Use Ref instead of PassRefPtr in WebCore/bindings
https://bugs.webkit.org/show_bug.cgi?id=144981

Reviewed by Darin Adler.

As a step to purge PassRefPtr, remove PassRefPtr in WebCore/bindings.

No new tests, no behavior changes.

* bindings/gobject/GObjectNodeFilterCondition.h:
(WebCore::GObjectNodeFilterCondition::create):
* bindings/gobject/GObjectXPathNSResolver.h:
(WebCore::GObjectXPathNSResolver::create):
* bindings/js/JSCustomXPathNSResolver.cpp:
(WebCore::JSCustomXPathNSResolver::create):
* bindings/js/JSCustomXPathNSResolver.h:
* bindings/js/JSDOMGlobalObjectTask.cpp:
* bindings/js/JSErrorHandler.h:
(WebCore::JSErrorHandler::create):
* bindings/js/JSLazyEventListener.cpp:
(WebCore::JSLazyEventListener::createForNode):
(WebCore::JSLazyEventListener::createForDOMWindow):
* bindings/js/JSLazyEventListener.h:
* bindings/js/JSMutationCallback.h:
(WebCore::JSMutationCallback::create):
* bindings/js/JSNodeFilterCondition.h:
(WebCore::JSNodeFilterCondition::create):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::SerializedScriptValue::create):
(WebCore::SerializedScriptValue::numberValue):
(WebCore::SerializedScriptValue::undefinedValue):
(WebCore::SerializedScriptValue::nullValue):
* bindings/js/SerializedScriptValue.h:
* bindings/objc/ObjCEventListener.h:
* bindings/objc/ObjCEventListener.mm:
(WebCore::ObjCEventListener::wrap):
* bindings/objc/ObjCNodeFilterCondition.h:
(WebCore::ObjCNodeFilterCondition::create):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184543 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Better optimize 'if' with ternaries conditional tests.
https://bugs.webkit.org/show_bug.cgi?id=144136

Reviewed by Benjamin Poulain.

This is the last fix I'll do for this for now. BooleanToNumber(Untyped:) where the input
is proved to be either BoolInt32 or Boolean should be optimized to just masking the
lowest bit.

This is another 37% speed-up on JSRegress/slow-ternaries.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileBooleanToNumber):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184542 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<rdar://problem/21003555> cloberrize() is wrong for ArithRound because it doesn't account for the arith mode
https://bugs.webkit.org/show_bug.cgi?id=145147

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-05-18
Reviewed by Filip Pizlo.

Really stupid bug: ArithRound nodes with different rounding modes
were not distinguished and CSE would happily unify with a node of
a different rounding mode.

DFG::clobberize() already support additional data but I was not using it.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* tests/stress/math-round-arith-rounding-mode.js: Added.
(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184541 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add SpecBoolInt32 type that means "I'm an int and I'm either 0 or 1"
https://bugs.webkit.org/show_bug.cgi?id=145137

Reviewed by Benjamin Poulain.

It's super useful to know if an integer value could be either zero or one. We have an
immediate need for this because of Int32|Boolean uses, where knowing that the Int32 is
either 0 or 1 means that there is no actual polymorphism if you just look at the low bit
(1 behaves like true, 0 behaves like false, and the low bit of 1|true is 1, and the low
bit of 0|false is 0).

We do this by splitting the SpecInt32 type into SpecBoolInt32 and SpecNonBoolInt32. This
change doesn't have any effect on behavior, yet. But it does give us the ability to
predict and prove when values are SpecBoolInt32; it's just we don't leverage this yet.

This is perf-neutral.

* bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):
* bytecode/SpeculatedType.h:
(JSC::isStringOrStringObjectSpeculation):
(JSC::isBoolInt32Speculation):
(JSC::isInt32Speculation):
(JSC::isInt32OrBooleanSpeculation):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184540 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Fix unsequenced warning in MiniBrowser's main.c
https://bugs.webkit.org/show_bug.cgi?id=145123

Reviewed by Gyuyoung Kim.

* MiniBrowser/efl/main.c:
(on_key_down):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184539 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Improve coverage of platform/mac/fast/text/font-weights.html
https://bugs.webkit.org/show_bug.cgi?id=145152

Reviewed by Anders Carlsson.

Add coverage of italics.

* platform/mac/fast/text/font-weights-expected.txt:
* platform/mac/fast/text/font-weights.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184538 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix uninitialized warnings in RealtimeMediaSourceCenterOwr.cpp
https://bugs.webkit.org/show_bug.cgi?id=145119

Reviewed by Gyuyoung Kim.

* platform/mediastream/openwebrtc/RealtimeMediaSourceCenterOwr.cpp:
(WebCore::RealtimeMediaSourceCenterOwr::validateRequestConstraints):
(WebCore::RealtimeMediaSourceCenterOwr::mediaSourcesAvailable):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184537 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CMake] Ignore warnings in system headers
https://bugs.webkit.org/show_bug.cgi?id=144747

Reviewed by Darin Adler.

.:

Require CMake 2.8.12 when compiling the GTK+ port. This is because we use the
target_include_directories command (added in 2.8.11) in GTK-specific cmake files, and also
use the SYSTEM argument to the command (added in 2.8.12).

* CMakeLists.txt:

Source/JavaScriptCore:

Separate include directories into WebKit project includes and system includes. Suppress all
warnings from headers in system include directories using the SYSTEM argument to
the include_directories command.

* CMakeLists.txt:
* PlatformGTK.cmake:

Source/WebCore:

Separate include directories into WebKit project includes and system includes. Suppress all
warnings from headers in system include directories using the SYSTEM argument to
the include_directories command.

* CMakeLists.txt:
* PlatformEfl.cmake:
* PlatformGTK.cmake:
* PlatformMac.cmake:

Source/WebKit:

Separate include directories into WebKit project includes and system includes. Suppress all
warnings from headers in system include directories using the SYSTEM argument to
the include_directories command.

* CMakeLists.txt:
* PlatformMac.cmake:

Source/WebKit2:

Separate include directories into WebKit project includes and system includes. Suppress all
warnings from headers in system include directories using the SYSTEM argument to
the include_directories command.

* CMakeLists.txt:
* PlatformEfl.cmake:
* PlatformGTK.cmake:

Source/WTF:

Separate include directories into WebKit project includes and system includes. Suppress all
warnings from headers in system include directories using the SYSTEM argument to
the include_directories command.

* wtf/CMakeLists.txt:
* wtf/PlatformEfl.cmake:
* wtf/PlatformGTK.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184536 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix return-type warnings in test_ewk2_color_picker.cpp
https://bugs.webkit.org/show_bug.cgi?id=145122

Reviewed by Gyuyoung Kim.

* UIProcess/API/efl/tests/test_ewk2_color_picker.cpp:
(EWK2ColorPickerTest::hideColorPicker):
(EWK2ColorPickerTest::hideColorPickerByRemovingElement):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184535 268f45cc-cd09-0410-ab3c-d52691b4dbfc

platform/mac/fast/text/font-weights.html is flakey
https://bugs.webkit.org/show_bug.cgi?id=145149

Reviewed by Alexey Proskuryakov.

* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184532 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION: v2 UI reports a higher memory usage
https://bugs.webkit.org/show_bug.cgi?id=145151

Reviewed by Chris Dumez.

The bug was caused by v2 UI using 1000 to divide the number of bytes instead of by 1024 as done in v1.
Fixed the bug by manually implementing the formatter as done in v1.

* public/v2/manifest.js:
(App.Manfiest._formatBytes): Added.
(App.Manifest._formatFetchedData): Use _formatByte instead of format('s').

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184531 268f45cc-cd09-0410-ab3c-d52691b4dbfc

prepare-ChangeLog reports function above deleted function as deleted; uninitialized value warning
when staged non-empty file for commit
https://bugs.webkit.org/show_bug.cgi?id=145082

Reviewed by Darin Adler.

Fixes two issues when running prepare-ChangeLog:
    1. The function above a deleted function is reported as changed.
    2. With a Git checkout of WebKit, a Perl uninitialized value warning is emitted when
    a new non-empty file is staged for commit (e.g. extractLineRangeBeforeAndAfterChange.pl,
    included in this patch).

Simplify code by using unified diff parsing logic for both SVN and Git support. Currently
prepare-ChangeLog has logic to parse normal diff- and unified diff- chunk range lines as
generated by `svn diff` and `git diff`, respectively. The logic for parsing these formats
has correctness issues. We should make use of the VCSUtil::parseChunkRange() to parse
chunk range lines of a unified diff as opposed to having specialized logic in prepare-ChangeLog.
VCSUtil::parseChunkRange() has existing test coverage.

* Scripts/prepare-ChangeLog:
(generateFunctionLists): Only add a line range to %line_ranges_before_changed, %line_ranges_after_changed
when the beginning line number, ending line number >= 1. Modified for-loop condition to iterate over
all the files represented by %line_ranges_before_changed and %line_ranges_after_changed so that we
examine files that only have deletions. Currently this works as a side effect of the behavior of
extractLineRangeAfterChange(), which always returns a well-formed (though nonsensical) line range for
a change that represents a deletion (e.g. extractLineRangeAfterChange("@@ -166,6 +165,0 @@") => [165, 165]).
(diffCommand): Generate a unified diff instead of a normal diff when using a SVN checkout of WebKit.
(extractLineRangeAfterChange): Remove logic to parse a normal diff chunk range line and write
the logic to parse a unified diff chunk range line in terms of VCSUtil::parseChunkRange().
We return (-1, -1) when the change represents a deletion.
(extractLineRangeBeforeChange): Remove logic to parse a normal diff chunk range line and write
the logic to parse a unified diff chunk range line in terms of VCSUtil::parseChunkRange().
We return (-1, -1) when the change represents an addition.
* Scripts/webkitperl/prepare-ChangeLog_unittest/extractLineRangeBeforeAndAfterChange.pl: Added;
unit tests.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184521 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Addressing post-review comments on r184353
https://bugs.webkit.org/show_bug.cgi?id=145146

Reviewed by Benjamin Poulain.

Source/WebCore:

See per-file comments.

No new tests because there is no behavior change.

* platform/graphics/mac/FontCacheMac.mm:
(WebCore::fontWithFamilySpecialCase): Use equalIgnoringASCIICase() AtomicString overload.
* rendering/RenderThemeMac.mm:
(WebCore::RenderThemeMac::updateCachedSystemFontDescription): Implement Ben's ideas for
cheaply constructing AtomicStrings only when necessary.

Source/WTF:

Create an overload for equalIgnoringASCIICase() for AtomicString and string literals.

* wtf/text/AtomicString.h:
(WTF::equalIgnoringASCIICase):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184519 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[ES6] Arrow function syntax. Feature flag for arrow function
https://bugs.webkit.org/show_bug.cgi?id=145108

Patch by Skachkov Alexandr <gskachkov@gmail.com> on 2015-05-18
Reviewed by Ryosuke Niwa.

Added feature flag ENABLE_ES6_ARROWFUNCTION_SYNTAX for arrow function

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:

Source/WTF:

* wtf/FeatureDefines.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184517 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WKWebsiteDataStore should fully support session storage
https://bugs.webkit.org/show_bug.cgi?id=145145
rdar://problem/10690447

Reviewed by Sam Weinig.

Add a session store data type and handle it when clearing and fetching data.

* Shared/WebsiteData/WebsiteDataTypes.h:
* UIProcess/API/Cocoa/WKWebsiteDataRecord.h:
* UIProcess/API/Cocoa/WKWebsiteDataRecord.mm:
(dataTypesToString):
* UIProcess/API/Cocoa/WKWebsiteDataRecordInternal.h:
(WebKit::toWebsiteDataTypes):
(WebKit::toWKWebsiteDataTypes):
* UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(+[WKWebsiteDataStore allWebsiteDataTypes]):
* UIProcess/Storage/StorageManager.cpp:
(WebKit::StorageManager::SessionStorageNamespace::origins):
(WebKit::StorageManager::SessionStorageNamespace::clearStorageAreasMatchingOrigin):
(WebKit::StorageManager::SessionStorageNamespace::clearAllStorageAreas):
(WebKit::StorageManager::getSessionStorageOrigins):
(WebKit::StorageManager::deleteSessionStorageOrigins):
(WebKit::StorageManager::deleteSessionStorageEntriesForOrigins):
* UIProcess/Storage/StorageManager.h:
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::fetchData):
(WebKit::WebsiteDataStore::removeData):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184516 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Improve Reliability of Closing and Reopening Elements Tab
https://bugs.webkit.org/show_bug.cgi?id=145139

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-18
Reviewed by Timothy Hatcher.

* UserInterface/Views/DOMTreeElement.js:
(WebInspector.DOMTreeElement.prototype.highlightSearchResults):
(WebInspector.DOMTreeElement.prototype.hideSearchHighlights):
(WebInspector.DOMTreeElement.prototype.emphasizeSearchHighlight.animationEnded):
(WebInspector.DOMTreeElement.prototype.emphasizeSearchHighlight):
(WebInspector.DOMTreeElement.prototype._updateChildren):
(WebInspector.DOMTreeElement.prototype.adjustCollapsedRange):
(WebInspector.DOMTreeElement.prototype._startEditingAsHTML.dispose):
(WebInspector.DOMTreeElement.prototype._startEditingAsHTML):
(WebInspector.DOMTreeElement.prototype.updateTitle):
Stop using the `delete` operator.

* UserInterface/Views/DOMTreeOutline.js:
(WebInspector.DOMTreeOutline.prototype.setVisible):
Trigger an update when the outline is made visible.

* UserInterface/Views/FrameDOMTreeContentView.js:
(WebInspector.FrameDOMTreeContentView.prototype._rootDOMNodeAvailable):
Provide a reasonable default selection if there is no body or document element.
For example in an augmented DOM tree.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184515 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Followup to: Networking process on iOS can be suspended and never exit
https://bugs.webkit.org/show_bug.cgi?id=144971.

Unreviewed. Fixing API tests that revealed the unintentional change in behavior.

* Shared/ChildProcessProxy.cpp:
(WebKit::ChildProcessProxy::shutDownProcess): The on WebProcessProxy code path that this
  was adopted from had an m_connection null check, and that null check needs to remain.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184514 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(142590): Scroll-snap points are improperly snapping to earlier index values
https://bugs.webkit.org/show_bug.cgi?id=145140
<rdar://problem/21006738>

Reviewed by Beth Dakin.

The new "nearestActiveSnapPoint" logic is firing while scroll snap animations are running. We need
to add an "isScrollSnapInProgress" predicate, much like the existing "isRubberBandInProgress" to avoid
certain "fix-up" logic that we don't want running while we are in the process of moving to a new position.

* platform/ScrollAnimator.h:
(WebCore::ScrollAnimator::ScrollAnimator::isScrollSnapInProgress): Added.
* platform/ScrollableArea.cpp:
(WebCore::ScrollableArea::updateScrollSnapState): If we are in the midst of a scroll snap operation,
do not attempt to reset position to the current active snap point.
* platform/cocoa/ScrollController.h:
* platform/cocoa/ScrollController.mm:
(WebCore::ScrollController::isScrollSnapInProgress): Added.
* platform/mac/ScrollAnimatorMac.h:
* platform/mac/ScrollAnimatorMac.mm:
(WebCore::ScrollAnimatorMac::isScrollSnapInProgress): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184513 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add ATS keys to MiniBrowser
https://bugs.webkit.org/show_bug.cgi?id=145141

Reviewed by Sam Weinig.

* MiniBrowser/mac/Info.plist:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184512 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[JSC] When entering a CheckTierUp without OSREntry, force the CheckTierUp for the outer loops with OSR Entry
https://bugs.webkit.org/show_bug.cgi?id=145092

Reviewed by Filip Pizlo.

When we have a hot loop without OSR Entry inside a slower loop that support OSR Entry,
we get the inside loop driving the tierUpCounter and we have very little chance of
doing a CheckTierUp on the outer loop. In turn, this give almost no opportunity to tier
up in the outer loop and OSR Enter there.

This patches changes CheckTierUp to force its outer loops to do a CheckTierUp themselves.

To do that, CheckTierUp sets a flag "nestedTriggerIsSet" to force the outer loop to
enter their CheckTierUp regardless of the tier-up counter.

* bytecode/ExecutionCounter.cpp:
(JSC::ExecutionCounter<countingVariant>::setThreshold):
This is somewhat unrelated. This assertion is incorrect because it relies on
m_counter, which changes on an other thread.

I have hit it a couple of times with this patch because we are a bit more aggressive
on CheckTierUp. What happens is:
1) ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet() first checks
   hasCrossedThreshold(), and it is false.
2) On the main thread, the hot loops keeps running and the counter becomes large
   enough to cross the threshold.
3) ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet() runs the next
   test, setThreshold(), where the assertion is. Since the counter is now large enough,
   the assertion fails.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

* dfg/DFGJITCode.h:
I used a uint8_t instead of a boolean to make the code generation clearer
in DFGSpeculativeJIT64.

* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:

* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
This is a bit annoying: we have the NaturalLoops analysis that provides us
everything we need to know about loops, but the TierUpCheck are conservative
and set on LoopHint.

To make the two work together, we first find all the CheckTierUp that cannot
OSR enter and we keep a list of all the natural loops containing them.

Then we do a second pass over the LoopHints, get their NaturalLoop, and check
if it contains a loop that cannot OSR enter.

* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTierUpCheckInjectionPhase.cpp:
(JSC::DFG::TierUpCheckInjectionPhase::run):
(JSC::DFG::TierUpCheckInjectionPhase::canOSREnterAtLoopHint):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184511 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add a Int-or-Boolean speculation to Branch
https://bugs.webkit.org/show_bug.cgi?id=145134

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

After https://bugs.webkit.org/show_bug.cgi?id=126778 we no longer have a reason not to do the
int-or-boolean optimization that we already do everywhere else.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

LayoutTests:

Added the reduced asm.js test case from https://bugs.webkit.org/show_bug.cgi?id=144136. We don't yet
run it as fast as we should but this is a big step.

* js/regress/script-tests/slow-ternaries.js: Added.
(.f):
(asmMod):
* js/regress/slow-ternaries-expected.txt: Added.
* js/regress/slow-ternaries.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184510 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Tab Restoration incorrectly makes ContentViews "shown" in background tabs
https://bugs.webkit.org/show_bug.cgi?id=145080

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-18
Reviewed by Timothy Hatcher.

Many tabs have their own content browser / navigation sidebar. During
state restoration, each tab would immediately try to restore an
appropriate ContentView after the load / navigation. However, in doing
so, we weren't respecting whether or not the Tab the ContentBrowser
was in was hidden or not, so ContentViews in background tags were
still being treated as shown/visible.

This patch changes state restoration to only affect the foreground
tab, and be delayed on all background tabs until that tab is shown.
This reduces the amount of work on load and navigation to just a
single tab instead of all tabs. Most importantly, it avoids having
performing work on ContentBrowsers that are non-visible, so state
restoration only happens for visible ContentBrowsers.

For simplicity, in the case of a delayed tab restoration triggered
by the user switching tabs, we don't try twice (like we occasionally
do on load/reload). We could add back some hueristic here if needed.

* UserInterface/Base/Main.js:
(WebInspector.contentLoaded):
(WebInspector.activateExtraDomains):
(WebInspector._mainResourceDidChange):
(WebInspector._restoreCookieForOpenTabs):
* UserInterface/Views/NavigationSidebarPanel.js:

* UserInterface/Views/TabContentView.js:
(WebInspector.TabContentView.prototype.shown):
(WebInspector.TabContentView.prototype.restoreStateFromCookie):
(WebInspector.TabContentView.prototype.saveStateToCookie):
When asked to restore state, save that logic until the next time the tab is shown.

* UserInterface/Views/TextEditor.js:
(WebInspector.TextEditor.prototype.get visible):
* UserInterface/Views/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor.prototype.editingControllerDidStartEditing):
(WebInspector.SourceCodeTextEditor.prototype._setTypeTokenAnnotatorEnabledState): Deleted.
Although this didn't actually catch the issue, it could potentially
catch other issues in the future. We don't want to enable the annotators
in a non-visible text editor, as it could be a performance issue.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184508 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] URTBF after r184503.

* PlatformGTK.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184506 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Networking process on iOS can be suspended and never exit.
<rdar://problem/20368630> and https://bugs.webkit.org/show_bug.cgi?id=144971

Reviewed by Darin Adler.

There's a few issues here.

1 - When the NetworkProcessProxy goes away, it takes its process assertion with it. This causes
    the Network process to suspend indefinitely, unable to ever respond to IPC::Connection callbacks.
    We already solved this with WebProcess with a watchdog timer keeping both the process assertion
    and xpc_connection alive while the process shuts down. This patch expands that to the network
    process, and it will be easy to expand that to database and plugin processes doing forward.

2 - All of our child processes either decide to self-terminate or listen for their connection to
    close at which point they terminate. This leads to various races. We should
    move to a model where the UI process explicitly tells them to shutdown, and this patch starts us
    down that path.

* CMakeLists.txt:
* DerivedSources.make:
* WebKit2.xcodeproj/project.pbxproj:

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::didReceiveMessage): Send ChildProcess messages to ChildProcess.

* Shared/ChildProcess.cpp:
(WebKit::ChildProcess::shutDown): For now, just terminate the process. In the future have the
  process do cleanup work before it is terminated.
* Shared/ChildProcess.h:
* Shared/ChildProcess.messages.in: Added.

* Shared/ChildProcessProxy.cpp:
(WebKit::ChildProcessProxy::shutDownProcess): Set a watchdog and - if possible - explicitly message
  the process to ShutDown.
(WebKit::ChildProcessProxy::abortProcessLaunchIfNeeded): Deleted.
* Shared/ChildProcessProxy.h:

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::~WebProcessPool): Explicitly tell the network process to shut down.

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::removeWebPage): Move abortProcessLaunchIfNeeded() and the watchdog timer
  code to ChildProcessProxy::shutDownProcess.

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::didReceiveMessage): Send ChildProcess messages to ChildProcess::didReceiveMessage.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184503 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[JSC] Speed up URL encode/decode by using bitmaps instead of strchr().
<https://webkit.org/b/145115>

Reviewed by Anders Carlsson.

We were calling strchr() for every character when doing URL encoding/decoding and it stood out
like a sore O(n) thumb in Instruments. Optimize this by using a Bitmap<256> instead.

5.5% progression on Kraken/stanford-crypto-sha256-iterative.

* runtime/JSGlobalObjectFunctions.cpp:
(JSC::makeCharacterBitmap):
(JSC::encode):
(JSC::decode):
(JSC::globalFuncDecodeURI):
(JSC::globalFuncDecodeURIComponent):
(JSC::globalFuncEncodeURI):
(JSC::globalFuncEncodeURIComponent):
(JSC::globalFuncEscape):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184501 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Network Cache: Make Data::adoptMap take the ownership of the file descriptor
https://bugs.webkit.org/show_bug.cgi?id=144950

Reviewed by Antti Koivisto.

It will be required to implement ShareableResource for soup
network backend. Also move the common code of Data to a common
file and add mapToFile(). The mapFile version that receives a file
descriptor has been renamed to adoptAndMapFile().

* CMakeLists.txt: Add new file to compilation.
* NetworkProcess/cache/NetworkCacheBlobStorage.cpp:
(WebKit::NetworkCache::BlobStorage::add): Use mapToFile().
* NetworkProcess/cache/NetworkCacheData.cpp: Added.
(WebKit::NetworkCache::Data::mapToFile): Write the data to the
given file and map it.
(WebKit::NetworkCache::mapFile):
(WebKit::NetworkCache::adoptAndMapFile):
(WebKit::NetworkCache::computeSHA1):
(WebKit::NetworkCache::bytesEqual):
* NetworkProcess/cache/NetworkCacheData.h:
* NetworkProcess/cache/NetworkCacheDataCocoa.mm:
(WebKit::NetworkCache::Data::adoptMap): Close the file descriptor.
* NetworkProcess/cache/NetworkCacheDataSoup.cpp:
(WebKit::NetworkCache::Data::Data): Use a constructor that
receives a file descriptor instead of the one receiving
Backing. If the file descriptor is not -1 then the Data is a map.
(WebKit::NetworkCache::MapWrapper::~MapWrapper): Also close the
file descriptor.
(WebKit::NetworkCache::Data::adoptMap): Pass the file descriptor
to the MapWrapper and create the Data passing the file descriptor.
* UIProcess/API/APIUserContentExtensionStore.cpp:
(API::openAndMapContentExtension): Use mapFile that receives a
file path.
(API::compiledToFile): Use adoptAndMapFile() and don't close the
descriptor.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184449 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Do not use fastMallocGoodSize anywhere
https://bugs.webkit.org/show_bug.cgi?id=145103

Reviewed by Michael Saboff.

Source/JavaScriptCore:

* assembler/AssemblerBuffer.h:
(JSC::AssemblerData::AssemblerData):
(JSC::AssemblerData::grow):

Source/WTF:

It is silly we see fastMallocGoodSize in profiles, it does absolutely nothing.

This patch keeps fastMallocGoodSize() around for older code linking
with newer WebKit, but remove any use of it inside WebKit.

* wtf/FastMalloc.cpp:
(WTF::fastMallocGoodSize):
* wtf/FastMalloc.h:
* wtf/Vector.h:
(WTF::VectorBufferBase::allocateBuffer):
(WTF::VectorBufferBase::tryAllocateBuffer):
(WTF::VectorBufferBase::reallocateBuffer):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184448 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[JSC] Make StringRecursionChecker faster in the simple cases without any recursion
https://bugs.webkit.org/show_bug.cgi?id=145102

Reviewed by Darin Adler.

Source/JavaScriptCore:

In general, the array targeted by Array.toString() or Array.join() are pretty
simple. In those simple cases, we spend as much time in StringRecursionChecker
as we do on the actual operation.

The reason for this is the HashSet stringRecursionCheckVisitedObjects used
to detect recursion. We are constantly adding and removing objects which
dirty buckets and force constant rehash.

This patch adds a simple shortcut for those simple case: in addition to the HashSet,
we keep a pointer to the root object of the recursion.
In the vast majority of cases, we no longer touch the HashSet at all.

This patch is a 12% progression on the overall score of ArrayWeighted.

* runtime/StringRecursionChecker.h:
(JSC::StringRecursionChecker::performCheck):
(JSC::StringRecursionChecker::~StringRecursionChecker):
* runtime/VM.h:

LayoutTests:

Improve the coverage a tiny bit.

* js/array-string-recursion-expected.txt: Added.
* js/array-string-recursion.html: Added.
* js/script-tests/array-string-recursion.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184447 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CSS Grid Layout] Add scrollbar width in intrinsic logical widths computation
https://bugs.webkit.org/show_bug.cgi?id=145021

Source/WebCore:

Like for flexboxes we've to take into account the scrollbar logical
width while computing the intrinsic min and max logical widths.

Reviewed by Sergio Villar Senin.

Test: fast/css-grid-layout/compute-intrinsic-widths-scrollbar.html

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::computeIntrinsicLogicalWidths): Add scrollbar
logical width.

LayoutTests:

Reviewed by Sergio Villar Senin.

* fast/css-grid-layout/compute-intrinsic-widths-scrollbar-expected.txt: Added.
* fast/css-grid-layout/compute-intrinsic-widths-scrollbar.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184446 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Insert store barriers late so that IR transformations don't have to worry about them
https://bugs.webkit.org/show_bug.cgi?id=145015

Reviewed by Geoffrey Garen.

We have had three kinds of bugs with store barriers. For the sake of discussion we say
that a store barrier is needed when we have something like:

    base.field = value

- We sometimes fail to realize that we could remove a barrier when value is a non-cell.
  This might happen if we prove value to be a non-cell even though in the FixupPhase it
  wasn't predicted non-cell.

- We sometimes have a barrier in the wrong place after object allocation sinking. We
  might sink an allocation to just above the store, but that puts it just after the
  StoreBarrier that FixupPhase inserted.

- We don't remove redundant barriers across basic blocks.

This comprehensively fixes these issues by doing store barrier insertion late, and
removing the store barrier elision phase. Store barrier insertion uses an epoch-based
algorithm to determine when stores need barriers. Briefly, a barrier is not needed if
base is in the current GC epoch (i.e. was the last object that we allocated or had a
barrier since last GC) or if base has a newer GC epoch than value (i.e. value would have
always been allocated before base). We do conservative things when merging epoch state
between basic blocks, and we only do such inter-block removal in the FTL. FTL also
queries AI to determine what type we've proved about value, and avoids barriers when
value is not a cell. FixupPhase still inserts type checks on some stores, to maximize
the likelihood that this AI-based removal is effective.

Rolling back in after fixing some debug build test failures.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGBlockMap.h:
(JSC::DFG::BlockMap::at):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
* dfg/DFGEpoch.h:
(JSC::DFG::Epoch::operator<):
(JSC::DFG::Epoch::operator>):
(JSC::DFG::Epoch::operator<=):
(JSC::DFG::Epoch::operator>=):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::speculateForBarrier):
(JSC::DFG::FixupPhase::insertStoreBarrier): Deleted.
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGStoreBarrierElisionPhase.cpp: Removed.
* dfg/DFGStoreBarrierElisionPhase.h: Removed.
* dfg/DFGStoreBarrierInsertionPhase.cpp: Added.
(JSC::DFG::performFastStoreBarrierInsertion):
(JSC::DFG::performGlobalStoreBarrierInsertion):
* dfg/DFGStoreBarrierInsertionPhase.h: Added.
* ftl/FTLOperations.cpp:
(JSC::FTL::operationMaterializeObjectInOSR): Fix an unrelated debug-only bug.
* tests/stress/load-varargs-then-inlined-call-and-exit.js: Test for that debug-only bug.
* tests/stress/load-varargs-then-inlined-call-and-exit-strict.js: Strict version of that test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184445 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Streams API] Delegate ReadableStreamReader reference counting to ReadableStream
https://bugs.webkit.org/show_bug.cgi?id=144907

Reviewed by Darin Adler.

Changed the link between readadable stream and reader.
Controller ref()/deref() now increments/decrements its stream ref counter, similarly to ReadableStreamController.
This ensures that even if JS scripts do not keep track of the readable stream,
the readable stream will not be disposed as long as the JS script has access to its reader.

All readers of a given stream are kept by the stream, either in an array (for released readers)
or and in ReadableStream::m_reader for the active reader.
This removes the need for the code synchronizing stream and reader.

As a reader can now already count on its stream, the reader no longer needs to store the error in errored state.
Removal of ReadableJSStream::Reader as closed promise rejection error is directly retrieved from the ReadableStream.
Moved the creation of reader directly in ReadableStream.

Next step should be to remove ReadableStreamReader::m_state and to delegate the handling of ReadableStreamReader closed promise callbacks to ReadableStream.

No change in behavior.

* Modules/streams/ReadableStream.cpp:
(WebCore::ReadableStream::changeStateToClosed):
(WebCore::ReadableStream::changeStateToErrored):
(WebCore::ReadableStream::getReader):
* Modules/streams/ReadableStream.h:
(WebCore::ReadableStream::reader):
* Modules/streams/ReadableStreamReader.cpp:
(WebCore::ReadableStreamReader::clean):
(WebCore::ReadableStreamReader::ref):
(WebCore::ReadableStreamReader::deref):
(WebCore::ReadableStreamReader::closed):
(WebCore::ReadableStreamReader::changeStateToClosed):
(WebCore::ReadableStreamReader::changeStateToErrored):
* Modules/streams/ReadableStreamReader.h:
(WebCore::ReadableStreamReader::ReadableStreamReader):
* Modules/streams/ReadableStreamReader.idl:
* bindings/js/JSReadableStreamCustom.cpp:
(WebCore::JSReadableStream::getReader):
* bindings/js/JSReadableStreamReaderCustom.cpp:
(WebCore::JSReadableStreamReader::closed):
(WebCore::constructJSReadableStreamReader):
* bindings/js/ReadableJSStream.cpp:
(WebCore::ReadableJSStream::storeError):
(WebCore::ReadableJSStream::ReadableJSStream): Deleted.
* bindings/js/ReadableJSStream.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184444 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash when uploading huge files to YouTube or Google Drive
https://bugs.webkit.org/show_bug.cgi?id=145083
rdar://problem/15468529

Reviewed by Darin Adler.

This fixes the crash, but uploading will fail.

* fileapi/FileReaderLoader.cpp:
(WebCore::FileReaderLoader::start): Tell SubresourceLoader to not store a copy of
all received data, FileReaderLoader has its own buffer.
(WebCore::FileReaderLoader::didReceiveResponse): Fixed a bounds check - not every
64-bit value that doesn't fit into 32 bits is negative. With this, FileReader fails
on huge files right away, as intended.
(WebCore::FileReaderLoader::didReceiveData): Fixed multiple bugs in code that's
executed when size is not available upfront. This is the code that used to crash,
but with the above fix, it's not executed by YouTube.
Not only overflow was handled incorrectly, but even simply growing a buffer for
append was buggy.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184443 268f45cc-cd09-0410-ab3c-d52691b4dbfc

bisect-builds: Add 'retry' option when prompting whether the bug reproduced
<http://webkit.org/b/145100>

Reviewed by Darin Adler.

* Scripts/bisect-builds:
- Add PROMPT_ANSWER_* constants for yes/no/retry/broken prompt.
- Switch to using PROMPT_RESPONSE_* constants when testing the
  value of $didReproduceBug.
- Add do { } while loops to implement 'retry' mode.
(promptForTest):
- Switch to returning PROMPT_RESPONSE_* constants.
- Add support for 'retry' response.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184442 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] WKPDFView should not follow javascript: links
https://bugs.webkit.org/show_bug.cgi?id=145101

Reviewed by Dan Bernstein.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::navigateToPDFLinkWithSimulatedClick): Returned early if url's protocol is javascript:.
(WebKit::WebPageProxy::navigateToURLWithSimulatedClick): Renamed to navigateToPDFLinkWithSimulatedClick to
reflect that this function is exclusively for following PDF links.
* UIProcess/WebPageProxy.h:
* UIProcess/ios/WKPDFView.mm:
(-[WKPDFView annotation:wasTouchedAtPoint:controller:]):
(-[WKPDFView actionSheetAssistant:openElementAtLocation:]):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::navigateToPDFLinkWithSimulatedClick): Renamed from navigateToURLWithSimulatedClick.
(WebKit::WebPage::navigateToURLWithSimulatedClick): Renamed to navigateToPDFLinkWithSimulatedClick.
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184441 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (Subpixel): Dashed underline is missing when box is positioned at subpixels.
https://bugs.webkit.org/show_bug.cgi?id=145097
rdar://problem/18588415

Reviewed by Simon Fraser.

Dashed and dotted border painting needs clipping in order to properly display corners.
Similarly to solid border's quad calculation, we pixelsnap the border positions before computing the clipping quad values.

Source/WebCore:

Test: fast/borders/dashed-border-on-subpixel-position.html
      fast/borders/dotted-border-on-subpixel-position.html

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::clipBorderSidePolygon):

LayoutTests:

* fast/borders/dashed-border-on-subpixel-position-expected.html: Added.
* fast/borders/dashed-border-on-subpixel-position.html: Added.
* fast/borders/dotted-border-on-subpixel-position-expected.html: Added.
* fast/borders/dotted-border-on-subpixel-position.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184440 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] Remote scrolling tree needs to coordinate scroll snap state during resize/rotations
https://bugs.webkit.org/show_bug.cgi?id=145059
<rdar://problem/20975978>

Reviewed by Simon Fraser.

The web view needs to update its scroll snap point offsets to take into account any
adjustments to the view size caused by content insets. We also need to update the
offstes after device rotation.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView scrollViewWillEndDragging:withVelocity:targetContentOffset:]): Retrieve the proper
computed content inset for the view and incorporate into any scroll snap point adjustments.
(-[WKWebView _updateVisibleContentRects]): If we have active scroll snap points,
* UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.h:
* UIProcess/ios/RemoteScrollingCoordinatorProxyIOS.mm:
(WebKit::RemoteScrollingCoordinatorProxy::adjustTargetContentOffsetForSnapping): Update to account
for content inset.
(WebKit::RemoteScrollingCoordinatorProxy::shouldSnapForMainFrameScrolling): Also validate that the
active index is valid.
(WebKit::RemoteScrollingCoordinatorProxy::closestSnapOffsetForMainFrameScrolling): Update to track
current active snap offset index.
(WebKit::RemoteScrollingCoordinatorProxy::hasActiveSnapPoint): Added.
(WebKit::RemoteScrollingCoordinatorProxy::nearestActiveSnapPoint): Added. It calculates the proper
scroll position incorporating any snap point and content insets.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184439 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r184415.
https://bugs.webkit.org/show_bug.cgi?id=145096

Broke several tests (Requested by msaboff on #webkit).

Reverted changeset:

"Insert store barriers late so that IR transformations don't
have to worry about them"
https://bugs.webkit.org/show_bug.cgi?id=145015
http://trac.webkit.org/changeset/184415

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184438 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove styleText() and applyStyleText() from InspectorStyle.
https://bugs.webkit.org/show_bug.cgi?id=145093

Patch by Sungmann Cho <sungmann.cho@navercorp.com> on 2015-05-16
Reviewed by Darin Adler.

styleText() and applyStyleText() in InspectorStyle are private aliases for the public
accessors in the same class but are rarely used. I think it would be better off removing
these aliases and updating all the current call sites to use the public accessors directly
as noted in InspectorStyleSheet.h.

No new tests, no behavior change.

* inspector/InspectorStyleSheet.cpp:
(WebCore::InspectorStyle::populateAllProperties):
* inspector/InspectorStyleSheet.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184437 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove MessageType variant of addMessageToConsole() from ChromeClient.
https://bugs.webkit.org/show_bug.cgi?id=145095

Patch by Sungmann Cho <sungmann.cho@navercorp.com> on 2015-05-16
Reviewed by Darin Adler.

All addMessageToConsole() in ChromeClient are exactly the same thing.
So there is no reason to keep all this methods.

No new tests, no behavior change.

* page/ChromeClient.h:
* page/PageConsoleClient.cpp:
(WebCore::PageConsoleClient::messageWithTypeAndLevel):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184436 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add getElementById to DocumentFragment
https://bugs.webkit.org/show_bug.cgi?id=145094

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Match the latest DOM standard and other browsers by adding getElementById
to DocumentFragment in addition to Document and SVGSVGElement. Add NonElementParentNode
interface that the DOM standard defines.

Test: fast/dom/DocumentFragment/getElementById.html

* DerivedSources.make:
* WebCore.xcodeproj/project.pbxproj:
Add NonElementParentNode.idl

* dom/Document.idl:
Mark Document as implementing NonElementParentNode and remove now redundant getElementById
declaration.

* dom/DocumentFragment.cpp:
(WebCore::DocumentFragment::getElementById):
* dom/DocumentFragment.h:
Add implementation of getElementById for DocumentFragments. Add a fast path for ShadowRoots
which can take advantage of the fact that they are TreeScopes to use the elements by id cache
in TreeScrope.

* dom/DocumentFragment.idl:
Mark DocumentFragment as implementing NonElementParentNode.

* dom/NonElementParentNode.idl: Copied from Source/WebCore/dom/NonDocumentTypeChildNode.idl.
Added.

* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::getElementById):
* svg/SVGSVGElement.h:
* svg/SVGSVGElement.idl:
Convert to taking an AtomicString to match other getElementByIds.

LayoutTests:

* fast/dom/DocumentFragment/getElementById-expected.txt: Added.
* fast/dom/DocumentFragment/getElementById.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184435 268f45cc-cd09-0410-ab3c-d52691b4dbfc

When redirecting to data URL use HTTP response for same origin policy checks
https://bugs.webkit.org/show_bug.cgi?id=145054
rdar://problem/20299050

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test: http/tests/security/canvas-remote-read-data-url-image-redirect.html

* dom/ScriptElement.cpp:
(WebCore::ScriptElement::notifyFinished):
* dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::sanitizeScriptError):
* html/canvas/CanvasRenderingContext.cpp:
(WebCore::CanvasRenderingContext::wouldTaintOrigin):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::notifyFinished):
* loader/MediaResourceLoader.cpp:
(WebCore::MediaResourceLoader::responseReceived):
* loader/TextTrackLoader.cpp:
(WebCore::TextTrackLoader::notifyFinished):
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::isOriginClean):
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::passesAccessControlCheck):
(WebCore::CachedResource::passesSameOriginPolicyCheck):

    Factor repeatedly used same origin policy test into a function.

(WebCore::CachedResource::redirectReceived):

    When redirecting to a data URL save the redirect response.

(WebCore::CachedResource::responseForSameOriginPolicyChecks):

    In case we got redirected to data use that response instead of the final data response for policy checks.

* loader/cache/CachedResource.h:

LayoutTests:

* http/tests/security/canvas-remote-read-data-url-image-redirect-expected.txt: Added.
* http/tests/security/canvas-remote-read-data-url-image-redirect.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184434 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] wireless playback picker button is drawn incorrectly
https://bugs.webkit.org/show_bug.cgi?id=145057
rdar://problem/20877518

Reviewed by Jer Noble.

* Modules/mediacontrols/mediaControlsiOS.js:
(ControllerIOS.prototype.updateWirelessTargetPickerButton): This method is
defined in Controller, but is only meant to run on Macs. Override it with
an empty function for iOS.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184433 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL][WK2] Minibrowser : Add search icon to search bar
https://bugs.webkit.org/show_bug.cgi?id=139773

Patch by Tanay C <tanay.c@samsung.com> on 2015-05-16
Reviewed by Gyuyoung Kim.

* MiniBrowser/efl/main.c:
(search_icon_show): Added.
(search_box_show): Modified.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184432 268f45cc-cd09-0410-ab3c-d52691b4dbfc

run_benchmark should have an option to specify the number of runs
https://bugs.webkit.org/show_bug.cgi?id=145091

Reviewed by Stephanie Lewis.

Added --count option.

* Scripts/run-benchmark:
(main):
* Scripts/webkitpy/benchmark_runner/benchmark_runner.py:
(BenchmarkRunner.__init__):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184431 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r183300): Background missing on top links on apple.com
https://bugs.webkit.org/show_bug.cgi?id=145079
rdar://problem/20914252

Reviewed by Tim Horton.

Source/WebCore:

Re-land r184421 with a fix to check against rects.coverageRect
rather than the stale m_coverageRect.

Test: compositing/visible-rect/backing-change-height-from-zero.html

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::setVisibleAndCoverageRects):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::shouldSkipLayerInDump):

LayoutTests:

Re-land.

* compositing/visible-rect/backing-change-height-from-zero-expected.txt: Added.
* compositing/visible-rect/backing-change-height-from-zero.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184430 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: empty timeline should not use previous timeline's zoom interval
https://bugs.webkit.org/show_bug.cgi?id=132754

Reviewed by Joseph Pecoraro.

When a timeline recording is started in response to a provisional load, TimelineManager should check whether
the main resource url is changing before loading a new timeline recording. If the main resource is changing,
set the selection start, selection duration, and duration-per-pixel settings of the TimelineOverview to their
default values.

* UserInterface/Controllers/TimelineManager.js:
(WebInspector.TimelineManager):
(WebInspector.TimelineManager.prototype.isCapturingPageReload):
(WebInspector.TimelineManager.prototype.capturingStopped):
(WebInspector.TimelineManager.prototype.pageDidLoad):
(WebInspector.TimelineManager.prototype._startAutoCapturing):
Added a property for checking whether auto capture was triggered by a page reload.

* UserInterface/Views/LinearTimelineOverview.js:
(WebInspector.LinearTimelineOverview):
Increase default selection time to 15 seconds.

* UserInterface/Views/TimelineOverview.js:
(WebInspector.TimelineOverview):
Reset selection and zoom if TimelineManager isn't capturing in response to a page reload.

(WebInspector.TimelineOverview.prototype.reset):
Reset selection and zoom.

(WebInspector.TimelineOverview.prototype._timeRangeSelectionChanged):
(WebInspector.TimelineOverview.prototype._resetSelection):
Added a helper function for resetting selection and zoom to their default values.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184429 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: REGRESSION (r181625): Timeline recording started from console.profile is always empty
https://bugs.webkit.org/show_bug.cgi?id=144882

Reviewed by Joseph Pecoraro.

A timeline recording will always be stopped before the end of the current run loop is observed. Before
dispatching the recording stopped event, any events that are currently in progress should be considered
complete and sent to the frontend.

* inspector/InspectorTimelineAgent.cpp:
(WebCore::InspectorTimelineAgent::internalStop):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184428 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Timeline data grid displays wrong records after switching between Timelines/Frames mode
https://bugs.webkit.org/show_bug.cgi?id=145084

Reviewed by Timothy Hatcher.

Update timeline sidebar filter whenever the view mode changes.

* UserInterface/Views/TimelineSidebarPanel.js:
(WebInspector.TimelineSidebarPanel.prototype.treeElementForRepresentedObject.get if.get if):
(WebInspector.TimelineSidebarPanel.get else):
(WebInspector.TimelineSidebarPanel.prototype.treeElementForRepresentedObject.get if):
(WebInspector.TimelineSidebarPanel.prototype.treeElementForRepresentedObject):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184427 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Bump image format number to force image regeneration
https://bugs.webkit.org/show_bug.cgi?id=145074

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-15
Reviewed by Timothy Hatcher.

* UserInterface/Base/ImageUtilities.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184426 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Don't reset the preview recognizer in [WKContentViewInteraction cleanupInteraction]
https://bugs.webkit.org/show_bug.cgi?id=145081

We shouldn't reset the recognizer in [WKContentViewInteraction cleanupInteraction] since we don't re-add it
back to WKContentView when the process relaunched. Since we already add/remove it when the view is move into/
removed from the window, we don't need reset it in cleanupInteraction.

Patch by Yongjun Zhang <yongjun_zhang@apple.com> on 2015-05-15
Reviewed by Dan Bernstein.

* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView cleanupInteraction]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184425 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Test the interaction between font-family and font-weight
https://bugs.webkit.org/show_bug.cgi?id=145078

Reviewed by Dean Jackson.

This test is designed to test the interaction between font-family and font-weight. In particular,
our implementation of font-family accepts PostScript names, which may name a font with a particular
weight. However, there is another CSS property, font-weight, in which the author may also name a
particular weight. Our font selection algorithm takes both of these signals into account when
choosing fonts.

There is currently no good way in JavaScript to find the actual font chosen for some text.
Therefore, the best way to test this aspect of the font selection algorithm is to dump the render
tree, therefore testing glyph advances (which are a property of font weight).

* platform/mac/fast/text/font-weights-expected.txt: Added.
* platform/mac/fast/text/font-weights.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184424 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r184421.
https://bugs.webkit.org/show_bug.cgi?id=145087

Introduced 42 layout test failures (Requested by rniwa on
#webkit).

Reverted changeset:

"REGRESSION (r183300): Background missing on top links on
apple.com"
https://bugs.webkit.org/show_bug.cgi?id=145079
http://trac.webkit.org/changeset/184421

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184423 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r181910): WKWebView incorrectly scales snapshot
https://bugs.webkit.org/show_bug.cgi?id=145076

Patch by James Savage <james.savage@apple.com> on 2015-05-15
Reviewed by Tim Horton.

We added a fast path to snapshotting using IOSurfaces with
http://trac.webkit.org/changeset/181910 which incorrectly determined
scale and transform and resulted in bad snapshots in some situations.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _snapshotRect:intoImageOfWidth:completionHandler:]):
When snapshotting an IOSurface we need to compute our scale based off of
the rect in the WKWebView coordinates, we also failed to account for
non-zero origins in the snapshot rect. Remove an unused varible while
we're here.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184422 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r183300): Background missing on top links on apple.com
https://bugs.webkit.org/show_bug.cgi?id=145079
rdar://problem/20914252

Reviewed by Tim Horton.

Source/WebCore:

GraphicsLayerCA::setVisibleAndCoverageRects() only set the m_intersectsCoverageRect
flag if the coverage rect changed, but it doesn't if you simply change the size of
the layer.

Instead, always re-evaluate the intersection, and set the CoverageRectChanged bit
if it changes.

Test: compositing/visible-rect/backing-change-height-from-zero.html

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::setVisibleAndCoverageRects):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::shouldSkipLayerInDump): Don't skip any layers in a
debug layer dump, to assist debugging.

LayoutTests:

Composited box that toggles to a non-zero height and dumps layers.

* compositing/visible-rect/backing-change-height-from-zero-expected.txt: Added.
* compositing/visible-rect/backing-change-height-from-zero.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184421 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Move HTMLElement's children property to ParentNode
https://bugs.webkit.org/show_bug.cgi?id=145072

Reviewed by Chris Dumez.

Source/WebCore:

Match the latest DOM standard and other browsers by moving the children property
to ParentNode, thus exposing it on Element, Document and DocumentFragment.

Test: fast/dom/ParentNode-children.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::children):
Moved implementation from HTMLElement to here.

(WebCore::ContainerNode::ensureCachedHTMLCollection):
(WebCore::ContainerNode::cachedHTMLCollection):
Moved implementation from Element to here so that ContainerNode::children
can use it.

(WebCore::ContainerNode::firstElementChild):
(WebCore::ContainerNode::lastElementChild):
(WebCore::ContainerNode::childElementCount):
Remove unnecessary assertions.

* dom/ContainerNode.h:
Moved declarations from HTMLElement and Element to here.

* dom/Element.cpp:
(WebCore::Element::ensureCachedHTMLCollection): Deleted.
(WebCore::Element::cachedHTMLCollection): Deleted.
* dom/Element.h:
Moved to ContainerNode.

* dom/Node.cpp:
(WebCore::Node::previousElementSibling):
(WebCore::Node::nextElementSibling):
Remove unnecessary assertions.

* dom/ParentNode.idl:
Moved the children property here from HTMLElement.

* html/HTMLElement.cpp:
(WebCore::HTMLElement::children): Deleted.
* html/HTMLElement.h:
Moved to ContainerNode.

* html/HTMLElement.idl:
Get rid of the children property for all bindings except Objective-C which needs
to keep it to avoid changing the public API.

LayoutTests:

* fast/dom/ParentNode-children-expected.txt: Added.
* fast/dom/ParentNode-children.html: Added.
Test children on Element, Document and DocumentFragment.

* fast/dom/xmlserializer-serialize-to-string-exception-expected.txt:
Update results since document.children is no longer undefined.

* js/dom/dom-static-property-for-in-iteration-expected.txt:
Update results.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184420 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore ASan debug build fails. ERROR: WebCore has a weak external symbol in it.
https://bugs.webkit.org/show_bug.cgi?id=145070

Reviewed by David Kilzer.

Build fix.

* Configurations/WebCore.unexp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184419 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Reduce type annotation update frequency
https://bugs.webkit.org/show_bug.cgi?id=145066

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-15
Reviewed by Timothy Hatcher.

* UserInterface/Controllers/TypeTokenAnnotator.js:
Reduce the frequency which could commonly be 16-24ms
to a minimum of 100ms and maximum of 2000ms.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184418 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Prefix force on MouseEvent and add constants for click and force click values
https://bugs.webkit.org/show_bug.cgi?id=145065
-and corresponding-
rdar://problem/20770052

Reviewed by Tim Horton.

(WebCore::MouseEvent::webkitForce):
* dom/MouseEvent.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184417 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[MediaControls] Refactor media controls & bring improvements made to iOS controls to Mac.
https://bugs.webkit.org/show_bug.cgi?id=144973

Reviewed by Dean Jackson.

Pull improvements made to the iOS media controls back into the Mac controls by moving
code from mediaControlsiOS.js into MediaControlsApple.js.

The largest refactored feature is the ability to drop individual controls from the media
controls when the video is too small to contain them. To allow these controls to resize
dynamically, a new "resize" event is fired inside the media element's shadow DOM.

* Modules/mediacontrols/mediaControlsApple.css:
(audio::-webkit-media-controls-panel .dropped): Added; sets "display: none".
* Modules/mediacontrols/mediaControlsApple.js:
(Controller): Set defaults for new variables.
(Controller.prototype.updateControls): Update the controls width; moved from iOS.js.
(Controller.prototype.handleReadyStateChange): Update the controls; moved from iOS.js.
(Controller.prototype.handleTimeUpdate): Update the progress; moved from iOS.js.
(Controller.prototype.handleTimelineInput): Pause if scrubbing; moved from iOS.js.
(Controller.prototype.handleTimelineChange): Update the progress; moved from iOS.js.
(Controller.prototype.showControls): Update the controls width; moved from iOS.js.
(Controller.prototype.hideControls): Removed _potentiallyScrubbing check; not needed due to changes
    to controlsAlwaysVisible().
(Controller.prototype.scheduleUpdateLayoutForDisplayedWidth): Moved from iOS.js.
(Controller.prototype.isControlVisible): Added; checks whether control is parented & not hidden.
(Controller.prototype.updateLayoutForDisplayedWidth): Moved from iOS.js and refactored.
(Controller.prototype.controlsAlwaysVisible): Return true if scrubbing.
(Controller.prototype.updateHasAudio): Check currentPlaybackTargetIsWireless(); moved from iOS.js.
(Controller.prototype.get scrubbing): Simple getter for _scrubbing.
(Controller.prototype.set scrubbing): Check play state if scrubbing; start playback (if necessary)
    if not scrubbing.
(Controller.prototype.get pageScaleFactor): Moved from iOS.js.
(Controller.prototype.set pageScaleFactor): Ditto.
(Controller.prototype.handleRootResize): Schedule an update of the contrtols width.

Remove a bunch of newly unnecessary code from the iOS media controls:

* Modules/mediacontrols/mediaControlsiOS.js:
(ControllerIOS):
(ControllerIOS.prototype.createControls): Remove ivars moved into Apple.js.
(ControllerIOS.prototype.configureInlineControls): Remove spacer; made unnecessary.
(ControllerIOS.prototype.showControls): Deleted.
(ControllerIOS.prototype.updateTime): Deleted.
(ControllerIOS.prototype.handleTimelineTouchStart): Just call "scrubbing = true", handled in Apple.js.
(ControllerIOS.prototype.handleTimelineTouchEnd): Just call "scrubbing = false", handled in Apple.js.
(ControllerIOS.prototype.handleReadyStateChange): Deleted.
(ControllerIOS.prototype.setPlaying): Don't check _timelineIsHidden; not needed.
(ControllerIOS.prototype.get pageScaleFactor): Deleted.
(ControllerIOS.prototype.set pageScaleFactor): Deleted.
(ControllerIOS.prototype.scheduleUpdateLayoutForDisplayedWidth): Deleted.
(ControllerIOS.prototypeupdateLayoutForDisplayedWidth): Deleted.

Fire a "resize" event at the shadow DOM root when layout results in a size change.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::layoutSizeChanged): Fire the "resize" event at the shadow DOM.
* html/HTMLMediaElement.h:
* rendering/RenderMedia.cpp:
(WebCore::RenderMedia::layout): Trigger layoutSizeChanged()
* rendering/RenderMedia.h:

Drive-by fixes:

* Modules/mediacontrols/mediaControlsApple.js:
(Controller.prototype.createControls): aria-label text is totally wrong; removed.
(Controller.prototype.updateWirelessPlaybackStatus): Use class-names to hide controls, not inline styles.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184416 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Insert store barriers late so that IR transformations don't have to worry about them
https://bugs.webkit.org/show_bug.cgi?id=145015

Reviewed by Geoffrey Garen.

We have had three kinds of bugs with store barriers. For the sake of discussion we say
that a store barrier is needed when we have something like:

    base.field = value

- We sometimes fail to realize that we could remove a barrier when value is a non-cell.
  This might happen if we prove value to be a non-cell even though in the FixupPhase it
  wasn't predicted non-cell.

- We sometimes have a barrier in the wrong place after object allocation sinking. We
  might sink an allocation to just above the store, but that puts it just after the
  StoreBarrier that FixupPhase inserted.

- We don't remove redundant barriers across basic blocks.

This comprehensively fixes these issues by doing store barrier insertion late, and
removing the store barrier elision phase. Store barrier insertion uses an epoch-based
algorithm to determine when stores need barriers. Briefly, a barrier is not needed if
base is in the current GC epoch (i.e. was the last object that we allocated or had a
barrier since last GC) or if base has a newer GC epoch than value (i.e. value would have
always been allocated before base). We do conservative things when merging epoch state
between basic blocks, and we only do such inter-block removal in the FTL. FTL also
queries AI to determine what type we've proved about value, and avoids barriers when
value is not a cell. FixupPhase still inserts type checks on some stores, to maximize
the likelihood that this AI-based removal is effective.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGBlockMap.h:
(JSC::DFG::BlockMap::at):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
* dfg/DFGEpoch.h:
(JSC::DFG::Epoch::operator<):
(JSC::DFG::Epoch::operator>):
(JSC::DFG::Epoch::operator<=):
(JSC::DFG::Epoch::operator>=):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::speculateForBarrier):
(JSC::DFG::FixupPhase::insertStoreBarrier): Deleted.
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGStoreBarrierElisionPhase.cpp: Removed.
* dfg/DFGStoreBarrierElisionPhase.h: Removed.
* dfg/DFGStoreBarrierInsertionPhase.cpp: Added.
(JSC::DFG::performFastStoreBarrierInsertion):
(JSC::DFG::performGlobalStoreBarrierInsertion):
* dfg/DFGStoreBarrierInsertionPhase.h: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184415 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[ARM64] Do not fail branchConvertDoubleToInt32 when the result is zero and not negative zero
https://bugs.webkit.org/show_bug.cgi?id=144976

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-05-15
Reviewed by Michael Saboff.

Failing the conversion on zero is pretty dangerous as we discovered on x86.

This patch does not really impact performance significantly because
r184220 removed the zero checks from Kraken. This patch is just to be
on the safe side for cases not covered by existing benchmarks.

* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::branchConvertDoubleToInt32):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184414 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Content Extensions] Fail to load old content extension files
https://bugs.webkit.org/show_bug.cgi?id=145027

Reviewed by Eric Carlson.

Source/WebCore:

* contentextensions/DFABytecode.h:

Source/WebKit2:

* UIProcess/API/APIUserContentExtensionStore.cpp:
(API::openAndMapContentExtension):
* UIProcess/API/APIUserContentExtensionStore.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184413 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove unnecessary forward declarations in PropertyNameArray.h.
https://bugs.webkit.org/show_bug.cgi?id=145058

Patch by Sungmann Cho <sungmann.cho@navercorp.com> on 2015-05-15
Reviewed by Andreas Kling.

No new tests, no behavior change.

* runtime/PropertyNameArray.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184412 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Fix some possible event listener leakers in content views
https://bugs.webkit.org/show_bug.cgi?id=145068

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-15
Reviewed by Timothy Hatcher.

Now that some content views can be closed that weren't closable before, ensure
we clean up after global event listeners that may strongly reference "this".

* UserInterface/Views/DOMTreeContentView.js:
(WebInspector.DOMTreeContentView.prototype.closed):
* UserInterface/Views/DOMTreeOutline.js:
(WebInspector.DOMTreeOutline.prototype.close):
* UserInterface/Views/LayoutTimelineView.js:
(WebInspector.LayoutTimelineView.prototype.closed):
* UserInterface/Views/NetworkTimelineView.js:
(WebInspector.NetworkTimelineView.prototype.closed):
* UserInterface/Views/RenderingFrameTimelineView.js:
(WebInspector.RenderingFrameTimelineView.prototype.closed):
* UserInterface/Views/ScriptContentView.js:
(WebInspector.ScriptContentView.prototype.closed):
* UserInterface/Views/ScriptTimelineView.js:
(WebInspector.ScriptTimelineView.prototype.closed):
* UserInterface/Views/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor.prototype.close):
* UserInterface/Views/TextResourceContentView.js:
(WebInspector.TextResourceContentView.prototype.closed):
* UserInterface/Views/TimelineDataGrid.js:
(WebInspector.TimelineDataGrid.prototype.closed):
(WebInspector.TimelineDataGrid.prototype.handleEvent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184411 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Initiator Popovers no longer work in Layout Timeline
https://bugs.webkit.org/show_bug.cgi?id=145067

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-15
Reviewed by Timothy Hatcher.

* UserInterface/Views/LayoutTimelineDataGrid.js:
(WebInspector.LayoutTimelineDataGrid.prototype.callFramePopoverAnchorElement):
Update the column name, which changed in r183134.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184410 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Temporarily disable failing API test.

* TestWebKitAPI/Tests/WebKit2ObjC/ActionMenus.mm:
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184409 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSArray::setLength() should reallocate instead of zero-filling if the reallocation would be small enough.
https://bugs.webkit.org/show_bug.cgi?id=144622

Reviewed by Geoffrey Garen.

When setting the array to a new length that is shorter, we now check if it is worth
just making a new butterfly instead of clearing out the slots in the old butterfly
that resides beyond the new length.  If so, we will make a new butterfly instead.

There is no perf differences in the benchmark results.  However, this does benefit
the perf of pathological cases where we need to shorten the length of a very large
array, as is the case in tests/mozilla/js1_5/Array/regress-101964.js.  With this
patch, we can expect that test to complete in a short time again.

* runtime/JSArray.cpp:
(JSC::JSArray::setLength):
* runtime/JSObject.cpp:
(JSC::JSObject::reallocateAndShrinkButterfly):
- makes a new butterfly with a new shorter length.
* runtime/JSObject.h:
* tests/mozilla/js1_5/Array/regress-101964.js:
- Undo this test change since this patch will prevent us from spending a lot of time
  clearing a large butterfly.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184407 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed build fix.

* platform/ios/WebVideoFullscreenInterfaceAVKit.mm: Add clang pragmas to ignore
deprecation warnings.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184406 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFGLICMPhase shouldn't create NodeOrigins with forExit but without semantic
https://bugs.webkit.org/show_bug.cgi?id=145062

Reviewed by Filip Pizlo.

We assert in various places (including NodeOrigin::isSet()) that a
NodeOrigin's semantic and forExit must be either both set, or both
unset.  However, LICM'ing a node with unset NodeOrigin would only set
forExit, and leave semantic unset. This can for instance happen when a
Phi node is constant-folded into a JSConstant, which in turn gets
LICM'd.

This patch changes DFGLICMPhase to set the NodeOrigin's semantic in
addition to its forExit if semantic was previously unset.

It also adds two validators to DFGValidate.cpp:
 - In both SSA and CPS form, a NodeOrigin semantic and forExit must be either both set or both unset
 - In CPS form, all nodes must have a set NodeOrigin forExit (this is
   the CPS counterpart to the SSA validator that checks that all nodes
   must have a set NodeOrigin except possibly for a continuous chunk of
   nodes at the top of a block)

* dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::attemptHoist):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
(JSC::DFG::Validate::validateCPS):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184405 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Limit alternate fullscreen with linked on or after.
https://bugs.webkit.org/show_bug.cgi?id=144894

Patch by Jeremy Jones <jeremyj@apple.com> on 2015-05-15
Reviewed by Dean Jackson.

Source/WebCore:

* platform/ios/WebCoreSystemInterfaceIOS.h: add new wkIOSSystemVersion

Source/WebKit/mac:

* WebView/WebView.mm:
(shouldAllowAlternateFullscreen): Added.
(-[WebView _preferencesChanged:]):

Source/WebKit2:

* UIProcess/API/Cocoa/WKWebView.mm:
(shouldAllowAlternateFullscreen): Added.
(-[WKWebView initWithFrame:configuration:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184404 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed. Revert part of r184361.

* Modules/mediacontrols/mediaControlsApple.js:
(Controller.prototype.configureInlineControls):
HI wants the buttons flipped.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184403 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix trivial typo in TextEncodingDetectorICU.cpp.
https://bugs.webkit.org/show_bug.cgi?id=145055

Patch by Sungmann Cho <sungmann.cho@navercorp.com> on 2015-05-15
Reviewed by Alexey Proskuryakov.

No new tests, no behavior change..

* platform/text/TextEncodingDetectorICU.cpp:
(WebCore::detectTextEncoding):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184402 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Cyrillic top-level domains are displayed as punycode
https://bugs.webkit.org/show_bug.cgi?id=145024
rdar://problem/17747133
rdar://problem/14116594

Reviewed by Tim Horton.

Handling each TLD in code is annoying, but we can probably survive like this
for a few more years, and maybe we'll think of an entirely different way to deal
with non-ASCII domain labels in the meanwhile.

* platform/mac/WebCoreNSURLExtras.mm:
(WebCore::isSecondLevelDomainNameAllowedByTLDRules):
(WebCore::allCharactersAllowedByTLDRules):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184401 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Cursor is displayed after full screen video controls fade away.
https://bugs.webkit.org/show_bug.cgi?id=145034.
<rdar://problem/20458604>

Reviewed by Jer Noble.

* Modules/mediacontrols/mediaControlsApple.css:
(video::-webkit-media-controls-panel):
Unnecessary cursor style is on the control panel while hidden but
the cursor will already be hidden anyways from being auto-hidden.
Causes style to change when controls are hidden,
which causes the cursor to reappear.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184400 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2][Cocoa] Back swipe tab snapshot takes a long time to be removed on bing.com
https://bugs.webkit.org/show_bug.cgi?id=145061
<rdar://problem/20939743>

Reviewed by Tim Horton.

When swiping back from a video search result to the list of video
search results on bing.com, the back swipe gesture tab snapshot takes
~3 seconds to be removed, even though the page gets loaded almost
instantly from PageCache. The tab snapshot should be removed as soon as
the load is done.

The issue is that we only cleared the back swipe gesture tab snapshot
after PageClient::didFinishLoadForMainFrame() has been called. However,
PageClient::didFinishLoadForMainFrame() was only being called by
WebPageProxy if the main frame loaded *without* error. In case the main
frame loaded with an error, only WebPageProxy::didFailLoadForFrame() is
called, not WebPageProxy::didFinishLoadForFrame() and we would fail to
remove the gesture snapshot until the 3 seconds timeout.

This patch calls PageClient::didFinishLoadForMainFrame() from
WebPageProxy::didFailLoadForFrame() so we remove the snapshot in the
error case as well.

The reason didFailLoadForFrame() is being called on bing.com video
search results is because a "ping" load is aborted when the page is
entering PageCache. Aborting any kind of resource load sets a
"cancellation" error on the main document.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didFailLoadForFrame):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184399 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, remove an unused declaration.

* dfg/DFGSpeculativeJIT.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184398 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove unused constant-base and constant-value store barrier code in the DFG
https://bugs.webkit.org/show_bug.cgi?id=145039

Reviewed by Andreas Kling.

Just killing dead code.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): Deleted.
(JSC::DFG::SpeculativeJIT::writeBarrier): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::writeBarrier):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::writeBarrier):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184397 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Checkmark on OFF option of captions sometimes does not appear.
https://bugs.webkit.org/show_bug.cgi?id=145060.
<rdar://problem/19388333>

Reviewed by Eric Carlson.

* Modules/mediacontrols/mediaControlsApple.js:
(Controller.prototype.buildCaptionMenu):
Audio tracks don’t have an OFF option.
Remove related code to allow OFF option for subtitles to work properly.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184396 268f45cc-cd09-0410-ab3c-d52691b4dbfc

White edge on animating panel on rokkosunnyvale.com
https://bugs.webkit.org/show_bug.cgi?id=144986
rdar://problem/20907683

Reviewed by Simon Fraser.

Background image geometry calculation needs to be based on the final painting size of the container
in order to accurately compute tile sizes, repeating positions etc.
The container's size is pixelsnapped at painting using absolute coordinates. This patch
ensures that we snap to the same size while computing background geometry.

Source/WebCore:

Test: fast/images/background-image-size-changes-fractional-position.html

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::paintBoxDecorations):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::paintBoxDecorations):
(WebCore::RenderBox::paintBackground):
(WebCore::RenderBox::getBackgroundPaintedExtent):
(WebCore::RenderBox::computeBackgroundIsKnownToBeObscured):
(WebCore::RenderBox::maskClipRect):
(WebCore::RenderBox::repaintLayerRectsForImage): unable to get absolute coords.
* rendering/RenderBox.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
(WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
(WebCore::RenderBoxModelObject::getGeometryForBackgroundImage):
(WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground):
* rendering/RenderBoxModelObject.h:
* rendering/RenderFieldset.cpp:
(WebCore::RenderFieldset::paintBoxDecorations):
* rendering/RenderImage.cpp:
(WebCore::RenderImage::boxShadowShouldBeAppliedToBackground):
(WebCore::RenderImage::computeBackgroundIsKnownToBeObscured):
* rendering/RenderImage.h:
* rendering/RenderLayer.cpp: unable to get absolute coords.
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage): currently not used.
* rendering/RenderObject.h:
(WebCore::RenderObject::computeBackgroundIsKnownToBeObscured):
(WebCore::RenderObject::backgroundIsKnownToBeObscured):
* rendering/RenderTable.cpp:
(WebCore::RenderTable::paintBoxDecorations):
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::boxShadowShouldBeAppliedToBackground):
* rendering/RenderTableCell.h:

LayoutTests:

* fast/backgrounds/hidpi-bitmap-background-repeat-on-subpixel-position-expected.html: progression.
* fast/images/background-image-size-changes-fractional-position-expected.html: Added.
* fast/images/background-image-size-changes-fractional-position.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184395 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash in RenderFlowThread::popFlowThreadLayoutState() due to mismatched push/pop count
https://bugs.webkit.org/show_bug.cgi?id=145042

Reviewed by David Hyatt.

RenderFlowThread previously used a ListHashSet to store its stack of active objects. This
is problematic because, if the same object is pushed twice, only a single entry of that
object is added to the stack. After this occurs, a matching number of pushes will pop too
many items off the stack, causing a crash when popping a stack with zero items. This
specifically happens in FrameView::layout(), which will push its root renderer on the stack
of active items, and then ask the root to layout(), which will attempt to push itself on the
stack of active items.

Instead of a ListHashSet, use a Vector, which has similar memory characteristics and no
uniqueness requirements.

* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::pushFlowThreadLayoutState):
(WebCore::RenderFlowThread::popFlowThreadLayoutState):
* rendering/RenderFlowThread.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184394 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Build fix for some versions of clang.

* wtf/SaturatedArithmetic.h:
(signedAddOverflows):
(signedSubtractOverflows):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184393 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Gardening 15th May.
https://bugs.webkit.org/show_bug.cgi?id=145047

Unreviewed.

Patch by Marcos Chavarría Teijeiro <mchavarria@igalia.com> on 2015-05-15

* platform/gtk/TestExpectations:
* platform/gtk/fast/events/ghostly-mousemoves-in-subframe-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184392 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Curl] WebSocket platform part is not implemented.
https://bugs.webkit.org/show_bug.cgi?id=144628

Reviewed by Darin Adler.

Add Curl platform code implementation for WebSockets.

* platform/network/curl/SocketStreamHandle.h:
(WebCore::SocketStreamHandle::create):
(WebCore::SocketStreamHandle::SocketData::SocketData):
* platform/network/curl/SocketStreamHandleCurl.cpp:
(WebCore::SocketStreamHandle::SocketStreamHandle):
(WebCore::SocketStreamHandle::~SocketStreamHandle):
(WebCore::SocketStreamHandle::platformSend):
(WebCore::SocketStreamHandle::platformClose):
(WebCore::SocketStreamHandle::readData):
(WebCore::SocketStreamHandle::sendData):
(WebCore::SocketStreamHandle::waitForAvailableData):
(WebCore::SocketStreamHandle::startThread):
(WebCore::SocketStreamHandle::stopThread):
(WebCore::SocketStreamHandle::didReceiveData):
(WebCore::SocketStreamHandle::didOpenSocket):
(WebCore::SocketStreamHandle::createCopy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184389 268f45cc-cd09-0410-ab3c-d52691b4dbfc

User interruption while running of run-webkit-tests should also generate results.html
https://bugs.webkit.org/show_bug.cgi?id=122154

Patch by Ravi Phaneendra Kasibhatla <r.kasibhatla@samsung.com> on 2015-05-15
Reviewed by Csaba Osztrogonác.

Generation of results.html on execution of run-webkit-tests happens only
on completion of entire layout tests run. It should be created even when
the execution has been interrupted - either by user (by pressing Ctrl+C)
or because of other interruptions (like exit-after-n-failures option).

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
(LayoutTestRunner.run_tests):
* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager.run):
* Scripts/webkitpy/layout_tests/models/test_run_results.py:
(TestRunResults.__init__):
* Scripts/webkitpy/layout_tests/run_webkit_tests.py:
(main):
* Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
(RunTest.test_keyboard_interrupt):
(MainTest.test_exception_handling):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184382 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[buildbot] Fix the URL of the performance bots
https://bugs.webkit.org/show_bug.cgi?id=145043

Reviewed by Ryosuke Niwa.

* BuildSlaveSupport/build.webkit.org-config/templates/root.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184379 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix typo in function name parseFunctionParamters -> parseFunctionParameters
https://bugs.webkit.org/show_bug.cgi?id=145040

Patch by Alexandr Skachkov <gskachkov@gmail.com> on 2015-05-15
Reviewed by Mark Lam.

* parser/Parser.h:
* parser/Parser.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184378 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r183861): [SOUP] Downloads are broken when using the Network Process
https://bugs.webkit.org/show_bug.cgi?id=144738

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Add ResourceHandle::releaseForDownload() that releases the current
handle to be used as a download.

* platform/network/ResourceHandle.h:
* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::ResourceHandle::releaseForDownload):

Source/WebKit2:

When converting the main resource handle to a download, the
NetworkResourceLoader is aborted, and the ResourceHandle is
cleaned up aborting the download operation. We need to use a
different ResourceHandle for the download operation.

* Shared/Downloads/soup/DownloadSoup.cpp:
(WebKit::Download::startWithHandle): Use ResourceHandle::releaseForDownload()
instead of reusing the given handle.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184376 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Removed failing test expectations from passing tests.

* TestExpectations:
* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184375 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Fix PlatformDisplayWayland construction error, implement the destructor
https://bugs.webkit.org/show_bug.cgi?id=144997

Reviewed by Carlos Garcia Campos.

The PlatformDisplayWayland constructor is private, so we can't use
std::make_unique<>() to construct an object of this class.

Implement the PlatformDisplayWayland destructor, cleaning out all
the Wayland resources, if present.

* platform/graphics/wayland/PlatformDisplayWayland.cpp:
(WebCore::PlatformDisplayWayland::create):
(WebCore::PlatformDisplayWayland::PlatformDisplayWayland):
(WebCore::PlatformDisplayWayland::~PlatformDisplayWayland):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184374 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Images on www.fitstylelife.com jiggle on hover.
https://bugs.webkit.org/show_bug.cgi?id=145020
rdar://problem/20885337

Reviewed by Simon Fraser.

This patch ensures that the clipping layer of a composited content is pixel snapped properly.

Source/WebCore:

Tests: compositing/composited-parent-clipping-layer-on-subpixel-position.html
       compositing/parent-clipping-layer-on-subpixel-position.html

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateGeometry):

LayoutTests:

* compositing/composited-parent-clipping-layer-on-subpixel-position-expected.html: Added.
* compositing/composited-parent-clipping-layer-on-subpixel-position.html: Added.
* compositing/parent-clipping-layer-on-subpixel-position-expected.html: Added.
* compositing/parent-clipping-layer-on-subpixel-position.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184373 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Have DOMWindow::createWindow() take references to frames
https://bugs.webkit.org/show_bug.cgi?id=145037

Reviewed by Gyuyoung Kim.

Have DOMWindow::createWindow() take references to frames instead of
pointers as they are expected to be non-null. Also return a RefPtr
instead of a PassRefPtr.

* inspector/InspectorFrontendClientLocal.cpp:
(WebCore::InspectorFrontendClientLocal::openInNewTab):
* loader/FrameLoader.cpp:
(WebCore::createWindow):
* loader/FrameLoader.h:
* page/DOMWindow.cpp:
(WebCore::DOMWindow::createWindow):
(WebCore::DOMWindow::open):
(WebCore::DOMWindow::showModalDialog):
* page/DOMWindow.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184372 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION (r183794): Garbage tiles when body background switches to fixed
https://bugs.webkit.org/show_bug.cgi?id=145032
rdar://problem/20963679

Reviewed by Dean Jackson.

Source/WebCore:

After r183794 (or possibly an earlier commit), we failed to dynamically update
the configuration of layers that handled fixed background attachment on the root.

This would result in unpainted tiles, and non-fixed-background behavior.

Fix by calling RenderLayerCompositor::rootOrBodyStyleChanged() whenever the
style changes on the root or body renderers, and triggering a compositing update
if the fixedness of the background changes. It calls the existing rootBackgroundTransparencyChanged()
if the color changes.

Test: platform/mac-wk2/tiled-drawing/toggle-to-fixed-background.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::styleDidChange):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::rootOrBodyStyleChanged):
(WebCore::RenderLayerCompositor::rootBackgroundTransparencyChanged):
* rendering/RenderLayerCompositor.h:

LayoutTests:

Test that toggles the attachment of the body background to fixed, then dumps layers.

* platform/mac-wk2/tiled-drawing/toggle-to-fixed-background-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/toggle-to-fixed-background.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184371 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rename connectionDidClose and related methods to be more clear.
https://bugs.webkit.org/show_bug.cgi?id=145030

Reviewed by Darin Adler.

These methods were easy to confuse with "Connection::Client::didClose()", yet they
were about something much more explicit: A child process being shut down by the UI Process.

Let's call them as such.

* Shared/ChildProcessProxy.cpp:
(WebKit::ChildProcessProxy::shutDownProcess):
(WebKit::ChildProcessProxy::clearConnection): Deleted.
(WebKit::ChildProcessProxy::connectionDidClose): Deleted.
* Shared/ChildProcessProxy.h:

* UIProcess/Databases/DatabaseProcessProxy.cpp:
(WebKit::DatabaseProcessProxy::processWillShutDown):
* UIProcess/Databases/DatabaseProcessProxy.h:

* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::processWillShutDown):
* UIProcess/Network/NetworkProcessProxy.h:

* UIProcess/Plugins/PluginProcessProxy.cpp:
(WebKit::PluginProcessProxy::processWillShutDown):
* UIProcess/Plugins/PluginProcessProxy.h:

* UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::webProcessWillShutDown):
(WebKit::WebFrameProxy::disconnect): Deleted.
* UIProcess/WebFrameProxy.h:

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::webProcessWillShutDown):
(WebKit::WebPageProxy::connectionDidClose): Deleted.
* UIProcess/WebPageProxy.h:

* UIProcess/WebProcessLifetimeTracker.cpp:
(WebKit::WebProcessLifetimeTracker::webProcessWillShutDown):
(WebKit::WebProcessLifetimeTracker::connectionDidClose): Deleted.
* UIProcess/WebProcessLifetimeTracker.h:

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::processWillShutDown):
(WebKit::WebProcessProxy::shutDown):
(WebKit::WebProcessProxy::removeWebPage):
(WebKit::WebProcessProxy::didClose):
(WebKit::WebProcessProxy::disconnectFramesFromPage):
(WebKit::WebProcessProxy::shouldTerminate):
(WebKit::WebProcessProxy::requestTermination):
(WebKit::WebProcessProxy::connectionDidClose): Deleted.
(WebKit::WebProcessProxy::disconnect): Deleted.
* UIProcess/WebProcessProxy.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184370 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reverted r177753, now that <rdar://problem/19347133> is fixed.

Rubber-stamped by Benjamin Poulain.

* wtf/SaturatedArithmetic.h:
(signedAddOverflows):
(signedSubtractOverflows):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184369 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove StoreBarrierWithNullCheck, nobody ever generates this.

Rubber stamped by Benjamin Poulain and Michael Saboff.

If we did bring something like this back in the future, we would just use UntypedUse instead
of CellUse to indicate that this is what we want.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::isStoreBarrier):
* dfg/DFGNodeType.h:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileStoreBarrier):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184368 268f45cc-cd09-0410-ab3c-d52691b4dbfc

PutGlobalVar should reference the global object it's storing into
https://bugs.webkit.org/show_bug.cgi?id=145036

Reviewed by Michael Saboff.

This makes it easier to reason about store barrier insertion and elimination. This changes
the format of PutGlobalVar so that child1 is the global object and child2 is the value.
Previously it just had child1, and that was the value.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184367 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r184359 and r184362.
https://bugs.webkit.org/show_bug.cgi?id=145035

Introduced a crash in six media element tests (Requested by
rniwa on #webkit).

Reverted changesets:

"[MediaControls] Refactor media controls & bring improvements
made to iOS controls to Mac."
https://bugs.webkit.org/show_bug.cgi?id=144973
http://trac.webkit.org/changeset/184359

"Unreviewed build fix after r184359; typo."
http://trac.webkit.org/changeset/184362

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184366 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Some CFNetwork SPI to reset HSTS hosts added since a date should not be used on Yosemite.
https://bugs.webkit.org/show_bug.cgi?id=145025.
and
rdar://problem/20646308.

Patch by Zhuo Li <zachli@apple.com> on 2015-05-14
Reviewed by Alexey Proskuryakov.

* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::resetHSTSHostsAddedAfterDate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184365 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Update the New Tab button disabled state after extra domains are activated
https://bugs.webkit.org/show_bug.cgi?id=145028

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-05-14
Reviewed by Timothy Hatcher.

* UserInterface/Base/Main.js:
(WebInspector.activateExtraDomains):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184364 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[CMake] Error out when ruby is too old
https://bugs.webkit.org/show_bug.cgi?id=145014

Reviewed by Martin Robinson.

.:

Error out immediately after checking for Ruby if the ruby executable is not found, or if it
is too old.

* CMakeLists.txt:

Source/JavaScriptCore:

Don't enforce the check for the Ruby executable here; it's now enforced in the top-level
CMakeLists.txt instead.

* CMakeLists.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184363 268f45cc-cd09-0410-ab3c-d52691b4dbfc