResult): Ditto.
        (WebInspector.ProfileView.prototype.jumpToPreviousSearchResult): Ditto.
        (WebInspector.ProfileView.prototype.showingFirstSearchResult): Does what the function says.
        (WebInspector.ProfileView.prototype.showingLastSearchResult): Ditto.
        (WebInspector.ProfileView.prototype._jumpToSearchResult): Select and reveal the profile node.
        Expand all the ancestors first so the profile node will have a DataGridNode.
        (WebInspector.ProfileView.prototype._changeView): Perform the search again on the new tree.
        (WebInspector.ProfileDataGridNode.prototype.createCell): Add the highlight class to cells that
        have search matches.
        * page/inspector/ProfilesPanel.js:
        (WebInspector.ProfilesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
        (WebInspector.ProfilesPanel.prototype.showProfile): Use profileViewForProfile.
        (WebInspector.ProfilesPanel.prototype.showView): Call showProfile. Used by Panel to show a view.
        (WebInspector.ProfilesPanel.prototype.profileViewForProfile): Create the ProfileView if needed.
        (WebInspector.ProfilesPanel.prototype.closeVisibleView): Renamed visibleProfileView  to visibleView.
        (WebInspector.ProfilesPanel.prototype.get searchableViews): Return all the views.
        (WebInspector.ProfilesPanel.prototype.searchMatchFound): Update the sidebar search matches.
        (WebInspector.ProfilesPanel.prototype.searchCanceled): Clear all the sidebar search matches.
        (WebInspector.ProfileSidebarTreeElement.prototype.set searchMatches): Set the class and bubbleText.
        * page/inspector/inspector.css: New style rules for the cell highlight color.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36837 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Adds search support to the Resources and Scripts panels.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * page/inspector/Images/searchSmallBlue.png: Added.
        * page/inspector/Images/searchSmallBrightBlue.png: Added.
        * page/inspector/Images/searchSmallGray.png: Added.
        * page/inspector/Images/searchSmallWhite.png: Added.
        * page/inspector/ResourceView.js:
        (WebInspector.ResourceView.prototype.attach): Attempt to attach to "resource-views"
        or "script-resource-views" since one might not be created yet.
        * page/inspector/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.show): Hide any views that are visible that
        are not this panel's current visible view. This can happen when a ResourceView is
        visible in the Scripts panel then switched to the this panel.
        (WebInspector.ResourcesPanel.prototype.get searchableViews): Return all views, with the
        visibleView first.
        (WebInspector.ResourcesPanel.prototype.searchResultsSortFunction): Return a sort function
        that uses the current graph search function. So cycling through results will be in the order
        things appear in the sidebar.
        (WebInspector.ResourcesPanel.prototype.searchMatchFound): Update the search matches on the
        resource's sidebar tree element.
        (WebInspector.ResourcesPanel.prototype.searchCanceled): Restore the error and warning bubbles
        in the sidebar. Calls the Panel prototype's searchCanceled.
        (WebInspector.ResourcesPanel.prototype.performSearch): Hide all the error and warning bubbles
        in the sidebar. Calls the Panel prototype's performSearch.
        (WebInspector.ResourcesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
        (WebInspector.ResourcesPanel.prototype.addMessageToResource): Don't call updateErrorsAndWarnings
        if there is a current search query.
        (WebInspector.ResourcesPanel.prototype.clearMessages): Ditto.
        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded): Ditto.
        (WebInspector.ResourcesPanel.prototype.showView): Call showResource. Used by Panel to show a view.
        (WebInspector.ResourceSidebarTreeElement.prototype.resetBubble): Clear all the classes and content.
        (WebInspector.ResourceSidebarTreeElement.prototype.set searchMatches): Set the bubbleText and class.
        (WebInspector.ResourceSidebarTreeElement.prototype.updateErrorsAndWarnings): Call resetBubble.
        * page/inspector/ScriptView.js:
        (WebInspector.ScriptView): Set _sourceFrameSetup to flase.
        (WebInspector.ScriptView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
        it will start at the first result.
        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded): Add an event listener for "syntax
        highlighting complete".
        (WebInspector.ScriptView.prototype): Share many methods with SourceView.
        * page/inspector/ScriptsPanel.js:
        (WebInspector.ScriptsPanel.prototype.show): Hide any views that are visible that are not this
        This can happen when a ResourceView is visible in the Resources panel then switched to the this panel.
        (WebInspector.ScriptsPanel.prototype.get searchableViews): Return all views, with the visibleView first.
        (WebInspector.ScriptsPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
        (WebInspector.ScriptsPanel.prototype.showView): Call _showScriptOrResource. Used by Panel to show a view.
        (WebInspector.ScriptsPanel.prototype._sourceViewForScriptOrResource): Added helper.
        * page/inspector/SourceFrame.js:
        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript): Dispatch a "syntax highlighting complete" event.
        * page/inspector/SourceView.js:
        (WebInspector.SourceView.prototype.hide):
        (WebInspector.SourceView.prototype.detach):
        (WebInspector.SourceView.prototype._resourceLoadingFinished): Moved from the bottom of the file.
        (WebInspector.SourceView.prototype._addBreakpoint): Ditto.
        (WebInspector.SourceView.prototype.searchCanceled): Delete search properties.
        (WebInspector.SourceView.prototype.performSearch): Search the frame if it is loaded, otherwise
        store the worker function as _delayedFindSearchMatches and call it later in _sourceFrameSetupFinished.
        (WebInspector.SourceView.prototype.jumpToFirstSearchResult):
        (WebInspector.SourceView.prototype.jumpToLastSearchResult):
        (WebInspector.SourceView.prototype.jumpToNextSearchResult):
        (WebInspector.SourceView.prototype.jumpToPreviousSearchResult):
        (WebInspector.SourceView.prototype.showingFirstSearchResult):
        (WebInspector.SourceView.prototype.showingLastSearchResult):
        (WebInspector.SourceView.prototype._jumpToSearchResult): Selects the found Range.
        (WebInspector.SourceView.prototype._sourceFrameSetupFinished): Calls _delayedFindSearchMatches.
        (WebInspector.SourceView.prototype._syntaxHighlightingComplete): Call _sourceFrameSetupFinished.
        * page/inspector/inspector.css:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36836 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Rename some properties of ResourcesPanel and ScriptsPanel to be the same,
        so future code can be shared.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * page/inspector/ResourcesPanel.js: Renamed resourceViews to viewsContainerElement.
        And visibleResourceView to visibleView.
        * page/inspector/ScriptsPanel.js: Renamed scriptResourceViews to viewsContainerElement.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36835 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Highlight all matched search results in the Elements panel DOM tree.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * page/inspector/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype.searchCanceled): Clear the highlight
        on all previous search results.
        (WebInspector.ElementsPanel.prototype.performSearch): Set the hihglight
        on all new search results.
        * page/inspector/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeElement): Delay setting the title until onattach.
        (WebInspector.ElementsTreeElement.prototype.get/set highlighted): Sets or removes
        the highlighted class on the listItemElement.
        (WebInspector.ElementsTreeElement.prototype.onattach): Set the highlighted class
        if needed. Calls _updateTitle.
        (WebInspector.ElementsTreeElement.prototype._updateTitle): Adds a span with the highlight
        class so it can be styled when the highlighted class is present.
        * page/inspector/inspector.css: New style rules for the hihglight.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36834 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Add search support to the Elements panel.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * page/inspector/ElementsPanel.js:
        (WebInspector.ElementsPanel.prototype.searchCanceled): Call updateSearchMatchesCount
        with a 0 match count to rest. Reset the other search properties.
        (WebInspector.ElementsPanel.prototype.performSearch): Evaluates the search as an XPath
        query and a CSS selector on all the Documents in the page. Remembers the found nodes
        and avoids duplicates. Focuses the first result.
        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult): Focuses the next result.
        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult): Focuses the previous result.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36833 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Add support to Panel that allows easy searching of sub-views.

        Reviewed by Oliver Hunt.

        * page/inspector/Panel.js:
        (WebInspector.Panel.prototype.searchCanceled): Call searchCanceled on all the
        views in the search results and delete the currentQuery property. Call
        WebInspector.updateSearchMatchesCount wit ha 0 match count to rest. Reset the
        other search properties.
        (WebInspector.Panel.prototype.performSearch): Call searchCanceled since it will
        reset everything we need before doing a new search. Get an array of searchableViews
        from the panel, implemented by sub-classes. Iterate over the views one-by-one
        with an interval to prevent blocking the UI for large lists of searchableViews.
        This keeps the interface really responsive. Pass a finishedCallback function to
        the performSearch on each view so it can notify the panel of results.
        (WebInspector.Panel.prototype.jumpToNextSearchResult): Finds the index in the
        searchResults of the visibleView, so we know where in the results we are.
        This is done every time incase the user manually navigates to a new view.
        If the view is showing the last result, jump to the next view and show it's
        first result. Otherwise jump to the next result in the current view.
        (WebInspector.Panel.prototype.jumpToPreviousSearchResult): Ditto, but in reverse.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36832 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Add support for asking the current panel to perform a search, find next/previous and clear.
        A search is performed on the new new current panel when switching between panels. The search
        label/placeholder in the toolbar now includes the panel name to make it clear that panel will
        be searched. The search field contents are selected when Command/Control-F or Enter/Return
        is pressed, so the user can easily type an entirely new query. The search match count shows
        up in the toolbar next to the search field.

        Also changed:
         * Rename lastQuery to currentQuery since it better matches the truth.
         * Set the search field "results" attribute to zero since results arn't saved for
           how we use the search field.
         * Make repeated presses of the Return key jump to the next search result instead
           of doing nothing.
         * Increased the search field width.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * English.lproj/localizedStrings.js: New strings.
        * page/inspector/inspector.css: New styles.
        * page/inspector/inspector.html: Add the search-results-matches element. Add the
        incremental attribute to the search field and set the results attribute to zero.
        * page/inspector/inspector.js:
        (WebInspector.set currentPanel): perform the search on the new panel.
        (WebInspector.loaded): Change the event listeners and remove code that changes
        the search label text.
        (WebInspector.documentKeyDown): Add support for Command/Control-G and
        Command/Control-Shift-G. To jump to the next and previous search results.
        (WebInspector.updateSearchLabel): Added. Update the search placeholder/label.
        This does different things depending on the attached state.
        (WebInspector.searchKeyDown): Call preventDefault since this was the Enter key.
        This prevents a "search" event from firing for key down. We handle the Enter key
        on key up in searchKeyUp. This stops performSearch from being called twice in a row.
        (WebInspector.searchKeyUp): Calls performSearch when it is the Enter key.
        (WebInspector.performSearch): Delete the currentQuery property and call searchCanceled
        on all the panels. Call jumpToNextSearchResult when this is the same query or a forced search.
        Call updateSearchMatchesCount to reset the matches count in the toolbar.
        (WebInspector.updateSearchMatchesCount): Added. Updates the matches count in the toolbar.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36831 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Remove the previous Inspector search code to make room for the new stuff.

        https://bugs.webkit.org/show_bug.cgi?id=21005

        Reviewed by Oliver Hunt.

        * page/inspector/inspector.css:
        * page/inspector/inspector.html:
        * page/inspector/inspector.js:
        (WebInspector.get/set showingSearchResults): Removed.
        (WebInspector.searchResultsKeyDown): Removed.
        (WebInspector.searchResultsResizerDragStart): Removed.
        (WebInspector.searchResultsResizerDragEnd): Removed.
        (WebInspector.searchResultsResizerDrag): Removed.
        (WebInspector.performSearch): Removed searching parts.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36830 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Use the Array.remove helper function in more places.

        https://bugs.webkit.org/show_bug.cgi?id=21037

        Reviewed by Kevin McCullough.

        * page/inspector/ResourceCategory.js:
        (WebInspector.ResourceCategory.prototype.removeResource): Use Array.remove.
        * page/inspector/ResourcesPanel.js:
        (WebInspector.ResourcesPanel.prototype.removeResource): Ditto.
        * page/inspector/inspector.js:
        (WebInspector.removeResource): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36829 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Fixes a bug where inspecting a node after reloading the page
        would not reveal the node in the DOM tree. The TreeOutline
        was not being told to forget decendants of a removed child.
        So old TreeElements would be found that are not in the tree.

        https://bugs.webkit.org/show_bug.cgi?id=21036

        Reviewed by Kevin McCullough.

        * page/inspector/treeoutline.js:
        (TreeOutline._removeChildAtIndex): Call _forgetChildrenRecursive
        in addition to _forgetTreeElement.
        (TreeOutline._removeChildren): Call _forgetChildrenRecursive
        in addition to _forgetTreeElement.
        (TreeOutline._rememberTreeElement): Use Array.indexOf to quickly
        search for known elements.
        (TreeOutline._forgetTreeElement): Use Array.remove to remove elements.
        (TreeOutline._forgetChildrenRecursive): Recursively traverse the
        descendants and call _forgetTreeElement.
        * page/inspector/utilities.js:
        (Array.prototype.remove): Speed up this function by using Array.indexOf
        when onlyFirst is true.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36828 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Fixes a bug where inspecting some short text nodes does
        not reveal them in the Elements panel DOM tree.

        https://bugs.webkit.org/show_bug.cgi?id=21035

        Reviewed by Oliver Hunt.

        * page/inspector/ElementsTreeOutline.js:
        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
        The revealAndSelectNode() method might find a different element
        if there is inlined text, and the select() call would change the
        focusedDOMNode and reenter this setter. So to avoid calling
        focusedNodeChanged() twice, first check if _focusedDOMNode is
        the same node as the one passed in.
        (WebInspector.ElementsTreeOutline.prototype.update): Remove use of
        this.treeOutline, since this is the TreeOutline.
        (WebInspector.ElementsTreeOutline.prototype.findTreeElement): Added.
        Provides default functions for isAncestor, getParet and equal.
        Calls the base protoype's findTreeElement. If that returns null
        and the node is a text node, try finding it's parent.
        (WebInspector.ElementsTreeOutline.prototype.revealNode): Removed.
        Renamed to revealAndSelectNode.
        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
        Selects and reveals the node passed in. Use the simple findTreeElement.
        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
        Remove use of this.treeOutline, since this is the TreeOutline.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36827 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Fixes an exception that happened when removing a Resource
        from the ResourcesPanel.

        https://bugs.webkit.org/show_bug.cgi?id=21034

        Reviewed by Kevin McCullough.

        * page/inspector/ResourcesPanel.js:
        (WebInspctor.ResourcesPanel.prototype.removeResource):
        Remove the graphElement.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36826 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Darin Adler.

        * wtf/Platform.h: Removed duplicate #if.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36825 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Kevin McCullough  <kmccullough@apple.com>

        Fixed "Time" to "Tim"

        * ChangeLog:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36824 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Oliver.

Move mapInstanceToElement/removeInstanceMapping/instancesForElement
from SVGDocumentExtensions to SVGElement. It's more useful to store
the list of SVGElementInstances per SVGElement, instead of using
a document-wide hash for this purpose.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36823 268f45cc-cd09-0410-ab3c-d52691b4dbfc

wx build fix.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36822 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Geoffrey Garen  <ggaren@apple.com>

        Reviewed by Darin Adler.

        Changed the layout of the call frame from

        { header, parameters, locals | constants, temporaries }

        to

        { parameters, header | locals, constants, temporaries }

        This simplifies function entry+exit, and enables a number of future
        optimizations.

        13.5% speedup on empty call benchmark for bytecode; 23.6% speedup on
        empty call benchmark for CTI.

        SunSpider says no change. SunSpider --v8 says 1% faster.

        * VM/CTI.cpp:

        Added a bit of abstraction for calculating whether a register is a
        constant, since this patch changes that calculation:
        (JSC::CTI::isConstant):
        (JSC::CTI::getConstant):
        (JSC::CTI::emitGetArg):
        (JSC::CTI::emitGetPutArg):
        (JSC::CTI::getConstantImmediateNumericArg):

        Updated for changes to callframe header location:
        (JSC::CTI::emitPutToCallFrameHeader):
        (JSC::CTI::emitGetFromCallFrameHeader):
        (JSC::CTI::printOpcodeOperandTypes):

        Renamed to spite Oliver:
        (JSC::CTI::emitInitRegister):

        Added an abstraction for emitting a call through a register, so that
        calls through registers generate exception info, too:
        (JSC::CTI::emitCall):

        Updated to match the new callframe header layout, and to support calls
        through registers, which have no destination address:
        (JSC::CTI::compileOpCall):
        (JSC::CTI::privateCompileMainPass):
        (JSC::CTI::privateCompileSlowCases):
        (JSC::CTI::privateCompile):

        * VM/CTI.h:

        More of the above:
        (JSC::CallRecord::CallRecord):

        * VM/CodeBlock.cpp:

        Updated for new register layout:
        (JSC::registerName):
        (JSC::CodeBlock::dump):

        * VM/CodeBlock.h:

        Updated CodeBlock to track slightly different information about the
        register frame, and tweaked the style of an ASSERT_NOT_REACHED.
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::getStubInfo):

        * VM/CodeGenerator.cpp:

        Added some abstraction around constant register allocation, since this
        patch changes it, changed codegen to account for the new callframe
        layout, and added abstraction around register fetching code
        that used to assume that all local registers lived at negative indices,
        since vars now live at positive indices:
        (JSC::CodeGenerator::generate):
        (JSC::CodeGenerator::addVar):
        (JSC::CodeGenerator::addGlobalVar):
        (JSC::CodeGenerator::allocateConstants):
        (JSC::CodeGenerator::CodeGenerator):
        (JSC::CodeGenerator::addParameter):
        (JSC::CodeGenerator::registerFor):
        (JSC::CodeGenerator::constRegisterFor):
        (JSC::CodeGenerator::newRegister):
        (JSC::CodeGenerator::newTemporary):
        (JSC::CodeGenerator::highestUsedRegister):
        (JSC::CodeGenerator::addConstant):

        ASSERT that our caller referenced the registers it passed to us.
        Otherwise, we might overwrite them with parameters:
        (JSC::CodeGenerator::emitCall):
        (JSC::CodeGenerator::emitConstruct):

        * VM/CodeGenerator.h:

        Added some abstraction for getting a RegisterID for a given index,
        since the rules are a little weird:
        (JSC::CodeGenerator::registerFor):

        * VM/Machine.cpp:

        Utility function to transform a machine return PC to a virtual machine
        return VPC, for the sake of stack unwinding, since both PCs are stored
        in the same location now:
        (JSC::vPCForPC):

        Tweaked to account for new call frame:
        (JSC::Machine::initializeCallFrame):

        Tweaked to account for registerOffset supplied by caller:
        (JSC::slideRegisterWindowForCall):

        Tweaked to account for new register layout:
        (JSC::scopeChainForCall):
        (JSC::Machine::callEval):
        (JSC::Machine::dumpRegisters):
        (JSC::Machine::unwindCallFrame):
        (JSC::Machine::execute):

        Changed op_call and op_construct to implement the new calling convention:
        (JSC::Machine::privateExecute):

        Tweaked to account for the new register layout:
        (JSC::Machine::retrieveArguments):
        (JSC::Machine::retrieveCaller):
        (JSC::Machine::retrieveLastCaller):
        (JSC::Machine::callFrame):
        (JSC::Machine::getArgumentsData):

        Changed CTI call helpers to implement the new calling convention:
        (JSC::Machine::cti_op_call_JSFunction):
        (JSC::Machine::cti_op_call_NotJSFunction):
        (JSC::Machine::cti_op_ret_activation):
        (JSC::Machine::cti_op_ret_profiler):
        (JSC::Machine::cti_op_construct_JSConstruct):
        (JSC::Machine::cti_op_construct_NotJSConstruct):
        (JSC::Machine::cti_op_call_eval):

        * VM/Machine.h:

        * VM/Opcode.h:

        Renamed op_initialise_locals to op_init, because this opcode
        doesn't initialize all locals, and it doesn't initialize only locals.
        Also, to spite Oliver.

        * VM/RegisterFile.h:

        New call frame enumeration values:
        (JSC::RegisterFile::):

        Simplified the calculation of whether a RegisterID is a temporary,
        since we can no longer assume that all positive non-constant registers
        are temporaries:
        * VM/RegisterID.h:
        (JSC::RegisterID::RegisterID):
        (JSC::RegisterID::setTemporary):
        (JSC::RegisterID::isTemporary):

        Renamed firstArgumentIndex to firstParameterIndex because the assumption
        that this variable pertained to the actual arguments supplied by the
        caller caused me to write some buggy code:
        * kjs/Arguments.cpp:
        (JSC::ArgumentsData::ArgumentsData):
        (JSC::Arguments::Arguments):
        (JSC::Arguments::fillArgList):
        (JSC::Arguments::getOwnPropertySlot):
        (JSC::Arguments::put):

        Updated for new call frame layout:
        * kjs/DebuggerCallFrame.cpp:
        (JSC::DebuggerCallFrame::functionName):
        (JSC::DebuggerCallFrame::type):
        * kjs/DebuggerCallFrame.h:

        Changed the activation object to account for the fact that a call frame
        header now sits between parameters and local variables. This change
        requires all variable objects to do their own marking, since they
        now use their register storage differently:
        * kjs/JSActivation.cpp:
        (JSC::JSActivation::mark):
        (JSC::JSActivation::copyRegisters):
        (JSC::JSActivation::createArgumentsObject):
        * kjs/JSActivation.h:

        Updated global object to use the new interfaces required by the change
        to JSActivation above:
        * kjs/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::reset):
        (JSC::JSGlobalObject::mark):
        (JSC::JSGlobalObject::copyGlobalsFrom):
        (JSC::JSGlobalObject::copyGlobalsTo):
        * kjs/JSGlobalObject.h:
        (JSC::JSGlobalObject::addStaticGlobals):

        Updated static scope object to use the new interfaces required by the
        change to JSActivation above:
        * kjs/JSStaticScopeObject.cpp:
        (JSC::JSStaticScopeObject::mark):
        (JSC::JSStaticScopeObject::~JSStaticScopeObject):
        * kjs/JSStaticScopeObject.h:
        (JSC::JSStaticScopeObject::JSStaticScopeObject):
        (JSC::JSStaticScopeObject::d):

        Updated variable object to use the new interfaces required by the
        change to JSActivation above:
        * kjs/JSVariableObject.cpp:
        (JSC::JSVariableObject::copyRegisterArray):
        (JSC::JSVariableObject::setRegisters):
        * kjs/JSVariableObject.h:

        Changed the bit twiddling in symbol table not to assume that all indices
        are negative, since they can be positive now:
        * kjs/SymbolTable.h:
        (JSC::SymbolTableEntry::SymbolTableEntry):
        (JSC::SymbolTableEntry::isNull):
        (JSC::SymbolTableEntry::getIndex):
        (JSC::SymbolTableEntry::getAttributes):
        (JSC::SymbolTableEntry::setAttributes):
        (JSC::SymbolTableEntry::isReadOnly):
        (JSC::SymbolTableEntry::pack):
        (JSC::SymbolTableEntry::isValidIndex):

        Changed call and construct nodes to ref their functions and/or bases,
        so that emitCall/emitConstruct doesn't overwrite them with parameters.
        Also, updated for rename to registerFor:
        * kjs/nodes.cpp:
        (JSC::ResolveNode::emitCode):
        (JSC::NewExprNode::emitCode):
        (JSC::EvalFunctionCallNode::emitCode):
        (JSC::FunctionCallValueNode::emitCode):
        (JSC::FunctionCallResolveNode::emitCode):
        (JSC::FunctionCallBracketNode::emitCode):
        (JSC::FunctionCallDotNode::emitCode):
        (JSC::PostfixResolveNode::emitCode):
        (JSC::DeleteResolveNode::emitCode):
        (JSC::TypeOfResolveNode::emitCode):
        (JSC::PrefixResolveNode::emitCode):
        (JSC::ReadModifyResolveNode::emitCode):
        (JSC::AssignResolveNode::emitCode):
        (JSC::ConstDeclNode::emitCodeSingle):
        (JSC::ForInNode::emitCode):

        Added abstraction for getting exception info out of a call through a
        register:
        * masm/X86Assembler.h:
        (JSC::X86Assembler::emitCall):

        Removed duplicate #if:
        * wtf/Platform.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36821 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rubber stamped by Sam.

Move code from EventTarget to EventTargetNode.

I refactored most parts to live in EventTarget, a year ago,
though the implementation of EventTargetSVGElementInstance is
done in another way, that obsoletes this.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36820 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix horizontal scrollbars on windows.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36819 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-09-23  Beth Dakin  <bdakin@apple.com>

        Reviewed by Sam Weinig.

        Fix for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add Contact"
        link at gmail does not support AXPress action
        and corresponding: <rdar://problem/6216178>

        I fixed this bug by making AccessibilityObject::anchorElement
        support ARIA links.

        * page/AccessibilityImageMapLink.cpp:
        (WebCore::AccessibilityImageMapLink::anchorElement):
        * page/AccessibilityImageMapLink.h:
        * page/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::anchorElement):
        * page/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isNativeAnchor):
        * page/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::isNativeAnchor):
        (WebCore::AccessibilityRenderObject::anchorElement):
        (WebCore::AccessibilityRenderObject::internalLinkElement):
        (WebCore::AccessibilityRenderObject::url):
        * page/AccessibilityRenderObject.h:
        * page/mac/AccessibilityObjectWrapper.mm:
        (AXLinkElementForNode):

WebKitTools:

2008-09-23  Beth Dakin  <bdakin@apple.com>

        Reviewed by Sam Weinig.

        This patch extends DumpRenderTree's AccessibilityController to ask
        if the focused element supports the press action.

        * DumpRenderTree/AccessibilityUIElement.cpp:
        (getSupportsPressActionCallback):
        (AccessibilityUIElement::getJSClass):
        * DumpRenderTree/AccessibilityUIElement.h:
        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
        (AccessibilityUIElement::supportsPressAction):

LayoutTests:

2008-09-23  Beth Dakin  <bdakin@apple.com>

        Reviewed by Sam Weinig.

        Test for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add
        Contact" link at gmail does not support AXPress action
        and corresponding: <rdar://problem/6216178>

        * accessibility/aria-link-supports-press-expected.txt: Added.
        * accessibility/aria-link-supports-press.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36818 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Time and Oliver.

        Bug 20949: Catch repeated messages in Inspector Controller to limit
        memory usage
        - Store the repeat count in the Console Message object, in the
        Inspector Controller and JS ConsoleMessage object.

        * page/InspectorController.cpp:
        (WebCore::ConsoleMessage::ConsoleMessage):
        (WebCore::ConsoleMessage::operator==):
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::addConsoleMessage):
        (WebCore::InspectorController::addScriptConsoleMessage):
        * page/InspectorController.h:
        * page/inspector/Console.js:
        * page/inspector/Resource.js:
        * page/inspector/ResourcesPanel.js:
        * page/inspector/SourceFrame.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36817 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Eric.

Working on proper EventTarget support for SVGElementInstance.

Add new EventTargetSVGElementInstance class, and it's corresponding JS wrapper.
Finally JSEventTargetBase, is actually used for another class than JSEventTargetnode.

Remove EventTarget inheritance from SVGElementInstance, and the manual "TreeShared"
implementation. Let it use TreeShared directly.

It's not activated so far (SVGUseElement still creating SVGElementInstance objects).
The transition to EventTargetSVGElementInstance will be done in a few individual patches.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36816 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Dave Hyatt.

        - https://bugs.webkit.org/show_bug.cgi?id=21040
          Pass NULL instead of the identity matrix to CTFontCreateWithGraphicsFont()

        * platform/graphics/mac/SimpleFontDataMac.mm:
        (WebCore::SimpleFontData::getCTFont):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36815 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-09-23  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=21039

        Teach the viewless Mac scrollbar how to avoid NSWindow's resizer.

        Reviewed by Sam Weinig

        * platform/ScrollView.h:
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::setFrameGeometry):
        * platform/Scrollbar.h:
        * platform/Widget.cpp:
        (WebCore::Widget::convertFromContainingWindow):
        * platform/Widget.h:
        * platform/mac/ScrollViewMac.mm:
        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
        (WebCore::ScrollView::ScrollView):
        (WebCore::ScrollView::~ScrollView):
        (WebCore::ScrollView::windowResizerRect):
        (WebCore::ScrollView::resizerOverlapsContent):
        (WebCore::ScrollView::adjustOverlappingScrollbarCount):
        (WebCore::ScrollView::setParent):
        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::convertFromContainingWindow):

WebKit/mac:

2008-09-23  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=21039

        Teach the viewless Mac scrollbar how to avoid the NSWindow resizer.

        Reviewed by Sam Weinig

        * WebCoreSupport/WebChromeClient.mm:
        (WebChromeClient::windowResizerRect):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36814 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Dirk Schulze  <vbs85@gmx.de>

        Reviewed by Darin Adler. Landed by Jan Alonzo.

        Added support for getImageData() and putImageData()
        to Cairo.

        [CAIRO] needs getImageData and putImageData support
        https://bugs.webkit.org/show_bug.cgi?id=20838

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::ImageBuffer):
        (WebCore::ImageBuffer::getImageData):
        (WebCore::ImageBuffer::putImageData):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36813 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Marco Barisione  <marco.barisione@collabora.co.uk>

        Reviewed by Holger Freyther.

        http://bugs.webkit.org/show_bug.cgi?id=18987
        [GTK] Implement SharedBuffer::createWithContentsOfFile and
        KURL::fileSystemPath

        * GNUmakefile.am: Add KURLGtk.cpp and SharedBufferGtk.cpp.
        * platform/gtk/KURLGtk.cpp: Added.
        (WebCore::KURL::fileSystemPath): Implemented.
        * platform/gtk/SharedBufferGtk.cpp: Added.
        (WebCore::SharedBuffer::createWithContentsOfFile): Implemented.
        * platform/gtk/TemporaryLinkStubs.cpp: Remove the old stubs.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36812 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Oliver Hunt, okayed by Darin Adler.

        <rdar://problem/5575547> REGRESSION: ATOK has no phrase boundary on Safari/Mail.app

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintCompositionUnderline): Add 2 pixel spacing between clauses.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36811 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebKit/mac:

        Reviewed by Beth Dakin.

        - fix <rdar://problem/6233388> Crash beneath -[WebFrameView keyDown:]

        Test: fast/events/keydown-remove-frame.html

        * WebView/WebFrameView.mm:
        (-[WebFrameView keyDown:]): Added a null check.

LayoutTests:

        Reviewed by Beth Dakin.

        - test for <rdar://problem/6233388> Crash beneath -[WebFrameView keyDown:]

        * fast/events/keydown-remove-frame-expected.txt: Added.
        * fast/events/keydown-remove-frame.html: Added.
        * fast/events/resources/keydown-remove-frame-iframe.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36810 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Darin.

        Bug 21030: The JS debugger breaks on the do of a do-while not the while
        (where the conditional statement is)
        https://bugs.webkit.org/show_bug.cgi?id=21030
        Now the statementListEmitCode detects if a do-while node is being
        emited and emits the debug hook on the last line instead of the first.

        This change had no effect on sunspider.

        * kjs/nodes.cpp:
        (JSC::statementListEmitCode):
        * kjs/nodes.h:
        (JSC::StatementNode::isDoWhile):
        (JSC::DoWhileNode::isDoWhile):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36809 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Camron Zwarich.

        - inline the fast case of instanceof
        https://bugs.webkit.org/show_bug.cgi?id=20818

        ~2% speedup on EarleyBoyer test.

        * VM/CTI.cpp:
        (JSC::CTI::privateCompileMainPass):
        (JSC::CTI::privateCompileSlowCases):
        * VM/Machine.cpp:
        (JSC::Machine::cti_op_instanceof):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36808 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=21023
        Don't use TEC for encodings supported by ICU

        * platform/text/mac/mac-encodings.txt: Removed x-mac-centraleurroman, x-mac-cyrillic,
        x-mac-greek, and x-mac-turkish.

        * platform/text/TextCodecICU.cpp: (WebCore::TextCodecICU::registerExtendedEncodingNames):
        Register aliases for these encodings that are not registered automatically; updated comments.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36807 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Cameron Zwarich.

        - add forgotten slow case logic for !==

        * VM/CTI.cpp:
        (JSC::CTI::privateCompileSlowCases):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36806 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Cameron Zwarich.

        - inline the fast cases of !==, same as for ===

        2.9% speedup on EarleyBoyer benchmark

        * VM/CTI.cpp:
        (JSC::CTI::compileOpStrictEq): Factored stricteq codegen into this function,
        and parameterized so it can do the reverse version as well.
        (JSC::CTI::privateCompileMainPass): Use the above for stricteq and nstricteq.
        * VM/CTI.h:
        (JSC::CTI::): Declare above stuff.
        * VM/Machine.cpp:
        (JSC::Machine::cti_op_nstricteq): Removed fast cases, now handled inline.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36805 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Oliver Hunt.

        Bug 20989: Aguments constructor should put 'callee' and 'length' properties in a more efficient way
        <https://bugs.webkit.org/show_bug.cgi?id=20989>

        Make special cases for the 'callee' and 'length' properties in the
        Arguments object.

        This is somewhere between a 7.8% speedup and a 10% speedup on the V8
        Raytrace benchmark, depending on whether it is run alone or with the
        other V8 benchmarks.

        * kjs/Arguments.cpp:
        (JSC::ArgumentsData::ArgumentsData):
        (JSC::Arguments::Arguments):
        (JSC::Arguments::mark):
        (JSC::Arguments::getOwnPropertySlot):
        (JSC::Arguments::put):
        (JSC::Arguments::deleteProperty):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36804 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix (add file i forgot in r36801)

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36803 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-23  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - speed up instanceof some more
        https://bugs.webkit.org/show_bug.cgi?id=20818

        ~2% speedup on EarleyBoyer

        The idea here is to record in the StructureID whether the class
        needs a special hasInstance or if it can use the normal logic from
        JSObject.

        Based on this I inlined the real work directly into
        cti_op_instanceof and put the fastest checks up front and the
        error handling at the end (so it should be fairly straightforward
        to split off the beginning to be inlined if desired).

        I only did this for CTI, not the bytecode interpreter.

        * API/JSCallbackObject.h:
        (JSC::JSCallbackObject::createStructureID):
        * ChangeLog:
        * VM/Machine.cpp:
        (JSC::Machine::cti_op_instanceof):
        * kjs/JSImmediate.h:
        (JSC::JSImmediate::isAnyImmediate):
        * kjs/TypeInfo.h:
        (JSC::TypeInfo::overridesHasInstance):
        (JSC::TypeInfo::flags):

WebCore:

2008-09-23  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - speed up instanceof some more
        https://bugs.webkit.org/show_bug.cgi?id=20818

        ~2% speedup on EarleyBoyer

        (WebCore updates.)

        * bindings/js/JSQuarantinedObjectWrapper.h:
        (WebCore::JSQuarantinedObjectWrapper::createStructureID):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36802 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

- fix https://bugs.webkit.org/show_bug.cgi?id=21008
  getting pixels by index from CanvasPixelArray is unnecessarily slow

Reviewed by Oliver Hunt

* GNUmakefile.am: Added JSCanvasPixelArrayCustom.h.
* WebCore.vcproj/WebCore.vcproj: Ditto.
* WebCore.xcodeproj/project.pbxproj: Ditto.

* bindings/js/JSCanvasPixelArrayCustom.cpp: Removed indexGetter and
  indexSetter. These are now both inlined, so in the header.
* bindings/js/JSCanvasPixelArrayCustom.h: Added. The getByIndex
  function is what's used for HasCustomIndexGetter. Also moved the
  indexSetter function here.

* bindings/scripts/CodeGeneratorJS.pm: Changed HasCustomIndexGetter
  to use a getByIndex member function rather than an indexGetter stat
  member function in a property slot. This lets us avoid the property
  slot mechanism's rule where it turns numeric property names into
  strings in the identifier table, which is good because that's slow.
  Also added a new property CustomHeader that allows IDL files to
  introduce headers to be included -- useful when we have functions
  that we want to inline into the binding.

* html/CanvasPixelArray.idl: Added CustomHeader attribute.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36801 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    No review, build fix only.

        Another blind stab in the dark.

        * svg/graphics/cg/SVGResourceClipperCg.cpp: Add missing header.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36800 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    No review, build fix only.

        Third time's the charm, eh?  My local build is sadly still not done...

        * platform/graphics/AffineTransform.cpp: remove extra &
        * platform/graphics/AffineTransform.h: remove extra &

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36799 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Eric Seidel  <eric@webkit.org>

        No review, build fix only.

        * platform/graphics/AffineTransform.cpp: remove extra ;

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36798 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    No review, build fix only.

        Speculative fix for the build while I wait for my compile to finish.

        * platform/graphics/AffineTransform.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36797 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebKit/win:

2008-09-22  Alice Liu  <alice.liu@apple.com>

        Added record-memory-win.vcproj tool to the solution

        Reviewed by Steve Falkenburg.

        * WebKit.vcproj/WebKit.sln:

WebKitTools:

2008-09-22  Alice Liu  <alice.liu@apple.com>

        Adding a stand-alone Windows console application to record a process's memory usage

        Reviewed by Steve Falkenburg.

        * record-memory-win: Added.
        * record-memory-win/main.cpp: Added.
        * record-memory-win/record-memory-win.vcproj: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36796 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Dirk Schulze  <vbs85@gmx.de>

        Reviewed by eseidel.  Landed by eseidel.

        Moved makeMapBetweenRects from SVG/CG to AffineTransform
        Make SVGResourceClipper::applyClip more cross-platform

        * platform/graphics/AffineTransform.cpp:
        * platform/graphics/AffineTransform.h:
        * svg/graphics/cg/CgSupport.cpp:
        * svg/graphics/cg/CgSupport.h:
        * svg/graphics/cg/SVGPaintServerGradientCg.cpp:
        (WebCore::SVGPaintServerGradient::handleBoundingBoxModeAndGradientTransformation):
        * svg/graphics/cg/SVGResourceClipperCg.cpp:
        (WebCore::SVGResourceClipper::applyClip):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36795 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        - https://bugs.webkit.org/show_bug.cgi?id=21019
          make FunctionBodyNode::ref/deref fast

        Speeds up v8-raytrace by 7.2%.

        * kjs/nodes.cpp:
        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize m_refCount to 0.
        * kjs/nodes.h:
        (JSC::FunctionBodyNode::ref): Call base class ref once, and thereafter use
        m_refCount.
        (JSC::FunctionBodyNode::deref): Ditto, but the deref side.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36794 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

        Pointed out by Sam Weinig.

        * kjs/Arguments.cpp:
        (JSC::Arguments::fillArgList): Fix bad copy and paste. Oops!

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36793 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich.

        - https://bugs.webkit.org/show_bug.cgi?id=20983
          ArgumentsData should have some room to allocate some extra arguments inline

        Speeds up v8-raytrace by 5%.

        * kjs/Arguments.cpp:
        (JSC::ArgumentsData::ArgumentsData): Use a fixed buffer if there are 4 or fewer
        extra arguments.
        (JSC::Arguments::Arguments): Use a fixed buffer if there are 4 or fewer
        extra arguments.
        (JSC::Arguments::~Arguments): Delete the buffer if necessary.
        (JSC::Arguments::mark): Update since extraArguments are now Register.
        (JSC::Arguments::fillArgList): Added special case for the only case that's
        actually used in the practice, when there are no parameters. There are some
        other special cases in there too, but that's the only one that matters.
        (JSC::Arguments::getOwnPropertySlot): Updated to use setValueSlot since there's
        no operation to get you at the JSValue* inside a Register as a "slot".

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36792 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Alp Toker  <alp@nuanti.com>

        Reviewed by David Hyatt.

        https://bugs.webkit.org/show_bug.cgi?id=16331
        [Gtk] no focus when button/checkbox/radiobutton clicked, only when tabbed

        Obey GTK+ focusing conventions for controls and anchor elements.

        It could be interesting to push these decisions up to Settings or
        ChromeClient some day but this gets things working.

        Right and middle click events still need some work to match GTK+
        conventions.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::isMouseFocusable):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::isMouseFocusable):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::sendContextMenuEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36791 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix typo in ChangeLog

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36790 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Sam Weinig  <sam@webkit.org>

        Reviewed by Maciej Stachowiak.

        Patch for https://bugs.webkit.org/show_bug.cgi?id=21014
        Speed up for..in by using StructureID to avoid call hasProperty

        Speeds up fasta by 8%.

        * VM/JSPropertyNameIterator.cpp:
        (JSC::JSPropertyNameIterator::invalidate):
        * VM/JSPropertyNameIterator.h:
        (JSC::JSPropertyNameIterator::next):
        * kjs/PropertyNameArray.h:
        (JSC::PropertyNameArrayData::begin):
        (JSC::PropertyNameArrayData::end):
        (JSC::PropertyNameArrayData::setCachedStructureID):
        (JSC::PropertyNameArrayData::cachedStructureID):
        * kjs/StructureID.cpp:
        (JSC::StructureID::getEnumerablePropertyNames):
        (JSC::structureIDChainsAreEqual):
        * kjs/StructureID.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36789 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

        * page/mac/FrameMac.mm:
        (WebCore::Frame::baseWritingDirectionForSelectionStart): Fix indentation.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36788 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-09-22  Sam Weinig  <sam@webkit.org>

        Reviewed by Dan Bernstein.

        Patch for https://bugs.webkit.org/show_bug.cgi?id=21013
        Match Firefox in how we hide HTMLInputElement.selectionStart, selectionEnd
        and setSelectionRange.  This also allows us to remove the legacy JSHTMLInputElementBase
        class!

        - selectionStart, selectionEnd and setSelectionRange now are visible in iteration of
          non-selectable input types, but return undefined when accessed.

        * DerivedSources.make:
        * GNUmakefile.am:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * bindings/js/JSHTMLInputElementBase.cpp: Removed.
        * bindings/js/JSHTMLInputElementBase.h: Removed.
        * bindings/js/JSHTMLInputElementCustom.cpp: Added.
        (WebCore::JSHTMLInputElement::customGetOwnPropertySlot):
        (WebCore::JSHTMLInputElement::selectionStart):
        (WebCore::JSHTMLInputElement::selectionEnd):
        * bindings/js/JSHTMLInputElementCustom.h: Added.
        * html/HTMLInputElement.idl:

LayoutTests:

2008-09-22  Sam Weinig  <sam@webkit.org>

        Reviewed by Dan Bernstein.

        Tests for https://bugs.webkit.org/show_bug.cgi?id=21013

        * fast/forms/selection-functions.html: Update test to match new
        behavior that we now share with Firefox.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Sam Weinig.

        - fix <rdar://problem/5699571> Mail: Unable to change writing direction to LTR in an empty message

        Not testable in DumpRenderTree or in Safari

        * page/mac/FrameMac.mm:
        (WebCore::Frame::baseWritingDirectionForSelectionStart): Account for the
        case that the selection start node is a block.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36786 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Alexander Orlov  <alexander.orlov@loxal.net>

        Reviewed by Darin Adler.

        * projects/performance/index.html: Remove dead link to the 24fun test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36785 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Kelvin Sherlock  <ksherlock@gmail.com>

        Updated and tweaked by Sam Weinig.

        Reviewed by Geoffrey Garen.

        Bug 20020: Proposed enhancement to JavaScriptCore API
        <https://bugs.webkit.org/show_bug.cgi?id=20020>

        Add JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError, and JSObjectMakeRegExp
        functions to create JavaScript Array, Date, Error, and RegExp objects, respectively.

        * API/JSObjectRef.cpp: The functions
        * API/JSObjectRef.h: Function prototype and documentation
        * JavaScriptCore.exp: Added functions to exported function list
        * API/tests/testapi.c: Added basic functionality tests.

        * kjs/DateConstructor.cpp:
        Replaced static JSObject* constructDate(ExecState* exec, JSObject*, const ArgList& args)
        with JSObject* constructDate(ExecState* exec, const ArgList& args).
        Added static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args) function

        * kjs/DateConstructor.h:
        added prototype for JSObject* constructDate(ExecState* exec, const ArgList& args)

        * kjs/ErrorConstructor.cpp:
        removed static qualifier from ErrorInstance* constructError(ExecState* exec, const ArgList& args)

        * kjs/ErrorConstructor.h:
        added prototype for ErrorInstance* constructError(ExecState* exec, const ArgList& args)

        * kjs/RegExpConstructor.cpp:
        removed static qualifier from JSObject* constructRegExp(ExecState* exec, const ArgList& args)

        * kjs/RegExpConstructor.h:
        added prototype for JSObject* constructRegExp(ExecState* exec, const ArgList& args)

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36784 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-09-22  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=21007

        Make sure that the scrollbar gets sent a release event on platforms that call handleMouseDoubleClickEvent.

        Reviewed by Sam Weinig

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseDoubleClickEvent):

LayoutTests:

2008-09-22  David Hyatt  <hyatt@apple.com>

        Layout test for double click scrollbar bug.

        Reviewed by Sam Weinig

        * fast/events/scrollbar-double-click-expected.txt: Added.
        * fast/events/scrollbar-double-click.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36783 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Matt Lilek  <webkit@mattlilek.com>

        Not reviewed, Windows build fix.

        * kjs/Arguments.cpp:
        * kjs/FunctionPrototype.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36782 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    No review, rollback only.

        Roll out Peter's change (per his request)
        http://trac.webkit.org/changeset/36069
        https://bugs.webkit.org/show_bug.cgi?id=19663
        This change has been the source of numerous regressions
        (several of which were latent bugs revealed by this change,
        others were bugs in this change)

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::startAnimation):
        (WebCore::BitmapImage::advanceAnimation):
        * platform/graphics/BitmapImage.h:
        * platform/graphics/cairo/ImageCairo.cpp:
        (WebCore::BitmapImage::draw):
        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::BitmapImage::draw):
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore::BitmapImage::draw):
        * platform/graphics/wx/ImageWx.cpp:
        (WebCore::BitmapImage::draw):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36781 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

        Reviewed by Sam Weinig.

        - fix <rdar://problem/5158514> Switch the complex text code path to Core Text

        Tests: platform/mac-snowleopard/fast/text/myanmar-shaping.html
               platform/mac-snowleopard/fast/text/thai-combining-mark-positioning.html

        * config.h: Use Core Text if not building for Leopard or Tiger.

LayoutTests:

        Reviewed by Sam Weinig.

        - tests and updated results for <rdar://problem/5158514> Switch the complex text code path to Core Text

        * platform/mac-snowleopard/fast: Added.
        * platform/mac-snowleopard/fast/text: Added.
        * platform/mac-snowleopard/fast/text/atsui-multiple-renderers-expected.checksum: Added.
        * platform/mac-snowleopard/fast/text/atsui-multiple-renderers-expected.png: Added.
        * platform/mac-snowleopard/fast/text/atsui-multiple-renderers-expected.txt: Added.
        * platform/mac-snowleopard/fast/text/myanmar-shaping-expected.checksum: Added.
        * platform/mac-snowleopard/fast/text/myanmar-shaping-expected.png: Added.
        * platform/mac-snowleopard/fast/text/myanmar-shaping-expected.txt: Added.
        * platform/mac-snowleopard/fast/text/myanmar-shaping.html: Added.
        * platform/mac-snowleopard/fast/text/resources: Added.
        * platform/mac-snowleopard/fast/text/resources/Garuda.ttf: Added from http://www.w3.org/International/tests/test-webfonts/test-thai-tibetan-myanmar.html.
        * platform/mac-snowleopard/fast/text/resources/mm3.ttf: Added from http://www.w3.org/International/tests/test-webfonts/test-thai-tibetan-myanmar.html.
        * platform/mac-snowleopard/fast/text/thai-combining-mark-positioning-expected.checksum: Added.
        * platform/mac-snowleopard/fast/text/thai-combining-mark-positioning-expected.png: Added.
        * platform/mac-snowleopard/fast/text/thai-combining-mark-positioning-expected.txt: Added.
        * platform/mac-snowleopard/fast/text/thai-combining-mark-positioning.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36780 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-22  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin Adler.

        Patch for https://bugs.webkit.org/show_bug.cgi?id=20982
        Speed up the apply method of functions by special-casing array and 'arguments' objects

        1% speedup on v8-raytrace.

        Test: fast/js/function-apply.html

        * kjs/Arguments.cpp:
        (JSC::Arguments::fillArgList):
        * kjs/Arguments.h:
        * kjs/FunctionPrototype.cpp:
        (JSC::functionProtoFuncApply):
        * kjs/JSArray.cpp:
        (JSC::JSArray::fillArgList):
        * kjs/JSArray.h:

LayoutTests:

2008-09-22  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin Adler.

        Test for https://bugs.webkit.org/show_bug.cgi?id=20982

        * fast/js/function-apply-expected.txt: Added.
        * fast/js/function-apply.html: Added.
        * fast/js/resources/function-apply.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36779 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        - https://bugs.webkit.org/show_bug.cgi?id=20993
          Array.push/pop need optimized cases for JSArray

        3% or so speedup on DeltaBlue benchmark.

        * kjs/ArrayPrototype.cpp:
        (JSC::arrayProtoFuncPop): Call JSArray::pop when appropriate.
        (JSC::arrayProtoFuncPush): Call JSArray::push when appropriate.

        * kjs/JSArray.cpp:
        (JSC::JSArray::putSlowCase): Set m_fastAccessCutoff when appropriate, getting
        us into the fast code path.
        (JSC::JSArray::pop): Added.
        (JSC::JSArray::push): Added.
        * kjs/JSArray.h: Added push and pop.

        * kjs/operations.cpp:
        (JSC::throwOutOfMemoryError): Don't inline this. Helps us avoid PIC branches.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36778 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=21006

        Add code that paints an NSView-less scroller using HIThemeDrawTrack.  This scrollbar is still not
        switched on.  There are still a few more refinements to make to the rendering and behavior.

        Reviewed by Darin Adler

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::paint):
        * platform/ScrollbarThemeComposite.h:
        (WebCore::ScrollbarThemeComposite::paintTrack):
        (WebCore::ScrollbarThemeComposite::paintButton):
        (WebCore::ScrollbarThemeComposite::paintThumb):
        * platform/mac/ScrollbarThemeMac.h:
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::backButtonRect):
        (WebCore::ScrollbarThemeMac::forwardButtonRect):
        (WebCore::scrollbarPartToHIPressedState):
        (WebCore::ScrollbarThemeMac::paint):
        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::invalidateRect):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36777 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Sam Weinig

        transition end event when -webkit-transition-property: all puts wrong
        propertyName in event
        https://bugs.webkit.org/show_bug.cgi?id=20903

        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::sendTransitionEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36774 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/6230234> AXTable should probably not be exposed in there's only one cell

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36773 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/6167779> Setting AXSelectedTextRange for TextAreas in a WebView behaves incorrectly

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36772 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore:

2008-09-22  David Hyatt  <hyatt@apple.com>

        Clean up some parent relationships in the back end stylesheet code.  Make sure parentStyleSheet
        properly walks up nested rule blocks to reach the parent sheet instead of giving up at the immediate
        parent.  Also fix the doc() method so that it is properly set when the parent of the sheet is an import
        rule.

        Reviewed by Sam Weinig

        Added fast/css/nested-rule-parent-sheet.html

         * css/CSSImportRule.cpp:
        (WebCore::CSSImportRule::insertedIntoParent):
        * css/CSSRule.cpp:
        (WebCore::CSSRule::parentStyleSheet):
        (WebCore::CSSRule::parentRule):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::CSSStyleSheet):
        * css/CSSStyleSheet.h:

LayoutTests:

2008-09-22  David Hyatt  <hyatt@apple.com>

        Add new test for .parentStyleSheet.

        Reviewed by Sam Weinig

        * fast/css/nested-rule-parent-sheet.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36771 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Reviewed by Sam Weinig.

        - fix https://bugs.webkit.org/show_bug.cgi?id=21002
          Make the ATSUI code path respect spacingDisabled()

        Fixes svg/text/text-spacing-01-b.svg in run-webkit-tests --complex-text

        * platform/graphics/mac/FontMacATSUI.mm:
        (WebCore::overrideLayoutOperation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36770 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-22  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Cameron Zwarich.

        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag

        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>

        2.2% speedup on EarleyBoyer benchmark.

        * API/JSCallbackConstructor.cpp:
        * API/JSCallbackConstructor.h:
        (JSC::JSCallbackConstructor::createStructureID):
        * API/JSCallbackFunction.cpp:
        * API/JSCallbackFunction.h:
        (JSC::JSCallbackFunction::createStructureID):
        * API/JSCallbackObject.h:
        (JSC::JSCallbackObject::createStructureID):
        * API/JSCallbackObjectFunctions.h:
        (JSC::::hasInstance):
        * API/JSValueRef.cpp:
        (JSValueIsInstanceOfConstructor):
        * JavaScriptCore.exp:
        * VM/Machine.cpp:
        (JSC::Machine::privateExecute):
        (JSC::Machine::cti_op_instanceof):
        * kjs/InternalFunction.cpp:
        * kjs/InternalFunction.h:
        (JSC::InternalFunction::createStructureID):
        * kjs/JSObject.cpp:
        * kjs/JSObject.h:
        * kjs/TypeInfo.h:
        (JSC::TypeInfo::implementsHasInstance):

WebCore:

2008-09-22  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Cameron Zwarich.

        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag

        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>

        2.2% speedup on EarleyBoyer benchmark.

        * bindings/js/JSQuarantinedObjectWrapper.cpp:
        * bindings/js/JSQuarantinedObjectWrapper.h:
        (WebCore::JSQuarantinedObjectWrapper::createStructureID):
        * bindings/scripts/CodeGeneratorJS.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36766 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Windows build fix

        * WebCore.vcproj/WebCore.vcproj: Add a missing </File> tag.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36765 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-22  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Dave Hyatt.

        Based on initial work by Darin Adler.

        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
        - use this to JIT inline code for eq_null and neq_null
        https://bugs.webkit.org/show_bug.cgi?id=20823

        0.5% speedup on SunSpider
        ~4% speedup on Richards benchmark

        * VM/CTI.cpp:
        (JSC::CTI::privateCompileMainPass):
        * VM/Machine.cpp:
        (JSC::jsTypeStringForValue):
        (JSC::jsIsObjectType):
        (JSC::Machine::privateExecute):
        (JSC::Machine::cti_op_is_undefined):
        * VM/Machine.h:
        * kjs/JSCell.h:
        * kjs/JSValue.h:
        * kjs/StringObjectThatMasqueradesAsUndefined.h:
        (JSC::StringObjectThatMasqueradesAsUndefined::create):
        (JSC::StringObjectThatMasqueradesAsUndefined::createStructureID):
        * kjs/StructureID.h:
        (JSC::StructureID::mutableTypeInfo):
        * kjs/TypeInfo.h:
        (JSC::TypeInfo::TypeInfo):
        (JSC::TypeInfo::masqueradesAsUndefined):
        * kjs/operations.cpp:
        (JSC::equal):
        * masm/X86Assembler.h:
        (JSC::X86Assembler::):
        (JSC::X86Assembler::setne_r):
        (JSC::X86Assembler::setnz_r):
        (JSC::X86Assembler::testl_i32m):

WebCore:

2008-09-22  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Dave Hyatt.

        Based on initial work by Darin Adler.

        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
        - use this to JIT inline code for eq_null and neq_null
        https://bugs.webkit.org/show_bug.cgi?id=20823

        * WebCore.xcodeproj/project.pbxproj:
        * WebCore.vcproj/WebCore.vcproj:
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::JSCSSStyleDeclaration::nameGetter):
        * bindings/js/JSHTMLAllCollection.cpp: Added.
        (WebCore::):
        * bindings/js/JSHTMLAllCollection.h:
        (WebCore::JSHTMLAllCollection::createStructureID):
        (WebCore::JSHTMLAllCollection::toBoolean):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36764 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>

        Reviewed by Simon.

        Initialize QCoreApplication in kjs binary/Shell.cpp

        This allows us to use QCoreApplication::instance() to
        get the main thread in ThreadingQt.cpp

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36763 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>

        Reviewed by Simon.

        Fix the QtWebKit build

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36762 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  Alp Toker  <alp@nuanti.com>

        Suggested by David Hyatt.

        Build fix: ScrollView::update() is still used by Document.cpp on !MAC
        so make it public.

        * platform/ScrollView.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36761 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  David Hyatt  <hyatt@apple.com>

        Fix a regression in Windows scrollbar painting.  (Also fix the same
        bug in my new viewless Mac scrollbar painting code).  The track rect
        was being improperly inflated when painting resulting in the scrollbar
        being too tall and painting in the border of overflow sections.

        Reviewed by Oliver Hunt

        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::trackRect):
        * platform/win/ScrollbarThemeSafari.cpp:
        (WebCore::ScrollbarThemeSafari::trackRect):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36760 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-22  David Hyatt  <hyatt@apple.com>

        Fix a hit testing bug where events are mistakenly passed to subframes
        if the mouse is over the border or padding area of the frame.  Add
        a boolean flag, isOverWidget(), to hit test results so that EventHandler
        can check it to tell if the mouse is really over the content box of a
        RenderWidget and not just in the border/padding area.

        This is not testable, since the old code properly recovered when it detected
        that the mouse was outside the bounds of the view, but this prevents
        the extra passdown from even occurring (and is basically a nice cleanup).

        Reviewed by Oliver Hunt

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::hitTestResultAtPoint):
        (WebCore::subframeForHitTestResult):
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        (WebCore::EventHandler::handleMouseMoveEvent):
        (WebCore::EventHandler::handleMouseReleaseEvent):
        (WebCore::EventHandler::handleWheelEvent):
        * page/MouseEventWithHitTestResults.h:
        (WebCore::MouseEventWithHitTestResults::isOverWidget):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::HitTestResult):
        (WebCore::HitTestResult::operator=):
        * rendering/HitTestResult.h:
        (WebCore::HitTestResult::isOverWidget):
        (WebCore::HitTestResult::setIsOverWidget):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::nodeAtPoint):
        * rendering/RenderWidget.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36759 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  David Hyatt  <hyatt@apple.com>

        Rename FrameView's repaintRectangle method to repaintContentRectangle.  Make
        both it and ScrollView's updateContents method be off-limits to everyone in
        WebCore except for RenderView.

        Make repaintViewRectangle the only possible method for WebCore code to do
        an invalidation.  This ensures that all invalidates triggered by WebCore
        cross-platform code that cross ownerElement() boundaries are transform-aware.

        Make sure that iframes/frames contained inside objects that have transforms
        or reflections are not allowed to blit (this was already true for transparency).

        It is not possible to make a test for any of this, since iframe scrolling
        still doesn't work on Mac (since the invalidates are not being done
        through WebCore's cross-platform invalidation code but are instead going
        through NSScrollView's setNeedsDisplay still).

        Reviewed by Oliver Hunt

        * editing/SelectionController.cpp:
        (WebCore::SelectionController::recomputeCaretRect):
        (WebCore::SelectionController::invalidateCaretRect):
        (WebCore::SelectionController::focusedOrActiveStateChanged):
        * page/FrameView.cpp:
        (WebCore::FrameView::repaintContentRectangle):
        (WebCore::FrameView::endDeferredRepaints):
        * page/FrameView.h:
        * platform/ScrollView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintFillLayerExtended):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::enclosingPositionedAncestor):
        (WebCore::RenderLayer::requiresSlowRepaints):
        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::hasTransform):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::paintBoxDecorations):
        (WebCore::RenderView::repaintViewRectangle):
        (WebCore::RenderView::setSelection):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36758 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        - blind attempt to fix non-all-in-one builds

        * kjs/JSGlobalObject.cpp: Added includes of Arguments.h and RegExpObject.h.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36757 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        - fix debug build

        * kjs/StructureID.cpp:
        (JSC::StructureID::addPropertyTransition): Use typeInfo().type() instead of m_type.
        (JSC::StructureID::createCachedPrototypeChain): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36756 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-21  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
        https://bugs.webkit.org/show_bug.cgi?id=20981

        * JavaScriptCore.exp:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * VM/CTI.cpp:
        (JSC::CTI::privateCompileMainPass):
        (JSC::CTI::privateCompilePutByIdTransition):
        * VM/Machine.cpp:
        (JSC::jsIsObjectType):
        (JSC::Machine::Machine):
        * kjs/AllInOneFile.cpp:
        * kjs/JSCell.h:
        (JSC::JSCell::isObject):
        (JSC::JSCell::isString):
        * kjs/JSGlobalData.cpp:
        (JSC::JSGlobalData::JSGlobalData):
        * kjs/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::reset):
        * kjs/JSGlobalObject.h:
        (JSC::StructureID::prototypeForLookup):
        * kjs/JSNumberCell.h:
        (JSC::JSNumberCell::createStructureID):
        * kjs/JSObject.cpp:
        (JSC::JSObject::createInheritorID):
        * kjs/JSObject.h:
        (JSC::JSObject::createStructureID):
        * kjs/JSString.h:
        (JSC::JSString::createStructureID):
        * kjs/NativeErrorConstructor.cpp:
        (JSC::NativeErrorConstructor::NativeErrorConstructor):
        * kjs/RegExpConstructor.cpp:
        * kjs/RegExpMatchesArray.h: Added.
        (JSC::RegExpMatchesArray::getOwnPropertySlot):
        (JSC::RegExpMatchesArray::put):
        (JSC::RegExpMatchesArray::deleteProperty):
        (JSC::RegExpMatchesArray::getPropertyNames):
        * kjs/StructureID.cpp:
        (JSC::StructureID::StructureID):
        (JSC::StructureID::addPropertyTransition):
        (JSC::StructureID::toDictionaryTransition):
        (JSC::StructureID::changePrototypeTransition):
        (JSC::StructureID::getterSetterTransition):
        * kjs/StructureID.h:
        (JSC::StructureID::create):
        (JSC::StructureID::typeInfo):
        * kjs/TypeInfo.h: Added.
        (JSC::TypeInfo::TypeInfo):
        (JSC::TypeInfo::type):

WebCore:

2008-09-21  Maciej Stachowiak  <mjs@apple.com>

        Reviewed by Darin.

        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
        https://bugs.webkit.org/show_bug.cgi?id=20981

        * bindings/js/JSAudioConstructor.cpp:
        (WebCore::JSAudioConstructor::JSAudioConstructor):
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::JSCSSStyleDeclaration::nameGetter):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMStructure):
        * bindings/js/JSDOMBinding.h:
        (WebCore::getDOMStructure):
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSEventTargetNode.cpp:
        (WebCore::JSEventTargetNode::createPrototype):
        * bindings/js/JSHTMLOptionElementConstructor.cpp:
        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::JSImageConstructor):
        * bindings/js/JSXMLHttpRequestConstructor.cpp:
        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
        * bindings/js/JSXSLTProcessorConstructor.cpp:
        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
        * bindings/scripts/CodeGeneratorJS.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36755 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Maciej Stachowiak.

        - fix problem Maciej noticed where every JSNamedNodesCollection
          gets its own StructureID

        * bindings/js/JSNamedNodesCollection.cpp:
        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection): Use
        getDOMStructure to get the structure.
        * bindings/js/JSNamedNodesCollection.h:
        (WebCore::JSNamedNodesCollection::createPrototype): Return the
        object prototype.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36754 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich.

        - fix crash logging into Gmail due to recent Arguments change

        * kjs/Arguments.cpp:
        (JSC::Arguments::Arguments): Fix window where mark() function could
        see d->extraArguments with uninitialized contents.
        (JSC::Arguments::mark): Check d->extraArguments for 0 to handle two
        cases: 1) Inside the constructor before it's initialized.
        2) numArguments <= numParameters.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36753 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-20  David Hyatt  <hyatt@apple.com>

        Make sure transformed scrollbars in overflow sections position
        properly.  This patch mimics the same behavior that works for
        iframes, namely making sure that the same code that dynamically
        adjusts iframe widget positions at paint time for fixed positioning
        and transforms also applies to scrollbars.  (This is as simple as passing
        in the current translation factor at paint time rather than crawling
        up the layer tree to compute a "false" absolute position.)

        An existing transform test covers this (although only a pixel result
        reveals the correct rendering).

        Reviewed by Darin Adler

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateLayerPositions):
        (WebCore::RenderLayer::positionOverflowControls):
        (WebCore::RenderLayer::paintOverflowControls):
        (WebCore::RenderLayer::paintLayer):
        * rendering/RenderLayer.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36752 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        - fix loose end from the "duplicate constant values" patch

        * VM/CodeGenerator.cpp:
        (JSC::CodeGenerator::emitLoad): Add a special case for values the
        hash table can't handle.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36751 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Removed unnecessary nested timer check.

        Rubber-stamped by Dan Bernstein.

        * platform/win/SharedTimerWin.cpp:
        (WebCore::TimerWindowWndProc):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36750 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix the non-AllInOneFile build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36749 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    Improve timer resolution on WinXP.
        https://bugs.webkit.org/show_bug.cgi?id=20979

        Removed last-chance timer. It should not be necessary.
        Change timeEndPeriod timer to fire in 300ms instead of 20ms. Calling timeBeginPeriod/timeEndPeriod too often throws off accuracy.
        Remove Vista checks. We now run the same code on both XP and Vista.

        Call through to JSC::getCurrentUTCTimeWithMicroseconds from WebCore::currentTime.
        The code previously called GetSystemTimeAsFileTime, which is always low-resolution on XP, even within timeBeginPeriod(1).

        Reviewed by Maciej Stachowiak.

        * platform/win/SharedTimerWin.cpp:
        (WebCore::):
        (WebCore::TimerWindowWndProc):
        (WebCore::setSharedTimerFireTime):
        * platform/win/SystemTimeWin.cpp:
        (WebCore::currentTime):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36748 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich and Mark Rowe.

        - fix test failure caused by my recent IndexToNameMap patch

        * kjs/Arguments.cpp:
        (JSC::Arguments::deleteProperty): Added the accidentally-omitted
        check of the boolean result from toArrayIndex.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36747 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Maciej Stachowiak.

        - https://bugs.webkit.org/show_bug.cgi?id=20975
          inline immediate-number case of ==

        * VM/CTI.h: Renamed emitJumpSlowCaseIfNotImm to
        emitJumpSlowCaseIfNotImmNum, since the old name was incorrect.

        * VM/CTI.cpp: Updated for new name.
        (JSC::CTI::privateCompileMainPass): Added op_eq.
        (JSC::CTI::privateCompileSlowCases): Added op_eq.

        * VM/Machine.cpp:
        (JSC::Machine::cti_op_eq): Removed fast case, since it's now
        compiled.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36746 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Peter Gal  <galpter@inf.u-szeged.hu>

        Reviewed by Tim Hatcher and Eric Seidel.

        Fix the QT/Linux JavaScriptCore segmentation fault.
        https://bugs.webkit.org/show_bug.cgi?id=20914

        * wtf/ThreadingQt.cpp:
        (WTF::initializeThreading): Use currentThread() if
        platform is not a MAC (like in pre 36541 revisions)

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36745 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        * kjs/debugger.h: Removed some unneeded includes and declarations.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36744 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        - https://bugs.webkit.org/show_bug.cgi?id=20972
          speed up Arguments further by eliminating the IndexToNameMap

        No change on SunSpider. 1.29x as fast on V8 Raytrace.

        * kjs/Arguments.cpp: Moved ArgumentsData in here. Eliminated the
        indexToNameMap and hadDeletes data members. Changed extraArguments into
        an OwnArrayPtr and added deletedArguments, another OwnArrayPtr.
        Replaced numExtraArguments with numParameters, since that's what's
        used more directly in hot code paths.
        (JSC::Arguments::Arguments): Pass in argument count instead of ArgList.
        Initialize ArgumentsData the new way.
        (JSC::Arguments::mark): Updated.
        (JSC::Arguments::getOwnPropertySlot): Overload for the integer form so
        we don't have to convert integers to identifiers just to get an argument.
        Integrated the deleted case with the fast case.
        (JSC::Arguments::put): Ditto.
        (JSC::Arguments::deleteProperty): Ditto.

        * kjs/Arguments.h: Minimized includes. Made everything private. Added
        overloads for the integral property name case. Eliminated mappedIndexSetter.
        Moved ArgumentsData into the .cpp file.

        * kjs/IndexToNameMap.cpp: Emptied out and prepared for deletion.
        * kjs/IndexToNameMap.h: Ditto.

        * kjs/JSActivation.cpp:
        (JSC::JSActivation::createArgumentsObject): Elminated ArgList.

        * GNUmakefile.am:
        * JavaScriptCore.pri:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * JavaScriptCoreSources.bkl:
        * kjs/AllInOneFile.cpp:
        Removed IndexToNameMap.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36743 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Darin Adler  <darin@apple.com>

        * VM/CodeGenerator.cpp:
        (JSC::CodeGenerator::emitLoad): One more tweak: Wrote this in a slightly
        clearer style.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36742 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Judit Jasz  <jasy@inf.u-szeged.hu>

        Reviewed and tweaked by Darin Adler.

        - https://bugs.webkit.org/show_bug.cgi?id=20645
          Elminate duplicate constant values in CodeBlocks.

        Seems to be a wash on SunSpider.

        * VM/CodeGenerator.cpp:
        (JSC::CodeGenerator::emitLoad): Use m_numberMap and m_stringMap to guarantee
        we emit the same JSValue* for identical numbers and strings.
        * VM/CodeGenerator.h: Added overload of emitLoad for const Identifier&.
        Add NumberMap and IdentifierStringMap types and m_numberMap and m_stringMap.
        * kjs/nodes.cpp:
        (JSC::StringNode::emitCode): Call the new emitLoad and let it do the
        JSString creation.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36741 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2008-09-21  Paul Pedriana  <webkit@pedriana.com>

        Reviewed and tweaked by Darin Adler.

        - https://bugs.webkit.org/show_bug.cgi?id=16925
          Fixed lack of Vector buffer alignment for both GCC and MSVC.
          Since there's no portable way to do this, for now we don't support
          other compilers.

        * wtf/Vector.h: Added WTF_ALIGH_ON, WTF_ALIGNED, AlignedBufferChar, and AlignedBuffer.
        Use AlignedBuffer insteadof an array of char in VectorBuffer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36740 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore:

2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>

        Reviewed by Darin Adler.

        - https://bugs.webkit.org/show_bug.cgi?id=19408
          Add lightweight constant folding to the parser for *, /, + (only for numbers), <<, >>, ~ operators.

        1.008x as fast on SunSpider.

        * kjs/grammar.y:
        (makeNegateNode): Fold if expression is a number > 0.
        (makeBitwiseNotNode): Fold if expression is a number.
        (makeMultNode): Fold if expressions are both numbers.
        (makeDivNode): Fold if expressions are both numbers.
        (makeAddNode): Fold if expressions are both numbers.
        (makeLeftShiftNode): Fold if expressions are both numbers.
        (makeRightShiftNode): Fold if expressions are both numbers.

LayoutTests:

2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>

        Reviewed and tweaked by Darin Adler.

        - https://bugs.webkit.org/show_bug.cgi?id=19408
          Add test case for constant folding.

        * fast/js/constant-folding-expected.txt: Added.
        * fast/js/constant-folding.html: Added.
        * fast/js/resources/constant-folding.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@36739 268f45cc-cd09-0410-ab3c-d52691b4dbfc