https://bugs.webkit.org/show_bug.cgi?id=121750

Reviewed by Andreas Kling.

Source/JavaScriptCore:

* interpreter/CallFrame.h:
(JSC::ExecState::uncheckedArgument): Added. Like argument, but with an
assertion rather than a runtime check.

* API/APICallbackFunction.h:
(JSC::APICallbackFunction::call): Use uncheckedArgument because we are
already in a loop over arguments, so don't need a range check.
* API/JSCallbackConstructor.cpp:
(JSC::constructJSCallback): Ditto.
* API/JSCallbackObjectFunctions.h:
(JSC::JSCallbackObject::construct): Ditto.
(JSC::JSCallbackObject::call): Ditto.
* jsc.cpp:
(functionPrint): Ditto.
(functionRun): Ditto.
(functionSetSamplingFlags): Ditto.
(functionClearSamplingFlags): Ditto.
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncConcat): Ditto.
(JSC::arrayProtoFuncPush): Use uncheckedArgument because there is already
code that explicitly checks argumentCount.
(JSC::arrayProtoFuncSplice): Ditto.
(JSC::arrayProtoFuncUnShift): Ditto.
(JSC::arrayProtoFuncReduce): Ditto.
(JSC::arrayProtoFuncReduceRight): Ditto.
(JSC::arrayProtoFuncLastIndexOf): Ditto.
* runtime/DatePrototype.cpp:
(JSC::fillStructuresUsingTimeArgs): Ditto.
(JSC::fillStructuresUsingDateArgs): Ditto.
* runtime/JSArrayBufferConstructor.cpp:
(JSC::constructArrayBuffer): Ditto.
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice): Ditto.
* runtime/JSBoundFunction.cpp:
(JSC::boundFunctionCall): Ditto.
(JSC::boundFunctionConstruct): Ditto.
* runtime/JSDataViewPrototype.cpp:
(JSC::getData): Ditto.
(JSC::setData): Ditto.
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayView): Ditto.
* runtime/JSGenericTypedArrayViewPrototypeInlines.h:
(JSC::genericTypedArrayViewProtoFuncSet): Ditto.
(JSC::genericTypedArrayViewProtoFuncSubarray): Ditto.
* runtime/JSONObject.cpp:
(JSC::JSONProtoFuncParse): Ditto.
(JSC::JSONProtoFuncStringify): Ditto.
* runtime/JSPromiseConstructor.cpp:
(JSC::constructPromise): Ditto.
(JSC::JSPromiseConstructorFuncFulfill): Ditto.
(JSC::JSPromiseConstructorFuncResolve): Ditto.
(JSC::JSPromiseConstructorFuncReject): Ditto.
* runtime/MathObject.cpp:
(JSC::mathProtoFuncMax): Ditto.
(JSC::mathProtoFuncMin): Ditto.

* runtime/NameConstructor.cpp:
(JSC::constructPrivateName): Removed unneeded check of argumentCout
that simply repeats what argument already does.
* runtime/NativeErrorConstructor.cpp:
(JSC::Interpreter::constructWithNativeErrorConstructor): Ditto.
(JSC::Interpreter::callNativeErrorConstructor): Ditto.

* runtime/NumberConstructor.cpp:
(JSC::constructWithNumberConstructor): Use uncheckedArgument since
there is already code that explicitly checks argument count.
(JSC::callNumberConstructor): Ditto.

* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorCreate): Small refactoring to not call argument(0)
three times.

* runtime/SetConstructor.cpp:
(JSC::constructSet): Use uncheckedArgument since we are already in a loop
over arguments.

* runtime/StringConstructor.cpp:
(JSC::stringFromCharCodeSlowCase): In a loop.
(JSC::stringFromCharCode): Already checked count.
(JSC::constructWithStringConstructor): Ditto.
(JSC::callStringConstructor): Ditto.
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncConcat): Already checked count.
* runtime/TestRunnerUtils.cpp:
(JSC::numberOfDFGCompiles): Ditto.
(JSC::setNeverInline): Ditto.

Source/WebCore:

* bindings/js/JSHTMLCanvasElementCustom.cpp:
(WebCore::JSHTMLCanvasElement::probablySupportsContext): Already checked count.
(WebCore::JSHTMLCanvasElement::toDataURL): Ditto.
* bindings/js/JSHTMLDocumentCustom.cpp:
(WebCore::documentWrite): In a loop.
* bindings/js/JSInjectedScriptHostCustom.cpp:
(WebCore::JSInjectedScriptHost::inspectedObject): Already checked count.
(WebCore::JSInjectedScriptHost::internalConstructorName): Ditto.
(WebCore::JSInjectedScriptHost::isHTMLAllCollection): Ditto.
(WebCore::JSInjectedScriptHost::type): Ditto.
(WebCore::JSInjectedScriptHost::functionDetails): Ditto.
(WebCore::JSInjectedScriptHost::getEventListeners): Ditto.
(WebCore::JSInjectedScriptHost::inspect): Ditto.
(WebCore::JSInjectedScriptHost::databaseId): Ditto.
(WebCore::JSInjectedScriptHost::storageId): Ditto.
* bindings/js/JSSQLTransactionSyncCustom.cpp:
(WebCore::JSSQLTransactionSync::executeSql): Ditto.
* bindings/js/JSSVGLengthCustom.cpp:
(WebCore::JSSVGLength::convertToSpecifiedUnits): Ditto.
* bindings/js/JSSharedWorkerCustom.cpp:
(WebCore::JSSharedWorkerConstructor::constructJSSharedWorker): Ditto.

* bindings/js/JSWebGLRenderingContextCustom.cpp:
(WebCore::getObjectParameter): Already checked count.
(WebCore::JSWebGLRenderingContext::getAttachedShaders): Removed tortured code
to triply do the checking that the toWebGLProgram function already does, including
spurious exception checking in code that can't create an exception. Also count is
already checked.
(WebCore::JSWebGLRenderingContext::getExtension): More of the same.
(WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter): Ditto.
(WebCore::JSWebGLRenderingContext::getParameter): Ditto.
(WebCore::JSWebGLRenderingContext::getProgramParameter): Ditto.
(WebCore::JSWebGLRenderingContext::getShaderParameter): Ditto.
(WebCore::JSWebGLRenderingContext::getUniform): Ditto.
(WebCore::dataFunctionf): Ditto.
(WebCore::dataFunctioni): Ditto.
(WebCore::dataFunctionMatrix): Ditto.

* bindings/js/JSWorkerGlobalScopeCustom.cpp:
(WebCore::JSWorkerGlobalScope::importScripts): In a loop.
* bindings/js/JSXMLHttpRequestCustom.cpp:
(WebCore::JSXMLHttpRequest::open): Already checked. Also removed some unneeded
argument count checks.
(WebCore::JSXMLHttpRequest::send): Removed unneeded special case for 0 argument
count that does the same thing as the undefined case, since asking for an
argument past the count yields undefined.

* bindings/js/JSXSLTProcessorCustom.cpp:
(WebCore::JSXSLTProcessor::setParameter): Already checked.
(WebCore::JSXSLTProcessor::getParameter): Already checked.
(WebCore::JSXSLTProcessor::removeParameter): Already checked.

* bindings/js/ScheduledAction.cpp:
(WebCore::ScheduledAction::ScheduledAction): In a loop.
* bindings/js/ScriptCallStackFactory.cpp:
(WebCore::createScriptArguments): Ditto.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateParametersCheck): Removed some excess argumentCount checks.
Used uncheckedArgument in a few places. More needs to be done, especially for
overloaded functions.

* bridge/c/c_instance.cpp:
(JSC::Bindings::CInstance::invokeMethod): In a loop.
(JSC::Bindings::CInstance::invokeDefaultMethod): Ditto.
* bridge/objc/objc_instance.mm:
(ObjcInstance::invokeObjcMethod): Ditto.
(ObjcInstance::invokeDefaultMethod): Ditto.

* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
Updated.

Source/WebKit2:

* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::callMethod): In a loop.
(WebKit::JSNPObject::callObject): Ditto.
(WebKit::JSNPObject::callConstructor): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156240 268f45cc-cd09-0410-ab3c-d52691b4dbfc