Unreviewed, rolling out r94635.
http://trac.webkit.org/changeset/94635
https://bugs.webkit.org/show_bug.cgi?id=67704

Linux Touch build is failing to compile this change.
(Requested by loislo on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-07

Source/WebKit/chromium:

* public/WebInputEvent.h:
(WebKit::WebTouchEvent::WebTouchEvent):
* public/WebTouchPoint.h:
(WebKit::WebTouchPoint::WebTouchPoint):
* src/WebInputEventConversion.cpp:
(WebKit::PlatformTouchEventBuilder::PlatformTouchEventBuilder):
(WebKit::WebMouseEventBuilder::WebMouseEventBuilder):
(WebKit::WebMouseWheelEventBuilder::WebMouseWheelEventBuilder):
(WebKit::WebKeyboardEventBuilder::WebKeyboardEventBuilder):
* src/WebInputEventConversion.h:

Tools:

* DumpRenderTree/chromium/EventSender.cpp:
(EventSender::sendCurrentTouchEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94661 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94655.
http://trac.webkit.org/changeset/94655
https://bugs.webkit.org/show_bug.cgi?id=67703

It broke Leopard debug bot (Requested by ossy on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-07

* Scripts/webkitdirs.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94660 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67634
De-virtualize styleForRenderer()

Reviewed by Sam Weinig.

This has performance and code clarity benefits.

- move styleForRenderer from Node to Element
- get rid of the now unnecessary NodeRenderingContext parameter
- de-virtualize, add virtual customStyleForRenderer()

* dom/Element.cpp:
(WebCore::Element::customStyleForRenderer):
(WebCore::Element::styleForRenderer):
(WebCore::Element::recalcStyle):
* dom/Element.h:
* dom/Node.cpp:
* dom/Node.h:
(WebCore::Node::hasCustomWillOrDidRecalcStyle):
(WebCore::Node::setHasCustomWillOrDidRecalcStyle):
(WebCore::Node::hasCustomStyleForRenderer):
(WebCore::Node::setHasCustomStyleForRenderer):

    Move styleForRenderer, add customStyleForRenderer, add a bit.

* dom/NodeRenderingContext.cpp:
(WebCore::NodeRendererFactory::createRendererAndStyle):

    Handle non-element case separately since styleForRenderer was moved from Node to Element.

* html/HTMLNoScriptElement.cpp:
(WebCore::HTMLNoScriptElement::HTMLNoScriptElement):
(WebCore::HTMLNoScriptElement::customStyleForRenderer):
* html/HTMLNoScriptElement.h:

    Move a strange XHTMLMP special case to where it belongs.

* html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::attach):
* html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::attach):
* html/HTMLTitleElement.cpp:
(WebCore::HTMLTitleElement::textWithDirection):
* html/shadow/TextControlInnerElements.cpp:
(WebCore::TextControlInnerElement::TextControlInnerElement):
(WebCore::TextControlInnerElement::customStyleForRenderer):
(WebCore::TextControlInnerTextElement::TextControlInnerTextElement):
(WebCore::TextControlInnerTextElement::customStyleForRenderer):
* html/shadow/TextControlInnerElements.h:
* rendering/svg/SVGShadowTreeElements.cpp:
(WebCore::SVGShadowTreeContainerElement::customStyleForRenderer):
* rendering/svg/SVGShadowTreeElements.h:
* svg/SVGElement.cpp:
(WebCore::SVGElement::SVGElement):
(WebCore::SVGElement::customStyleForRenderer):
* svg/SVGElement.h:

    Adopt customStyleForRenderer().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94659 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change event is not fired for input[type=number] when the user reverts a change made by script
https://bugs.webkit.org/show_bug.cgi?id=67697

Reviewed by Kent Tamura.

Source/WebCore:

The bug was caused by HTMLInputElement::setValue not calling setTextAsOfLastFormControlChangeEvent
for text fields other than type=text.

Also fixed a that stepUpFromRenderer does not call setTextAsOfLastFormControlChangeEvent at appropriate
timing due to setValueAsNumber always passing sendChangeEvent=false to setValue by propagating values
through setValueAsNumber and applyStep. This refactoring allows us to remove calls to dispatch* in
stepUpFromRenderer because they're now called in setValueAsNumber or applyStep.

Test: fast/forms/number-input-changeevent.html

* html/BaseDateAndTimeInputType.cpp:
(WebCore::BaseDateAndTimeInputType::setValueAsNumber):
* html/BaseDateAndTimeInputType.h:
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::applyStep):
(WebCore::HTMLInputElement::stepUp):
(WebCore::HTMLInputElement::stepDown):
(WebCore::HTMLInputElement::setValue):
(WebCore::HTMLInputElement::setValueAsNumber):
(WebCore::HTMLInputElement::stepUpFromRenderer):
* html/HTMLInputElement.h:
* html/InputType.cpp:
(WebCore::InputType::setValueAsNumber):
* html/InputType.h:
* html/NumberInputType.cpp:
(WebCore::NumberInputType::setValueAsNumber):
* html/NumberInputType.h:
* html/RangeInputType.cpp:
(WebCore::RangeInputType::setValueAsNumber):
(WebCore::RangeInputType::handleKeydownEvent):
* html/RangeInputType.h:

LayoutTests:

Add a regression test to ensure WebKit fires change event when the user reverts a change made by script.

* fast/forms/number-input-changeevent-expected.txt: Added.
* fast/forms/number-input-changeevent.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94658 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Try to fix Qt build by moving the Qt specific include (which is not really allowed here!).

Not reviewed.

* css/CSSStyleSelector.cpp:
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::determineLinkStateSlowCase):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94657 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move SelectorChecker out from CSSStyleSelector scope
https://bugs.webkit.org/show_bug.cgi?id=67648

Reviewed by Sam Weinig.

- Move SelectorChecker to SelectorChecker.h/cpp
- Make private functions private
- Make members private, add accessors
- Move m_sameOriginOnly to CSSStyleSelector as it is not used by SelectorChecker

* CMakeLists.txt:
* GNUmakefile.list.am:
* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::CSSStyleSelector):
(WebCore::CSSStyleSelector::matchRules):
(WebCore::CSSStyleSelector::matchRulesForList):
(WebCore::CSSStyleSelector::sortMatchedRules):
(WebCore::CSSStyleSelector::initForStyleResolve):
(WebCore::CSSStyleSelector::matchUARules):
(WebCore::CSSStyleSelector::styleForElement):
(WebCore::CSSStyleSelector::pseudoStyleForElement):
(WebCore::CSSStyleSelector::styleForPage):
(WebCore::CSSStyleSelector::adjustRenderStyle):
(WebCore::CSSStyleSelector::pseudoStyleRulesForElement):
(WebCore::CSSStyleSelector::checkSelector):
(WebCore::RuleData::RuleData):
(WebCore::CSSStyleSelector::applyProperty):
(WebCore::CSSStyleSelector::checkForGenericFamilyChange):
(WebCore::CSSStyleSelector::setFontSize):
(WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
* css/CSSStyleSelector.h:
(WebCore::CSSStyleSelector::style):
(WebCore::CSSStyleSelector::parentStyle):
(WebCore::CSSStyleSelector::rootElementStyle):
(WebCore::CSSStyleSelector::element):
(WebCore::CSSStyleSelector::fontDescription):
(WebCore::CSSStyleSelector::parentFontDescription):
(WebCore::CSSStyleSelector::setFontDescription):
(WebCore::CSSStyleSelector::setZoom):
(WebCore::CSSStyleSelector::setEffectiveZoom):
(WebCore::CSSStyleSelector::setTextSizeAdjust):
(WebCore::CSSStyleSelector::setStyle):
(WebCore::CSSStyleSelector::fontSelector):
(WebCore::CSSStyleSelector::allVisitedStateChanged):
(WebCore::CSSStyleSelector::visitedStateChanged):
(WebCore::CSSStyleSelector::usesSiblingRules):
(WebCore::CSSStyleSelector::usesFirstLineRules):
(WebCore::CSSStyleSelector::usesBeforeAfterRules):
(WebCore::CSSStyleSelector::usesLinkRules):
(WebCore::CSSStyleSelector::addMatchedRule):
(WebCore::CSSStyleSelector::isRightPage):
(WebCore::CSSStyleSelector::ParentStackFrame::ParentStackFrame):
(WebCore::CSSStyleSelector::styleNotYetAvailable):
* css/SelectorChecker.cpp: Added.
(WebCore::SelectorChecker::SelectorChecker):
(WebCore::linkAttribute):
(WebCore::SelectorChecker::determineLinkStateSlowCase):
(WebCore::SelectorChecker::checkSelector):
(WebCore::SelectorChecker::fastCheckSelector):
(WebCore::SelectorChecker::isFastCheckableSelector):
(WebCore::addLocalNameToSet):
(WebCore::createHtmlCaseInsensitiveAttributesSet):
(WebCore::htmlAttributeHasCaseInsensitiveValue):
(WebCore::attributeQualifiedNameMatches):
(WebCore::attributeValueMatches):
(WebCore::anyAttributeMatches):
(WebCore::SelectorChecker::checkOneSelector):
(WebCore::SelectorChecker::checkScrollbarPseudoClass):
(WebCore::SelectorChecker::allVisitedStateChanged):
(WebCore::SelectorChecker::visitedStateChanged):
* css/SelectorChecker.h: Added.
(WebCore::SelectorChecker::document):
(WebCore::SelectorChecker::strictParsing):
(WebCore::SelectorChecker::isCollectingRulesOnly):
(WebCore::SelectorChecker::setCollectingRulesOnly):
(WebCore::SelectorChecker::isMatchingVisitedPseudoClass):
(WebCore::SelectorChecker::setMatchingVisitedPseudoClass):
(WebCore::SelectorChecker::pseudoStyle):
(WebCore::SelectorChecker::setPseudoStyle):
(WebCore::SelectorChecker::hasUnknownPseudoElements):
(WebCore::SelectorChecker::clearHasUnknownPseudoElements):
(WebCore::SelectorChecker::determineLinkState):
* dom/Element.cpp:
(WebCore::Element::webkitMatchesSelector):
* dom/SelectorQuery.cpp:
(WebCore::SelectorQuery::SelectorQuery):
* dom/SelectorQuery.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94656 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r94288) build-webkit doesn't work on Windows
https://bugs.webkit.org/show_bug.cgi?id=67646

Patch by Kristóf Kosztyó <kkristof@inf.u-szeged.hu> on 2011-09-07
Reviewed by Csaba Osztrogonác.

* Scripts/webkitdirs.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94655 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][Mac] Unreviewed gardening after r94646.

* platform/qt-mac/Skipped: Paint the Qt-Mac bot green.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94654 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-07  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed. Revert expectation that was wrongly generated for textStyles.svg.

        * platform/chromium-linux/svg/batik/text/textStyles-expected.png:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94653 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed Windows rebaselines.

* platform/win/fast/dom/Window/window-property-descriptors-expected.txt:
* platform/win/fast/js/global-constructors-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94652 268f45cc-cd09-0410-ab3c-d52691b4dbfc

One last GTK+ rebaseline for r94614.

* platform/gtk/fast/js/global-constructors-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94651 268f45cc-cd09-0410-ab3c-d52691b4dbfc

GTK+ rebaselines after r94614.

* platform/gtk/fast/dom/Window/window-properties-expected.txt:
* platform/gtk/fast/dom/Window/window-property-descriptors-expected.txt:
* platform/gtk/fast/dom/prototype-inheritance-2-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94650 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-07  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed. Rebaseline expectations after r94593

        * platform/chromium-linux/svg/css/getComputedStyle-basic-expected.txt: Removed.
        * platform/chromium-win-vista/fast/css/getComputedStyle/computed-style-expected.txt: Removed.
        * platform/chromium-win-vista/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt: Removed.
        * platform/chromium-win/svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94649 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fast/dom/replaceChild.html may not test what it's supposed to test and may sometimes be flaky
https://bugs.webkit.org/show_bug.cgi?id=67629

Patch by Xianzhu Wang <wangxianzhu@chromium.org> on 2011-09-07
Reviewed by Darin Adler.

The test is supposed to test Node.replaceChild() called from a frame.
However, in most cases, it's not executed because the test finishes before
the iframe's onload event handler. For now, the expected result is just
the original render tree before replaceChild(). In chance that iframe's
onload is executed earlier, the actual result might be different from
expected (that is, replaceChild() is executed and the DOM is actually changed.)

Use waitUntilDone() and notifyDone() to ensure the frame's onload handler
is called.

BTW changed it to a pure text test to avoid platform branches.

* fast/dom/replaceChild.html:
* fast/dom/replaceChild-expected.txt: Added.
* fast/dom/resources/replaceChildHelper.html:
* platform/chromium-linux/fast/dom/replaceChild-expected.png: Removed.
* platform/chromium-mac/fast/dom/replaceChild-expected.png: Removed.
* platform/chromium-win/fast/dom/replaceChild-expected.png: Removed.
* platform/chromium-win/fast/dom/replaceChild-expected.txt: Removed.
* platform/gtk/fast/dom/replaceChild-expected.png: Removed.
* platform/gtk/fast/dom/replaceChild-expected.txt: Removed.
* platform/mac-leopard/fast/dom/replaceChild-expected.png: Removed.
* platform/mac/fast/dom/replaceChild-expected.png: Removed.
* platform/mac/fast/dom/replaceChild-expected.txt: Removed.
* platform/qt/fast/dom/replaceChild-expected.png: Removed.
* platform/qt/fast/dom/replaceChild-expected.txt: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94648 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67413
[Chromium]Web Inspector: inspected page with dedicated worker crashes on refresh.
This patch enforces lifetime ordering between WorkerInspectorController and WorkerScriptController.

Reviewed by Yury Semikhatsky.

* workers/WorkerContext.cpp:
(WebCore::WorkerContext::clearInspector):
* workers/WorkerContext.h:
* workers/WorkerThread.cpp:
(WebCore::WorkerThreadShutdownFinishTask::performTask):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94647 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt] Unreviewed gardening. Add platform specific expected results for new passing tests.

* platform/qt/fast/borders/border-image-longhand-expected.png: Added.
* platform/qt/fast/borders/border-image-longhand-expected.txt: Added.
* platform/qt/fast/borders/border-image-scaled-expected.png: Added.
* platform/qt/fast/borders/border-image-scaled-expected.txt: Added.
* platform/qt/fast/borders/border-image-side-reduction-expected.png: Added.
* platform/qt/fast/borders/border-image-side-reduction-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94646 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-07  Ilya Tikhonovsky  <loislo@chromium.org>

        Unreviewed. Rebaseline expectations for svg/batik/text/textStyles.svg after r94624.

        * platform/chromium-linux/svg/batik/text/textStyles-expected.png:
        * platform/chromium-win/svg/batik/text/textStyles-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94645 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94627 and r94632.
http://trac.webkit.org/changeset/94627
http://trac.webkit.org/changeset/94632
https://bugs.webkit.org/show_bug.cgi?id=67698

It broke tests on GTK and Qt (Requested by Ossy on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-07

Source/JavaScriptCore:

* API/JSCallbackConstructor.cpp:
(JSC::JSCallbackConstructor::JSCallbackConstructor):
* API/JSCallbackConstructor.h:
(JSC::JSCallbackConstructor::create):
* API/JSCallbackFunction.cpp:
(JSC::JSCallbackFunction::JSCallbackFunction):
* API/JSCallbackFunction.h:
* JavaScriptCore.exp:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* debugger/DebuggerActivation.cpp:
(JSC::DebuggerActivation::create):
* debugger/DebuggerActivation.h:
* jsc.cpp:
(GlobalObject::constructorBody):
(GlobalObject::GlobalObject):
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::ArrayConstructor):
* runtime/ArrayConstructor.h:
* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::ArrayPrototype):
* runtime/ArrayPrototype.h:
(JSC::ArrayPrototype::create):
* runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::BooleanConstructor):
* runtime/BooleanConstructor.h:
* runtime/BooleanObject.cpp:
(JSC::BooleanObject::BooleanObject):
* runtime/BooleanObject.h:
(JSC::BooleanObject::create):
* runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::BooleanPrototype):
* runtime/BooleanPrototype.h:
* runtime/DateConstructor.cpp:
(JSC::DateConstructor::DateConstructor):
* runtime/DateConstructor.h:
* runtime/DateInstance.cpp:
(JSC::DateInstance::DateInstance):
* runtime/DateInstance.h:
(JSC::DateInstance::create):
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::DatePrototype):
* runtime/DatePrototype.h:
* runtime/Error.cpp:
(JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
* runtime/ErrorConstructor.cpp:
(JSC::ErrorConstructor::ErrorConstructor):
* runtime/ErrorConstructor.h:
(JSC::ErrorConstructor::create):
* runtime/ErrorPrototype.cpp:
(JSC::ErrorPrototype::ErrorPrototype):
* runtime/ErrorPrototype.h:
(JSC::ErrorPrototype::create):
* runtime/FunctionConstructor.cpp:
(JSC::FunctionConstructor::FunctionConstructor):
* runtime/FunctionConstructor.h:
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::FunctionPrototype):
* runtime/FunctionPrototype.h:
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::InternalFunction):
* runtime/InternalFunction.h:
* runtime/JSActivation.cpp:
(JSC::JSActivation::JSActivation):
* runtime/JSActivation.h:
(JSC::JSActivation::create):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::create):
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSONObject.cpp:
(JSC::JSONObject::JSONObject):
* runtime/JSONObject.h:
(JSC::JSONObject::create):
* runtime/JSStaticScopeObject.h:
(JSC::JSStaticScopeObject::create):
(JSC::JSStaticScopeObject::JSStaticScopeObject):
* runtime/JSString.cpp:
(JSC::StringObject::create):
* runtime/MathObject.cpp:
(JSC::MathObject::MathObject):
* runtime/MathObject.h:
(JSC::MathObject::create):
* runtime/NativeErrorConstructor.cpp:
(JSC::NativeErrorConstructor::NativeErrorConstructor):
* runtime/NativeErrorConstructor.h:
(JSC::NativeErrorConstructor::constructorBody):
* runtime/NativeErrorPrototype.cpp:
(JSC::NativeErrorPrototype::NativeErrorPrototype):
(JSC::NativeErrorPrototype::constructorBody):
* runtime/NativeErrorPrototype.h:
* runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::NumberConstructor):
* runtime/NumberConstructor.h:
* runtime/NumberObject.cpp:
(JSC::NumberObject::NumberObject):
* runtime/NumberObject.h:
(JSC::NumberObject::create):
* runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::NumberPrototype):
* runtime/NumberPrototype.h:
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::ObjectConstructor):
* runtime/ObjectConstructor.h:
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::RegExpConstructor):
(JSC::RegExpMatchesArray::RegExpMatchesArray):
* runtime/RegExpConstructor.h:
* runtime/RegExpMatchesArray.h:
(JSC::RegExpMatchesArray::create):
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::RegExpObject):
* runtime/RegExpObject.h:
(JSC::RegExpObject::create):
* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::RegExpPrototype):
* runtime/StringConstructor.cpp:
(JSC::StringConstructor::StringConstructor):
* runtime/StringConstructor.h:
* runtime/StringObject.cpp:
(JSC::StringObject::StringObject):
* runtime/StringObject.h:
(JSC::StringObject::create):
* runtime/StringObjectThatMasqueradesAsUndefined.h:
(JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::StringPrototype):
* runtime/StringPrototype.h:

Source/JavaScriptGlue:

* JSRun.cpp:
(JSGlueGlobalObject::JSGlueGlobalObject):

Source/WebCore:

* WebCore.exp.in:
* bindings/js/JSDOMBinding.h:
(WebCore::DOMConstructorObject::DOMConstructorObject):
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
* bindings/js/JSDOMGlobalObject.h:
* bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::create):
* bindings/js/JSDOMWindowShell.h:
* bindings/js/JSDOMWrapper.h:
(WebCore::JSDOMWrapper::JSDOMWrapper):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterface::JSTestInterface):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObj::JSTestObj):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface):
* bridge/c/CRuntimeObject.cpp:
(JSC::Bindings::CRuntimeObject::CRuntimeObject):
* bridge/c/CRuntimeObject.h:
* bridge/jni/jsc/JavaRuntimeObject.cpp:
(JSC::Bindings::JavaRuntimeObject::JavaRuntimeObject):
* bridge/jni/jsc/JavaRuntimeObject.h:
* bridge/objc/ObjCRuntimeObject.h:
* bridge/objc/ObjCRuntimeObject.mm:
(JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
* bridge/objc/objc_runtime.h:
(JSC::Bindings::ObjcFallbackObjectImp::create):
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
* bridge/qt/qt_instance.cpp:
(JSC::Bindings::QtRuntimeObject::QtRuntimeObject):
* bridge/qt/qt_pixmapruntime.cpp:
(JSC::Bindings::QtPixmapRuntimeObject::QtPixmapRuntimeObject):
* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
* bridge/qt/qt_runtime.h:
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::RuntimeArray):
* bridge/runtime_array.h:
(JSC::RuntimeArray::create):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::RuntimeMethod):
* bridge/runtime_method.h:
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::RuntimeObject):
* bridge/runtime_object.h:
(JSC::Bindings::RuntimeObject::create):

Source/WebKit/mac:

* Plugins/Hosted/ProxyRuntimeObject.h:
* Plugins/Hosted/ProxyRuntimeObject.mm:
(WebKit::ProxyRuntimeObject::ProxyRuntimeObject):

Source/WebKit2:

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::JSNPMethod::JSNPMethod):
(WebKit::JSNPMethod::create):
* WebProcess/Plugins/Netscape/JSNPMethod.h:
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::JSNPObject):
(WebKit::JSNPObject::create):
* WebProcess/Plugins/Netscape/JSNPObject.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94644 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fast/workers/worker-script-error.html fails on Chromium after r94061
https://bugs.webkit.org/show_bug.cgi?id=67206

Source/WebCore:

Default action should be prevented if window.onerror returned true and stay
not prevented otherwise.

Reviewed by Dmitry Titov.

Tests: fast/events/window-onerror14.html
       fast/events/window-onerror15.html
       fast/events/window-onerror16.html

* bindings/v8/V8AbstractEventListener.cpp:
(WebCore::V8AbstractEventListener::invokeEventHandler):
(WebCore::V8AbstractEventListener::shouldPreventDefault): allow specific
event listeners to decide when to prevent default action based on the handler
return value.
* bindings/v8/V8AbstractEventListener.h:
* bindings/v8/V8WindowErrorHandler.cpp:
(WebCore::V8WindowErrorHandler::callListenerFunction):
(WebCore::V8WindowErrorHandler::shouldPreventDefault):
* bindings/v8/V8WindowErrorHandler.h:
* bindings/v8/V8WorkerContextErrorHandler.cpp:
(WebCore::V8WorkerContextErrorHandler::callListenerFunction):
(WebCore::V8WorkerContextErrorHandler::shouldPreventDefault):
* bindings/v8/V8WorkerContextErrorHandler.h:

LayoutTests:

Add a couple more tests for window.onerror handler that check whether
error message is printed to the console pending on the handler return
value.

Reviewed by Dmitry Titov.

* fast/events/window-onerror14-expected.txt: Added.
* fast/events/window-onerror14.html: Added.
* fast/events/window-onerror15-expected.txt: Added.
* fast/events/window-onerror15.html: Added.
* fast/events/window-onerror16-expected.txt: Added.
* fast/events/window-onerror16.html: Added.
* platform/chromium/fast/events/window-onerror16-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94643 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Web Inspector: repair console sniffing for interactive ui tests
https://bugs.webkit.org/show_bug.cgi?id=67608

Reviewed by Pavel Feldman.

* src/js/Tests.js:
(.TestSuite.prototype.evaluateInConsole_):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94642 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed buildfix after r94620.

* WebCoreSupport/FrameLoaderClientQt.cpp:
(WebCore::FrameLoaderClientQt::createFrame):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94641 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Replace usages of Vector<UChar> with existing StringBuilder
https://bugs.webkit.org/show_bug.cgi?id=67079

Patch by Xianzhu Wang <wangxianzhu@chromium.org> on 2011-09-06
Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

This is part of work to support 8-bit string buffers.
Adds StringBuilder::characters() because the original Vector<UChar>::data()
is widely used.
Sets the minimum size of buffer to 16 to prevent possible performance
regression. Further performance investigation should be done in
https://bugs.webkit.org/show_bug.cgi?id=67084.

* wtf/Forward.h:
* wtf/text/StringBuilder.cpp:
(WTF::StringBuilder::appendUninitialized): Sets minimum buffer size to 16 bytes.
* wtf/text/StringBuilder.h:
(WTF::StringBuilder::operator[]):
(WTF::StringBuilder::characters): Added.

Source/WebCore:

No new tests. All existing unit tests and layout tests should run
as before.

* css/CSSOMUtils.cpp:
(WebCore::appendCharacter):
(WebCore::serializeCharacter):
(WebCore::serializeCharacterAsCodePoint):
(WebCore::serializeIdentifier):
(WebCore::serializeString):
* css/CSSOMUtils.h:
* css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::cssText):
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::SelectorChecker::determineLinkStateSlowCase):
* css/CSSWrapShapes.cpp:
(WebCore::CSSWrapShapeRect::cssText):
(WebCore::CSSWrapShapeCircle::cssText):
(WebCore::CSSWrapShapeEllipse::cssText):
(WebCore::CSSWrapShapePolygon::cssText):
* editing/HTMLInterchange.cpp:
(WebCore::convertHTMLTextToInterchangeFormat):
* editing/MarkupAccumulator.cpp:
(WebCore::appendCharactersReplacingEntities):
(WebCore::MarkupAccumulator::serializeNodes):
(WebCore::MarkupAccumulator::appendStartTag):
(WebCore::MarkupAccumulator::appendEndTag):
(WebCore::MarkupAccumulator::concatenateMarkup):
(WebCore::MarkupAccumulator::appendAttributeValue):
(WebCore::MarkupAccumulator::appendCustomAttributes):
(WebCore::MarkupAccumulator::appendQuotedURLAttributeValue):
(WebCore::MarkupAccumulator::appendNodeValue):
(WebCore::MarkupAccumulator::appendNamespace):
(WebCore::MarkupAccumulator::appendText):
(WebCore::MarkupAccumulator::appendComment):
(WebCore::MarkupAccumulator::appendDocumentType):
(WebCore::MarkupAccumulator::appendProcessingInstruction):
(WebCore::MarkupAccumulator::appendElement):
(WebCore::MarkupAccumulator::appendOpenTag):
(WebCore::MarkupAccumulator::appendCloseTag):
(WebCore::MarkupAccumulator::appendAttribute):
(WebCore::MarkupAccumulator::appendCDATASection):
(WebCore::MarkupAccumulator::appendStartMarkup):
(WebCore::MarkupAccumulator::appendEndMarkup):
* editing/MarkupAccumulator.h:
* editing/markup.cpp:
(WebCore::StyledMarkupAccumulator::appendElement):
(WebCore::StyledMarkupAccumulator::wrapWithNode):
(WebCore::StyledMarkupAccumulator::wrapWithStyleNode):
(WebCore::StyledMarkupAccumulator::appendStyleNodeOpenTag):
(WebCore::StyledMarkupAccumulator::takeResults):
(WebCore::StyledMarkupAccumulator::appendText):
(WebCore::urlToMarkup):
* html/DOMTokenList.cpp:
(WebCore::DOMTokenList::removeToken):
* html/HTMLFontElement.cpp:
(WebCore::parseFontSize):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::strippedPlaceholder):
* html/parser/CSSPreloadScanner.cpp:
(WebCore::CSSPreloadScanner::emitRule):
* html/parser/CSSPreloadScanner.h:
* html/parser/HTMLEntityParser.cpp:
(WebCore::consumeHTMLEntity):
* html/parser/HTMLEntityParser.h:
* html/parser/HTMLParserIdioms.cpp:
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):
* html/parser/HTMLTokenizer.cpp:
(WebCore::HTMLTokenizer::processEntity):
(WebCore::HTMLTokenizer::nextToken):
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::giveRemainingTo):
(WebCore::HTMLTreeBuilder::defaultForInTableText):
* html/parser/HTMLTreeBuilder.h:
* inspector/InspectorValues.cpp:
(WebCore::InspectorValue::toJSONString):
(WebCore::InspectorValue::writeJSON):
(WebCore::InspectorBasicValue::writeJSON):
(WebCore::InspectorString::writeJSON):
(WebCore::InspectorObject::writeJSON):
(WebCore::InspectorArray::writeJSON):
* inspector/InspectorValues.h:
* loader/CrossOriginAccessControl.cpp:
(WebCore::createAccessControlPreflightRequest):
* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::ApplicationCacheStorage::store):
* page/Chrome.cpp:
(WebCore::Chrome::setToolTip):
* page/PageSerializer.cpp:
(WebCore::SerializerMarkupAccumulator::appendText):
(WebCore::SerializerMarkupAccumulator::appendElement):
(WebCore::SerializerMarkupAccumulator::appendCustomAttributes):
* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::toString):
* platform/KURL.cpp:
(WebCore::KURL::deprecatedString):
(WebCore::decodeURLEscapeSequences):
* platform/LinkHash.cpp:
(WebCore::squeezeOutNullCharacters):
(WebCore::cleanSlashDotDotSlashes):
(WebCore::mergeDoubleSlashes):
(WebCore::cleanSlashDotSlashes):
(WebCore::cleanPath):
(WebCore::visitedURLInline):
(WebCore::visitedURL):
(WebCore::visitedLinkHash):
* platform/LinkHash.h:
* platform/gtk/DataObjectGtk.cpp:
(WebCore::DataObjectGtk::setURL):
* platform/network/HTTPParsers.cpp:
(WebCore::extractMIMETypeFromMediaType):
* platform/text/TextCodecICU.cpp:
(WebCore::TextCodecICU::decode):
* platform/text/TextStream.cpp:
(WebCore::TextStream::operator<<):
(WebCore::TextStream::release):
* platform/text/TextStream.h:
* plugins/PluginStream.cpp:
(WebCore::PluginStream::startStream):
* rendering/InlineTextBox.cpp:
(WebCore::adjustCharactersAndLengthForHyphen):
* rendering/InlineTextBox.h:
(WebCore::BufferForAppendingHyphen::BufferForAppendingHyphen):
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::markerTextWithSuffix):
* rendering/RenderListMarker.cpp:
(WebCore::toSymbolic):
(WebCore::RenderListMarker::paint):
(WebCore::RenderListMarker::suffix):
* rendering/RenderTreeAsText.cpp:
(WebCore::quoteAndEscapeNonPrintables):
* rendering/mathml/RenderMathMLFenced.cpp:
(WebCore::RenderMathMLFenced::updateFromElement):
* storage/IDBLevelDBCoding.cpp:
(WebCore::IDBLevelDBCoding::decodeString):
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::getAllResponseHeaders):
* xml/XPathFunctions.cpp:
(WebCore::XPath::FunId::evaluate):
(WebCore::XPath::FunConcat::evaluate):
* xml/XPathUtil.cpp:
(WebCore::XPath::stringValue):
* xml/XSLTProcessorLibxslt.cpp:
(WebCore::writeToStringBuilder):
(WebCore::saveResultToString):
* xml/parser/CharacterReferenceParserInlineMethods.h:
(WebCore::unconsumeCharacters):
(WebCore::consumeCharacterReference):
* xml/parser/XMLCharacterReferenceParser.cpp:
(WebCore::consumeXMLCharacterReference):
* xml/parser/XMLCharacterReferenceParser.h:
* xml/parser/XMLTokenizer.cpp:
(WebCore::XMLTokenizer::nextToken):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94640 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (Safari 5.1 - ToT): File input retains its file icon when the value is reset
https://bugs.webkit.org/show_bug.cgi?id=67567

Reviewed by Dimitri Glazkov.

Source/WebCore:

- Introduce InputType::setValue(), which is called by HTMLInputElement::setValue().
- Clear m_icon in FileInputType::setValue().

Tests: fast/forms/file/file-reset-in-change-expected.html
       fast/forms/file/file-reset-in-change.html

* html/BaseButtonInputType.cpp:
(WebCore::BaseButtonInputType::setValue):
Implemenation for the "default" mode.
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#dom-input-value-default
* html/BaseButtonInputType.h:
* html/BaseCheckableInputType.cpp:
(WebCore::BaseCheckableInputType::setValue):
Implemenation for the "default/on" mode.
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#dom-input-value-default-on
* html/BaseCheckableInputType.h:
* html/FileInputType.cpp:
(WebCore::FileInputType::setValue):
Implemenation for the "filename" mode, and clearing m_icon.
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#dom-input-value-filename
* html/FileInputType.h:
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setValue):
Move some code to InputType::setValue().
(WebCore::HTMLInputElement::setValueInternal): A helper for InputType::setValue().
* html/HTMLInputElement.h:
* html/HiddenInputType.cpp:
(WebCore::HiddenInputType::setValue):
Implementation for the "default" mode.
* html/HiddenInputType.h:
* html/InputType.cpp:
(WebCore::InputType::setValue):
Implementation for the "value" mode.
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#dom-input-value-value
* html/InputType.h:
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::setValue):
In addition to the "value" mode processing, updates placeholder visibililty.
* html/TextFieldInputType.h:

LayoutTests:

* fast/forms/file/file-reset-in-change-expected.html: Added.
* fast/forms/file/file-reset-in-change.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94639 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Qt rebaseline after r94614.

* platform/qt/fast/dom/Window/window-properties-expected.txt:
* platform/qt/fast/dom/Window/window-property-descriptors-expected.txt:
* platform/qt/fast/dom/prototype-inheritance-2-expected.txt:
* platform/qt/fast/js/global-constructors-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94638 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r94274): The inner text value of an input element is not updated when input.value is set
https://bugs.webkit.org/show_bug.cgi?id=67681

Reviewed by Kent Tamura.

Source/WebCore:

The bug was caused by HTMLInputElement::setValue's not clearing m_suggestedValue before updateInnerTextValue is called.
Since updateInnerTextValue uses the suggested value when one is present, we need to clear m_suggestedValue in advance.

Test: fast/forms/suggested-value-after-setvalue.html

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setValue):

LayoutTests:

Added a test that overrides the suggested value by modifying the value IDL attribute of an input element.

* fast/forms/suggested-value-after-setvalue-expected.txt: Added.
* fast/forms/suggested-value-after-setvalue.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94637 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Attempt to fix GTK build.

* bindings/gobject/WebKitHTMLElementWrapperFactory.cpp:
(WebKit::createHTMLElementWrapper):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94636 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Modify WebTouchEvent structure to match WebCore::TouchEvent
https://bugs.webkit.org/show_bug.cgi?id=66800

Patch by Eric Boren <borenet@gmail.com> on 2011-09-06
Reviewed by Darin Fisher.

Source/WebKit/chromium:

* public/WebInputEvent.h:
(WebKit::WebTouchEvent::WebTouchEvent):
* public/WebTouchPoint.h:
(WebKit::WebTouchPoint::WebTouchPoint):
* src/WebInputEventConversion.cpp:
(WebKit::PlatformTouchEventBuilder::PlatformTouchEventBuilder):
(WebKit::WebTouchEventBuilder::WebTouchEventBuilder):
* src/WebInputEventConversion.h:

Tools:

* DumpRenderTree/chromium/EventSender.cpp:
(EventSender::sendCurrentTouchEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94635 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Layout Test fast/dom/HTMLMeterElement/meter-element-crash.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=67653

Reviewed by James Robinson.

* fast/dom/HTMLMeterElement/meter-element-crash.html: Added waitUntilDone/notifyDone,
and changed "1" that's displayed after testing to "PASS".

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94634 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fast/forms/suggested-value-crash.html crashes on Windows
https://bugs.webkit.org/show_bug.cgi?id=67688

Reviewed by Adam Barth.

Source/WebCore:

The crash was caused because functions in internals were accessing uninitialized QualifiedNames.
Fixed the bug by avoiding to link to inputTag and textareaTag. Instead, we resort to toInputElement
and string comparison.

* testing/Internals.cpp:
(WebCore::Internals::wasLastChangeUserEdit):
(WebCore::Internals::suggestedValue):
(WebCore::Internals::setSuggestedValue):

Source/WebKit2:

Removed sybmols for inputTag and textareaTag. Added the symbol for StringImpl::equal.

* win/WebKit2.def:
* win/WebKit2CFLite.def:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94633 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix broken snow leopard build
https://bugs.webkit.org/show_bug.cgi?id=67693

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-06
Reviewed by Daniel Bates.

Removed unnecessary symbol export.

* JavaScriptCore.exp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94632 268f45cc-cd09-0410-ab3c-d52691b4dbfc

garden-o-matic details view should having working rebaseline and next/previous buttons
https://bugs.webkit.org/show_bug.cgi?id=67659

Reviewed by Dimitri Glazkov.

This patch wires up basic back/forward buttons that let you traverse
through the results we're examining in the details view.  This ended up
being more code than I expected, but I wanted to keep all the state
information in the DOM itself.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results_unittests.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/styles/results.css:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94631 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Fix WebFrameClient receiving isRedirect when reloading
https://bugs.webkit.org/show_bug.cgi?id=63591

Patch by Ben Smith <binji@chromium.org> on 2011-09-06
Reviewed by Adam Barth.

Fix bug when quickly reloading a WebFrame where the
WebFrameClient would get called with decidePolicyForNavigation
isRedirect=true.

* src/FrameLoaderClientImpl.cpp:
(WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForNavigationAction):
* src/WebDataSourceImpl.h:
(WebKit::WebDataSourceImpl::isRedirect):
* tests/WebFrameTest.cpp:
(WebKit::TestReloadDoesntRedirectWebFrameClient::decidePolicyForNavigation):
(WebKit::TestReloadDoesntRedirectWebFrameClient::cancelledError):
(WebKit::TEST_F):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94630 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFG JIT does not optimize booleans
https://bugs.webkit.org/show_bug.cgi?id=67670

Reviewed by Gavin Barraclough.

This adds boolean value profiling, boolean prediction in the DFG,
boolean forward flow propagation in the DFGPropagator, boolean
data format in DFG generation info, and comprehensive optimizations
based on both boolean prediction and boolean generation info.
This is brings the speed-up on v8-richards to 12%, and gives slight
speed-ups elsewhere as well.

Making this work right required navigating some subtleties in
value profiling.  Some functions get compiled with insufficient
information because some important path of the function never
executed.  In these cases, we wish to fall back on static
speculation.  But to do so, we need to ensure that predictions that
are inherent in the code (like that GetById almost certainly takes
a cell operand) are reflected in predictions that we make in
DFGPropagator.  Thus, DFGPropagator now does both backward and
forward flow, using a both forward and backward fixpoint.

The backward flow in DFGPropagator is a separate static analysis,
and needs to keep a set of backward flow abstract values for
variables, arguments, and globals.  To make this easy, this patch
factors out DFGGraph's prediction tracking capability into
DFGPredictionTracker, which now gets used by both DFGGraph (for
forward flow predictions) and DFGPropagator (for backward flow
predictions).  Backward flow predictions eventually get merged
into forward flow ones, but the two are not equivalent: a forward
flow prediction is a superset of the backward flow prediction.

Debugging these prediction issues required a better understanding
of where we fail speculation, and what our value predictions look
like.  This patch also adds optional verbose speculation failure
(so an informative printf fires whenever speculation failure occurs)
and slight improvements to the verbosity in other places.

* bytecode/ValueProfile.h:
(JSC::ValueProfile::numberOfBooleans):
(JSC::ValueProfile::probabilityOfBoolean):
(JSC::ValueProfile::dump):
(JSC::ValueProfile::computeStatistics):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::stronglyPredict):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGGenerationInfo.h:
(JSC::DFG::dataFormatToString):
(JSC::DFG::needDataFormatConversion):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::predictArgumentTypes):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::Graph):
(JSC::DFG::Graph::predictions):
(JSC::DFG::Graph::predict):
(JSC::DFG::Graph::predictGlobalVar):
(JSC::DFG::Graph::getPrediction):
(JSC::DFG::Graph::getGlobalVarPrediction):
(JSC::DFG::Graph::isBooleanConstant):
(JSC::DFG::Graph::valueOfBooleanConstant):
* dfg/DFGJITCodeGenerator.cpp:
(JSC::DFG::JITCodeGenerator::fillInteger):
(JSC::DFG::JITCodeGenerator::fillDouble):
(JSC::DFG::JITCodeGenerator::fillJSValue):
(JSC::DFG::JITCodeGenerator::isKnownNotInteger):
(JSC::DFG::JITCodeGenerator::isKnownBoolean):
(JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
(JSC::DFG::JITCodeGenerator::emitBranch):
(JSC::DFG::JITCodeGenerator::speculationCheck):
(JSC::DFG::GPRTemporary::GPRTemporary):
* dfg/DFGJITCodeGenerator.h:
(JSC::DFG::JITCodeGenerator::isBooleanConstant):
(JSC::DFG::JITCodeGenerator::valueOfBooleanConstant):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
(JSC::DFG::JITCompiler::link):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::debugCall):
(JSC::DFG::JITCompiler::isBooleanConstant):
(JSC::DFG::JITCompiler::valueOfBooleanConstant):
* dfg/DFGNode.h:
(JSC::DFG::isBooleanPrediction):
(JSC::DFG::predictionToString):
(JSC::DFG::mergePredictions):
(JSC::DFG::makePrediction):
(JSC::DFG::Node::isBooleanConstant):
(JSC::DFG::Node::valueOfBooleanConstant):
(JSC::DFG::Node::hasBooleanResult):
(JSC::DFG::Node::hasNumericResult):
(JSC::DFG::Node::predict):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionTracker.h: Added.
(JSC::DFG::operandIsArgument):
(JSC::DFG::PredictionSlot::PredictionSlot):
(JSC::DFG::PredictionTracker::PredictionTracker):
(JSC::DFG::PredictionTracker::initializeSimilarTo):
(JSC::DFG::PredictionTracker::numberOfArguments):
(JSC::DFG::PredictionTracker::numberOfVariables):
(JSC::DFG::PredictionTracker::argumentIndexForOperand):
(JSC::DFG::PredictionTracker::predictArgument):
(JSC::DFG::PredictionTracker::predict):
(JSC::DFG::PredictionTracker::predictGlobalVar):
(JSC::DFG::PredictionTracker::getArgumentPrediction):
(JSC::DFG::PredictionTracker::getPrediction):
(JSC::DFG::PredictionTracker::getGlobalVarPrediction):
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::Propagator):
(JSC::DFG::Propagator::fixpoint):
(JSC::DFG::Propagator::setPrediction):
(JSC::DFG::Propagator::mergeUse):
(JSC::DFG::Propagator::mergePrediction):
(JSC::DFG::Propagator::propagateNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::~SpeculateBooleanOperand):
(JSC::DFG::SpeculateBooleanOperand::index):
(JSC::DFG::SpeculateBooleanOperand::gpr):
(JSC::DFG::SpeculateBooleanOperand::use):
* runtime/JSGlobalData.h:
* runtime/JSValue.cpp:
(JSC::JSValue::description):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94629 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rebaseline for bug 65583 (path based border radius drawing on skia)
https://bugs.webkit.org/show_bug.cgi?id=67596

Patch by Ben Wells <benwells@chromium.org> on 2011-09-06
Reviewed by Kenneth Russell.

* fast/backgrounds/gradient-background-leakage-expected.txt: Renamed from LayoutTests/platform/gtk/fast/backgrounds/gradient-background-leakage-expected.txt.
* fast/box-shadow/inset-with-extraordinary-radii-and-border-expected.txt: Renamed from LayoutTests/platform/gtk/fast/box-shadow/inset-with-extraordinary-radii-and-border-expected.txt.
* fast/box-shadow/spread-expected.txt: Renamed from LayoutTests/platform/gtk/fast/box-shadow/spread-expected.txt.
* fast/css/box-shadow-and-border-radius-expected.txt: Renamed from LayoutTests/platform/gtk/fast/css/box-shadow-and-border-radius-expected.txt.
* fast/css/color-leakage-expected.txt: Renamed from LayoutTests/platform/gtk/fast/css/color-leakage-expected.txt.
* fast/css/nested-rounded-corners-expected.txt:
* platform/chromium-linux-x86/fast/css/box-shadow-and-border-radius-expected.png: Added.
* platform/chromium-linux/css2.1/t0805-c5517-brdr-s-00-c-expected.png:
* platform/chromium-linux/fast/: 17 changes
* platform/chromium-win-vista/fast/css/box-shadow-and-border-radius-expected.png: Added.
* platform/chromium-win-xp/fast/css/box-shadow-and-border-radius-expected.png: Added.
* platform/chromium-win/css2.1/t0805-c5517-brdr-s-00-c-expected.png:
* platform/chromium-win/fast/: 19 changes
* platform/chromium/test_expectations.txt:
* platform/gtk/fast/box-shadow/inset-with-extraordinary-radii-and-border-expected.png: Renamed from LayoutTests/fast/box-shadow/inset-with-extraordinary-radii-and-border-expected.png.
* platform/gtk/fast/css/nested-rounded-corners-expected.txt: Removed.
* platform/mac/fast/: 5 files removed
* platform/mac/fast/css/nested-rounded-corners-expected.txt: Copied from LayoutTests/fast/css/nested-rounded-corners-expected.txt.
* platform/qt/: 6 files removed

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94628 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unzip initialization lists and constructors in JSCell hierarchy (5/7)
https://bugs.webkit.org/show_bug.cgi?id=67420

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-06
Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Completed the fifth level of the refactoring to add finishCreation()
methods to all classes within the JSCell hierarchy with non-trivial
constructor bodies.

This primarily consists of pushing the calls to finishCreation() down
into the constructors of the subclasses of the second level of the hierarchy
as well as pulling the finishCreation() calls out into the class's corresponding
create() method if it has one.  Doing both simultaneously allows us to
maintain the invariant that the finishCreation() method chain is called exactly
once during the creation of an object, since calling it any other number of
times (0, 2, or more) will cause an assertion failure.

* API/JSCallbackConstructor.cpp:
(JSC::JSCallbackConstructor::JSCallbackConstructor):
* API/JSCallbackConstructor.h:
(JSC::JSCallbackConstructor::create):
* API/JSCallbackFunction.cpp:
(JSC::JSCallbackFunction::JSCallbackFunction):
(JSC::JSCallbackFunction::finishCreation):
* API/JSCallbackFunction.h:
* JavaScriptCore.exp:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* debugger/DebuggerActivation.cpp:
* debugger/DebuggerActivation.h:
(JSC::DebuggerActivation::create):
* jsc.cpp:
(GlobalObject::finishCreation):
(GlobalObject::GlobalObject):
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::ArrayConstructor):
(JSC::ArrayConstructor::finishCreation):
* runtime/ArrayConstructor.h:
* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::ArrayPrototype):
* runtime/ArrayPrototype.h:
(JSC::ArrayPrototype::create):
* runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::BooleanConstructor):
(JSC::BooleanConstructor::finishCreation):
* runtime/BooleanConstructor.h:
* runtime/BooleanObject.cpp:
(JSC::BooleanObject::BooleanObject):
* runtime/BooleanObject.h:
(JSC::BooleanObject::create):
* runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::BooleanPrototype):
(JSC::BooleanPrototype::finishCreation):
* runtime/BooleanPrototype.h:
* runtime/DateConstructor.cpp:
(JSC::DateConstructor::DateConstructor):
(JSC::DateConstructor::finishCreation):
* runtime/DateConstructor.h:
* runtime/DateInstance.cpp:
(JSC::DateInstance::DateInstance):
* runtime/DateInstance.h:
(JSC::DateInstance::create):
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::DatePrototype):
(JSC::DatePrototype::finishCreation):
* runtime/DatePrototype.h:
* runtime/Error.cpp:
(JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
* runtime/ErrorConstructor.cpp:
(JSC::ErrorConstructor::ErrorConstructor):
(JSC::ErrorConstructor::finishCreation):
* runtime/ErrorConstructor.h:
* runtime/ErrorPrototype.cpp:
(JSC::ErrorPrototype::ErrorPrototype):
* runtime/ErrorPrototype.h:
(JSC::ErrorPrototype::create):
* runtime/FunctionConstructor.cpp:
(JSC::FunctionConstructor::FunctionConstructor):
(JSC::FunctionConstructor::finishCreation):
* runtime/FunctionConstructor.h:
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::FunctionPrototype):
(JSC::FunctionPrototype::finishCreation):
* runtime/FunctionPrototype.h:
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::InternalFunction):
* runtime/InternalFunction.h:
* runtime/JSActivation.cpp:
(JSC::JSActivation::JSActivation):
* runtime/JSActivation.h:
(JSC::JSActivation::create):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::create):
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSONObject.cpp:
(JSC::JSONObject::JSONObject):
* runtime/JSONObject.h:
(JSC::JSONObject::create):
* runtime/JSStaticScopeObject.h:
(JSC::JSStaticScopeObject::create):
(JSC::JSStaticScopeObject::JSStaticScopeObject):
* runtime/JSString.cpp:
(JSC::StringObject::create):
* runtime/MathObject.cpp:
(JSC::MathObject::MathObject):
* runtime/MathObject.h:
(JSC::MathObject::create):
* runtime/NativeErrorConstructor.cpp:
(JSC::NativeErrorConstructor::NativeErrorConstructor):
* runtime/NativeErrorConstructor.h:
(JSC::NativeErrorConstructor::finishCreation):
* runtime/NativeErrorPrototype.cpp:
(JSC::NativeErrorPrototype::NativeErrorPrototype):
(JSC::NativeErrorPrototype::finishCreation):
* runtime/NativeErrorPrototype.h:
* runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::NumberConstructor):
(JSC::NumberConstructor::finishCreation):
* runtime/NumberConstructor.h:
* runtime/NumberObject.cpp:
(JSC::NumberObject::NumberObject):
* runtime/NumberObject.h:
(JSC::NumberObject::create):
* runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::NumberPrototype):
(JSC::NumberPrototype::finishCreation):
* runtime/NumberPrototype.h:
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::ObjectConstructor):
(JSC::ObjectConstructor::finishCreation):
* runtime/ObjectConstructor.h:
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::RegExpConstructor):
(JSC::RegExpConstructor::finishCreation):
(JSC::RegExpMatchesArray::RegExpMatchesArray):
* runtime/RegExpConstructor.h:
* runtime/RegExpMatchesArray.h:
(JSC::RegExpMatchesArray::create):
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::RegExpObject):
* runtime/RegExpObject.h:
(JSC::RegExpObject::create):
* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::RegExpPrototype):
* runtime/StringConstructor.cpp:
(JSC::StringConstructor::StringConstructor):
(JSC::StringConstructor::finishCreation):
* runtime/StringConstructor.h:
* runtime/StringObject.cpp:
(JSC::StringObject::StringObject):
* runtime/StringObject.h:
(JSC::StringObject::create):
* runtime/StringObjectThatMasqueradesAsUndefined.h:
(JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::StringPrototype):
(JSC::StringPrototype::finishCreation):
* runtime/StringPrototype.h:

Source/JavaScriptGlue:

Completed the fifth level of the refactoring to add finishCreation()
methods to all classes within the JSCell hierarchy with non-trivial
constructor bodies.

This primarily consists of pushing the calls to finishCreation() down
into the constructors of the subclasses of the second level of the hierarchy
as well as pulling the finishCreation() calls out into the class's corresponding
create() method if it has one.  Doing both simultaneously allows us to
maintain the invariant that the finishCreation() method chain is called exactly
once during the creation of an object, since calling it any other number of
times (0, 2, or more) will cause an assertion failure.

* JSRun.cpp:
(JSGlueGlobalObject::JSGlueGlobalObject):

Source/WebCore:

No new tests.

Completed the fifth level of the refactoring to add finishCreation()
methods to all classes within the JSCell hierarchy with non-trivial
constructor bodies.

This primarily consists of pushing the calls to finishCreation() down
into the constructors of the subclasses of the second level of the hierarchy
as well as pulling the finishCreation() calls out into the class's corresponding
create() method if it has one.  Doing both simultaneously allows us to
maintain the invariant that the finishCreation() method chain is called exactly
once during the creation of an object, since calling it any other number of
times (0, 2, or more) will cause an assertion failure.

* WebCore.exp.in:
* bindings/js/JSDOMBinding.h:
(WebCore::DOMConstructorObject::DOMConstructorObject):
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
(WebCore::JSDOMGlobalObject::finishCreation):
* bindings/js/JSDOMGlobalObject.h:
* bindings/js/JSDOMWindowShell.cpp:
* bindings/js/JSDOMWindowShell.h:
(WebCore::JSDOMWindowShell::create):
* bindings/js/JSDOMWrapper.h:
(WebCore::JSDOMWrapper::JSDOMWrapper):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterface::JSTestInterface):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObj::JSTestObj):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface):
* bridge/c/CRuntimeObject.cpp:
(JSC::Bindings::CRuntimeObject::CRuntimeObject):
(JSC::Bindings::CRuntimeObject::finishCreation):
* bridge/c/CRuntimeObject.h:
* bridge/jni/jsc/JavaRuntimeObject.cpp:
(JSC::Bindings::JavaRuntimeObject::JavaRuntimeObject):
(JSC::Bindings::JavaRuntimeObject::finishCreation):
* bridge/jni/jsc/JavaRuntimeObject.h:
* bridge/objc/ObjCRuntimeObject.h:
* bridge/objc/ObjCRuntimeObject.mm:
(JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
(JSC::Bindings::ObjCRuntimeObject::finishCreation):
* bridge/objc/objc_runtime.h:
(JSC::Bindings::ObjcFallbackObjectImp::create):
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
* bridge/qt/qt_instance.cpp:
(JSC::Bindings::QtRuntimeObject::QtRuntimeObject):
* bridge/qt/qt_pixmapruntime.cpp:
(JSC::Bindings::QtPixmapRuntimeObject::QtPixmapRuntimeObject):
* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
(JSC::Bindings::QtRuntimeMethod::finishCreation):
* bridge/qt/qt_runtime.h:
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::RuntimeArray):
* bridge/runtime_array.h:
(JSC::RuntimeArray::create):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::RuntimeMethod):
(JSC::RuntimeMethod::finishCreation):
* bridge/runtime_method.h:
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::RuntimeObject):
* bridge/runtime_object.h:
(JSC::Bindings::RuntimeObject::create):

Source/WebKit/mac:

Completed the fifth level of the refactoring to add finishCreation()
methods to all classes within the JSCell hierarchy with non-trivial
constructor bodies.

This primarily consists of pushing the calls to finishCreation() down
into the constructors of the subclasses of the second level of the hierarchy
as well as pulling the finishCreation() calls out into the class's corresponding
create() method if it has one.  Doing both simultaneously allows us to
maintain the invariant that the finishCreation() method chain is called exactly
once during the creation of an object, since calling it any other number of
times (0, 2, or more) will cause an assertion failure.

* Plugins/Hosted/ProxyRuntimeObject.h:
* Plugins/Hosted/ProxyRuntimeObject.mm:
(WebKit::ProxyRuntimeObject::ProxyRuntimeObject):
(WebKit::ProxyRuntimeObject::finishCreation):

Source/WebKit2:

Completed the fifth level of the refactoring to add finishCreation()
methods to all classes within the JSCell hierarchy with non-trivial
constructor bodies.

This primarily consists of pushing the calls to finishCreation() down
into the constructors of the subclasses of the second level of the hierarchy
as well as pulling the finishCreation() calls out into the class's corresponding
create() method if it has one.  Doing both simultaneously allows us to
maintain the invariant that the finishCreation() method chain is called exactly
once during the creation of an object, since calling it any other number of
times (0, 2, or more) will cause an assertion failure.

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::JSNPMethod::JSNPMethod):
(WebKit::JSNPMethod::finishCreation):
* WebProcess/Plugins/Netscape/JSNPMethod.h:
(WebKit::JSNPMethod::create):
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::JSNPObject):
* WebProcess/Plugins/Netscape/JSNPObject.h:
(WebKit::JSNPObject::create):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94627 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update chromium gpu baseline due to skia roll

* platform/chromium-gpu-win/fast/canvas/canvas-text-alignment-expected.png:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94626 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Implement list style properties in CSSStyleApplyProperty.
https://bugs.webkit.org/show_bug.cgi?id=67103

Reviewed by Eric Seidel.

No new tests / no behavioral changes.

* css/CSSStyleApplyProperty.cpp:
Add class to wrap call to CSSStyleSelector::styleImage().
(WebCore::ApplyPropertyStyleImage::ApplyPropertyStyleImage):
(WebCore::ApplyPropertyStyleImage::applyValue):
(WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
Initialize handlers for list style properties.
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applyProperty):
Remove existing property implementations.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94625 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update various chromium baselines.

* platform/chromium-cg-mac-leopard/fast/css/value-list-out-of-bounds-crash-expected.png:
* platform/chromium-cg-mac-leopard/scrollbars/overflow-scrollbar-combinations-expected.png:
* platform/chromium-mac/fast/dom/Window/window-lookup-precedence-expected.txt: Copied from LayoutTests/platform/chromium/fast/dom/Window/window-lookup-precedence-expected.txt.
* platform/chromium-mac/fast/dom/wrapper-classes-expected.txt: Copied from LayoutTests/platform/chromium/fast/dom/wrapper-classes-expected.txt.
* platform/chromium-win/svg/batik/text/textStyles-expected.png:
* platform/chromium-win/svg/batik/text/textStyles-expected.txt:
* platform/chromium/fast/dom/Window/window-lookup-precedence-expected.txt:
* platform/chromium/fast/dom/wrapper-classes-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94624 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Accessibility tests crashing in BasicRawSentinelNode code
https://bugs.webkit.org/show_bug.cgi?id=67682

Reviewed by Geoffrey Garen.

A CodeBlock should ensure that no other CodeBlocks have references to it after
it is destroyed.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::~CodeBlock):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94623 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore: https://bugs.webkit.org/show_bug.cgi?id=67486
This reverts r65993 which gives wrong results for rshift
in some corner cases (see the test).

Patch by Yong Li <yoli@rim.com> on 2011-09-06
Reviewed by Gavin Barraclough.

New test: fast/js/floating-point-truncate-rshift.html

* assembler/ARMAssembler.h:
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
(JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):

LayoutTests: https://bugs.webkit.org/show_bug.cgi?id=67486
Add a test case for branchTruncateDoubleToInt32() which is
used in right shift optimization when the assembler
"supportsFloatingPointTruncate".

Patch by Yong Li <yoli@rim.com> on 2011-09-06
Reviewed by Gavin Barraclough.

* fast/js/floating-point-truncate-rshift-expected.txt: Added.
* fast/js/floating-point-truncate-rshift.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94622 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94621 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt] Move away from QPointer as it is slow and it has a replacement QWeakPointer.
https://bugs.webkit.org/show_bug.cgi?id=67673

Reviewed by Ariya Hidayat.

Source/WebCore:

Move away from QPointer to QWeakPointer, it is faster.

No new tests, the existing ones should cover.

* bridge/qt/qt_instance.cpp:
(JSC::Bindings::QtInstance::~QtInstance):
(JSC::Bindings::QtInstance::getClass):
(JSC::Bindings::QtField::name):
(JSC::Bindings::QtField::valueFromInstance):
* bridge/qt/qt_instance.h:
(JSC::Bindings::QtInstance::getObject):
* bridge/qt/qt_runtime.h:
* platform/qt/SharedTimerQt.cpp:
(WebCore::SharedTimerQt::inst):

Source/WebKit/qt:

Move away from QPointer as Qt provides a better and faster solution : QWeakPointer.

* Api/qwebframe.cpp:
(QWebHitTestResult::linkTargetFrame):
(QWebHitTestResult::frame):
* Api/qwebframe_p.h:
* Api/qwebpage.cpp:
(QWebPagePrivate::QWebPagePrivate):
(QWebPagePrivate::~QWebPagePrivate):
(QWebPagePrivate::acceptNavigationRequest):
(QWebPagePrivate::createMainFrame):
(QWebPagePrivate::updateAction):
(QWebPagePrivate::mouseMoveEvent):
(QWebPagePrivate::mousePressEvent):
(QWebPagePrivate::mouseDoubleClickEvent):
(QWebPagePrivate::mouseTripleClickEvent):
(QWebPagePrivate::mouseReleaseEvent):
(QWebPage::createStandardContextMenu):
(QWebPagePrivate::wheelEvent):
(QWebPagePrivate::focusInEvent):
(QWebPage::setPalette):
(QWebPagePrivate::touchEvent):
(QWebPage::~QWebPage):
(QWebPage::mainFrame):
(QWebPage::viewportSize):
(QWebPage::preferredContentsSize):
(QWebPage::setContentEditable):
(QWebPage::updatePositionDependentActions):
* Api/qwebpage_p.h:
* Api/qwebview.cpp:
* WebCoreSupport/DumpRenderTreeSupportQt.cpp:
(DumpRenderTreeSupportQt::contextMenu):
* WebCoreSupport/FrameLoaderClientQt.cpp:
(WebCore::FrameLoaderClientQt::createFrame):
* tests/qwebframe/tst_qwebframe.cpp:
(tst_QWebFrame::ownership):
* tests/qwebpage/tst_qwebpage.cpp:
(PluginCounterPage::PluginCounterPage):
(PluginTracerPage::createPlugin):
(tst_QWebPage::createViewlessPlugin):
* tests/qwebview/tst_qwebview.cpp:
(tst_QWebView::reusePage):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94620 268f45cc-cd09-0410-ab3c-d52691b4dbfc

fix MockFileSystem.glob(), refactor filesystem tests
https://bugs.webkit.org/show_bug.cgi?id=67462

Reviewed by Eric Seidel.

In debugging why my proposed change for MockFileSystem.glob()
in bug 66228 didn't work, I stumbled across two real bugs
that cancelled each other out for the unit tests. I fixed those
(glob shouldn't recurse into subdirs, and we weren't populating
self.dirs from self.files properly).

I have also created a "mixin" class for tests that can be shared
between the real filesystem and the mock filesystem - MockFileSystem
is being used enough it needs its own tests.

* Scripts/webkitpy/common/system/filesystem_mock.py:
* Scripts/webkitpy/common/system/filesystem_mock_unittest.py: Added.
* Scripts/webkitpy/common/system/filesystem_unittest.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94618 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update expected results of bindings tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94617 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed build fix for r94559.

Marked the relevant parameters as unused if !ENABLE(JIT), and surrounded
new out-of-line JIT-specific method definitions with !ENABLE(JIT).

* bytecode/CodeBlock.cpp:
* runtime/Executable.cpp:
(JSC::EvalExecutable::compileInternal):
(JSC::ProgramExecutable::compileInternal):
(JSC::FunctionExecutable::compileForCallInternal):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94616 268f45cc-cd09-0410-ab3c-d52691b4dbfc

editing/selection/mixed-editability-10.html is failing on the bots
https://bugs.webkit.org/show_bug.cgi?id=67683

Update editing/selection/mixed-editability-10.html baselines after
HTMLSpanElement introduction.

* editing/selection/mixed-editability-10-expected.txt:
* platform/qt/editing/selection/mixed-editability-10-expected.png: Removed.
    - This test is no longer an image test.
* platform/qt/editing/selection/mixed-editability-10-expected.txt:
* platform/win/editing/selection/mixed-editability-10-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94615 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove window.HTMLBlockquoteElement per HTML5 (and DOM Core 1)
https://bugs.webkit.org/show_bug.cgi?id=67678

Reviewed by Darin Adler.

This is why we can't have nice things.

There was some confusion in the original DOM HTML 1 spec about
the existence of HTMlBlockquoteElement which was clarified by
a later errata, removing HTMLBlockquoteElement:
http://www.w3.org/DOM/updates/REC-DOM-Level-1-19981001-errata.html
"This interface is an error and must be ignored. The Interface HTMLQuoteElement is used for both the Q and BLOCKQUOTE elements"

Le sigh.  Personally I think having a separate HTMLBlockquoteElement
is clearer, but thats not how the web works.  Removed it and updated test results.

* CMakeLists.txt:
* CodeGenerators.pri:
* DerivedSources.cpp:
* DerivedSources.make:
* GNUmakefile.list.am:
* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* bindings/gobject/GNUmakefile.am:
* editing/IndentOutdentCommand.cpp:
* html/HTMLBlockquoteElement.cpp: Removed.
* html/HTMLBlockquoteElement.h: Removed.
* html/HTMLBlockquoteElement.idl: Removed.
* html/HTMLElementsAllInOne.cpp:
* html/HTMLQuoteElement.cpp:
(WebCore::HTMLQuoteElement::HTMLQuoteElement):
(WebCore::HTMLQuoteElement::insertedIntoDocument):
* html/HTMLTagNames.in:
* page/DOMWindow.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94614 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rename confirmCompositionWithoutDisturbingSelection to cancelComposition
https://bugs.webkit.org/show_bug.cgi?id=67569

Reviewed by Antonio Gomes.

Source/WebCore:

Renamed Editor::confirmCompositionWithoutDisturbingSelection to Editor::cancelComposition.
Also renamed the shared function from confirmComposition to setComposition.

* WebCore.exp.in:
* editing/Editor.cpp:
(WebCore::Editor::confirmComposition):
(WebCore::Editor::cancelComposition):
(WebCore::Editor::setComposition):
* editing/Editor.h:

Source/WebKit/chromium:

* src/WebFrameImpl.cpp:
(WebKit::WebFrameImpl::unmarkText):

Source/WebKit/gtk:

* WebCoreSupport/EditorClientGtk.cpp:
(WebKit::EditorClient::respondToChangedSelection):

Source/WebKit/mac:

* WebView/WebHTMLView.mm:
(-[WebHTMLView _updateSelectionForInputManager]):

Source/WebKit/win:

* WebView.cpp:
(WebView::resetIME):

Source/WebKit2:

* UIProcess/API/mac/WKView.mm:
(-[WKView resignFirstResponder]):
(-[WKView _updateTextInputStateIncludingSecureInputState:]):
* UIProcess/WebPageProxy.h:
* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::cancelComposition):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:
* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::cancelComposition):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94613 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update expectations for a few tests that render oddly on xp due to r94589

* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94612 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebVTTTokenizer files in the wrong place in the Xcode project.

* WebCore.xcodeproj/project.pbxproj:
Move WebVTTTokenizer files so they are in the right place in the project.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94609 268f45cc-cd09-0410-ab3c-d52691b4dbfc

MediaElementAudioSourceNode destruction triggers ASSERTS
https://bugs.webkit.org/show_bug.cgi?id=67665

Reviewed by Nate Chapin.

Source/WebCore:

Test: webaudio/mediaelementaudiosourcenode-gc.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::setAudioSourceNode):
* webaudio/AudioContext.cpp:
(WebCore::AudioContext::uninitializeDispatch):
(WebCore::AudioContext::stop):
* webaudio/AudioContext.h:

LayoutTests:

* webaudio/mediaelementaudiosourcenode-gc-expected.txt: Added.
* webaudio/mediaelementaudiosourcenode-gc.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94608 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix broken PPC build due to new dtoa library
https://bugs.webkit.org/show_bug.cgi?id=67654

Patch by Mark Hahnenberg <mhahnenberg@apple.com> on 2011-09-06
Reviewed by Dan Bernstein.

Added condition for PPC in the new dtoa compatibility check so that
building won't fail.

* wtf/dtoa/utils.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94607 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Update pixel baselines for r94597

* platform/chromium-cg-mac/fast/borders/border-image-scaled-expected.png: Added.
* platform/chromium-cg-mac/fast/borders/border-image-side-reduction-expected.png: Added.
* platform/chromium-cg-mac/fast/css/value-list-out-of-bounds-crash-expected.png: Added.
* platform/chromium-cg-mac/scrollbars/overflow-scrollbar-combinations-expected.png:
* platform/chromium-linux/fast/borders/border-image-scaled-expected.png: Added.
* platform/chromium-linux/fast/css/value-list-out-of-bounds-crash-expected.png:
* platform/chromium-linux/scrollbars/overflow-scrollbar-combinations-expected.png:
* platform/chromium-linux/svg/css/getComputedStyle-basic-expected.txt: Copied from LayoutTests/platform/chromium-win/svg/css/getComputedStyle-basic-expected.txt.
* platform/chromium-win-vista/fast/css/getComputedStyle/computed-style-expected.txt: Copied from LayoutTests/platform/chromium-win/fast/css/getComputedStyle/computed-style-expected.txt.
* platform/chromium-win-vista/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt: Copied from LayoutTests/platform/chromium-win/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt.
* platform/chromium-win/fast/borders/border-image-longhand-expected.png: Added.
* platform/chromium-win/fast/borders/border-image-longhand-expected.txt: Added.
* platform/chromium-win/fast/borders/border-image-scaled-expected.png: Added.
* platform/chromium-win/fast/borders/border-image-scaled-expected.txt: Added.
* platform/chromium-win/fast/borders/border-image-side-reduction-expected.png: Added.
* platform/chromium-win/fast/borders/border-image-side-reduction-expected.txt: Added.
* platform/chromium-win/fast/css/getComputedStyle/computed-style-expected.txt:
* platform/chromium-win/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* platform/chromium-win/fast/css/value-list-out-of-bounds-crash-expected.png:
* platform/chromium-win/scrollbars/overflow-scrollbar-combinations-expected.png:
* platform/chromium-win/svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94605 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Add WebFloatQuad.h for Android
https://bugs.webkit.org/show_bug.cgi?id=67573

Reviewed by Darin Fisher.

Android uses this wrapper of WebCore::FloatQuad in some API methods
(which will appear in subsequent patches).

* WebKit.gyp:
* public/WebFloatQuad.h: Added.
* src/WebFloatQuad.cpp: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94604 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt] Fix API test failure after r92823 and r93001.
https://bugs.webkit.org/show_bug.cgi?id=67676

Reviewed by Kenneth Rohde Christiansen.

r92823 and r93001 make WebKit no longer produce wrapping style
spans on copy and paste and class="Apple-style-span" anymore.
Our expectations need to be updated.

* tests/qwebpage/tst_qwebpage.cpp:
(tst_QWebPage::cursorMovements):
(tst_QWebPage::textSelection):
(tst_QWebPage::findText):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94601 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Add didAcceptIndices to ExternalPopupMenuClient for Android
https://bugs.webkit.org/show_bug.cgi?id=67574

Reviewed by Darin Fisher.

In Android, external popup menus can admit multiple selection (e.g.,
for listboxes presented using external UI).

* public/WebExternalPopupMenuClient.h:
* src/ExternalPopupMenu.cpp:
(WebKit::ExternalPopupMenu::didAcceptIndices):
* src/ExternalPopupMenu.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94600 268f45cc-cd09-0410-ab3c-d52691b4dbfc

An object's structure should reference the global object responsible for its creation
https://bugs.webkit.org/show_bug.cgi?id=67624

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

Add a reference to a GlobalObject to Structure, and update all calls to
Structure::create() to pass the global object that is the origin for that
structure.  For objects where the appropriate global object isn't available
at construction time (global object prototypes, etc), or objects that
logically don't have a global object (strings, etc) we just pass null.

This change is largely mechanical (passing a new globalObject parameter
around).

* API/JSCallbackConstructor.h:
(JSC::JSCallbackConstructor::createStructure):
* API/JSCallbackFunction.h:
(JSC::JSCallbackFunction::createStructure):
* API/JSCallbackObject.h:
(JSC::JSCallbackObject::createStructure):
* API/JSContextRef.cpp:
* JavaScriptCore.exp:
* debugger/DebuggerActivation.h:
(JSC::DebuggerActivation::createStructure):
* runtime/Arguments.h:
(JSC::Arguments::createStructure):
* runtime/ArrayConstructor.h:
(JSC::ArrayConstructor::createStructure):
* runtime/ArrayPrototype.h:
(JSC::ArrayPrototype::createStructure):
* runtime/BooleanObject.h:
(JSC::BooleanObject::createStructure):
* runtime/BooleanPrototype.h:
(JSC::BooleanPrototype::createStructure):
* runtime/DateConstructor.h:
(JSC::DateConstructor::createStructure):
* runtime/DateInstance.h:
(JSC::DateInstance::createStructure):
* runtime/DatePrototype.h:
(JSC::DatePrototype::createStructure):
* runtime/ErrorInstance.h:
(JSC::ErrorInstance::createStructure):
* runtime/ErrorPrototype.h:
(JSC::ErrorPrototype::createStructure):
* runtime/Executable.h:
(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):
(JSC::EvalExecutable::createStructure):
(JSC::ProgramExecutable::createStructure):
(JSC::FunctionExecutable::createStructure):
* runtime/FunctionPrototype.h:
(JSC::FunctionPrototype::createStructure):
* runtime/GetterSetter.h:
(JSC::GetterSetter::createStructure):
* runtime/InternalFunction.h:
(JSC::InternalFunction::createStructure):
* runtime/JSAPIValueWrapper.h:
(JSC::JSAPIValueWrapper::createStructure):
* runtime/JSActivation.h:
(JSC::JSActivation::createStructure):
* runtime/JSArray.h:
(JSC::JSArray::createStructure):
* runtime/JSByteArray.cpp:
(JSC::JSByteArray::createStructure):
* runtime/JSByteArray.h:
* runtime/JSFunction.h:
(JSC::JSFunction::createStructure):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::finishCreation):
(JSC::JSGlobalObject::createStructure):
* runtime/JSNotAnObject.h:
(JSC::JSNotAnObject::createStructure):
* runtime/JSONObject.h:
(JSC::JSONObject::createStructure):
* runtime/JSObject.cpp:
(JSC::JSObject::createInheritorID):
* runtime/JSObject.h:
(JSC::JSObject::createStructure):
(JSC::JSNonFinalObject::createStructure):
(JSC::JSFinalObject::createStructure):
(JSC::createEmptyObjectStructure):
* runtime/JSObjectWithGlobalObject.h:
(JSC::JSObjectWithGlobalObject::createStructure):
* runtime/JSPropertyNameIterator.h:
(JSC::JSPropertyNameIterator::createStructure):
* runtime/JSStaticScopeObject.h:
(JSC::JSStaticScopeObject::createStructure):
* runtime/JSString.h:
(JSC::RopeBuilder::createStructure):
* runtime/JSVariableObject.h:
(JSC::JSVariableObject::createStructure):
* runtime/JSWrapperObject.h:
(JSC::JSWrapperObject::createStructure):
* runtime/MathObject.h:
(JSC::MathObject::createStructure):
* runtime/NativeErrorConstructor.h:
(JSC::NativeErrorConstructor::createStructure):
(JSC::NativeErrorConstructor::constructorBody):
* runtime/NumberConstructor.h:
(JSC::NumberConstructor::createStructure):
* runtime/NumberObject.h:
(JSC::NumberObject::createStructure):
* runtime/NumberPrototype.h:
(JSC::NumberPrototype::createStructure):
* runtime/ObjectConstructor.h:
(JSC::ObjectConstructor::createStructure):
* runtime/ObjectPrototype.h:
(JSC::ObjectPrototype::createStructure):
* runtime/RegExp.h:
(JSC::RegExp::createStructure):
* runtime/RegExpConstructor.h:
(JSC::RegExpConstructor::createStructure):
* runtime/RegExpObject.h:
(JSC::RegExpObject::createStructure):
* runtime/RegExpPrototype.h:
(JSC::RegExpPrototype::createStructure):
* runtime/ScopeChain.h:
(JSC::ScopeChainNode::createStructure):
* runtime/StrictEvalActivation.h:
(JSC::StrictEvalActivation::createStructure):
* runtime/StringConstructor.h:
(JSC::StringConstructor::createStructure):
* runtime/StringObject.h:
(JSC::StringObject::createStructure):
* runtime/StringObjectThatMasqueradesAsUndefined.h:
(JSC::StringObjectThatMasqueradesAsUndefined::create):
(JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
* runtime/StringPrototype.h:
(JSC::StringPrototype::createStructure):
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::visitChildren):
* runtime/Structure.h:
(JSC::Structure::create):
(JSC::Structure::globalObject):
(JSC::Structure::setGlobalObject):
* runtime/StructureChain.h:
(JSC::StructureChain::createStructure):

Source/JavaScriptGlue:

Update for Structure::create() requiring a global object.

* JSRun.h:
(JSGlueGlobalObject::create):
* UserObjectImp.h:
(UserObjectImp::createStructure):

Source/WebCore:

Update calls to Structure::create() to pass the globalObject in,
and update the CodeGenerator to generate appropriate createStructure
methods.

* bindings/js/JSAudioConstructor.h:
(WebCore::JSAudioConstructor::createStructure):
* bindings/js/JSDOMBinding.h:
(WebCore::DOMConstructorObject::createStructure):
(WebCore::getDOMStructure):
* bindings/js/JSDOMGlobalObject.h:
(WebCore::JSDOMGlobalObject::createStructure):
(WebCore::getDOMConstructor):
* bindings/js/JSDOMWindowBase.h:
(WebCore::JSDOMWindowBase::createStructure):
* bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::setWindow):
* bindings/js/JSDOMWindowShell.h:
(WebCore::JSDOMWindowShell::createStructure):
* bindings/js/JSDOMWrapper.h:
(WebCore::JSDOMWrapper::createStructure):
* bindings/js/JSImageConstructor.h:
(WebCore::JSImageConstructor::createStructure):
* bindings/js/JSImageDataCustom.cpp:
(WebCore::toJS):
* bindings/js/JSOptionConstructor.h:
(WebCore::JSOptionConstructor::createStructure):
* bindings/js/JSWorkerContextBase.h:
(WebCore::JSWorkerContextBase::createStructure):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::initScript):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorDeclaration):
* bridge/c/CRuntimeObject.h:
(JSC::Bindings::CRuntimeObject::createStructure):
* bridge/c/c_instance.cpp:
(JSC::Bindings::CRuntimeMethod::createStructure):
* bridge/jni/jsc/JavaInstanceJSC.cpp:
(JavaRuntimeMethod::createStructure):
* bridge/jni/jsc/JavaRuntimeObject.h:
(JSC::Bindings::JavaRuntimeObject::createStructure):
* bridge/objc/ObjCRuntimeObject.h:
(JSC::Bindings::ObjCRuntimeObject::createStructure):
* bridge/objc/objc_instance.mm:
(ObjCRuntimeMethod::createStructure):
* bridge/objc/objc_runtime.h:
(JSC::Bindings::ObjcFallbackObjectImp::createStructure):
* bridge/runtime_array.h:
(JSC::RuntimeArray::createStructure):
* bridge/runtime_method.h:
(JSC::RuntimeMethod::createStructure):
* bridge/runtime_object.h:
(JSC::Bindings::RuntimeObject::createStructure):

Source/WebKit/mac:

Update for new Structure::create() globalObject parameter.

* Plugins/Hosted/ProxyInstance.mm:
(WebKit::ProxyRuntimeMethod::createStructure):
* Plugins/Hosted/ProxyRuntimeObject.h:
(WebKit::ProxyRuntimeObject::createStructure):

Source/WebKit2:

Update for new Structure::create globalObject parameter.

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::JSNPMethod::create):
* WebProcess/Plugins/Netscape/JSNPMethod.h:
(WebKit::JSNPMethod::createStructure):
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::create):
* WebProcess/Plugins/Netscape/JSNPObject.h:
(WebKit::JSNPObject::createStructure):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94599 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move NPAPI headers in bridge to plugins
https://bugs.webkit.org/show_bug.cgi?id=67661

Source/WebCore:

Reviewed by Darin Adler.

* WebCore.gypi:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
Update build systems.

* bridge/npapi.h: Removed.
* bridge/npruntime.h: Removed.
* bridge/nptypes.h: Removed.
* plugins/npapi.h: Copied from Source/WebCore/bridge/npapi.h.
* plugins/npruntime.h: Copied from Source/WebCore/bridge/npruntime.h.
* plugins/nptypes.h: Copied from Source/WebCore/bridge/nptypes.h.

Tools:

Update forwarding headers.

* DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h:
* DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94598 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67672

Improve background-size parsing. Make it actually dump auto values properly, and also make it omit
auto if it is the second value. Fix the parsing to not create a value list when only a singleton value
is specified.

Reviewed by Beth Dakin.

Covered well by existing tests.

Source/WebCore:

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::fillSizeToCSSValue):
* css/CSSParser.cpp:
(WebCore::CSSParser::parseFillSize):
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::mapFillSize):

LayoutTests:

* fast/backgrounds/size/parsing-background-size-values-expected.txt:
* fast/backgrounds/size/parsing-inherit-expected.txt:
* fast/backgrounds/size/resources/parsing-background-size-values.js:
* fast/backgrounds/size/resources/parsing-inherit.js:
* fast/css/getComputedStyle/computed-style-expected.txt:
* fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* fast/css/getComputedStyle/getComputedStyle-background-size-expected.txt:
* fast/css/value-list-out-of-bounds-crash.html:
* svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94597 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix build bustage from accidental project file addition.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94596 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update some layout test results following the improved Pair parsing code that landed in r94593.

* fast/backgrounds/size/parsing-background-size-values-expected.txt:
* fast/backgrounds/size/resources/parsing-background-size-values.js:
* fast/reflections/reflection-computed-style-expected.txt:
* inspector/elements/elements-panel-styles-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94595 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests does not include a test for DFG speculation recovery of additions
https://bugs.webkit.org/show_bug.cgi?id=67667

Reviewed by Geoffrey Garen.

* fast/js/add-recovery-expected.txt: Added.
* fast/js/add-recovery.html: Added.
* fast/js/script-tests/add-recovery.js: Added.
(destructiveAddForBoxedInteger):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94594 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67657

Implement border-image-width. This patch stops short of converting -webkit-border-image to a shorthand.
I'll do that in the next patch.

Note that unlike the -webkit-border-image syntax, border-image-width does not actually set the border
width values. It simply makes cuts into the border image drawing area (which for now is just the border
box, but that will change once border-image-outset is implemented).

This means we need additional storage for the slices, since they are now separate from the border widths.

For backwards compatibility, -webkit-border-image will continue to set the border widths when
border-image-width is specified in the -webkit-border-image shorthand.

Reviewed by Beth Dakin.

Source/WebCore:

Added new tests in fast/borders.

* css/CSSBorderImageSliceValue.cpp:
(WebCore::CSSBorderImageSliceValue::CSSBorderImageSliceValue):
(WebCore::CSSBorderImageSliceValue::cssText):
* css/CSSBorderImageSliceValue.h:
(WebCore::CSSBorderImageSliceValue::create):
(WebCore::CSSBorderImageSliceValue::slices):
Rename slices() to imageSlices() and add borderSlices() and m_borderSlices to hold the desired cuts
for the border image drawing area. Converted the slices over to the new Quad primitive value (a RectBase
subclass that is identical to Rect but dumps as a quad instead of a rect primitive).

* css/CSSBorderImageValue.cpp:
(WebCore::CSSBorderImageValue::CSSBorderImageValue):
(WebCore::CSSBorderImageValue::cssText):
* css/CSSBorderImageValue.h:
(WebCore::CSSBorderImageValue::create):
Make CSSBorderImageValue take the border slices during construction now.

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::valueForNinePieceImageSlice):
(WebCore::valueForNinePieceImageWidth):
(WebCore::valueForNinePieceImageRepeat):
(WebCore::valueForNinePieceImage):
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
Add support for computed style via valueForNinePieceImageWidth. Patch all of the border image properties
to dump the most compact form possible for the property values, e.g., "stretch stretch" becomes "stretch."

* css/CSSParser.cpp:
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseReflect):
(WebCore::BorderImageParseContext::BorderImageParseContext):
(WebCore::BorderImageParseContext::commitImageSlice):
(WebCore::BorderImageParseContext::commitBorderWidth):
(WebCore::BorderImageParseContext::commitBorderImage):
(WebCore::CSSParser::parseBorderImage):
(WebCore::isBorderImageRepeatKeyword):
(WebCore::CSSParser::parseBorderImageRepeat):
(WebCore::BorderImageSliceParseContext::commitBorderImageSlice):
(WebCore::CSSParser::parseBorderImageSlice):
(WebCore::BorderImageWidthParseContext::BorderImageWidthParseContext):
(WebCore::BorderImageWidthParseContext::allowNumber):
(WebCore::BorderImageWidthParseContext::allowFinalCommit):
(WebCore::BorderImageWidthParseContext::top):
(WebCore::BorderImageWidthParseContext::commitNumber):
(WebCore::BorderImageWidthParseContext::setAllowFinalCommit):
(WebCore::BorderImageWidthParseContext::setTop):
(WebCore::BorderImageWidthParseContext::commitBorderImageWidth):
(WebCore::CSSParser::parseBorderImageWidth):
* css/CSSParser.h:
Modify the border-image code to pass off border-image-width parsing to parseBorderImageWidth.

* css/CSSPrimitiveValue.cpp:
(WebCore::isValidCSSUnitTypeForDoubleConversion):
(WebCore::CSSPrimitiveValue::init):
(WebCore::CSSPrimitiveValue::cleanup):
(WebCore::CSSPrimitiveValue::getQuadValue):
(WebCore::CSSPrimitiveValue::cssText):
* css/CSSPrimitiveValue.h:
(WebCore::CSSPrimitiveValue::getQuadValue):
Add the new Quad value to CSSPrimitiveValue.

* css/CSSPropertyNames.in:
Add the new properties for border-image-width and -webkit-mask-box-image-width.

* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applyProperty):
(WebCore::CSSStyleSelector::mapNinePieceImage):
(WebCore::CSSStyleSelector::mapNinePieceImageSlice):
(WebCore::CSSStyleSelector::mapNinePieceImageWidth):
(WebCore::CSSStyleSelector::loadPendingImages):
* css/CSSStyleSelector.h:
Add the code to map the image width into border slices.

* css/Rect.h:
(WebCore::RectBase::top):
(WebCore::RectBase::right):
(WebCore::RectBase::bottom):
(WebCore::RectBase::left):
(WebCore::RectBase::setTop):
(WebCore::RectBase::setRight):
(WebCore::RectBase::setBottom):
(WebCore::RectBase::setLeft):
(WebCore::RectBase::RectBase):
(WebCore::RectBase::~RectBase):
(WebCore::Rect::create):
(WebCore::Rect::Rect):
(WebCore::Quad::create):
(WebCore::Quad::Quad):
Adding the new Quad value.

* rendering/RenderBoxModelObject.cpp:
(WebCore::computeBorderImageSide):
(WebCore::RenderBoxModelObject::paintNinePieceImage):
Modify painting to treat the border slices as separate from the border widths.

* rendering/style/NinePieceImage.cpp:
(WebCore::NinePieceImage::operator==):
* rendering/style/NinePieceImage.h:
(WebCore::NinePieceImage::NinePieceImage):
(WebCore::NinePieceImage::imageSlices):
(WebCore::NinePieceImage::setImageSlices):
(WebCore::NinePieceImage::borderSlices):
(WebCore::NinePieceImage::setBorderSlices):
(WebCore::NinePieceImage::copyImageSlicesFrom):
(WebCore::NinePieceImage::copyBorderSlicesFrom):
* rendering/style/StyleRareNonInheritedData.cpp:
Add the border slices.

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
* rendering/style/StyleReflection.h:
(WebCore::StyleReflection::StyleReflection):
Make sure masks and reflections default border-image-width to auto instead of 1, since that matches
old behavior.

LayoutTests:

* fast/borders/border-image-longhand.html: Added.
* fast/borders/border-image-scaled.html: Added.
* fast/borders/border-image-side-reduction.html: Added.
* fast/css/getComputedStyle/computed-style-expected.txt:
* fast/css/getComputedStyle/computed-style-with-zoom-expected.txt:
* fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* fast/css/getComputedStyle/getComputedStyle-border-image-expected.txt:
* fast/css/large-value-csstext-expected.txt:
* svg/css/getComputedStyle-basic-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94593 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] Check in 'build' for compiled binaries first
https://bugs.webkit.org/show_bug.cgi?id=67549

Reviewed by Dirk Pranke.

I'm working on moving the windows build output to a common location
rather than relative to the sln file.  Because of that, we need to
check those build locations first for DumpRenderTree.exe.

* Scripts/webkitpy/layout_tests/port/chromium_win.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94592 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium skia] JPEGImageEncoder: hoist constants out of the encoding loop
https://bugs.webkit.org/show_bug.cgi?id=67589

Reviewed by Kenneth Russell.

Change the row converter function signatures to be the same.  Call them via a function
pointer during the encoding loop.  Minor webkit style cleanup, remove unused include.

No new tests.  Covered by existing canvas 2d and 3d tests.
canvas/philip/tests/toDataURL.jpeg.alpha.html
fast/canvas/webgl/premultiplyalpha-test.html

* platform/image-encoders/skia/JPEGImageEncoder.cpp:  Remove SkUnPreMultiply.h (not used).
(WebCore::preMultipliedBGRAtoRGB):  Use unsigned char* instead of void* for pixels.
(WebCore::RGBAtoRGB):  pixels & pixelCount to match the preMultipliedBGRAtoRGB() signature.
(WebCore::encodePixels):  Move constants out of the encoding loop: use a function pointer
to call preMultipliedBGRAtoRGB or RGBAtoRGB (now they have identical signatures), define
and use pixelRowStride constant.
(WebCore::JPEGImageEncoder::encode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94591 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Allow MediaSource API to be enabled at runtime.
https://bugs.webkit.org/show_bug.cgi?id=67306

Patch by Aaron Colwell <acolwell@chromium.org> on 2011-09-06
Reviewed by Eric Carlson.

Source/WebCore:

* bindings/generic/RuntimeEnabledFeatures.cpp:
* bindings/generic/RuntimeEnabledFeatures.h:
(WebCore::RuntimeEnabledFeatures::webkitMediaSourceEnabled):
(WebCore::RuntimeEnabledFeatures::setWebkitMediaSourceEnabled):
* html/HTMLMediaElement.idl:

Source/WebKit/chromium:

* public/WebRuntimeFeatures.h:
* src/WebRuntimeFeatures.cpp:
(WebKit::WebRuntimeFeatures::enableMediaSource):
(WebKit::WebRuntimeFeatures::isMediaSourceEnabled):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94590 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[skia] never draw with GDI, so that all text can be gpu-accelerated
https://bugs.webkit.org/show_bug.cgi?id=65203

Reviewed by Kenneth Russell.

Source/WebCore:

* platform/graphics/chromium/FontChromiumWin.cpp:
(WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::TransparencyAwareFontPainter):
(WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
(WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
(WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::TransparencyAwareUniscribePainter):
(WebCore::drawGlyphsWin):
(WebCore::Font::drawComplexText):
* platform/graphics/chromium/UniscribeHelper.cpp:
(WebCore::UniscribeHelper::draw):
* platform/graphics/skia/PlatformContextSkia.cpp:
* platform/graphics/skia/PlatformContextSkia.h:
* platform/graphics/skia/SkiaFontWin.cpp:
(WebCore::skiaDrawText):
* platform/graphics/skia/SkiaFontWin.h:

LayoutTests:

* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94589 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][Symbian] REGRESSION[94105] DumpRenderTree.exe doesn't build on Symbian
https://bugs.webkit.org/show_bug.cgi?id=67644

Patch by Ademar de Souza Reis Jr. <ademar.reis@openbossa.org> on 2011-09-06
Reviewed by Csaba Osztrogonác.

* symbian/eabi/QtWebKitu.def: add missing entry for
FrameLoaderClientQt::dumpProgressFinishedCallback(bool)

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94588 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[chromium] REGRESSION(94353): requestAnimationFrame not throttled in compositing path
https://bugs.webkit.org/show_bug.cgi?id=67621

CCSingleThreadProxy should not perform layout when called
via the compositeImmediately path. Doing so makes it look
like frame rate is unbounded.

Reviewed by James Robinson.

* platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
(WebCore::CCSingleThreadProxy::compositeAndReadback):
(WebCore::CCSingleThreadProxy::compositeImmediately):
(WebCore::CCSingleThreadProxy::commitIfNeeded):
* platform/graphics/chromium/cc/CCSingleThreadProxy.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94587 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r94274): FormManagerTest.PreviewForm and FillFormNonEmptyField fail on chromium
https://bugs.webkit.org/show_bug.cgi?id=67453

Reviewed by Kent Tamura.

.:

Add symbols for internals.

* Source/autotools/symbols.filter:

Source/WebCore:

Fixed the bug by updating inner text value in setSuggestedValue.

Also added a suggestedValue and setSuggestedValue on window.internals for testing purposes.

Test: fast/forms/suggested-value.html

* WebCore.exp.in:
* testing/Internals.cpp:
(WebCore::Internals::suggestedValue):
(WebCore::Internals::setSuggestedValue):
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit/chromium:

Chromium code incorrectly calls Node::isFocusable without updating layout, and was hitting assertions.
Fix the assertion failure (and a potential crash) by updating layout in WebCore::isFocusable.

* src/WebNode.cpp:
(WebKit::WebNode::isFocusable):

Source/WebKit2:

Add symbols for internals.

* win/WebKit2.def:
* win/WebKit2CFLite.def:

LayoutTests:

Added a regression test to ensure HTMLInputElement updates its inner text value when the suggested value is set.

* fast/forms/suggested-value-expected.txt: Added.
* fast/forms/suggested-value.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94586 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Web Inspector: [Extensions API] rename webInspector.resources to webInspector.network
        https://bugs.webkit.org/show_bug.cgi?id=66460

        Unreviewed, renaming tests in WK2 skiplists after r93312.

        * platform/win-wk2/Skipped:
        * platform/wk2/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94585 268f45cc-cd09-0410-ab3c-d52691b4dbfc

load() does not reset the resource selection algorithm
https://bugs.webkit.org/show_bug.cgi?id=64917

Reviewed by Darin Adler.

Source/WebCore:

Test: media/video-source-load.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::selectMediaResource): Reset m_nextChildNodeToConsider, update
    comments and rearrange logic to more closely match logic in spec.
(WebCore::HTMLMediaElement::noneSupported): Update comments.

LayoutTests:

* media/video-source-load-expected.txt: Added.
* media/video-source-load.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94584 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Use soup_session_add_feature_by_type uniformly in WebKit2.
https://bugs.webkit.org/show_bug.cgi?id=67593

Patch by Wajahat Siddiqui <mdwajahatali.siddiqui@motorola.com> on 2011-09-06
Reviewed by Martin Robinson.

Using soup_session_add_feature_by_type for adding all soup features
instead of adding using GRefPtr.

* WebProcess/gtk/WebProcessMainGtk.cpp:
(WebKit::WebProcessMainGtk):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94583 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Style not propagated to anonymous boxes and anonymous
inline-blocks.
https://bugs.webkit.org/show_bug.cgi?id=67364

Source/WebCore:

Reviewed by James Robinson.

Share propagateStyleToAnonymousChildren with RenderBlock::styleDidChange.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::styleDidChange):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::propagateStyleToAnonymousChildren):
* rendering/RenderObject.h:

LayoutTests:

Add comments explaining what the test does.

Reviewed by James Robinson.

* fast/ruby/ruby-block-style-not-updated-with-before-after-content.html:
* fast/ruby/ruby-block-style-not-updated.html:
* fast/ruby/ruby-inline-style-not-updated-with-before-after-content.html:
* fast/ruby/ruby-inline-style-not-updated.html:
* fast/table/table-before-child-style-update.html:
* fast/table/table-row-before-child-style-update.html:
* fast/table/table-row-style-not-updated-with-after-content.html:
* fast/table/table-row-style-not-updated-with-before-content.html:
* fast/table/table-style-not-updated.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94582 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[skia] States of GraphicsContext may never be restored after clipToImageBuffer
https://bugs.webkit.org/show_bug.cgi?id=67358

Source/WebCore:

beginLayerClippedToImage/applyClipFromImage are mismatched when clipping to
an empty ImageBuffer, which will make states of GraphicsContext incorrect.

Patch by Robin Cao <robin.cao@torchmobile.com.cn> on 2011-09-06
Reviewed by James Robinson.

Test: fast/repaint/background-clip-text.html

* platform/graphics/skia/PlatformContextSkia.cpp:
(WebCore::PlatformContextSkia::beginLayerClippedToImage):

LayoutTests:

Patch by Robin Cao <robin.cao@torchmobile.com.cn> on 2011-09-06
Reviewed by James Robinson.

* fast/repaint/background-clip-text-expected.png: Added.
* fast/repaint/background-clip-text-expected.txt: Added.
* fast/repaint/background-clip-text.html: Added.
* platform/qt/Skipped: Missing layoutController.testRepaint().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94581 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Use a hierarchial structure for the garden-o-matic results view
https://bugs.webkit.org/show_bug.cgi?id=67620

Reviewed by Dimitri Glazkov.

This patch re-organizes the results view to use a hierachial structure
for selection.  At the top-level are sections for each test.  Expanding
the test section shows a tab selector for builders.

This structure prepares us for wiring up various actions to this view.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/controllers.js:
(.):
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:
():
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results.js:
(.):
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/results_unittests.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/styles/results.css:
(.results-view>.toolbar):
(.results-view>.toolbar ul.actions):
(.results-view>.toolbar ul.actions li):
(.results-grid table):
(.results-grid table td, .results-view table th):
(.results-grid table th):
(.results-grid .text-result):
(.results-grid .image-result):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94580 268f45cc-cd09-0410-ab3c-d52691b4dbfc

garden-o-matic's base.probe generates spam in the JavaScript console
https://bugs.webkit.org/show_bug.cgi?id=67622

Reviewed by Dimitri Glazkov.

Now that we have CORS set up on the buildbot, we can use XMLHttpRequest
instead of HTMLScriptElement to test whether results exist.  This
reduces the console.log spam and saves bandwidth because we can use a
HEAD request instead of a GET request.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94579 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Do not allocate memory for extremely large surfaces.
https://bugs.webkit.org/show_bug.cgi?id=65192

Patch by Raphael Kubo da Costa <kubo@profusion.mobi> on 2011-09-06
Reviewed by Martin Robinson.

So far, RenderThemeEfl tried to allocate a buffer and a cairo surface
the size of the whole form element passed to it.

In the case of
fast/overflow/overflow-height-float-not-removed-crash.html and others,
this meant extremely large widgets, which crashed the code.

We now only render the widgets if they are smaller than some hardcoded
and sufficiently large values which should work in most cases.

No new tests, as this was uncovered by existing ones.

* platform/efl/RenderThemeEfl.cpp:
(WebCore::RenderThemeEfl::isFormElementTooLargeToDisplay):
(WebCore::RenderThemeEfl::cacheThemePartNew):
(WebCore::RenderThemeEfl::paintThemePart):
* platform/efl/RenderThemeEfl.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94578 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: implement source map v3 consumer.
https://bugs.webkit.org/show_bug.cgi?id=67205

Reviewed by Yury Semikhatsky.

Source/WebCore:

Test: inspector/debugger/compiler-source-mapping.html

* WebCore.gypi:
* WebCore.vcproj/WebCore.vcproj:
* inspector/front-end/CompilerSourceMapping.js: Added.
(WebInspector.CompilerSourceMapping):
(WebInspector.CompilerSourceMapping.prototype.compiledLocationToSourceLocation):
(WebInspector.CompilerSourceMapping.prototype.sourceLocationToCompiledLocation):
(WebInspector.CompilerSourceMapping.prototype.get sources):
(WebInspector.ClosureCompilerSourceMapping):
(WebInspector.ClosureCompilerSourceMapping.prototype.compiledLocationToSourceLocation):
(WebInspector.ClosureCompilerSourceMapping.prototype.sourceLocationToCompiledLocation):
(WebInspector.ClosureCompilerSourceMapping.prototype.get sources):
(WebInspector.ClosureCompilerSourceMapping.prototype._findMapping):
(WebInspector.ClosureCompilerSourceMapping.prototype._parsePayload):
(WebInspector.ClosureCompilerSourceMapping.prototype._isSeparator):
(WebInspector.ClosureCompilerSourceMapping.prototype._decodeVLQ):
(WebInspector.ClosureCompilerSourceMapping.StringCharIterator):
(WebInspector.ClosureCompilerSourceMapping.StringCharIterator.prototype.next):
(WebInspector.ClosureCompilerSourceMapping.StringCharIterator.prototype.peek):
(WebInspector.ClosureCompilerSourceMapping.StringCharIterator.prototype.hasNext):
* inspector/front-end/WebKit.qrc:
* inspector/front-end/inspector.html:

LayoutTests:

* inspector/debugger/compiler-source-mapping-expected.txt: Added.
* inspector/debugger/compiler-source-mapping.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94577 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, unskip tests now passing because bug 61523 was fixed.

* platform/gtk/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94576 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add windows changes for JSC:RegExp functional tests
https://bugs.webkit.org/show_bug.cgi?id=67521

Windows build changes for regular expression functional test.

Rubber-stamped by Gavin Barraclough.

* JavaScriptCore.vcproj/JavaScriptCore.sln:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* JavaScriptCore.vcproj/testRegExp: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpPostBuild.cmd: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpPreBuild.cmd: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpPreLink.cmd: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added.
* JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94575 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][Mac] Unreviewed gardening.

* platform/qt-mac/Skipped: Skip one more failing test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94574 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Chromium] Unreviewed, update expectation for inspector/elements/elements-panel-styles.html,
which no longer looks flaky.
https://bugs.webkit.org/show_bug.cgi?id=63056

* platform/chromium/test_expectations.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94573 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt] Unreviewed gardening after r94331.

* platform/qt/fast/css/focus-ring-multiline-writingmode-vertical-expected.png: Renamed from LayoutTests/platform/qt-linux/fast/css/focus-ring-multiline-writingmode-vertical-expected.png.
* platform/qt/fast/css/focus-ring-multiline-writingmode-vertical-expected.txt: Renamed from LayoutTests/platform/qt-linux/fast/css/focus-ring-multiline-writingmode-vertical-expected.txt.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94572 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: re-implement RawSourceCode.
https://bugs.webkit.org/show_bug.cgi?id=67609

Source/WebCore:

RawSourceCode content and source mapping loading logic is too complex, re-implement it using simpler semantics:
1) Initially, RawSourceCode doesn't have any content or mapping because content loading and
formatting operations are asynchronous, it only has scripts metadata. We don't update UI right
after RawSourceCode creation until full RawSourceCode representation is ready (content + mapping).
2) When RawSourceCode representation is ready (e.g. resource is finished, or content is formatted
if in pretty-print mode) we dispatch SourceMappingUpdated event to notify the listeners that
source code should be shown to user and raw locations should be converted to ui locations
(to show breakpoins, messages, call frames etc in UI). At this moment, all source file's content
is ready for loading and source mapping is available.
3) Later, RawSourceCode representation may change again, e.g. if pretty-print mode is toggled, or
blocked resource is finished etc., in that case SourceMappingUpdated is dispatched again to update
source code, links and decorations in UI.

Reviewed by Yury Semikhatsky.

* inspector/front-end/DebuggerPresentationModel.js:
(WebInspector.DebuggerPresentationModel.prototype.linkifyLocation):
(WebInspector.DebuggerPresentationModel.prototype._addScript):
(WebInspector.DebuggerPresentationModel.prototype._sourceMappingUpdated):
(WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage.didGetUILocation):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage):
(WebInspector.DebuggerPresentationModel.prototype.messagesForUISourceCode):
* inspector/front-end/ScriptsPanel.js:
(WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
(WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
* inspector/front-end/SourceFile.js:
(WebInspector.RawSourceCode):
(WebInspector.RawSourceCode.prototype.addScript):
(WebInspector.RawSourceCode.prototype.contentEdited):
(WebInspector.RawSourceCode.prototype._resourceFinished):
(WebInspector.RawSourceCode.prototype.requestContent):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded.sourceMappingUpdated):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded):
(WebInspector.RawSourceCode.prototype.forceLoadContent):
(WebInspector.RawSourceCode.prototype._updateSourceMapping.didCreateSourceMapping):
(WebInspector.RawSourceCode.prototype._updateSourceMapping):
(WebInspector.RawSourceCode.prototype._createContentProvider):
(WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent.didFormatContent):
(WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent):
(WebInspector.RawSourceCode.prototype._createSourceMapping):
(WebInspector.RawSourceCode.prototype._saveSourceMapping):
(WebInspector.StaticContentProvider):
(WebInspector.StaticContentProvider.prototype.requestContent):

LayoutTests:

Reviewed by Yury Semikhatsky.

* inspector/debugger/content-providers-expected.txt:
* inspector/debugger/content-providers.html:
* inspector/debugger/scripts-panel.html:
* inspector/debugger/source-frame-count.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94571 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][Mac] Unreviewed gardening.

* platform/qt-mac/Skipped: Skip new failing tests to paint the bot green.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94570 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Regression:  On Lion, redirects lose HTTP authentication headers
        https://bugs.webkit.org/show_bug.cgi?id=66354

        Unreviewed, renaming tests in WK2 skiplist after r93247.

        * platform/wk2/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94569 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94564.
http://trac.webkit.org/changeset/94564
https://bugs.webkit.org/show_bug.cgi?id=67555

It broke many tests

Source/WebCore:

* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::svgAttributeChanged):

LayoutTests:

* svg/custom/tref-clone-crash-expected.txt: Removed.
* svg/custom/tref-clone-crash.html: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94568 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Web Inspector: nuke background events collection (dead feature)
        https://bugs.webkit.org/show_bug.cgi?id=66296

        Reviewed by Yury Semikhatsky.

        * platform/wk2/Skipped: Remove non-existent tests from the Skipped list
        as well.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94567 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, removing non-existent test from Qt skiplist.

* platform/qt/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94566 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][ARM] http/tests/loading/empty-urls.html fails
https://bugs.webkit.org/show_bug.cgi?id=67638

[Qt][ARM]fast/dom/call-a-constructor-as-a-function.html fails
https://bugs.webkit.org/show_bug.cgi?id=67639

* platform/qt-arm/Skipped: Skip failing tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94565 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2011-09-06  Rob Buis  <rbuis@rim.com>

        use after free in WebCore::SVGTRefElement::updateReferencedText
        https://bugs.webkit.org/show_bug.cgi?id=67555

        Reviewed by Nikolas Zimmermann.

        Do not install event listener if tref is not part of any document.

        Test: svg/custom/tref-clone-crash.html

        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::svgAttributeChanged):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94564 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][ARM] Missing WebGLContextEvent window property
https://bugs.webkit.org/show_bug.cgi?id=67637

* platform/qt-arm/fast/dom/Window/window-property-descriptors-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94563 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r94560.
http://trac.webkit.org/changeset/94560
https://bugs.webkit.org/show_bug.cgi?id=67636

It made inspector/debugger/script-formatter.html flakey
(Requested by Ossy on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-06

Source/WebCore:

* inspector/front-end/BreakpointManager.js:
(WebInspector.BreakpointManager.prototype.set reset):
* inspector/front-end/DebuggerPresentationModel.js:
(WebInspector.DebuggerPresentationModel.prototype._addScript.didCreateSourceMapping):
(WebInspector.DebuggerPresentationModel.prototype._addScript):
(WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeReplaced):
(WebInspector.DebuggerPresentationModel.prototype.setFormatSource):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage.didGetUILocation):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage):
(WebInspector.PresenationCallFrame.prototype.select):
* inspector/front-end/ScriptsPanel.js:
(WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
(WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
* inspector/front-end/SourceFile.js:
(WebInspector.RawSourceCode):
(WebInspector.RawSourceCode.prototype.addScript):
(WebInspector.RawSourceCode.prototype.contentEdited):
(WebInspector.RawSourceCode.prototype.requestContent):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded.didRequestContent):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded):
(WebInspector.RawSourceCode.prototype._setContentProvider):
(WebInspector.RawSourceCode.prototype.forceLoadContent):
(WebInspector.RawSourceCode.prototype._reload):
(WebInspector.RawSourceCode.prototype._requestContent):
(WebInspector.RawSourceCode.prototype._loadResourceContent):
(WebInspector.RawSourceCode.prototype._loadScriptContent):
(WebInspector.RawSourceCode.prototype._loadAndConcatenateScriptsContent):
(WebInspector.RawSourceCode.prototype._didRequestContent):
(WebInspector.RawSourceCode.prototype._hasPendingResource):
(WebInspector.FormattedContentProvider):
(WebInspector.FormattedContentProvider.prototype.requestContent.didRequestContent.didFormatContent):
(WebInspector.FormattedContentProvider.prototype.requestContent):

LayoutTests:

* inspector/debugger/content-providers-expected.txt:
* inspector/debugger/content-providers.html:
* inspector/debugger/scripts-panel.html:
* inspector/debugger/source-frame-count.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94562 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=67480
[Chromium] [REGRESSION] Layout Test svg/batik/text/textStyles.svg is failing

Reviewed by Dimitri Glazkov.

The text node needs willRecalcStyle mechanism too.

* dom/Text.cpp:
(WebCore::Text::recalcTextStyle):
* dom/Text.h:
(WebCore::Text::willRecalcTextStyle):
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::SVGTRefElement):
(WebCore::SVGShadowText::SVGShadowText):
(WebCore::SVGShadowText::willRecalcTextStyle):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94561 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: re-implement RawSourceCode.
https://bugs.webkit.org/show_bug.cgi?id=67609

Source/WebCore:

RawSourceCode content and source mapping loading logic is too complex, re-implement it using simpler semantics:
1) Initially, RawSourceCode doesn't have any content or mapping because content loading and
formatting operations are asynchronous, it only has scripts metadata. We don't update UI right
after RawSourceCode creation until full RawSourceCode representation is ready (content + mapping).
2) When RawSourceCode representation is ready (e.g. resource is finished, or content is formatted
if in pretty-print mode) we dispatch SourceMappingUpdated event to notify the listeners that
source code should be shown to user and raw locations should be converted to ui locations
(to show breakpoins, messages, call frames etc in UI). At this moment, all source file's content
is ready for loading and source mapping is available.
3) Later, RawSourceCode representation may change again, e.g. if pretty-print mode is toggled, or
blocked resource is finished etc., in that case SourceMappingUpdated is dispatched again to update
source code, links and decorations in UI.

Reviewed by Yury Semikhatsky.

* inspector/front-end/DebuggerPresentationModel.js:
(WebInspector.DebuggerPresentationModel.prototype.linkifyLocation):
(WebInspector.DebuggerPresentationModel.prototype._addScript):
(WebInspector.DebuggerPresentationModel.prototype._sourceMappingUpdated):
(WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage.didGetUILocation):
(WebInspector.DebuggerPresentationModel.prototype._addConsoleMessage):
(WebInspector.DebuggerPresentationModel.prototype.messagesForUISourceCode):
* inspector/front-end/ScriptsPanel.js:
(WebInspector.ScriptsPanel.prototype._uiSourceCodeReplaced):
(WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
* inspector/front-end/SourceFile.js:
(WebInspector.RawSourceCode):
(WebInspector.RawSourceCode.prototype.addScript):
(WebInspector.RawSourceCode.prototype.contentEdited):
(WebInspector.RawSourceCode.prototype._resourceFinished):
(WebInspector.RawSourceCode.prototype.requestContent):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded.sourceMappingUpdated):
(WebInspector.RawSourceCode.prototype.createSourceMappingIfNeeded):
(WebInspector.RawSourceCode.prototype.forceLoadContent):
(WebInspector.RawSourceCode.prototype._updateSourceMapping.didCreateSourceMapping):
(WebInspector.RawSourceCode.prototype._updateSourceMapping):
(WebInspector.RawSourceCode.prototype._createContentProvider):
(WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent.didFormatContent):
(WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent):
(WebInspector.RawSourceCode.prototype._createSourceMapping):
(WebInspector.RawSourceCode.prototype._saveSourceMapping):
(WebInspector.StaticContentProvider):
(WebInspector.StaticContentProvider.prototype.requestContent):

LayoutTests:

Reviewed by Yury Semikhatsky.

* inspector/debugger/content-providers-expected.txt:
* inspector/debugger/content-providers.html:
* inspector/debugger/scripts-panel.html:
* inspector/debugger/source-frame-count.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94560 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore does not have tiered compilation
https://bugs.webkit.org/show_bug.cgi?id=67176

Reviewed by Gavin Barraclough.

This adds the ability to have multiple CodeBlocks associated with
a particular role in an Executable.  These are stored in
descending order of compiler tier.  CodeBlocks are optimized when
a counter (m_executeCounter) that is incremented in loops and
epilogues becomes positive.  Optimizing means that all calls to
the old CodeBlock are unlinked.

The DFG can now pull in predictions from ValueProfiles, and
propagate them along the graph.  To support the new phase while
maintaing some level of abstraction, a DFGDriver was introduced
that encapsulates how to run the DFG compiler.

This is turned off by default because it's not yet a performance
win on all benchmarks.  It speeds up crypto and richards by
10% and 6% respectively, but still does not do as good of a job
as it could.  Notably, the DFG backend has not changed, and
is largely oblivious to the new information being made available
to it.

When turned off (the default), this patch is performance neutral.

* CMakeLists.txt:
* GNUmakefile.am:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
* JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
* JavaScriptCore.xcodeproj/project.pbxproj:
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::branchAdd32):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::branchAdd32):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::visitAggregate):
(JSC::CallLinkInfo::unlink):
(JSC::CodeBlock::unlinkCalls):
(JSC::CodeBlock::unlinkIncomingCalls):
(JSC::CodeBlock::clearEvalCache):
(JSC::replaceExistingEntries):
(JSC::CodeBlock::copyDataFromAlternative):
(JSC::ProgramCodeBlock::replacement):
(JSC::EvalCodeBlock::replacement):
(JSC::FunctionCodeBlock::replacement):
(JSC::ProgramCodeBlock::compileOptimized):
(JSC::EvalCodeBlock::compileOptimized):
(JSC::FunctionCodeBlock::compileOptimized):
* bytecode/CodeBlock.h:
(JSC::GlobalCodeBlock::GlobalCodeBlock):
(JSC::ProgramCodeBlock::ProgramCodeBlock):
(JSC::EvalCodeBlock::EvalCodeBlock):
(JSC::FunctionCodeBlock::FunctionCodeBlock):
* bytecode/ValueProfile.h:
(JSC::ValueProfile::dump):
(JSC::ValueProfile::computeStatistics):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
* bytecompiler/BytecodeGenerator.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::ByteCodeParser):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::dynamicallyPredict):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::parse):
* dfg/DFGDriver.cpp: Added.
(JSC::DFG::compile):
(JSC::DFG::tryCompile):
(JSC::DFG::tryCompileFunction):
* dfg/DFGDriver.h: Added.
(JSC::DFG::tryCompile):
(JSC::DFG::tryCompileFunction):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::predictArgumentTypes):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::predict):
(JSC::DFG::Graph::predictGlobalVar):
(JSC::DFG::Graph::isConstant):
(JSC::DFG::Graph::isJSConstant):
(JSC::DFG::Graph::isInt32Constant):
(JSC::DFG::Graph::isDoubleConstant):
(JSC::DFG::Graph::valueOfJSConstant):
(JSC::DFG::Graph::valueOfInt32Constant):
(JSC::DFG::Graph::valueOfDoubleConstant):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::isConstant):
(JSC::DFG::JITCompiler::isJSConstant):
(JSC::DFG::JITCompiler::isInt32Constant):
(JSC::DFG::JITCompiler::isDoubleConstant):
(JSC::DFG::JITCompiler::valueOfJSConstant):
(JSC::DFG::JITCompiler::valueOfInt32Constant):
(JSC::DFG::JITCompiler::valueOfDoubleConstant):
* dfg/DFGNode.h:
(JSC::DFG::isCellPrediction):
(JSC::DFG::isNumberPrediction):
(JSC::DFG::predictionToString):
(JSC::DFG::mergePrediction):
(JSC::DFG::makePrediction):
(JSC::DFG::Node::valueOfJSConstant):
(JSC::DFG::Node::isInt32Constant):
(JSC::DFG::Node::isDoubleConstant):
(JSC::DFG::Node::valueOfInt32Constant):
(JSC::DFG::Node::valueOfDoubleConstant):
(JSC::DFG::Node::predict):
* dfg/DFGPropagation.cpp: Added.
(JSC::DFG::Propagator::Propagator):
(JSC::DFG::Propagator::fixpoint):
(JSC::DFG::Propagator::setPrediction):
(JSC::DFG::Propagator::mergePrediction):
(JSC::DFG::Propagator::propagateNode):
(JSC::DFG::Propagator::propagateForward):
(JSC::DFG::Propagator::propagateBackward):
(JSC::DFG::propagate):
* dfg/DFGPropagation.h: Added.
(JSC::DFG::propagate):
* dfg/DFGRepatch.cpp:
(JSC::DFG::dfgLinkFor):
* heap/HandleHeap.h:
(JSC::HandleHeap::Node::Node):
* jit/JIT.cpp:
(JSC::JIT::emitOptimizationCheck):
(JSC::JIT::emitTimeoutCheck):
(JSC::JIT::privateCompile):
(JSC::JIT::linkFor):
* jit/JIT.h:
(JSC::JIT::emitOptimizationCheck):
* jit/JITCall32_64.cpp:
(JSC::JIT::emit_op_ret):
(JSC::JIT::emit_op_ret_object_or_this):
* jit/JITCode.h:
(JSC::JITCode::JITCode):
(JSC::JITCode::bottomTierJIT):
(JSC::JITCode::topTierJIT):
(JSC::JITCode::nextTierJIT):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_ret):
(JSC::JIT::emit_op_ret_object_or_this):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h:
* runtime/Executable.cpp:
(JSC::EvalExecutable::compileOptimized):
(JSC::EvalExecutable::compileInternal):
(JSC::ProgramExecutable::compileOptimized):
(JSC::ProgramExecutable::compileInternal):
(JSC::FunctionExecutable::compileOptimizedForCall):
(JSC::FunctionExecutable::compileOptimizedForConstruct):
(JSC::FunctionExecutable::compileForCallInternal):
(JSC::FunctionExecutable::compileForConstructInternal):
* runtime/Executable.h:
(JSC::EvalExecutable::compile):
(JSC::ProgramExecutable::compile):
(JSC::FunctionExecutable::compileForCall):
(JSC::FunctionExecutable::compileForConstruct):
(JSC::FunctionExecutable::compileOptimizedFor):
* wtf/Platform.h:
* wtf/SentinelLinkedList.h:
(WTF::BasicRawSentinelNode::BasicRawSentinelNode):
(WTF::BasicRawSentinelNode::setPrev):
(WTF::BasicRawSentinelNode::setNext):
(WTF::BasicRawSentinelNode::prev):
(WTF::BasicRawSentinelNode::next):
(WTF::BasicRawSentinelNode::isOnList):
(WTF::::remove):
(WTF::::SentinelLinkedList):
(WTF::::begin):
(WTF::::end):
(WTF::::push):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94559 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Return to transform multiplication: motion transform * other transforms
https://bugs.webkit.org/show_bug.cgi?id=67601

Source/WebCore:

Reviewed by Nikolas Zimmermann.

Right now we take the current transform of a transformable SVG element, post multiply the animation transform
and post multiply the motion transform to the other both:

  transform * animation transform * motion transform

We switched to this behavior with the clean up of AffineTransform.
While the specification of SVG demands us to do so, no other SVG viewer is doing it that way. Now switching back to:

  motion transform * transform * animation transform

This is done by other SVG viewers as well. While their is no consense about how to multiply the different transforms
on the SVG WG, their is a consense that the current specified behavior is unwanted. See
http://lists.w3.org/Archives/Public/www-svg/2011Jan/0055.html for more details.

We pass the following tests of the official W3C SVG test suite again now:

- animate-elem-24-t.svg
- animate-elem-30-t.svg

* svg/SVGStyledTransformableElement.cpp:
(WebCore::SVGStyledTransformableElement::animatedLocalTransform):
* svg/SVGTextElement.cpp:
(WebCore::SVGTextElement::animatedLocalTransform):

LayoutTests:

Reviewed by Nikolas Zimmermann.

Change the expected results of nested transformations to match new behavior
on matrices multiplications.

* svg/animations/animate-path-nested-transforms-expected.txt:
* svg/animations/animate-text-nested-transforms-expected.txt:
* svg/animations/script-tests/animate-path-nested-transforms.js:
(startSample):
(endSample):
* svg/animations/script-tests/animate-text-nested-transforms.js:
(startSample):
(endSample):
* svg/animations/svgtransform-animation-discrete-expected.txt:
* svg/animations/svgtransform-animation-discrete.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94558 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Qt][WK2] http/tests/history/popstate-fires-with-pending-requests.html breaks ~400 subsequent tests
https://bugs.webkit.org/show_bug.cgi?id=49321

Rubber-stamped by Csaba Osztrogonác.

* platform/qt-wk2/Skipped:
The issue is not reproducible any more, so the bug can be closed and the test unskipped.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94557 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Updated expectations on Mac for fast/js/global-constructors.html.

Rubber-stampted by Gavin Barraclough.

* platform/mac/fast/js/global-constructors-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@94556 268f45cc-cd09-0410-ab3c-d52691b4dbfc