https://bugs.webkit.org/show_bug.cgi?id=74455

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/PredictedType.cpp:
(JSC::predictionToString):
(JSC::predictionFromClassInfo):
* bytecode/PredictedType.h:
(JSC::isUint8ClampedArrayPrediction):
(JSC::isActionableMutableArrayPrediction):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::initialize):
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::fixupNode):
(JSC::DFG::Propagator::performNodeCSE):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
(JSC::DFG::clampDoubleToByte):
(JSC::DFG::compileClampIntegerToByte):
(JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* runtime/JSCell.h:
* runtime/JSGlobalData.h:
* wtf/Forward.h:
* wtf/Uint8Array.h:
* wtf/Uint8ClampedArray.h: Added.
(WTF::Uint8ClampedArray::set):
(WTF::Uint8ClampedArray::create):
(WTF::Uint8ClampedArray::Uint8ClampedArray):
(WTF::Uint8ClampedArray::subarray):

Source/WebCore:

Test: fast/js/dfg-uint8clampedarray.html

* CMakeLists.txt:
* DerivedSources.cpp:
* DerivedSources.make:
* DerivedSources.pri:
* ForwardingHeaders/wtf/Uint8ClampedArray.h: Added.
* GNUmakefile.list.am:
* Target.pri:
* UseJSC.cmake:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSBindingsAllInOne.cpp:
* bindings/js/JSDOMWindowCustom.cpp:
* bindings/js/JSUint8ClampedArrayCustom.cpp: Added.
(WebCore::JSUint8ClampedArray::indexSetter):
(WebCore::toJS):
(WebCore::JSUint8ClampedArray::set):
(WebCore::JSUint8ClampedArrayConstructor::constructJSUint8ClampedArray):
* bindings/scripts/CodeGeneratorJS.pm:
(IsTypedArrayType):
(GenerateHeader):
* html/canvas/Uint8ClampedArray.idl: Added.
* page/DOMWindow.idl:

Source/WTF:

* WTF.pro:

LayoutTests:

* fast/canvas/webgl/array-unit-tests-expected.txt:
* fast/canvas/webgl/array-unit-tests.html:
* fast/dom/Window/script-tests/window-property-descriptors.js:
* fast/dom/Window/window-properties.html:
* fast/dom/script-tests/constructed-objects-prototypes.js:
(constructorPropertiesOnWindow):
* fast/dom/script-tests/prototype-inheritance-2.js:
(constructorNamesForWindow):
* fast/js/dfg-uint8clampedarray-expected.txt: Added.
* fast/js/dfg-uint8clampedarray.html: Added.
* fast/js/script-tests/dfg-uint8clampedarray.js: Added.
(getter1):
(setter1):
(getter2):
(setter2):
(getter3):
(setter3):
(getter4):
(setter4):
(getters.getter1.a):
(.a):
(setters.setter1.a):
(safeGetter):
(safeSetter):
* fast/js/script-tests/global-constructors.js:
* platform/chromium/fast/canvas/webgl/array-unit-tests-expected.txt: Copied from LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt.
* platform/chromium/test_expectations.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105217 268f45cc-cd09-0410-ab3c-d52691b4dbfc