Merge changes I55c6d71a,Ifb3277d4,Ia1b847a2,I7ba9cf3f,Ida2b2a8a,I1280ec90,I72f818d5,I2e3b588b,I9a4e6289,Ia724c78b,Icd8612c8,Ie31b15d7,Ie125edae,I77941a88,I89dae78b,I3516e5ca,I1a4c17b5,I2c4ecc1a,I9c8e6537,Ifac13115,Ie1f80e09,Ia541ed77,I60ce9d78

* changes:
  Merge WebKit at r82507: Update ThirdPartyProject.prop
  Merge WebKit at r82507: Cherry-pick change r88166 to add INSPECTOR guards to ScriptProfiler
  Merge WebKit at r82507: Work around a V8 bug
  Merge WebKit at r82507: JNIType renamed to JavaType
  Merge WebKit at r82507: IconDatabaseClient interface expanded
  Merge WebKit at r82507: Don't use new loss-free code path in HTMLCanvasElement::toDataURL()
  Merge WebKit at r82507: IcondDatabaseBase::iconForPageURL() renamed
  Merge WebKit at r82507: IconDatabaseBase::Open() signature changed
  Merge WebKit at r82507: Node::isContentEditable() renamed
  Merge WebKit at r82507: Use icon database through IconDatabaseBase
  Merge WebKit at r82507: toInputElement() is now a member of Node
  Merge WebKit at r82507: FrameLoaderClient::objectContentType() signature changed
  Merge WebKit at r82507: StringImpl::computeHash() removed
  Merge WebKit at r82507: Stub out FontPlatformData::setOrientation()
  Merge WebKit at r82507: Path::strokeBoundingRect() is now const
  Merge WebKit at r82507: Add missing UnusedParam.h include in ApplicationCacheGroup.cpp
  Merge WebKit at r82507: Continue to use Android's version of FontPlatformData.h
  Merge WebKit at r82507: Update signature of FontCustomPlatformData::fontPlatformData()
  Merge WebKit at r82507: Fix conflicts due to JNI refactoring
  Merge WebKit at r82507: Fix conflicts due to new StorageTracker
  Merge WebKit at r82507: Fix conflicts
  Merge WebKit at r82507: Fix makefiles
  Merge WebKit at r82507: Initial merge by git

1 files changed, 32 insertions, 43 deletions

diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 7313d52..ab0e237 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -35,6 +35,8 @@
 
 namespace JSC {
 
+    class JSGlobalObject;
+
 #if COMPILER(MSVC)
     // If WTF_MAKE_NONCOPYABLE is applied to JSCell we end up with a bunch of
     // undefined references to the JSCell copy constructor and assignment operator
@@ -53,10 +55,9 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(JSCell);
 #endif
 
+        friend class ExecutableBase;
         friend class GetterSetter;
         friend class Heap;
-        friend class JIT;
-        friend class JSNumberCell;
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
@@ -67,15 +68,16 @@ namespace JSC {
         friend class MarkedSpace;
         friend class MarkedBlock;
         friend class ScopeChainNode;
+        friend class StructureChain;
 
     private:
         explicit JSCell(Structure*);
         virtual ~JSCell();
 
     public:
-        static PassRefPtr<Structure> createDummyStructure()
+        static PassRefPtr<Structure> createDummyStructure(JSGlobalData& globalData)
         {
-            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
+            return Structure::create(globalData, jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
         }
 
         // Querying the type.
@@ -107,7 +109,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // Garbage collection.
         void* operator new(size_t, ExecState*);
@@ -137,6 +139,16 @@ namespace JSC {
         // property names, we want a similar interface with appropriate optimizations.)
         bool fastGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
+        static ptrdiff_t structureOffset()
+        {
+            return OBJECT_OFFSETOF(JSCell, m_structure);
+        }
+
+        Structure* const * addressOfStructure() const
+        {
+            return &m_structure;
+        }
+
     protected:
         static const unsigned AnonymousSlotCount = 0;
 
@@ -203,6 +215,11 @@ namespace JSC {
         return isCell() ? asCell()->getString(exec) : UString();
     }
 
+    template <typename Base> UString HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+    {
+        return jsValue().getString(exec);
+    }
+
     inline JSObject* JSValue::getObject() const
     {
         return isCell() ? asCell()->getObject() : 0;
@@ -322,24 +339,19 @@ namespace JSC {
 
     inline JSObject* JSValue::toObject(ExecState* exec) const
     {
-        return isCell() ? asCell()->toObject(exec) : toObjectSlowCase(exec);
+        return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
     }
 
-    inline JSObject* JSValue::toThisObject(ExecState* exec) const
+    inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
     {
-        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
+        return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
     }
-    
-    template <typename T> void MarkStack::append(DeprecatedPtr<T>* slot)
+
+    inline JSObject* JSValue::toThisObject(ExecState* exec) const
     {
-        internalAppend(slot->get());
+        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
     
-    template <typename T> void MarkStack::append(WriteBarrierBase<T>* slot)
-    {
-        internalAppend(slot->get());
-    }
-
     ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
     {
         ASSERT(!m_isCheckingForDefaultMarkViolation);
@@ -350,31 +362,6 @@ namespace JSC {
             m_values.append(cell);
     }
 
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-    
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
-    {
-        ASSERT(value);
-        internalAppend(value->jsValue());
-    }
-
-    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
-    {
-        ASSERT(value);
-        if (value.isCell())
-            internalAppend(value.asCell());
-    }
-
     inline Heap* Heap::heap(JSValue v)
     {
         if (!v.isCell())
@@ -411,8 +398,10 @@ namespace JSC {
     
     inline MarkedSpace::SizeClass& MarkedSpace::sizeClassFor(size_t bytes)
     {
-        ASSERT(bytes && bytes <= preciseCutoff);
-        return m_preciseSizeClasses[(bytes - 1) / preciseStep];
+        ASSERT(bytes && bytes < maxCellSize);
+        if (bytes < preciseCutoff)
+            return m_preciseSizeClasses[(bytes - 1) / preciseStep];
+        return m_impreciseSizeClasses[(bytes - 1) / impreciseStep];
     }
 
     inline void* MarkedSpace::allocate(size_t bytes)