Merge branch 'master' of git@scm.dev.nokia.troll.no:qt/qt

Conflicts:
	src/network/socket/qlocalsocket.cpp

18 files changed, 230 insertions, 56 deletions

diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 55518f5..c8bba0f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,149 @@
+2009-06-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
+
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+
+2009-06-26  Eric Seidel  <eric@webkit.org>
+
+        No review, only rolling out r45259.
+
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
+
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to Vector.
+
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Make the opcode sampler work once again.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
+
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
+
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
+
+        * bytecode/CodeBlock.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26676
+
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
+
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26675
+
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
+
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
+
+        * wtf/HashMap.h:
+
+2009-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
+
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        * parser/Nodes.cpp:
+        (JSC::CommaNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
+
 2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Maciej Stachowiak.
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 94901f9..afd32f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -38,6 +38,7 @@
 #include "Nodes.h"
 #include "RegExp.h"
 #include "UString.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -214,7 +215,7 @@ namespace JSC {
     }
 #endif
 
-    class CodeBlock {
+    class CodeBlock : public WTF::FastAllocBase {
         friend class JIT;
     public:
         CodeBlock(ScopeNode* ownerNode);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 21de281..d29a24d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -40,6 +40,7 @@
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
@@ -60,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator {
+    class BytecodeGenerator : public WTF::FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 0f7625a..8e80eca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -3811,17 +3811,17 @@ yyreduce:
 
   case 196:
 #line 781 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
@@ -3888,7 +3888,7 @@ yyreduce:
 #line 855 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3936,7 +3936,7 @@ yyreduce:
 #line 892 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -5092,10 +5092,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index fa7ec0b..7b1e547 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1085,7 +1085,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
 
     StructureChain* protoChain = structure->prototypeChain(callFrame);
     if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
+        vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 7cab254..702c89c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -66,7 +66,7 @@ namespace JSC {
 
     enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter : public WTF::FastAllocBase {
+    class Interpreter : public FastAllocBase {
         friend class JIT;
         friend class CachedCall;
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index cceac74..31f0c8b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -31,6 +31,7 @@
 
 #include "JSValue.h"
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -47,7 +48,7 @@ namespace JSC {
 
     typedef ExecState CallFrame;
 
-    class Register {
+    class Register : public WTF::FastAllocBase {
     public:
         Register();
         Register(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index bc006fc..db3f38a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -342,61 +342,40 @@ namespace JSC {
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
         }
         static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
         }
         static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
 
         static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
         static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
@@ -407,9 +386,6 @@ namespace JSC {
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index 2dc69c1..bc07178 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -108,8 +108,8 @@ namespace JSC {
         JIT::Call call()
         {
 #if ENABLE(OPCODE_SAMPLING)
-            ASSERT(m_jit->m_bytecodeIndex != (unsigned)-1);
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
 #endif
 
             m_jit->restoreArgumentReference();
@@ -117,7 +117,8 @@ namespace JSC {
             m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
 
 #if ENABLE(OPCODE_SAMPLING)
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
 #endif
 
             m_jit->killLastResultRegister();
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 52dddde..c5ca425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -80,7 +80,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -778,17 +778,17 @@ AssignmentOperator:
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -854,7 +854,7 @@ VariableDeclarationList:
   | VariableDeclarationList ',' IDENT Initializer
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -891,7 +891,7 @@ VariableDeclarationListNoIn:
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -2071,10 +2071,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
index ea1579b..d17da69 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -659,9 +659,9 @@ namespace JSC {
 
     inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
         : ExpressionNode(globalData)
-        , m_expr1(expr1)
-        , m_expr2(expr2)
     {
+        m_expressions.append(expr1);
+        m_expressions.append(expr2);
     }
 
     inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 3cfd125..ba6e1e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1186,8 +1186,10 @@ RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, Re
 
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1);
-    return generator.emitNode(dst, m_expr2);
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 7cdc19d..a9f88b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -169,7 +169,8 @@ namespace JSC {
         virtual bool isResolveNode() const { return false; }
         virtual bool isBracketAccessorNode() const { return false; }
         virtual bool isDotAccessorNode() const { return false; }
-        virtual bool isFuncExprNode() const { return false; } 
+        virtual bool isFuncExprNode() const { return false; }
+        virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
 
@@ -1087,16 +1088,20 @@ namespace JSC {
         Operator m_operator;
         ExpressionNode* m_right;
     };
+    
+    typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
     class CommaNode : public ExpressionNode {
     public:
         CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
+        void append(ExpressionNode* expr) { m_expressions.append(expr); }
+
     private:
+        virtual bool isCommaNode() const { return true; }
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        ExpressionNode* m_expr1;
-        ExpressionNode* m_expr2;
+        ExpressionVector m_expressions;
     };
     
     class ConstDeclNode : public ExpressionNode {
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
index fdd7bbc..ba48c55 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-    struct CallIdentifier : public WTF::FastAllocBase {
+    struct CallIdentifier : public FastAllocBase {
         UString m_name;
         UString m_url;
         unsigned m_lineNumber;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 3b10d32..17aff24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -30,7 +30,7 @@ namespace JSC {
     class JSObject;
     class ScopeChainIterator;
     
-    class ScopeChainNode : public WTF::FastAllocBase {
+    class ScopeChainNode : public FastAllocBase {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
             : next(next)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
index 71e6bfa..1c81856 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -397,4 +397,7 @@ namespace WTF {
 
 } // namespace WTF
 
+// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
+using WTF::FastAllocBase;
+
 #endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index c5b75ff..3de5ee6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -29,7 +29,7 @@ namespace WTF {
 
     template<typename KeyArg, typename MappedArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
         typename KeyTraitsArg = HashTraits<KeyArg>, typename MappedTraitsArg = HashTraits<MappedArg> >
-    class HashMap {
+    class HashMap : public FastAllocBase {
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 050feb1..c378fd0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -28,6 +28,10 @@
 #include <limits>
 #include <utility>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 namespace WTF {
 
     using std::min;
@@ -563,6 +567,32 @@ namespace WTF {
         Buffer m_buffer;
     };
 
+#if PLATFORM(QT)
+    template<typename T>
+    QDataStream& operator<<(QDataStream& stream, const Vector<T>& data)
+    {
+        stream << qint64(data.size());
+        foreach (const T& i, data)
+            stream << i;
+        return stream;
+    }
+
+    template<typename T>
+    QDataStream& operator>>(QDataStream& stream, Vector<T>& data)
+    {
+        data.clear();
+        qint64 count;
+        T item;
+        stream >> count;
+        data.reserveCapacity(count);
+        for (qint64 i = 0; i < count; ++i) {
+            stream >> item;
+            data.append(item);
+        }
+        return stream;
+    }
+#endif
+
     template<typename T, size_t inlineCapacity>
     Vector<T, inlineCapacity>::Vector(const Vector& other)
         : m_size(other.size())