Remove putDirectVirtual

Reviewed by Sam Weinig.

This could most generously be described as 'vestigial'.
No performance impact.

* API/JSObjectRef.cpp:
(JSObjectSetProperty):
    - changed to use defineOwnProperty
* debugger/DebuggerActivation.cpp:
* debugger/DebuggerActivation.h:
    - remove putDirectVirtual
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
    - changed to use defineOwnProperty
* runtime/ClassInfo.h:
* runtime/JSActivation.cpp:
* runtime/JSActivation.h:
* runtime/JSCell.cpp:
* runtime/JSCell.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
* runtime/JSObject.cpp:
* runtime/JSObject.h:
* runtime/JSProxy.cpp:
* runtime/JSProxy.h:
* runtime/JSSymbolTableObject.cpp:
* runtime/JSSymbolTableObject.h:
    - remove putDirectVirtual
* runtime/PropertyDescriptor.h:
(JSC::PropertyDescriptor::PropertyDescriptor):
    - added constructor for convenience



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154459 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove getOwnPropertyDescriptor trap

Reviewed by Geoff Garen.

All implementations of this method are now called via the method table, and equivalent in behaviour.
Remove all duplicate implementations (and the method table trap), and add a single member function implementation on JSObject.

Source/JavaScriptCore: 

* API/JSCallbackObject.h:
* API/JSCallbackObjectFunctions.h:
* debugger/DebuggerActivation.cpp:
* debugger/DebuggerActivation.h:
* runtime/Arguments.cpp:
* runtime/Arguments.h:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayConstructor.h:
* runtime/ArrayPrototype.cpp:
* runtime/ArrayPrototype.h:
* runtime/BooleanPrototype.cpp:
* runtime/BooleanPrototype.h:
    - remove getOwnPropertyDescriptor
* runtime/ClassInfo.h:
    - remove getOwnPropertyDescriptor from MethodTable
* runtime/DateConstructor.cpp:
* runtime/DateConstructor.h:
* runtime/DatePrototype.cpp:
* runtime/DatePrototype.h:
* runtime/ErrorPrototype.cpp:
* runtime/ErrorPrototype.h:
* runtime/JSActivation.cpp:
* runtime/JSActivation.h:
* runtime/JSArray.cpp:
* runtime/JSArray.h:
* runtime/JSArrayBuffer.cpp:
* runtime/JSArrayBuffer.h:
* runtime/JSArrayBufferView.cpp:
* runtime/JSArrayBufferView.h:
* runtime/JSCell.cpp:
* runtime/JSCell.h:
* runtime/JSDataView.cpp:
* runtime/JSDataView.h:
* runtime/JSDataViewPrototype.cpp:
* runtime/JSDataViewPrototype.h:
* runtime/JSFunction.cpp:
* runtime/JSFunction.h:
* runtime/JSGenericTypedArrayView.h:
* runtime/JSGenericTypedArrayViewInlines.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
* runtime/JSNotAnObject.cpp:
* runtime/JSNotAnObject.h:
* runtime/JSONObject.cpp:
* runtime/JSONObject.h:
    - remove getOwnPropertyDescriptor
* runtime/JSObject.cpp:
(JSC::JSObject::propertyIsEnumerable):
    - switch to call new getOwnPropertyDescriptor member function
(JSC::JSObject::getOwnPropertyDescriptor):
    - new, based on imlementation from GET_OWN_PROPERTY_DESCRIPTOR_IMPL
(JSC::JSObject::defineOwnNonIndexProperty):
    - switch to call new getOwnPropertyDescriptor member function
* runtime/JSObject.h:
* runtime/JSProxy.cpp:
* runtime/JSProxy.h:
* runtime/NamePrototype.cpp:
* runtime/NamePrototype.h:
* runtime/NumberConstructor.cpp:
* runtime/NumberConstructor.h:
* runtime/NumberPrototype.cpp:
* runtime/NumberPrototype.h:
    - remove getOwnPropertyDescriptor
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorGetOwnPropertyDescriptor):
(JSC::objectConstructorSeal):
(JSC::objectConstructorFreeze):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
    - switch to call new getOwnPropertyDescriptor member function
* runtime/ObjectConstructor.h:
    - remove getOwnPropertyDescriptor
* runtime/PropertyDescriptor.h:
    - remove GET_OWN_PROPERTY_DESCRIPTOR_IMPL
* runtime/RegExpConstructor.cpp:
* runtime/RegExpConstructor.h:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpMatchesArray.h:
* runtime/RegExpObject.cpp:
* runtime/RegExpObject.h:
* runtime/RegExpPrototype.cpp:
* runtime/RegExpPrototype.h:
* runtime/StringConstructor.cpp:
* runtime/StringConstructor.h:
* runtime/StringObject.cpp:
* runtime/StringObject.h:
    - remove getOwnPropertyDescriptor

Source/WebCore: 

* WebCore.exp.in:
* bindings/js/JSDOMWindowCustom.cpp:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorDeclaration):
(GenerateConstructorHelperMethods):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
* bindings/scripts/test/JS/JSTestActiveDOMObject.h:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
* bindings/scripts/test/JS/JSTestEventConstructor.h:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
* bindings/scripts/test/JS/JSTestEventTarget.h:
* bindings/scripts/test/JS/JSTestException.cpp:
* bindings/scripts/test/JS/JSTestException.h:
* bindings/scripts/test/JS/JSTestInterface.cpp:
* bindings/scripts/test/JS/JSTestInterface.h:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
* bindings/scripts/test/JS/JSTestNamedConstructor.h:
* bindings/scripts/test/JS/JSTestNode.cpp:
* bindings/scripts/test/JS/JSTestNode.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/JS/JSTestObj.h:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
* bindings/scripts/test/JS/JSTestTypedefs.h:
* bridge/jsc/BridgeJSC.h:
(JSC::Bindings::Instance::getOwnPropertySlot):
* bridge/objc/objc_runtime.h:
* bridge/objc/objc_runtime.mm:
* bridge/runtime_array.cpp:
* bridge/runtime_array.h:
* bridge/runtime_method.cpp:
* bridge/runtime_method.h:
* bridge/runtime_object.cpp:
* bridge/runtime_object.h:
    - remove getOwnPropertyDescriptor

Source/WebKit2: 

* WebProcess/Plugins/Netscape/JSNPObject.cpp:
* WebProcess/Plugins/Netscape/JSNPObject.h:
    - remove getOwnPropertyDescriptor



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154373 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove getPropertyDescriptor

Reviewed by Oliver Hunt.

This is used by lookupGetter/lookupSetter - this can easily bee replaced by getPropertySlot.
Since we'll be getting the GetterSetter from the slot in the setter case, rename isGetter() to isAccessor().

* runtime/JSObject.cpp:
* runtime/JSObject.h:
    - remove getPropertyDescriptor
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
    - replace call to getPropertyDescriptor with getPropertySlot
* runtime/PropertyDescriptor.h:
* runtime/PropertySlot.h:
(JSC::PropertySlot::isAccessor):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::getterSetter):
    - rename isGetter() to isAccessor()



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154337 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove custom getOwnPropertyDescriptor for JSProxy

Reviewed by Geoff Garen.

GET_OWN_PROPERTY_DESCRIPTOR_IMPL runs afoul with JSProxy due to the workaround for JSDOMWindow's broken behavior.
Because the window object incorrectly searches the prototype chain in getOwnPropertySlot we check that the base
object matches, but in the case of JSProxy we can end up comparing the window object to the window shell & falsely
assuming this is a prototype property. Add toThis conversion to correctly identify proxied own access. I've kept
the original slotBase check as a fast case, and also so that direct access on JSDOMWindow still works.

* runtime/JSProxy.cpp:
    - Remove custom getOwnPropertyDescriptor implementation.
* runtime/PropertyDescriptor.h:
    - Modify own property access check to perform toThis conversion.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154334 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove custom getOwnPropertyDescriptor for global objects

Reviewed by Geoff Garen.

Fix attributes of JSC SynbolTableObject entries, ensure that cross frame access is safe, and suppress prototype chain walk.

* runtime/JSGlobalObject.cpp:
    - Remove custom getOwnPropertyDescriptor implementation.
* runtime/JSSymbolTableObject.h:
(JSC::symbolTableGet):
    - The symbol table does not store the DontDelete attribute, we should be adding it back in.
* runtime/PropertyDescriptor.h:
    - JSDOMWindow walks the prototype chain on own access. This is bad, but for now workaround for the getOwnPropertyDescriptor case.
* runtime/PropertySlot.h:
(JSC::PropertySlot::setUndefined):
    - This is used by WebCore when blocking access to properties on cross-frame access.
      Mark blocked properties as read-only, non-configurable to prevent defineProperty.

Source/WebCore: <https://webkit.org/b/120041> Remove superfluous min calls in RenderBlock::computeOverflow

Patch by Ryosuke Niwa <rniwa@webkit.org> on 2013-08-19
Reviewed by Simon Fraser.

Merge https://chromium.googlesource.com/chromium/blink/+/29cad35d6b4642804e6b7c1a30f0b4435dd7a71d

They are contained in an "if" statement that ensures that textIndent < 0 and so the min will never be 0.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::computeOverflow):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154313 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Start removing custom implementations of getOwnPropertyDescriptor

Reviewed by Sam Weinig.

This can now typically implemented in terms of getOwnPropertySlot.
Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
Switch over most classes in JSC & the WebCore bindings generator to use this.

Source/JavaScriptCore: 

* API/JSCallbackObjectFunctions.h:
* debugger/DebuggerActivation.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSArrayBuffer.cpp:
* runtime/JSArrayBufferView.cpp:
* runtime/JSCell.cpp:
* runtime/JSDataView.cpp:
* runtime/JSDataViewPrototype.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGenericTypedArrayViewInlines.h:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/NamePrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* runtime/PropertyDescriptor.h:
    - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
* runtime/PropertySlot.h:
(JSC::PropertySlot::isValue):
(JSC::PropertySlot::isGetter):
(JSC::PropertySlot::isCustom):
(JSC::PropertySlot::isCacheableValue):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::attributes):
(JSC::PropertySlot::getterSetter):
    - Add accessors necessary to convert PropertySlot to descriptor.
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpMatchesArray.h:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.

Source/WebCore: 

* bindings/js/JSCSSStyleDeclarationCustom.cpp:
* bindings/js/JSHTMLAppletElementCustom.cpp:
* bindings/js/JSHTMLEmbedElementCustom.cpp:
* bindings/js/JSHTMLObjectElementCustom.cpp:
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::getOwnPropertySlotDelegate):
* bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertySlotDelegate):
* bindings/js/JSWorkerGlobalScopeCustom.cpp:
    - Remove getOwnPropertyDescriptorDelegate methods,
      Change attributes of cross-frame access properties in JSHistory/JSLocation to prevent properties from being redefined.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):
    - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
* bindings/scripts/test/JS/JSTestException.cpp:
* bindings/scripts/test/JS/JSTestInterface.cpp:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
* bindings/scripts/test/JS/JSTestNode.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
    - Update test expectations.

LayoutTests: 

* http/tests/security/xss-DENIED-defineProperty-expected.txt:
    - Remove erroneous error messages - cross frame access to reload is allowed - it's just read-only, non-configurable.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154300 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=107327

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

We're renaming these two files, so we have to replace the names everywhere.

* API/APICast.h:
* API/APIJSValue.h: Removed.
* API/JSBlockAdaptor.mm:
* API/JSStringRefCF.cpp:
* API/JSValue.h: Copied from Source/JavaScriptCore/API/APIJSValue.h.
* API/JSValue.mm:
* API/JSValueInternal.h:
* API/JSValueRef.cpp:
* API/JSWeakObjectMapRefPrivate.cpp:
* API/JavaScriptCore.h:
* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* bytecode/CallLinkStatus.h:
* bytecode/CodeBlock.cpp:
* bytecode/MethodOfGettingAValueProfile.h:
* bytecode/ResolveGlobalStatus.cpp:
* bytecode/ResolveGlobalStatus.h:
* bytecode/SpeculatedType.h:
* bytecode/ValueRecovery.h:
* dfg/DFGByteCodeParser.cpp:
* dfg/DFGJITCompiler.cpp:
* dfg/DFGNode.h:
* dfg/DFGSpeculativeJIT.cpp:
* dfg/DFGSpeculativeJIT64.cpp:
* heap/CopiedBlock.h:
* heap/HandleStack.cpp:
* heap/HandleTypes.h:
* heap/WeakImpl.h:
* interpreter/Interpreter.h:
* interpreter/Register.h:
* interpreter/VMInspector.h:
* jit/HostCallReturnValue.cpp:
* jit/HostCallReturnValue.h:
* jit/JITCode.h:
* jit/JITExceptions.cpp:
* jit/JITExceptions.h:
* jit/JSInterfaceJIT.h:
* llint/LLIntCLoop.h:
* llint/LLIntData.h:
* llint/LLIntSlowPaths.cpp:
* profiler/ProfilerBytecode.h:
* profiler/ProfilerBytecodeSequence.h:
* profiler/ProfilerBytecodes.h:
* profiler/ProfilerCompilation.h:
* profiler/ProfilerCompiledBytecode.h:
* profiler/ProfilerDatabase.h:
* profiler/ProfilerOSRExit.h:
* profiler/ProfilerOSRExitSite.h:
* profiler/ProfilerOrigin.h:
* profiler/ProfilerOriginStack.h:
* runtime/ArgList.cpp:
* runtime/CachedTranscendentalFunction.h:
* runtime/CallData.h:
* runtime/Completion.h:
* runtime/ConstructData.h:
* runtime/DateConstructor.cpp:
* runtime/DateInstance.cpp:
* runtime/DatePrototype.cpp:
* runtime/JSAPIValueWrapper.h:
* runtime/JSCJSValue.cpp: Copied from Source/JavaScriptCore/runtime/JSValue.cpp.
* runtime/JSCJSValue.h: Copied from Source/JavaScriptCore/runtime/JSValue.h.
(JSValue):
* runtime/JSCJSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlines.h.
* runtime/JSGlobalData.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObjectFunctions.h:
* runtime/JSStringJoiner.h:
* runtime/JSValue.cpp: Removed.
* runtime/JSValue.h: Removed.
* runtime/JSValueInlines.h: Removed.
* runtime/LiteralParser.h:
* runtime/Operations.h:
* runtime/PropertyDescriptor.h:
* runtime/PropertySlot.h:
* runtime/Protect.h:
* runtime/RegExpPrototype.cpp:
* runtime/Structure.h:

Source/WebCore:

No new tests.

We're renaming these two files, so we have to replace the names everywhere.

* ForwardingHeaders/runtime/JSCJSValue.h: Copied from Source/WebCore/ForwardingHeaders/runtime/JSValue.h.
* ForwardingHeaders/runtime/JSValue.h: Removed.
* WebCore.vcproj/WebCore.vcproj:
* bindings/js/JSArrayBufferViewHelper.h:
* bindings/js/JSCustomXPathNSResolver.h:
* bindings/js/JSHTMLAllCollectionCustom.cpp:
* bindings/js/JSIntentConstructor.cpp:
* bindings/js/JSMessagePortCustom.h:
* bindings/js/JSNodeFilterCondition.h:
* bindings/js/JavaScriptCallFrame.cpp:
* bindings/js/ScriptCallStackFactory.cpp:
* bindings/js/ScriptValue.h:
* bindings/js/SerializedScriptValue.h:
* bindings/objc/WebScriptObjectPrivate.h:
* bridge/c/c_utility.h:
* bridge/testbindings.cpp:
* bridge/testbindings.mm:
* bridge/testqtbindings.cpp:
* plugins/PluginView.cpp:
* plugins/blackberry/PluginViewBlackBerry.cpp:
* plugins/gtk/PluginViewGtk.cpp:
* plugins/mac/PluginViewMac.mm:
* plugins/qt/PluginViewQt.cpp:
* plugins/win/PluginViewWin.cpp:

Source/WebKit/gtk:

We're renaming these two files, so we have to replace the names everywhere.

* WebCoreSupport/DumpRenderTreeSupportGtk.cpp:

Source/WebKit/mac:

We're renaming these two files, so we have to replace the names everywhere.

* DOM/WebDOMOperations.mm:
* ForwardingHeaders/runtime/JSCJSValue.h: Copied from Source/WebKit/mac/ForwardingHeaders/runtime/JSValue.h.
* ForwardingHeaders/runtime/JSValue.h: Removed.
* WebView/WebFrame.mm:
* WebView/WebView.mm:

Source/WebKit/win:

We're renaming these two files, so we have to replace the names everywhere.

* WebFrame.cpp:
* WebView.cpp:

Source/WebKit/wx:

We're renaming these two files, so we have to replace the names everywhere.

* WebFrame.cpp:
* WebView.cpp:

Source/WebKit2:

We're renaming these two files, so we have to replace the names everywhere.

* WebProcess/WebPage/WebPage.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140718 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=79931

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

* runtime/JSObject.cpp:
(JSC::JSObject::defineOwnProperty):
    - use attributesOverridingCurrent instead of attributesWithOverride.
* runtime/PropertyDescriptor.cpp:
* runtime/PropertyDescriptor.h:
    - remove attributesWithOverride - attributesOverridingCurrent does the same thing.

LayoutTests: 

* fast/js/Object-defineProperty-expected.txt:
* fast/js/script-tests/Object-defineProperty.js:
    - Added tests.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@109240 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=72855

Reviewed by Darin Adler.

Added WTF_EXPORT_PRIVATE and JS_EXPORT_PRIVATE based on JavaScriptCore.exp files.
The change is generated by a tool calledListExportables (https://github.com/omo/ListExportables)

* API/OpaqueJSString.h:
* bytecode/CodeBlock.h:
* bytecode/SamplingTool.h:
* debugger/Debugger.h:
* debugger/DebuggerActivation.h:
* debugger/DebuggerCallFrame.h:
* heap/AllocationSpace.h:
* heap/HandleHeap.h:
* heap/Heap.h:
* heap/MachineStackMarker.h:
* heap/MarkStack.h:
* heap/VTableSpectrum.h:
* heap/WriteBarrierSupport.h:
* parser/Nodes.h:
* parser/ParserArena.h:
* profiler/Profile.h:
* runtime/ArgList.h:
* runtime/CallData.h:
* runtime/Completion.h:
* runtime/ConstructData.h:
* runtime/DateInstance.h:
* runtime/Error.h:
* runtime/ExceptionHelpers.h:
* runtime/FunctionConstructor.h:
* runtime/Identifier.h:
* runtime/InitializeThreading.h:
* runtime/InternalFunction.h:
* runtime/JSArray.h:
* runtime/JSByteArray.h:
* runtime/JSCell.h:
* runtime/JSFunction.h:
* runtime/JSGlobalData.cpp:
* runtime/JSGlobalData.h:
* runtime/JSGlobalObject.h:
* runtime/JSGlobalThis.h:
* runtime/JSLock.h:
* runtime/JSObject.h:
* runtime/JSString.h:
* runtime/JSValue.h:
* runtime/JSVariableObject.h:
* runtime/Lookup.h:
* runtime/MemoryStatistics.h:
* runtime/ObjectPrototype.h:
* runtime/Options.h:
* runtime/PropertyDescriptor.h:
* runtime/PropertyNameArray.h:
* runtime/PropertySlot.h:
* runtime/RegExp.h:
* runtime/RegExpObject.h:
* runtime/SamplingCounter.h:
* runtime/SmallStrings.h:
* runtime/StringObject.h:
* runtime/Structure.h:
* runtime/TimeoutChecker.h:
* runtime/UString.h:
* runtime/WriteBarrier.h:
* wtf/ArrayBufferView.h:
* wtf/ByteArray.h:
* wtf/CryptographicallyRandomNumber.h:
* wtf/CurrentTime.h:
* wtf/DateMath.h:
* wtf/DecimalNumber.h:
* wtf/FastMalloc.cpp:
* wtf/FastMalloc.h:
* wtf/MD5.h:
* wtf/MainThread.h:
* wtf/MetaAllocator.h:
* wtf/MetaAllocatorHandle.h:
* wtf/OSAllocator.h:
* wtf/PageBlock.h:
* wtf/RandomNumber.h:
* wtf/RefCountedLeakCounter.h:
* wtf/SHA1.h:
* wtf/Threading.cpp:
* wtf/Threading.h:
* wtf/ThreadingPrimitives.h:
* wtf/WTFThreadData.h:
* wtf/dtoa.h:
* wtf/text/AtomicString.h:
* wtf/text/CString.h:
* wtf/text/StringBuilder.h:
* wtf/text/StringImpl.h:
* wtf/text/WTFString.h:
* wtf/unicode/Collator.h:
* wtf/unicode/UTF8.h:
* yarr/Yarr.h:
* yarr/YarrPattern.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104900 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=76148

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

AccessorDescriptor properties may have their get & set properties defined to reference a function
(Callable object) or be set to undefined. Valid PropertyDescriptors created by toPropertyDescriptor
(defined from JS code via Object.defineProperty, etc) have get and set properties that are in one of
three states (1) nonexistent, (2) set to undefined, or (3) a function (any Callable object).

On the PropertyDescriptor object these three states are represneted by JSValue(), jsUndefined(), and
any JSObject* (with a constraint that this must be callable).

Logically the get/set property of an accessor descriptor on an object might be in any of the three
states above, but in practice there is no way to distinguish between the first two states. As such
we stor the get/set values in property storage in a JSObject* field, with 0 indicating absent or
undefined. When unboxing to a PropertyDescriptor, map this back to a JS undefined value.

* runtime/GetterSetter.h:
(JSC::GetterSetter::setGetter):
(JSC::GetterSetter::setSetter):
    - Allow the getter/setter to be cleared.
* runtime/JSArray.cpp:
(JSC::JSArray::putDescriptor):
    - Changed to call getterObject/setterObject.
(JSC::JSArray::defineOwnNumericProperty):
    - Added ASSERT.
* runtime/JSObject.cpp:
(JSC::putDescriptor):
(JSC::JSObject::defineOwnProperty):
    - Changed to call getterObject/setterObject.
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorGetOwnPropertyDescriptor):
    - getter/setter values read from properties on object are never missing, they will now be set as undefined by 'setDescriptor'.
(JSC::toPropertyDescriptor):
    - Do not translate undefined->empty, this loses an important distinction between a get/set property being absent, or being explicitly set to undefined.
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::getterObject):
(JSC::PropertyDescriptor::setterObject):
    - Accessors to convert the get/set property to an object pointer, converting undefined to 0.
(JSC::PropertyDescriptor::setDescriptor):
(JSC::PropertyDescriptor::setAccessorDescriptor):
    - Translate a getter/setter internally represented at 0 to undefined, indicating that it is present.
* runtime/PropertyDescriptor.h:
    - Declare getterObject/setterObject.

LayoutTests: 

* fast/js/Object-defineProperty-expected.txt:
* fast/js/script-tests/Object-defineProperty.js:
    - Update a couple of inaccurate tests (it is invalid for a property to have
      both a get: and value: field; AccessorDescritor properties do not have a
      writable property). Add more test cases.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104836 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=75975

Reviewed by Sam Weinig.

Source/JavaScriptCore: 

Rather than strictEqual.

* runtime/JSArray.cpp:
(JSC::JSArray::defineOwnNumericProperty):
    - Missing configurablePresent() check.
* runtime/JSObject.cpp:
(JSC::JSObject::defineOwnProperty):
    - call sameValue.
* runtime/PropertyDescriptor.cpp:
(JSC::sameValue):
    - Moved from JSArray.cpp, fix NaN comparison.
(JSC::PropertyDescriptor::equalTo):
    - call sameValue.
* runtime/PropertyDescriptor.h:
    - Added declaration for sameValue.

LayoutTests: 

* fast/js/array-defineOwnProperty-expected.txt:
* fast/js/script-tests/array-defineOwnProperty.js:
    - Add new test cases.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104602 268f45cc-cd09-0410-ab3c-d52691b4dbfc

defineOwnProperty not implemented for Array objects

Reviewed by Sam Weinig.

Source/JavaScriptCore: 

Implements support for getter/setter & non-default attribute properties on arrays,
by forcing them into a dictionary-like 'SparseMode'. This fixes ~300 test-262
test failures.

* JavaScriptCore.exp:
    - Updated exports.
* dfg/DFGOperations.cpp:
    - JSArray::pop now requires an exec state.
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncPop):
    - JSArray::pop now requires an exec state.
* runtime/JSArray.cpp:
(JSC::SparseArrayValueMap::add):
    - Add a potentially empty entry into the map.
(JSC::SparseArrayValueMap::put):
    - Changed to call setter.
(JSC::SparseArrayEntry::get):
    - calls getters.
(JSC::SparseArrayEntry::getNonSparseMode):
    - does not call getters.
(JSC::JSArray::enterSparseMode):
    - Convert into 'SparseMode' - removes the vectors, don't allow it to be recreated.
(JSC::JSArray::putDescriptor):
    - Create a numeric property based on a descriptor.
(JSC::sameValue):
    - See ES5.1 9.12.
(JSC::reject):
    - Helper for the [[DefineOwnProperty]] algorithm.
(JSC::JSArray::defineOwnNumericProperty):
    - Define an indexed property on an array object.
(JSC::JSArray::setLengthWritable):
    - Marks the length read-only, enters SparseMode as necessary.
(JSC::JSArray::defineOwnProperty):
    - Defines either an indexed property or 'length' on an array object.
(JSC::JSArray::getOwnPropertySlotByIndex):
    - Updated to correctly handle accessor descriptors & attributes.
(JSC::JSArray::getOwnPropertyDescriptor):
    - Updated to correctly handle accessor descriptors & attributes.
(JSC::JSArray::put):
    - Pass strict mode flag to setLength.
(JSC::JSArray::putByIndex):
    - putByIndexBeyondVectorLength requires an ExecState* rather than a JSGloablData&.
(JSC::JSArray::putByIndexBeyondVectorLength):
    - Pass exec to SparseArrayValueMap::put.
(JSC::JSArray::deletePropertyByIndex):
    - Do not allow deletion of non-configurable properties.
(JSC::compareKeysForQSort):
    - used in implementation of getOwnPropertyNames.
(JSC::JSArray::getOwnPropertyNames):
    - Properties in the sparse map should be iterated in order.
(JSC::JSArray::setLength):
    - Updated to take a 'shouldThrow' flag, return a result indicating error.
(JSC::JSArray::pop):
    - pop should throw an error if length is not writable, even if the array is empty.
(JSC::JSArray::push):
    - putByIndexBeyondVectorLength requires an ExecState* rather than a JSGloablData&.
(JSC::JSArray::sort):
    - Changed 'get' to 'getNonSparseMode' (can't be getters to call).
(JSC::JSArray::compactForSorting):
    - Changed 'get' to 'getNonSparseMode' (can't be getters to call).
* runtime/JSArray.h:
(JSC::SparseArrayValueMap::lengthIsReadOnly):
    - Check if the length is read only.
(JSC::SparseArrayValueMap::setLengthIsReadOnly):
    - Mark the length as read only.
(JSC::SparseArrayValueMap::find):
    - Moved into header.
(JSC::JSArray::isLengthWritable):
    - Wraps SparseArrayValueMap::lengthIsReadOnly.
* runtime/JSObject.cpp:
(JSC::JSObject::defineOwnProperty):
    - Should be returning the result of putDescriptor.
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::attributesOverridingCurrent):
    - Added attributesOverridingCurrent - this should probably be merged with attributesWithOverride.
* runtime/PropertyDescriptor.h:
    - Added attributesOverridingCurrent.

LayoutTests: 

* fast/js/array-defineOwnProperty-expected.txt: Added.
* fast/js/array-defineOwnProperty.html: Added.
* fast/js/script-tests/array-defineOwnProperty.js: Added.
    - Added tests for array properties with accessors & non-defulat attributes.
* fast/js/mozilla/strict/15.4.4.6-expected.txt:
* fast/js/mozilla/strict/8.12.5-expected.txt:
* ietestcenter/Javascript/15.4.4.14-9-a-12-expected.txt:
* ietestcenter/Javascript/15.4.4.15-8-a-12-expected.txt:
    - Check in passing results.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104488 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ThrowTypeError should be a singleton object

Reviewed by Sam Weinig.

Source/JavaScriptCore: 

Per section 13.2.3 of the spec.
We could change setAccessorDescriptor to be able to share the global
GetterSetter object, rather than storing the accessor functions and
creating a new GetterSetter in defineProperty - but this won't be a
small change to PropertyDescriptors (and would probably mean making
GetterSetter objects immutable?) - so I'll leave that for another
patch.

* JavaScriptCore.exp:
    - don't export setAccessorDescriptor
* runtime/Arguments.cpp:
(JSC::Arguments::createStrictModeCallerIfNecessary):
(JSC::Arguments::createStrictModeCalleeIfNecessary):
    - call throwTypeErrorGetterSetter instead of createTypeErrorFunction
* runtime/Error.cpp:
* runtime/Error.h:
    - remove createTypeErrorFunction
* runtime/JSFunction.cpp:
* runtime/JSFunction.h:
    - remove unused createDescriptorForThrowingProperty
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
(JSC::JSGlobalObject::visitChildren):
    - removed m_strictModeTypeErrorFunctionStructure.
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::internalFunctionStructure):
    - removed m_strictModeTypeErrorFunctionStructure.
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setAccessorDescriptor):
    - changed to take a GetterSetter
* runtime/PropertyDescriptor.h:
    - changed to take a GetterSetter

LayoutTests: 

Per section 13.2.3 of the spec.

* fast/js/basic-strict-mode-expected.txt:
    - ThrowTypeError is a singleton, so cannot generate
      property-specific error messages.
* fast/js/script-tests/strict-throw-type-error.js: Added.
* fast/js/strict-throw-type-error-expected.txt: Added.
* fast/js/strict-throw-type-error.html: Added.
    - added test case that ThrowTypeError is a singleton



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103958 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=51604

Reviewed by Eric Seidel.

Update references to JavaScriptCore to point to the new location.

* Android.mk:
* CMakeLists.txt:
* DerivedSources.pro:
* GNUmakefile.am:
* Makefile:
* WebKit.pri:
* WebKit.pro:
* wscript:

Tools: 

Update references to JavaScriptCore to point to the new location.

* BuildSlaveSupport/build.webkit.org-config/master.cfg:
* DumpRenderTree/qt/DumpRenderTree.pro:
* DumpRenderTree/qt/ImageDiff.pro:
* DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
* DumpRenderTree/wscript:
* Scripts/build-jsc:
* Scripts/build-webkit:
* Scripts/do-file-rename:
* Scripts/do-webcore-rename:
* Scripts/run-javascriptcore-tests:
* Scripts/update-javascriptcore-test-results:
* Scripts/webkitdirs.pm:
* Scripts/webkitpy/common/config/build_unittest.py:
* Scripts/webkitpy/style/checker.py:
* Scripts/webkitpy/style/checker_unittest.py:
* Scripts/webkitpy/style/checkers/cpp_unittest.py:
* WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro:
* WebKitTestRunner/qt/WebKitTestRunner.pro:
* wx/build/settings.py:

WebCore: 

Update references to JavaScriptCore.

* Android.derived.jscbindings.mk:
* Android.v8bindings.mk:
* CMakeLists.txt:
* WebCore.gyp/WebCore.gyp:
* WebCore.pro:
  - These changes are subtle and might not be 100% correct.
* move-js-headers.sh:

WebKit/chromium: 

* WebKit.gyp:
  - Point to JavaScriptCore in its new location.

WebKit/gtk: 

* GNUmakefile.am:
* docs/GNUmakefile.am:
  - Point to JavaScriptCore in its new location.

WebKit/qt: 

* WebKit_pch.h:
* docs/qtwebkit.qdocconf:
  - Point to JavaScriptCore in its new location.

WebKit/win: 

* WebKit.vcproj/WebKit.sln:
  - Point to JavaScriptCore in its new location.

WebKit/wx: 

* bindings/python/wscript:
* wscript:
  - Point to JavaScriptCore in its new location.

WebKit2: 

* WebKit2.pro:
  - Point to JavaScriptCore in its new location.

Websites/bugs.webkit.org: 

* PrettyPatch/PrettyPatch.rb:
  - Remove reference to JavaScriptCore as a source directory.

Websites/webkit.org: 

* coding/assertion-guidelines.html:
  - Update documentation to point to the new location of
    JavaScriptCore.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.

Reviewed by Oliver Hunt.

JavaScriptCore: 

* API/JSCallbackObjectFunctions.h:
(JSC::::toString):
* API/JSValueRef.cpp:
(JSValueIsStrictEqual):
* JavaScriptCore.exp:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitEqualityOp):
* debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::functionName):
(JSC::DebuggerCallFrame::calculatedFunctionName):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::callEval):
(JSC::Interpreter::privateExecute):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* profiler/ProfileGenerator.cpp:
(JSC::ProfileGenerator::addParentForConsoleStart):
* profiler/Profiler.cpp:
(JSC::Profiler::willExecute):
(JSC::Profiler::didExecute):
(JSC::Profiler::createCallIdentifier):
(JSC::createCallIdentifierFromFunctionImp):
* profiler/Profiler.h:
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncIndexOf):
(JSC::arrayProtoFuncLastIndexOf):
* runtime/DateConstructor.cpp:
(JSC::constructDate):
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::name):
(JSC::InternalFunction::displayName):
(JSC::InternalFunction::calculatedDisplayName):
* runtime/InternalFunction.h:
* runtime/JSCell.cpp:
(JSC::JSCell::getString):
* runtime/JSCell.h:
(JSC::JSValue::getString):
* runtime/JSONObject.cpp:
(JSC::gap):
(JSC::Stringifier::Stringifier):
(JSC::Stringifier::appendStringifiedValue):
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectFunction):
(JSC::JSObject::putDirectFunctionWithoutTransition):
(JSC::JSObject::defineOwnProperty):
* runtime/JSObject.h:
* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::get):
* runtime/JSString.cpp:
(JSC::JSString::Rope::~Rope):
(JSC::JSString::resolveRope):
(JSC::JSString::getPrimitiveNumber):
(JSC::JSString::toNumber):
(JSC::JSString::toString):
(JSC::JSString::toThisString):
(JSC::JSString::getStringPropertyDescriptor):
* runtime/JSString.h:
(JSC::JSString::Rope::createOrNull):
(JSC::JSString::Rope::operator new):
(JSC::JSString::value):
(JSC::JSString::tryGetValue):
(JSC::JSString::getIndex):
(JSC::JSString::getStringPropertySlot):
(JSC::JSValue::toString):
* runtime/JSValue.h:
* runtime/NativeErrorConstructor.cpp:
(JSC::NativeErrorConstructor::NativeErrorConstructor):
* runtime/Operations.cpp:
(JSC::JSValue::strictEqualSlowCase):
* runtime/Operations.h:
(JSC::JSValue::equalSlowCaseInline):
(JSC::JSValue::strictEqualSlowCaseInline):
(JSC::JSValue::strictEqual):
(JSC::jsLess):
(JSC::jsLessEq):
(JSC::jsAdd):
(JSC::concatenateStrings):
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::equalTo):
* runtime/PropertyDescriptor.h:
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncReplace):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):

WebCore: 

* bindings/ScriptControllerBase.cpp:
(WebCore::ScriptController::executeIfJavaScriptURL):
* bindings/js/JSCanvasRenderingContext2DCustom.cpp:
(WebCore::toHTMLCanvasStyle):
(WebCore::JSCanvasRenderingContext2D::setFillColor):
(WebCore::JSCanvasRenderingContext2D::setStrokeColor):
(WebCore::JSCanvasRenderingContext2D::setShadow):
* bindings/js/ScriptCallStack.cpp:
(WebCore::ScriptCallStack::ScriptCallStack):
(WebCore::ScriptCallStack::initialize):
* bindings/js/ScriptValue.cpp:
(WebCore::ScriptValue::getString):
* bindings/js/ScriptValue.h:
* bindings/js/SerializedScriptValue.cpp:
(WebCore::SerializingTreeWalker::convertIfTerminal):
* bindings/objc/WebScriptObject.mm:
(+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
* page/Console.cpp:
(WebCore::Console::addMessage):

WebKit/mac: 

* WebView/WebView.mm:
(aeDescFromJSValue):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51801 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=29503

Reviewed by Geoff Garen

Implement Object.defineProperty.  This requires adding the API to
ObjectConstructor, along with a helper function that implements the
ES5 internal [[ToPropertyDescriptor]] function.  It then adds
JSObject::defineOwnProperty that implements the appropriate ES5 semantics.
Currently defineOwnProperty uses a delete followed by a put to redefine
attributes of a property, clearly this is less efficient than it could be
but we can improve this if it needs to be possible in future.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48542 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=28724

Reviewed by Gavin Barraclough.

JavaScriptCore:
Implement the core runtime support for getOwnPropertyDescriptor.
This adds a virtual getOwnPropertyDescriptor method to every class
that implements getOwnPropertySlot that shadows the behaviour of
getOwnPropertySlot.  The alternative would be to make getOwnPropertySlot
(or PropertySlots in general) provide property attribute information,
but quick testing showed this to be a regression.

WebCore:
Implement the WebCore side of getOwnPropertyDescriptor.  This
requires a custom implementation of getOwnPropertyDescriptor
for every class with a custom implementation of getOwnPropertySlot.

The bindings generator has been updated to generate appropriate
versions of getOwnPropertyDescriptor for the general case where
a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
about how getOwnPropertyDescriptor should work in the context of
"host" functions with polymorphic [[GetOwnProperty]], so it seems
okay that occasionally we "guess" what attributes -- eg. determining
whether a property is writable.

Test: fast/js/getOwnPropertyDescriptor.html

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@47780 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=28294

Reviewed by Maciej Stachowiak.

Add a bit to TypeInfo to indicate that an object uses the standard
JSObject::markChildren method.  This allows us to devirtualise marking
of most objects (though a branch is still needed).  We also add a branch
to identify arrays thus devirtualising marking in that case as well.

In order to make the best use of this devirtualisation I've also reworked
the MarkStack::drain() logic to make the iteration more efficient.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@47267 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=12216

Reviewed by Gavin Barraclough and Sam Weinig

Make the GC mark phase iterative by using an explicit mark stack.
To do this marking any single object is performed in multiple stages
  * The object is appended to the MarkStack, this sets the marked
    bit for the object using the new markDirect() function, and then
    returns
  * When the MarkStack is drain()ed the object is popped off the stack
    and markChildren(MarkStack&) is called on the object to collect
    all of its children.  drain() then repeats until the stack is empty.

Additionally I renamed a number of methods from 'mark' to 'markAggregate'
in order to make it more clear that marking of those object was not
going to result in an actual recursive mark.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@47022 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2009-06-17  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
        of arbitrary complexity
        https://bugs.webkit.org/show_bug.cgi?id=26429

        For marking I decided not to use gcProtect, because this is inside the engine
        so it's easy enough to just do marking. And that darned gcProtect does locking!
        Oliver tried to convince me to used MarkedArgumentBuffer, but the constructor
        for that class says "FIXME: Remove all clients of this API, then remove this API."

        * runtime/Collector.cpp:
        (JSC::Heap::collect): Add a call to JSONObject::markStringifiers.

        * runtime/CommonIdentifiers.cpp:
        (JSC::CommonIdentifiers::CommonIdentifiers): Added emptyIdentifier.
        * runtime/CommonIdentifiers.h: Ditto.

        * runtime/JSGlobalData.cpp:
        (JSC::JSGlobalData::JSGlobalData): Initialize firstStringifierToMark to 0.
        * runtime/JSGlobalData.h: Added firstStringifierToMark.

        * runtime/JSONObject.cpp: Cut down the includes to the needed ones only.
        (JSC::unwrapNumberOrString): Added. Helper for unwrapping number and string
        objects to get their number and string values.
        (JSC::ReplacerPropertyName::ReplacerPropertyName): Added. The class is used
        to wrap an identifier or integer so we don't have to do any work unless we
        actually call a replacer.
        (JSC::ReplacerPropertyName::value): Added.
        (JSC::gap): Added. Helper function for the Stringifier constructor.
        (JSC::PropertyNameForFunctionCall::PropertyNameForFunctionCall): Added.
        The class is used to wrap an identifier or integer so we don't have to
        allocate a number or string until we actually call toJSON or a replacer.
        (JSC::PropertyNameForFunctionCall::asJSValue): Added.
        (JSC::Stringifier::Stringifier): Updated and moved out of the class
        definition. Added code to hook this into a singly linked list for marking.
        (JSC::Stringifier::~Stringifier): Remove from the singly linked list.
        (JSC::Stringifier::mark): Mark all the objects in the holder stacks.
        (JSC::Stringifier::stringify): Updated.
        (JSC::Stringifier::appendQuotedString): Tweaked and streamlined a bit.
        (JSC::Stringifier::toJSON): Renamed from toJSONValue.
        (JSC::Stringifier::appendStringifiedValue): Renamed from stringify.
        Added code to use the m_holderStack to do non-recursive stringify of
        objects and arrays. This code also uses the timeout checker since in
        pathological cases it could be slow even without calling into the
        JavaScript virtual machine.
        (JSC::Stringifier::willIndent): Added.
        (JSC::Stringifier::indent): Added.
        (JSC::Stringifier::unindent): Added.
        (JSC::Stringifier::startNewLine): Added.
        (JSC::Stringifier::Holder::Holder): Added.
        (JSC::Stringifier::Holder::appendNextProperty): Added. This is the
        function that handles the format of arrays and objects.
        (JSC::JSONObject::getOwnPropertySlot): Moved this down to the bottom
        of the file so the JSONObject class is not interleaved with the
        Stringifier class.
        (JSC::JSONObject::markStringifiers): Added. Calls mark.
        (JSC::JSONProtoFuncStringify): Streamlined the code here. The code
        to compute the gap string is now a separate function.

        * runtime/JSONObject.h: Made everything private. Added markStringifiers.

LayoutTests:

2009-06-17  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
        of arbitrary complexity
        https://bugs.webkit.org/show_bug.cgi?id=26429

        * fast/js/JSON-stringify-expected.txt: Updated.
        * fast/js/resources/JSON-stringify.js: Changed the infinite object and
        infinite array tests to instead just test something a fixed number of
        levels deep. Otherwise we end up with an infinite loop in the test,
        which would lead to the slow-script dialog in the production web browser.
        Also raised the number from 512 to 2048 since there's no fixed limit any more.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@44813 268f45cc-cd09-0410-ab3c-d52691b4dbfc

<https://bugs.webkit.org/show_bug.cgi?id=26249>

Reviewed by Sam Weinig.

Implement JSON.stringify.  This patch handles all the semantics of the ES5
JSON.stringify function, including replacer functions and arrays and both
string and numeric gap arguments.

Currently uses a clamped recursive algorithm basically identical to the spec
description but with a few minor tweaks for performance and corrected semantics
discussed in the es-discuss mailing list.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@44550 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2009-05-13  Darin Adler  <darin@apple.com>

        Revert the parser arena change. It was a slowdown, not a speedup.
        Better luck next time (I'll break it up into pieces).

WebCore:

2009-05-13  Darin Adler  <darin@apple.com>

        Revert the parser arena change. It was a slowdown, not a speedup.
        Better luck next time (I'll break it up into pieces).

WebKit/mac:

2009-05-13  Darin Adler  <darin@apple.com>

        Revert the parser arena change. It was a slowdown, not a speedup.
        Better luck next time (I'll break it up into pieces).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43661 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2009-05-13  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich.

        Bug 25674: syntax tree nodes should use arena allocation
        https://bugs.webkit.org/show_bug.cgi?id=25674

        Step 3: Add some actual arena allocation. About 1% SunSpider speedup.

        * JavaScriptCore.exp: Updated.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
        contains const Identifier* now.
        (JSC::BytecodeGenerator::emitPushNewScope): Updated to take a const
        Identifier&.
        * bytecompiler/BytecodeGenerator.h: Ditto

        * bytecompiler/SegmentedVector.h: Added isEmpty.

        * debugger/Debugger.cpp:
        (JSC::Debugger::recompileAllJSFunctions): Moved this function here from
        WebCore so WebCore doesn't need the details of FunctionBodyNode.
        * debugger/Debugger.h: Ditto.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::execute): Updated since VarStack contains const
        Identifier* now.

        * jit/JITStubs.cpp:
        (JSC::JITStubs::cti_vm_lazyLinkCall): Call isHostFunction on the body
        rather than on the function object, since we can't easily have inlined
        access to the FunctionBodyNode in JSFunction.h since WebCore needs
        access to that header.
        (JSC::JITStubs::cti_op_construct_JSConstruct): Ditto.
        * profiler/Profiler.cpp:
        (JSC::Profiler::createCallIdentifier): Ditto.

        * parser/Grammar.y: Use JSGlobalData* to pass the global data pointer
        around whenever possible instead of using void*. Changed
        SET_EXCEPTION_LOCATION from a macro to an inline function. Marked
        the structure-creating functions inline. Changed the VarStack to use
        identifier pointers instead of actual identifiers. This takes
        advantage of the fact that all identifier pointers come from the
        arena and avoids referenc count churn. Changed Identifier* to
        const Identifier* to make sure we don't modify any by accident.
        Used identifiers for regular expression strings too, using the new
        scanRegExp that has out parameters instead of the old one that relied
        on side effects in the Lexer. Move the creation of numeric identifiers
        out of this file and into the PropertyNode constructor.

        * parser/Lexer.cpp:
        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
        and changed to call ParserArena.
        (JSC::Lexer::scanRegExp): Added out arguments that are const Identifier*
        as well as a prefix character argument so we can handle the /= case
        without a string append.
        (JSC::Lexer::skipRegExp): Added. Skips a regular expression without
        allocating Identifier objects.
        (JSC::Lexer::clear): Removed the code to manage m_identifiers, m_pattern,
        and m_flags, and added code to set m_arena to 0.
        * parser/Lexer.h: Updated for changes above.

        * parser/NodeConstructors.h:
        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
        on the arena.
        (JSC::ParserArenaDeletable::operator new): Changed to call the
        allocateDeletable function on the arena instead of deleteWithArena.
        (JSC::RegExpNode::RegExpNode): Changed arguments to Identifier instead
        of UString since these come from the parser which makes identifiers.
        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
        numeric identifiers. Some day we might want to optimize this for
        integers so it doesn't create a string for each one.
        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
        since it's now a const Identifier& so it can't be left uninitialized.
        (JSC::BreakNode::BreakNode): Ditto.
        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
        to keep track of the statements rather than a separate statement vector.
        (JSC::BlockNode::BlockNode): Ditto.
        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.

        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
        It seemed strangely out of place in the header.
        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
        UString as well as Identifier.
        (JSC::SourceElements::singleStatement): Added.
        (JSC::SourceElements::lastStatement): Added.
        (JSC::RegExpNode::emitBytecode): Updated since the pattern and flags
        are now Identifier instead of UString. Also changed the throwError code
        to use the substitution mechanism instead of doing a string append.
        (JSC::SourceElements::emitBytecode): Added. Replaces the old
        statementListEmitCode function, since we now keep the SourceElements
        objects around.
        (JSC::BlockNode::lastStatement): Added.
        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
        statementListEmitCode.
        (JSC::CaseClauseNode::emitBytecode): Added.
        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
        instead of statementListEmitCode.
        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
        SourceElements* instead of using releaseContentsIntoVector.
        (JSC::ScopeNode::emitStatementsBytecode): Added.
        (JSC::ScopeNode::singleStatement): Added.
        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
        of statementListEmitCode.
        (JSC::EvalNode::emitBytecode): Ditto.
        (JSC::EvalNode::generateBytecode): Removed code to clear the children
        vector. This optimization is no longer possible since everything is in
        a single arena.
        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
        insetad of statementListEmitCode and check for the return node using
        the new functions.

        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
        of Identifier and rely on the arena to control lifetime. Added a new
        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
        FastAllocBase instead of having its own operator new. Base the Node
        class on ParserArenaFreeable. Changed the various Node classes
        to use const Identifier& instead of Identifier to avoid the need to
        call their destructors and allow them to function as "freeable" in the
        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
        as a base class since they do not descend from Node. Eliminated the
        StatementVector type and instead have various classes use SourceElements*
        instead of StatementVector. This prevents those classes from having th
        use ParserArenaDeletable to make sure the vector destructor is called.

        * parser/Parser.cpp:
        (JSC::Parser::parse): Pass the arena to the lexer.

        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
        included by Nodes.h.

        * parser/ParserArena.cpp:
        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
        since we store only the current pointer and the end of pool pointer.
        (JSC::ParserArena::deallocateObjects): Added. Contains the common
        memory-deallocation logic used by both the destructor and the
        reset function.
        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
        new structures, and switched to use clear() instead of shrink(0) since
        we don't really reuse arenas.
        (JSC::ParserArena::makeNumericIdentifier): Added.
        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
        is empty.
        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
        since this is used only for assertions at the moment.

        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
        ones that don't need destructors to be called. Also added the segmented
        vector of identifiers that used to be in the Lexer.

        * runtime/FunctionConstructor.cpp:
        (JSC::extractFunctionBody): Use singleStatement function rather than
        getting at a StatementVector.

        * runtime/FunctionPrototype.cpp:
        (JSC::functionProtoFuncToString): Call isHostFunction on the body
        rather than the function object.

        * runtime/JSFunction.cpp:
        (JSC::JSFunction::JSFunction): Moved the structure version of this in
        here from the header. It's not hot enough that it needs to be inlined.
        (JSC::JSFunction::isHostFunction): Moved this in here from the header.
        It's now a helper to be used only within the class.
        (JSC::JSFunction::setBody): Moved this in here. It's not hot enough that
        it needs to be inlined, and we want to be able to compile the header
        without the definition of FunctionBodyNode.

        * runtime/JSFunction.h: Eliminated the include of "Nodes.h". This was
        exposing too much JavaScriptCore dependency to WebCore. Because of this
        change and some changes made to WebCore, we could now export a lot fewer
        headers from JavaScriptCore, but I have not done that yet in this check-in.
        Made a couple functions non-inline. Removes some isHostFunction() assertions.
        
        * wtf/FastAllocBase.h: Added the conventional using statements we use in
        WTF so we can use identifiers from the WTF namespace without explicit
        namespace qualification or namespace directive. This is the usual WTF style,
        although it's unconventional in the C++ world. We use the namespace primarily
        for link-time disambiguation, not compile-time.

        * wtf/FastMalloc.cpp: Fixed an incorrect comment.

WebCore:

2009-05-13  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich.

        Bug 25674: syntax tree nodes should use arena allocation
        https://bugs.webkit.org/show_bug.cgi?id=25674

        * bindings/js/JSDOMBinding.h: Removed include of JSFunction.h.
        We don't want the entire DOM binding to depend on that file.

        * bindings/js/JSAudioConstructor.cpp: Added include of Error.h.
        Before we inherited this automatically because JDDOMBinding.h
        included JSFunction.h, but that was excessive.
        * bindings/js/JSDOMWindowCustom.cpp: Ditto.
        * bindings/js/JSHTMLInputElementCustom.cpp: Ditto.
        * bindings/js/JSImageConstructor.cpp: Ditto.
        * bindings/js/JSLazyEventListener.cpp: Ditto, but for JSFunction.h.
        * bindings/js/JSMessageChannelConstructor.cpp: Ditto.
        * bindings/js/JSOptionConstructor.cpp: Ditto.
        * bindings/js/JSWorkerConstructor.cpp: Ditto.
        * bindings/js/JSXMLHttpRequestConstructor.cpp: Ditto.
        * bridge/jni/jni_jsobject.mm: Ditto, but for SourceCode.h.
        * inspector/InspectorController.cpp: Ditto.

        * inspector/JavaScriptDebugServer.cpp:
        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
        Moved mose of this function into the base class in JavaScriptCore,
        so the details of compilation don't have to be exposed.

WebKit/mac:

2009-05-13  Darin Adler  <darin@apple.com>

        Reviewed by Cameron Zwarich.

        Bug 25674: syntax tree nodes should use arena allocation
        https://bugs.webkit.org/show_bug.cgi?id=25674

        * Plugins/Hosted/NetscapePluginInstanceProxy.mm: Updated includes.
        New ones needed due to reducing includes of JSDOMBinding.h.
        * WebView/WebScriptDebugger.mm: Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43642 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Cameron Zwarich.

        Bug 25674: syntax tree nodes should use arena allocation
        https://bugs.webkit.org/show_bug.cgi?id=25674

        Part two: Remove reference counting from most nodes.

        * JavaScriptCore.exp: Updated.

        * JavaScriptCore.xcodeproj/project.pbxproj: Added ParserArena.h and .cpp.

        * parser/Grammar.y: Replaced uses of ParserRefCountedData with uses of
        ParserArenaData. Took out now-nonfunctional code that tries to manually
        release declaration list. Changed the new calls that create FuncDeclNode
        and FuncExprNode so that they use the proper version of operator new for
        the reference-counted idiom, not the deletion idiom.

        * parser/NodeConstructors.h:
        (JSC::ParserArenaDeletable::operator new): Added.
        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Added.
        (JSC::Node::Node): Removed ParserRefCounted initializer.
        (JSC::ElementNode::ElementNode): Ditto.
        (JSC::PropertyNode::PropertyNode): Ditto.
        (JSC::ArgumentsNode::ArgumentsNode): Ditto.
        (JSC::SourceElements::SourceElements): Ditto.
        (JSC::ParameterNode::ParameterNode): Ditto.
        (JSC::FuncExprNode::FuncExprNode): Added ParserArenaRefCounted initializer.
        (JSC::FuncDeclNode::FuncDeclNode): Ditto.
        (JSC::CaseClauseNode::CaseClauseNode): Removed ParserRefCounted initializer.
        (JSC::ClauseListNode::ClauseListNode): Ditto.
        (JSC::CaseBlockNode::CaseBlockNode): Ditto.

        * parser/NodeInfo.h: Replaced uses of ParserRefCountedData with uses of
        ParserArenaData.

        * parser/Nodes.cpp:
        (JSC::ScopeNode::ScopeNode): Added ParserArenaRefCounted initializer.
        (JSC::ProgramNode::create): Use the proper version of operator new for
        the reference-counted idiom, not the deletion idiom. Use the arena
        contains function instead of the vecctor find function.
        (JSC::EvalNode::create): Use the proper version of operator new for
        the reference-counted idiom, not the deletion idiom. Use the arena
        reset function instead of the vector shrink function.
        (JSC::FunctionBodyNode::createNativeThunk): Use the proper version
        of operator new for the reference-counted idiom, not the deletion idiom.
        (JSC::FunctionBodyNode::create): More of the same.

        * parser/Nodes.h: Added ParserArenaDeletable and ParserArenaRefCounted
        to replace ParserRefCounted. Fixed inheritance so only the classes that
        need reference counting inherit from ParserArenaRefCounted.

        * parser/Parser.cpp:
        (JSC::Parser::parse): Set m_sourceElements to 0 since it now starts
        uninitialized. Just set it to 0 again in the failure case, since it's
        now just a raw pointer, not an owning one.
        (JSC::Parser::reparseInPlace): Removed now-unneeded get() function.
        (JSC::Parser::didFinishParsing): Replaced uses of ParserRefCountedData
        with uses of ParserArenaData.

        * parser/Parser.h: Less RefPtr, more arena.

        * parser/ParserArena.cpp: Added.
        * parser/ParserArena.h: Added.

        * runtime/JSGlobalData.cpp:
        (JSC::JSGlobalData::~JSGlobalData): Removed arena-related code, since it's
        now in the Parser.
        (JSC::JSGlobalData::createLeaked): Removed unneeded #ifndef.
        (JSC::JSGlobalData::createNativeThunk): Tweaked #if a bit.

        * runtime/JSGlobalData.h: Removed parserArena, which is now in Parser.

        * wtf/RefCounted.h: Added deletionHasBegun function, for use in
        assertions to catch deletion not done by the deref function.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43479 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Reviewed by Gavin Barraclough.

Fix the windows build by adding calling convention declarations everywhere,
chose fastcall as that seemed most sensible given we were having to declare
the convention explicitly.  In addition switched to fastcall on mac in the
deluded belief that documented fastcall behavior on windows would match
actual its actual behavior.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43372 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2009-05-05  Xan Lopez  <xlopez@igalia.com> and Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Oliver Hunt.

        Disable the NativeFunctionWrapper for all non-Mac ports for now,
        as it is also crashing on Linux/x86.

        * runtime/NativeFunctionWrapper.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43253 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43235 268f45cc-cd09-0410-ab3c-d52691b4dbfc

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43221 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2009-04-20  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Added PlainTextController.h
        and PlainTextController.mm.

        * DumpRenderTree/mac/FrameLoadDelegate.mm:
        (-[FrameLoadDelegate webView:didClearWindowObject:forFrame:]): Added PlainTextController
        as "window.plainText".

        * DumpRenderTree/mac/PlainTextController.h: Added.
        * DumpRenderTree/mac/PlainTextController.mm: Added.

LayoutTests:

2009-04-20  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        * fast/dom/Window/window-properties.html: Added a new DumpRenderTree window
        object property, plainText.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@42681 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Please clarify licensing for some files
        <http://bugs.webkit.org/show_bug.cgi?id=14970>

        Reviewed by Darin.

        * bindings/objc/WebScriptObject.h: Added Apple BSD-style license.
        * bindings/objc/WebScriptObjectPrivate.h: Ditto.
        * platform/text/mac/ShapeArabic.c: Added ICU license from WebCore/icu/LICENSE.

WebKit/mac:

        Please clarify licensing for some files
        <http://bugs.webkit.org/show_bug.cgi?id=14970>

        Reviewed by Darin.

        * Plugins/WebNetscapeDeprecatedFunctions.c: Updated copyright statement
        and added Apple BSD-style license.
        * Plugins/WebNetscapeDeprecatedFunctions.h: Ditto.

WebKitTools:

        Please clarify licensing for some files
        <http://bugs.webkit.org/show_bug.cgi?id=14970>

        Reviewed by Darin.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp: Added
        copyright statement.  Replaced license with newer Apple BSD-style license.
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h: Ditto.
        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp: Ditto.
        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.h: Ditto.
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp: Ditto.
        * DumpRenderTree/win/TestNetscapePlugin/main.c: Ditto.
        * mangleme/LICENSE: Added (LGPL).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@30520 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.c:
        (testAllocate):
        (testEnumerate):
        Add casts.
        
        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.h:
        Don't use #import, use #include.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20619 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Geoff.

        Implement _NPN_Enumerate support.
        
        * JavaScriptCore.exp:
        * bindings/NP_jsobject.cpp:
        (_NPN_Enumerate):
        * bindings/c/c_instance.cpp:
        (KJS::Bindings::CInstance::getPropertyNames):
        * bindings/c/c_instance.h:
        * bindings/npapi.h:
        * bindings/npruntime.h:
        * bindings/npruntime_impl.h:
        * bindings/runtime.h:
        (KJS::Bindings::Instance::getPropertyNames):
        * bindings/runtime_object.cpp:
        (RuntimeObjectImp::getPropertyNames):
        * bindings/runtime_object.h:
        (KJS::RuntimeObjectImp::getInternalInstance):

LayoutTests:

        Reviewed by Geoff.

        Add enumeration test.
        
        * plugins/netscape-enumerate-expected.txt: Added.
        * plugins/netscape-enumerate.html: Added.

WebKit:

        Reviewed by Geoff.

        * Plugins/WebNetscapePluginPackage.m:
        (-[WebNetscapePluginPackage load]):
        Initialize pushpopupsenabledstate, poppopupsenabledstate and enumerate.
        
        * Plugins/npapi.m:
        (NPN_PushPopupsEnabledState):
        (NPN_PopPopupsEnabledState):
        Add stubs for these functions.
        
        * Plugins/npfunctions.h:
        Add new methods to NPNetscapeFuncs.

WebKitTools:

        Reviewed by Geoff.

        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
        Add TestObject.c and TestObject.h
        
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c:
        (pluginGetProperty):
        Implement the testObject property.
        
        (pluginInvoke):
        Implement testEnumerate which takes an object and an array and enumerates
        the properties of the object and adds them to the array.
        
        (pluginAllocate):
        Allocate the test object.
        
        (pluginDeallocate):
        Free the test object.
        
        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.c: Added.
        * DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.h: Added.
        Add a test object with two enumerable properties.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20613 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Beth Dakin.
        
        Layout test for <rdar://problem/5091330> REGRESSION: Repro crash in 
        -[WebBaseNetscapePluginView(WebNPPCallbacks) destroyStream:reason:] 
        navigating away from page with DivX movie plug-in (13203)

        * plugins/destroy-stream-twice-expected.txt: Added.
        * plugins/destroy-stream-twice.html: Added.

WebKit:

        Reviewed by Beth Dakin, reviewed by Maciej Stachowiak.
        
        Layout test for <rdar://problem/5091330> REGRESSION: Repro crash in 
        -[WebBaseNetscapePluginView(WebNPPCallbacks) destroyStream:reason:] 
        navigating away from page with DivX movie plug-in (13203)
        
        Changed LOG_ERROR to LOG so the layout test doesn't produce console spew
        every time you run it.

        * Plugins/WebBaseNetscapePluginView.mm:
        (-[WebBaseNetscapePluginView destroyStream:reason:]):

WebKitTools:

        Reviewed by Beth Dakin.
        
        Layout test for <rdar://problem/5091330> REGRESSION: Repro crash in 
        -[WebBaseNetscapePluginView(WebNPPCallbacks) destroyStream:reason:] 
        navigating away from page with DivX movie plug-in (13203)
        
        Added hasStream property and destroyStream function, used by layout test.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c:
        (pluginGetProperty):
        (pluginInvoke):
        (pluginAllocate):
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.c:
        (NPP_NewStream):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20597 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Reviewed by Adam, Darin.

        <rdar://problem/5025212>
        In Mail, a crash occurs at WebCore::Frame::tree() when clicking on embedded flash object

        * plugins/get-url-with-blank-target-expected.txt: Added.
        * plugins/get-url-with-blank-target.html: Added.

WebKit:

        Reviewed by Adam, Darin.
 
        <rdar://problem/5025212>
        In Mail, a crash occurs at WebCore::Frame::tree() when clicking on embedded flash object

        * Plugins/WebBaseNetscapePluginView.mm:
        (-[WebBaseNetscapePluginView loadPluginRequest:]):
        Handle the case where the web view returned from the delegate method is null. Also, send out an error notification
        in that case so we can catch it.

WebKitTools:

        Reviewed by Adam, Darin.

        <rdar://problem/5025212>
        In Mail, a crash occurs at WebCore::Frame::tree() when clicking on embedded flash object
        
        Add a "getURLNotify" method to the plugin object. This lets you pass a URL, a target and a callback function
        to be run when the URL has finished (or failed) loading.
        
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c:
        (pluginInvoke):
        (handleCallback):
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.c:
        (NPP_URLNotify):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@19966 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        http://bugs.webkit.org/show_bug.cgi?id=11517
        REGRESSION: Flash clicks/interactivity not working properly

WebCore:
        * bridge/mac/FrameMac.mm:
        (WebCore::FrameMac::handleMouseMoveEvent):
        (WebCore::FrameMac::handleMouseReleaseEvent):
        Restore parts of event dispatching that were removed when fixing
        bug 7323 - just bypass those for subframes.

WebKitTools:
        Teach TestNetscapePlugin to log events passed to it. To enable, set eventLoggingEnabled to true:

        <embed name="plg" type="application/x-webkit-test-netscape" width=100 height=100></embed>
        <script>
            plg.eventLoggingEnabled = true;
            // use eventSender to simulate events...
        </script>

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c:
        (pluginGetProperty):
        (pluginSetProperty):
        (pluginAllocate):
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.c:
        (NPP_HandleEvent):

LayoutTests:
        * plugins/mouse-events-expected.txt: Added.
        * plugins/mouse-events.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@17611 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=7681
          memory leak in the plug-in tests

        * DumpRenderTree/TestNetscapePlugIn.subproj/main.c:
        (NPP_Destroy): Added code to release the plug-in object. This is the leak fix.
        (NPP_SetWindow): Remove unneeded code to store the window pointer.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c:
        Moved the browser global in here since it's declared in this file's header.
        Changed the code to set up the pluginClass structure to not use function
        pointer casts. Those are dangerous because they can hide many types of mismatch.
        And indeed when I did this I discovered that many functions were missing their
        boolean return values or had parameter declarations with the wrong types.
        (pluginGetProperty): Use STRINGZ_TO_NPVARIANT macro for greater simplicity and
        clarity. Added boolean return value: return true when successful and false when not.
        (pluginSetProperty): Added boolean return value, return false since we have no
        properties we can set.
        (pluginInvoke): Added boolean return value. Return true when successful and false
        when not. Use NPVARIANT macros where appropriate. Added a missing release for the
        return value from calling the browser. Changed code to put the strings in malloc
        buffers instead of relying on GCC's extension that allows variable-sized arrays
        on the stack.
        (pluginInvokeDefault): Added boolean return value, return false since we have no
        default function to call.
        (pluginInvalidate): Added missing parameter. Removed comment.
        (pluginAllocate): Removed unneeded cast. This is C code, not C++, so you don't have
        to cast the result of malloc.
        (pluginDeallocate): Removed uneeded cast.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h: Removed some unneeded
        includes. Changed our PluginObject to use NPObject instead of re-declaring fields
        that match NPObject's fields. Removed unused NPWindow pointer.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@13233 268f45cc-cd09-0410-ab3c-d52691b4dbfc

        Layout test for http://bugzilla.opendarwin.org/show_bug.cgi?id=6318
        REGRESSION: Repro crash in JS called from Flash on bdash.net.nz

        * fast/plugins/netscape-back-forward-expected.txt: Added.
        * fast/plugins/netscape-back-forward.html: Added.
        * fast/plugins/resources/go-back.html: Added.

WebKit:

        Reviewed by Darin.

        - Fixed http://bugzilla.opendarwin.org/show_bug.cgi?id=6361
        Add plugin support to DumpRenderTree

        * WebKit.exp: export WebPluginDatabase class, which DumpRenderTree
        needs to add plugins to the runtime.

WebKitTools:

        Reviewed by darin.

        - Fixed http://bugzilla.opendarwin.org/show_bug.cgi?id=6361
        Add plugin support to DumpRenderTree

        Also wrote first test plugin.

        * DumpRenderTree/DumpRenderTree.m:
        (main):
        (1) Put the WebView in an invisible window, because PlugIns are
        optimized not to load if there's no parent window.
        (2) Tell WebKit to load any PlugIns in the directory from which we
        loaded. This means we can build nasty PlugIns alongside DumpRenderTree
        and they'll load automagically during layout testing, but they won't be
        added to the user's system, hosing apps like Safari.

        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Added new
        test PlugIn to project.

        PlugIn added to project:

        * DumpRenderTree/TestNetscapePlugIn.subproj/Info.plist: Added.
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.c: Added.
        (getPluginClass):
        (initializeIdentifiers):
        (pluginHasProperty):
        (pluginHasMethod):
        (pluginGetProperty):
        (pluginSetProperty):
        (pluginInvoke):
        (pluginInvokeDefault):
        (pluginInvalidate):
        (pluginAllocate):
        (pluginDeallocate):
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h: Added.
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.c: Added.
        (NP_Initialize):
        (NP_GetEntryPoints):
        (NP_Shutdown):
        (NPP_New):
        (NPP_Destroy):
        (NPP_SetWindow):
        (NPP_NewStream):
        (NPP_DestroyStream):
        (NPP_WriteReady):
        (NPP_Write):
        (NPP_StreamAsFile):
        (NPP_Print):
        (NPP_HandleEvent):
        (NPP_URLNotify):
        (NPP_GetValue):
        (NPP_SetValue):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@11885 268f45cc-cd09-0410-ab3c-d52691b4dbfc