Context Navigation

← Previous Period
Next Period →

Timeline

Mar 11, 2018:

8:46 PM Changeset in webkit [229522] by Alan Bujtas

5 edits
2 copies
11 moves
4 adds in trunk/Tools

[LayoutReloaded] Add Line class for InlineFormattingContext -and move files around.
https://bugs.webkit.org/show_bug.cgi?id=183551

Reviewed by Wenson Hsieh.

LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js: Renamed from Tools/LayoutReloaded/BlockFormattingContext.js.

(BlockFormattingContext):
(BlockFormattingContext.prototype.layout):
(BlockFormattingContext.prototype.computeWidth):
(BlockFormattingContext.prototype.computeHeight):
(BlockFormattingContext.prototype.marginTop):
(BlockFormattingContext.prototype.marginBottom):
(BlockFormattingContext.prototype._computeStaticPosition):
(BlockFormattingContext.prototype._placeInFlowPositionedChildren):
(BlockFormattingContext.prototype._placeOutOfFlowDescendants):
(BlockFormattingContext.prototype._computeOutOfFlowWidth):
(BlockFormattingContext.prototype._computeFloatingWidth):
(BlockFormattingContext.prototype._computeInFlowWidth):
(BlockFormattingContext.prototype._computeOutOfFlowHeight):
(BlockFormattingContext.prototype._computeFloatingHeight):
(BlockFormattingContext.prototype._computeInFlowHeight):
(BlockFormattingContext.prototype._computeHorizontalConstraint):
(BlockFormattingContext.prototype._computeContentHeight):
(BlockFormattingContext.prototype._computeInFlowPositionedPosition):
(BlockFormattingContext.prototype._computeOutOfFlowPosition):
(BlockFormattingContext.prototype._shrinkToFitWidth):

LayoutReloaded/FormattingContext/BlockFormatting/BlockMarginCollapse.js: Renamed from Tools/LayoutReloaded/BlockMarginCollapse.js.

(BlockMarginCollapse.marginTop):
(BlockMarginCollapse.marginBottom):
(BlockMarginCollapse._isMarginTopCollapsedWithSibling):
(BlockMarginCollapse._isMarginBottomCollapsedWithSibling):
(BlockMarginCollapse._isMarginTopCollapsedWithParent):
(BlockMarginCollapse._isMarginBottomCollapsedWithParent):
(BlockMarginCollapse._nonCollapsedMarginTop):
(BlockMarginCollapse._nonCollapsedMarginBottom):
(BlockMarginCollapse._collapsedMarginTopFromFirstChild):
(BlockMarginCollapse._collapsedMarginBottomFromLastChild):
(BlockMarginCollapse._marginValue):
(BlockMarginCollapse._hasAdjoiningMarginTopAndBottom):
(BlockMarginCollapse):

LayoutReloaded/FormattingContext/FloatingContext.js: Renamed from Tools/LayoutReloaded/FloatingContext.js.

(FloatingContext):
(FloatingContext.prototype.computePosition):
(FloatingContext.prototype.bottom):
(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._positionForClear):
(FloatingContext.prototype._computePositionToAvoidIntrudingFloats):
(FloatingContext.prototype._addFloating):
(FloatingContext.prototype._findInnerMostLeftAndRight):
(FloatingContext.prototype._moveToNextVerticalPosition):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._findFloatingAtVerticalPosition):
(FloatingContext.prototype._isEmpty):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._bottom):
(FloatingContext.prototype._formattingContext):

LayoutReloaded/FormattingContext/FormattingContext.js: Renamed from Tools/LayoutReloaded/FormattingContext.js.

(FormattingContext):
(FormattingContext.prototype.rootContainer):
(FormattingContext.prototype.floatingContext):
(FormattingContext.prototype.layout):
(FormattingContext.prototype.computeWidth):
(FormattingContext.prototype.computeHeight):
(FormattingContext.prototype.marginTop):
(FormattingContext.prototype.marginLeft):
(FormattingContext.prototype.marginBottom):
(FormattingContext.prototype.marginRight):
(FormattingContext.prototype.absoluteMarginBox):
(FormattingContext.prototype.absoluteBorderBox):
(FormattingContext.prototype.absolutePaddingBox):
(FormattingContext.prototype.absoluteContentBox):

LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js: Renamed from Tools/LayoutReloaded/InlineFormattingContext.js.

(InlineFormattingContext):
(InlineFormattingContext.prototype.layout):
(InlineFormattingContext.prototype._handleInlineBox):
(InlineFormattingContext.prototype._handleText):
(InlineFormattingContext.prototype._commitLine):
(InlineFormattingContext.prototype._line):

LayoutReloaded/FormattingContext/InlineFormatting/Line.js: Copied from Tools/LayoutReloaded/InitialBlockContainer.js.

(Line):
(Line.prototype.isEmpty):
(Line.prototype.availableWidth):
(Line.prototype.appendFragment):

LayoutReloaded/LayoutReloaded.xcworkspace/contents.xcworkspacedata:
LayoutReloaded/LayoutTree/BlockContainer.js: Renamed from Tools/LayoutReloaded/BlockContainer.js.

(BlockContainer):
(BlockContainer.prototype.establishesInlineFormattingContext):

LayoutReloaded/LayoutTree/Box.js: Renamed from Tools/LayoutReloaded/Box.js.

(Box):
(Box.prototype.id):
(Box.prototype.setRendererName):
(Box.prototype.name):
(Box.prototype.node):
(Box.prototype.parent):
(Box.prototype.nextSibling):
(Box.prototype.nextInFlowSibling):
(Box.prototype.previousSibling):
(Box.prototype.previousInFlowSibling):
(Box.prototype.setParent):
(Box.prototype.setNextSibling):
(Box.prototype.setPreviousSibling):
(Box.prototype.rect):
(Box.prototype.topLeft):
(Box.prototype.bottomRight):
(Box.prototype.setTopLeft):
(Box.prototype.setSize):
(Box.prototype.setWidth):
(Box.prototype.setHeight):
(Box.prototype.isContainer):
(Box.prototype.isBlockLevelBox):
(Box.prototype.isBlockContainerBox):
(Box.prototype.isInlineLevelBox):
(Box.prototype.setIsAnonymous):
(Box.prototype.isAnonymous):
(Box.prototype.establishesFormattingContext):
(Box.prototype.establishedFormattingContext):
(Box.prototype.establishesBlockFormattingContext):
(Box.prototype.establishesInlineFormattingContext):
(Box.prototype.isPositioned):
(Box.prototype.isRelativePositioned):
(Box.prototype.isAbsolutePositioned):
(Box.prototype.isFixedPositioned):
(Box.prototype.isInFlow):
(Box.prototype.isOutOfFlowPositioned):
(Box.prototype.isInFlowPositioned):
(Box.prototype.isFloatingPositioned):
(Box.prototype.isFloatingOrOutOfFlowPositioned):
(Box.prototype.isRootElement):
(Box.prototype.containingBlock):
(Box.prototype.borderBox):
(Box.prototype.paddingBox):
(Box.prototype.contentBox):

LayoutReloaded/LayoutTree/Container.js: Renamed from Tools/LayoutReloaded/Container.js.

(Container):
(Container.prototype.isContainer):
(Container.prototype.setFirstChild):
(Container.prototype.setLastChild):
(Container.prototype.firstChild):
(Container.prototype.firstInFlowChild):
(Container.prototype.lastChild):
(Container.prototype.lastInFlowChild):
(Container.prototype.hasChild):
(Container.prototype.hasInFlowChild):

LayoutReloaded/LayoutTree/InitialBlockContainer.js: Renamed from Tools/LayoutReloaded/InitialBlockContainer.js.

(InitialBlockContainer):
(InitialBlockContainer.prototype.establishesBlockFormattingContext):
(InitialBlockContainer.prototype.paddingBox):
(InitialBlockContainer.prototype.contentBox):

LayoutReloaded/LayoutTree/InlineBox.js: Renamed from Tools/LayoutReloaded/InlineBox.js.

(InlineBox):
(InlineBox.prototype.setText):
(InlineBox.prototype.text):

LayoutReloaded/LayoutTree/Text.js: Renamed from Tools/LayoutReloaded/Text.js.

(Text):
(Text.prototype.node):
(Text.prototype.content):
(Text.prototype.length):

LayoutReloaded/Utils.js:

(Utils.nextBreakingOpportunity):
(Utils.measureText):

LayoutReloaded/misc/headers/Line.h: Copied from Tools/LayoutReloaded/misc/headers/Text.h.
LayoutReloaded/misc/headers/Text.h:
LayoutReloaded/test/border-simple.html:
LayoutReloaded/test/index.html:

8:38 PM Changeset in webkit [229521] by Wenson Hsieh

2 edits in trunk/Source/WebKit

Fix the internal iOS build after r229512
https://bugs.webkit.org/show_bug.cgi?id=183550

Reviewed by Zalan Bujtas.

Fixes a typo in a header import, as well as a nullability error. SecTrustEvaluate() takes in a nonnull outparam,
which was removed in r229512; this adds the outparam back, but does not consult its value when setting the
infoDictionary.

UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController _EVOrganizationName]):

8:25 PM Changeset in webkit [229520] by Yusuke Suzuki

4 edits
2 adds in trunk

[DFG] AI should convert CreateThis to NewObject if the prototype object is proved
https://bugs.webkit.org/show_bug.cgi?id=183310

Reviewed by Filip Pizlo.

JSTests:

stress/ai-create-this-to-new-object-fire.js: Added.

(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):

stress/ai-create-this-to-new-object.js: Added.

(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):

Source/JavaScriptCore:

This patch implements CreateThis -> NewObject conversion in AI if the given function is constant.
This contributes to 6% win in Octane/raytrace.

baseline patched

raytrace x2 1.19915+-0.01862 ^{1.13156+-0.01589} definitely 1.0597x faster

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

3:05 PM Changeset in webkit [229519] by Wenson Hsieh

2 edits in trunk/Source/JavaScriptCore

Disable Sigill crash analyzer on watchOS
https://bugs.webkit.org/show_bug.cgi?id=183548
<rdar://problem/38338032>

Reviewed by Mark Lam.

Sigill is not supported on watchOS.

runtime/Options.cpp:

(JSC::overrideDefaults):

2:09 PM Changeset in webkit [229518] by fpizlo@apple.com

22 edits
1 add in trunk/Source

Split DirectArguments into JSValueOOB and JSValueStrict parts
https://bugs.webkit.org/show_bug.cgi?id=183458

Reviewed by Yusuke Suzuki.
Source/JavaScriptCore:

Our Spectre plan for JSValue objects is to allow inline JSValue stores and loads guarded by
unmitigated structure checks. This works because objects reachable from JSValues (i.e. JSValue
objects, like String, Symbol, and any descendant of JSObject) will only contain fields that it's OK
to read and write within a Spectre mitigation window. Writes are important, because within the
window, a write could appear to be made speculatively and rolled out later. This means that:

JSValue objects cannot have lengths, masks, or anything else inline.

JSValue objects cannot have an inline type that is used as part of a Spectre mitigation for a type check, unless that type is in the form of a poison key.

This means that the dynamic poisoning that I previously landed for DirectArguments is wrong. It also
means that it's wrong for DirectArguments to have an inline length.

This changes DirectArguments to use poisoning according to the universal formula:

The random accessed portions are out-of-line, pointed to by a poisoned pointer.

No inline length.

Surprisingly, this is perf-neutral. It's probably perf-neutral because our compiler optimizations
amortize whatever cost there was.

bytecode/AccessCase.cpp:

(JSC::AccessCase::generateWithGuard):

dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:

(JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):

dfg/DFGCallCreateDirectArgumentsWithKnownLengthSlowPathGenerator.h: Added.

(JSC::DFG::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetFromArguments):
(JSC::DFG::SpeculativeJIT::compilePutToArguments):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileGetFromArguments):
(JSC::FTL::DFG::LowerDFGToB3::compilePutToArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedHeapCell):
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoison): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnLoadedType): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnType): Deleted.

heap/SecurityKind.h:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):
(JSC::JIT::emitDirectArgumentsGetByVal):

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/DirectArguments.cpp:

(JSC::DirectArguments::DirectArguments):
(JSC::DirectArguments::createUninitialized):
(JSC::DirectArguments::create):
(JSC::DirectArguments::createByCopying):
(JSC::DirectArguments::estimatedSize):
(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::overrideThings):
(JSC::DirectArguments::copyToArguments):
(JSC::DirectArguments::mappedArgumentsSize):

runtime/DirectArguments.h:
runtime/JSCPoison.h:
runtime/JSLexicalEnvironment.h:
runtime/JSSymbolTableObject.h:
runtime/VM.cpp:

(JSC::VM::VM):

runtime/VM.h:

Source/WTF:

wtf/MathExtras.h:

(WTF::dynamicPoison): Deleted.

12:52 PM Changeset in webkit [229517] by Yusuke Suzuki

5 edits in trunk/Source/JavaScriptCore

[B3] Above/Below should be strength-reduced for comparison with 0
https://bugs.webkit.org/show_bug.cgi?id=183543

Reviewed by Filip Pizlo.

Above(0, x) and BelowEqual(0, x) can be converted to constants false and true respectively.
This can be seen in ArraySlice(0) case: Select(Above(0, length), length, 0) this should
be converted to 0. This patch adds such a folding to comparisons.

We also fix B3ReduceStrength issue creating an orphan value. If a flipped value is folded to
a constant, we do not insert flipped value and make it an orphan. This issue causes JSC test
failure with this B3Const32/64Value change. With this patch, we create a flipped value only
when we fail to fold it to a constant.

b3/B3Const32Value.cpp:

(JSC::B3::Const32Value::lessThanConstant const):
(JSC::B3::Const32Value::greaterThanConstant const):
(JSC::B3::Const32Value::lessEqualConstant const):
(JSC::B3::Const32Value::greaterEqualConstant const):
(JSC::B3::Const32Value::aboveConstant const):
(JSC::B3::Const32Value::belowConstant const):
(JSC::B3::Const32Value::aboveEqualConstant const):
(JSC::B3::Const32Value::belowEqualConstant const):

b3/B3Const64Value.cpp:

(JSC::B3::Const64Value::lessThanConstant const):
(JSC::B3::Const64Value::greaterThanConstant const):
(JSC::B3::Const64Value::lessEqualConstant const):
(JSC::B3::Const64Value::greaterEqualConstant const):
(JSC::B3::Const64Value::aboveConstant const):
(JSC::B3::Const64Value::belowConstant const):
(JSC::B3::Const64Value::aboveEqualConstant const):
(JSC::B3::Const64Value::belowEqualConstant const):

b3/B3ReduceStrength.cpp:
b3/testb3.cpp:

(JSC::B3::int64Operands):
(JSC::B3::int32Operands):

10:45 AM Changeset in webkit [229516] by fpizlo@apple.com

10 edits
1 add in trunk/Source/bmalloc

PerProcess<> should be safe by default
https://bugs.webkit.org/show_bug.cgi?id=183545

Reviewed by Yusuke Suzuki.

This makes PerProcess<> safe by default, so we don't need SafePerProcess<>.

The new PerProcess<> design relies on a hash-consing mechanism for PerProcess<> storage based
on the PRETTY_FUNCTION from inside PerProcess<>, which captures the instantiated type in
the string. Therefore, this can be used to runtime-coalesce PerProcess<> instances based on
type.

I expect this to be perf-neutral. It's an important prerequisite to more bmalloc work, since I
don't want to have more PerProcess<> vs SafePerProcess<> bugs, and SafePerProcess<> can't be
used for everything (I don't see how to use it for isoheaps).

CMakeLists.txt:
bmalloc.xcodeproj/project.pbxproj:
bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):

bmalloc/IsoDirectoryInlines.h:

(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didBecome):

bmalloc/PerProcess.cpp: Added.

(bmalloc::stringHash):
(bmalloc::allocate):
(bmalloc::getPerProcessData):

bmalloc/PerProcess.h:

(bmalloc::PerProcess::mutex):
(bmalloc::PerProcess::coalesce):
(bmalloc::PerProcess::getSlowCase):
(): Deleted.

bmalloc/Scavenger.cpp:
bmalloc/Scavenger.h:
bmalloc/bmalloc.cpp:

(bmalloc::api::scavenge):
(bmalloc::api::setScavengerThreadQOSClass):

12:03 AM Changeset in webkit [229515] by Yusuke Suzuki

3 edits in trunk/Source/WTF

[Win] Use SRWLOCK and CONDITION_VARIABLE to simplify implementation
https://bugs.webkit.org/show_bug.cgi?id=183541

Reviewed by Darin Adler.

After Windows Vista, Windows offers SRWLOCK and CONDITION_VARIABLE.
They can simplify the implementation of our WTF::Mutex and WTF::ThreadCondition.

C++ std::mutex and std::condition_variable uses std::chrono for their timed
functions. Since std::chrono is not overflow-aware, we cannot reliably use
this functionalities. This is why we still keep WTF::Mutex and WTF::ThreadCondition.
They are used for ParkingLot.

wtf/ThreadingPrimitives.h:
wtf/ThreadingWin.cpp:

(WTF::Mutex::Mutex):
(WTF::Mutex::~Mutex):
(WTF::Mutex::lock):
(WTF::Mutex::tryLock):
(WTF::Mutex::unlock):
(WTF::absoluteTimeToWaitTimeoutInterval):
(WTF::ThreadCondition::ThreadCondition):
(WTF::ThreadCondition::~ThreadCondition):
(WTF::ThreadCondition::wait):
(WTF::ThreadCondition::timedWait):
(WTF::ThreadCondition::signal):
(WTF::ThreadCondition::broadcast):
(WTF::PlatformCondition::timedWait): Deleted.
(WTF::PlatformCondition::signal): Deleted.

Mar 10, 2018:

11:20 PM Changeset in webkit [229514] by Yusuke Suzuki

25 edits
4 adds in trunk

[FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
https://bugs.webkit.org/show_bug.cgi?id=181848

Reviewed by Sam Weinig.

JSTests:

microbenchmarks/regexp-u-global-es5.js: Added.

(fn):

microbenchmarks/regexp-u-global-es6.js: Added.

(fn):

stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.

(shouldBe):
(test):
(i.switch):

stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

In r181535, we support string.match(/nonglobal/) code. However, string.match(/global/g) is not
optimized since it sets lastIndex value before performing RegExp operation.

This patch optimizes the above "with a global flag" case by emitting SetRegExpObjectLastIndex properly.
RegExpMatchFast is converted to SetRegExpObjectLastIndex and RegExpMatchFastGlobal. The latter node
just holds RegExp (not RegExpObject) cell so that it can offer a chance to make NewRegexp PhantomNewRegexp
in object allocation sinking phase.

Added microbenchmarks shows that this patch makes NewRegexp PhantomNewRegexp even if the given RegExp
has a global flag. And it improves the performance.

baseline patched

regexp-u-global-es5 44.1298+-4.6128 ^{33.7920+-2.0110} definitely 1.3059x faster
regexp-u-global-es6 182.3272+-2.2861 ^{154.3414+-7.6769} definitely 1.1813x faster

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGMayExit.cpp:
dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToRegExpMatchFastGlobal):

dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::hasCellOperand):

dfg/DFGNodeType.h:
dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpMatchFastGlobal):

runtime/RegExpObject.cpp:

(JSC::collectMatches): Deleted.

runtime/RegExpObject.h:
runtime/RegExpObjectInlines.h:

(JSC::RegExpObject::execInline):
(JSC::RegExpObject::matchInline):
(JSC::advanceStringUnicode):
(JSC::collectMatches):
(JSC::RegExpObject::advanceStringUnicode): Deleted.

runtime/RegExpPrototype.cpp:

(JSC::advanceStringIndex):

11:16 PM Changeset in webkit [229513] by Yusuke Suzuki

3 edits in trunk/Source/JavaScriptCore

B3::reduceStrength should canonicalize integer comparisons
https://bugs.webkit.org/show_bug.cgi?id=150958

Reviewed by Filip Pizlo.

This patch sorts operands of comparisons by flipping opcode. For example, Above(0, @2) is
converted to Below(@2, 0). This sorting is the same to handleCommutativity rule. Since we
canonicalize comparisons to have constant value at least on the right hand side, we can
remove pattern matchings checking leftImm in B3LowerToAir.

Since this flipping changes the opcode of the value, to achieve safely, we just create a
new value which has flipped opcode and swapped operands. If we can fold it to a constant,
we replace m_value with this constant. If we fail to fold it to constant, we replace
m_value with the flipped one.

These comparisons are already handled in testb3.

b3/B3LowerToAir.cpp:
b3/B3ReduceStrength.cpp:

5:49 PM Changeset in webkit [229512] by jer.noble@apple.com

2 edits
3 copies
1 move
5 adds
1 delete in trunk/Source/WebKit

Improvements to fullscreen; new UI and security features
https://bugs.webkit.org/show_bug.cgi?id=183503

Reviewed by Dean Jackson.

Now that the iOS Fullscreen code has more than one major class, move it into an ios/
directory.

Clean up the WKFullScreenWindowControllerIOS class to more clearly separate external
facing API from purely internal functions.

Move the WKFullScreenViewController out into its own file. Add support for fullscreen
top inset and fullscreen autohide duration CSS constants.

Add a heuristic to distinguish between media control related touches and ones that look
more keyboard interactions.

Add a new UIStackView based control to hold the fullscreen controls.

UIProcess/ios/WKFullScreenWindowControllerIOS.mm: Removed.
UIProcess/ios/fullscreen/FullscreenTouchSecheuristic.cpp: Added.

(WebKit::FullscreenTouchSecheuristic::scoreOfNextTouch):
(WebKit::FullscreenTouchSecheuristic::reset):
(WebKit::FullscreenTouchSecheuristic::distanceScore):
(WebKit::FullscreenTouchSecheuristic::attenuationFactor):

UIProcess/ios/fullscreen/FullscreenTouchSecheuristic.h:

(WebKit::FullscreenTouchSecheuristic::setRampUpSpeed):
(WebKit::FullscreenTouchSecheuristic::setRampDownSpeed):
(WebKit::FullscreenTouchSecheuristic::setXWeight):
(WebKit::FullscreenTouchSecheuristic::setYWeight):
(WebKit::FullscreenTouchSecheuristic::setSize):
(WebKit::FullscreenTouchSecheuristic::setGamma):
(WebKit::FullscreenTouchSecheuristic::setGammaCutoff):

UIProcess/ios/fullscreen/WKFullScreenViewController.h:
UIProcess/ios/fullscreen/WKFullScreenViewController.mm: Added.

(WKFullScreenViewControllerPlaybackSessionModelClient::setParent):
(WKFullScreenViewControllerPlaybackSessionModelClient::setInterface):
(-[_WKExtrinsicButton setExtrinsicContentSize:]):
(-[_WKExtrinsicButton intrinsicContentSize]):
(-[WKFullScreenViewController initWithWebView:]):
(-[WKFullScreenViewController dealloc]):
(-[WKFullScreenViewController showUI]):
(-[WKFullScreenViewController hideUI]):
(-[WKFullScreenViewController videoControlsManagerDidChange]):
(-[WKFullScreenViewController setPrefersStatusBarHidden:]):
(-[WKFullScreenViewController setPlaying:]):
(-[WKFullScreenViewController setPictureInPictureActive:]):
(-[WKFullScreenViewController loadView]):
(-[WKFullScreenViewController viewWillAppear:]):
(-[WKFullScreenViewController viewDidLayoutSubviews]):
(-[WKFullScreenViewController viewWillTransitionToSize:withTransitionCoordinator:]):
(-[WKFullScreenViewController preferredStatusBarStyle]):
(-[WKFullScreenViewController prefersStatusBarHidden]):
(-[WKFullScreenViewController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):
(-[WKFullScreenViewController gestureRecognizer:shouldReceiveTouch:]):
(-[WKFullScreenViewController _manager]):
(-[WKFullScreenViewController _effectiveFullscreenInsetTop]):
(-[WKFullScreenViewController _cancelAction:]):
(-[WKFullScreenViewController _togglePiPAction:]):
(-[WKFullScreenViewController _touchDetected:]):
(-[WKFullScreenViewController _statusBarFrameDidChange:]):
(-[WKFullScreenViewController _updateWebViewFullscreenInsets]):
(-[WKFullScreenViewController _showPhishingAlert]):

UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.h: Copied from Source/WebKit/UIProcess/ios/WKFullScreenWindowControllerIOS.h.
UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm: Added.

(WebKit::replaceViewWithView):
(WebKit::WKWebViewState::applyTo):
(WebKit::WKWebViewState::store):
(-[WKFullscreenAnimationController transitionDuration:]):
(-[WKFullscreenAnimationController configureInitialAndFinalStatesForTransition:]):
(-[WKFullscreenAnimationController animateTransition:]):
(-[WKFullscreenAnimationController animationEnded:]):
(-[WKFullscreenAnimationController startInteractiveTransition:]):
(-[WKFullscreenAnimationController updateWithPercent:]):
(-[WKFullscreenAnimationController updateWithPercent:translation:anchor:]):
(-[WKFullscreenAnimationController end:]):
(-[WKFullScreenInteractiveTransition initWithAnimator:anchor:]):
(-[WKFullScreenInteractiveTransition wantsInteractiveStart]):
(-[WKFullScreenInteractiveTransition startInteractiveTransition:]):
(-[WKFullScreenInteractiveTransition updateInteractiveTransition:withTranslation:]):
(-[WKFullScreenInteractiveTransition cancelInteractiveTransition]):
(-[WKFullScreenInteractiveTransition finishInteractiveTransition]):
(-[WKFullScreenWindowController initWithWebView:]):
(-[WKFullScreenWindowController dealloc]):
(-[WKFullScreenWindowController isFullScreen]):
(-[WKFullScreenWindowController webViewPlaceholder]):
(-[WKFullScreenWindowController enterFullScreen]):
(-[WKFullScreenWindowController beganEnterFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController requestExitFullScreen]):
(-[WKFullScreenWindowController exitFullScreen]):
(-[WKFullScreenWindowController beganExitFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController _completedExitFullScreen]):
(-[WKFullScreenWindowController close]):
(-[WKFullScreenWindowController webViewDidRemoveFromSuperviewWhileInFullscreen]):
(-[WKFullScreenWindowController videoControlsManagerDidChange]):
(-[WKFullScreenWindowController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):
(-[WKFullScreenWindowController animationControllerForPresentedController:presentingController:sourceController:]):
(-[WKFullScreenWindowController animationControllerForDismissedController:]):
(-[WKFullScreenWindowController interactionControllerForDismissal:]):
(-[WKFullScreenWindowController _exitFullscreenImmediately]):
(-[WKFullScreenWindowController _invalidateEVOrganizationName]):
(-[WKFullScreenWindowController _isSecure]):
(-[WKFullScreenWindowController _serverTrust]):
(-[WKFullScreenWindowController _EVOrganizationName]):
(-[WKFullScreenWindowController _updateLocationInfo]):
(-[WKFullScreenWindowController _manager]):
(-[WKFullScreenWindowController _startToDismissFullscreenChanged:]):
(-[WKFullScreenWindowController _interactiveDismissChanged:]):

UIProcess/ios/fullscreen/WKFullscreenStackView.h: Renamed from Source/WebKit/UIProcess/ios/WKFullScreenWindowControllerIOS.h.
UIProcess/ios/fullscreen/WKFullscreenStackView.mm: Added.

(+[WKFullscreenStackView baseEffects]):
(+[WKFullscreenStackView configureView:forTintEffectWithColor:filterType:]):
(+[WKFullscreenStackView configureView:withBackgroundFillOfColor:opacity:filter:]):
(+[WKFullscreenStackView secondaryMaterialOverlayView]):
(+[WKFullscreenStackView applyPrimaryGlyphTintToView:]):
(+[WKFullscreenStackView applySecondaryGlyphTintToView:]):
(-[WKFullscreenStackView initWithArrangedSubviews:axis:]):
(-[WKFullscreenStackView setTargetViewForSecondaryMaterialOverlay:]):
(-[WKFullscreenStackView contentView]):
(-[WKFullscreenStackView _setArrangedSubviews:axis:]):
(-[WKFullscreenStackView setBounds:]):
(-[WKFullscreenStackView updateConstraints]):

WebKit.xcodeproj/project.pbxproj:

5:38 PM Changeset in webkit [229511] by Megan Gardner

17 edits in trunk/Source

Media query for default appearance
https://bugs.webkit.org/show_bug.cgi?id=183539
<rdar://problem/38326388>

Reviewed by Tim Horton.

Source/WebCore:

Not currently testable, will add tests in a later patch.

Write a media query to evaluate appearance.

css/CSSValueKeywords.in:
css/MediaFeatureNames.h:
css/MediaQueryEvaluator.cpp:

(WebCore::defaultAppearanceEvaluate):

css/MediaQueryExpression.cpp:

(WebCore::featureWithValidIdent):
(WebCore::isFeatureValidWithoutValue):

page/Page.h:

(WebCore::Page::defaultAppearance const):
(WebCore::Page::setDefaultAppearance):

Source/WebKit:

Write a media query to evaluate appearance.

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):
(-[WKWebView _setUseSystemAppearance:]):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters):
(WebKit::WebPageProxy::setDefaultAppearance):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::defaultAppearance const):

WebProcess/WebPage/WebPage.cpp:

(WebKit::m_credentialsMessenger):
(WebKit::WebPage::setDefaultAppearance):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

Write a media query to evaluate appearance.

WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(-[WebView _setUseSystemAppearance:]):

3:26 PM Changeset in webkit [229510] by dbates@webkit.org

6 edits in trunk/Source/WebCore

InlineTextBox should own shadow data
https://bugs.webkit.org/show_bug.cgi?id=183359
<rdar://problem/38171343>

Reviewed by Darin Adler.

Following r229147 we recompute the selection style, including any shadow data, whenever we
paint the inline text box. Therefore, InlineTextBox needs to take ownership of the shadow
data or it may be deallocated before it can be used.

Covered by existing tests.

rendering/InlineTextBox.cpp: Changed data type of InlineTextBox::MarkedTextStyle::textShadow

from const ShadowData* to std::optional<ShadowData>. Also removed explicitly deleted equality
and inequality operators as they are unnecessary. Layout tests should catch if these are ever
implemented and used when painting because the painted results will be wrong.
(WebCore::InlineTextBox::computeStyleForUnmarkedMarkedText const): Clone ShadowData.
(WebCore::InlineTextBox::resolveStyleForMarkedText): Simplified logic.
(WebCore::InlineTextBox::paintMarkedTextForeground): Modified code now that MarkedTextStyle
holds a std::optional<ShadowData>.
(WebCore::InlineTextBox::paintMarkedTextDecoration): Ditto.

rendering/TextPaintStyle.cpp:

(WebCore::computeTextSelectionPaintStyle): Changed the out parameter type from const ShadowData*
to std::optional<ShadowData>& and modified code as needed.

rendering/TextPaintStyle.h:
rendering/style/ShadowData.cpp: Removed unncessary #include of header LayoutRect.h.

This header will be included via ShadowData.h.
(WebCore::ShadowData::clone): Convenience method that returns an std::optional to a
cloned ShadowData object.

rendering/style/ShadowData.h:

1:43 PM Changeset in webkit [229509] by jmarcell@apple.com

4 edits in tags/Safari-606.1.7.1/Source/JavaScriptCore

Cherry-pick r229506. rdar://problem/38316707

1:37 PM Changeset in webkit [229508] by jmarcell@apple.com

7 edits in tags/Safari-606.1.7.1/Source

Versioning.

1:34 PM Changeset in webkit [229507] by jmarcell@apple.com

1 copy in tags/Safari-606.1.7.1

New tag.

12:13 PM Changeset in webkit [229506] by mark.lam@apple.com

4 edits in trunk/Source/JavaScriptCore

offlineasm should reset the Assembler's working state before doing another pass for a new target.
https://bugs.webkit.org/show_bug.cgi?id=183538
<rdar://problem/38325955>

Reviewed by Michael Saboff.

llint/LowLevelInterpreter.cpp:
offlineasm/asm.rb:
offlineasm/cloop.rb:

11:31 AM Changeset in webkit [229505] by Alan Bujtas

3 edits
2 adds in trunk

Turn off offset*/scroll* optimization for input elements with shadow content
https://bugs.webkit.org/show_bug.cgi?id=182383
<rdar://problem/37114190>

Reviewed by Antti Koivisto.

Source/WebCore:

We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
the previously computed values even when some part of the tree is dirty.
In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
for the root, while true (needs layout) for the shadow content.
This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.

Test: fast/forms/scrollheight-with-mutation-crash.html

dom/Document.cpp:

(WebCore::Document::updateLayoutIfDimensionsOutOfDate):

LayoutTests:

fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
fast/forms/scrollheight-with-mutation-crash.html: Added.

9:28 AM Changeset in webkit [229504] by commit-queue@webkit.org

8 edits in trunk/Source

Unreviewed, rolling out r229436.
https://bugs.webkit.org/show_bug.cgi?id=183542

seems to have regressed wasm compile times by 10% (Requested
by pizlo-mbp on #webkit).

Reverted changeset:

"bmalloc mutex should be adaptive"
https://bugs.webkit.org/show_bug.cgi?id=177839
https://trac.webkit.org/changeset/229436

3:33 AM Changeset in webkit [229503] by Wenson Hsieh

15 edits in trunk

[macOS] Copying a table from the Numbers app and pasting into iCloud Numbers fails
https://bugs.webkit.org/show_bug.cgi?id=183485
<rdar://problem/38041984>

Reviewed by Ryosuke Niwa.

Source/WebCore:

After r222656, WebKit now treats raw image data on the pasteboard as files for the purposes of computing
DataTransfer.files and DataTransfer.types. However, this is combined with existing policies that suppress
DataTransfer.getData and DataTransfer.setData when the pasteboard contains files (generalized to copy/paste in
r222688). This means we now don't allow web pages to access "text/plain" in the case where the user copies part
of a table from the native Numbers app since Numbers additionally writes a snapshot of the table to the platform
pasteboard.

This restriction on getData/setData was intended to prevent web pages from extracting users' file paths when
pasting or dropping, so it doesn't make sense to enforce this restriction even when there is only in-memory
image data on the pasteboard. To fix this bug, we make Pasteboard::fileContentState() differentiate between
cases where there are (real) files on the pasteboard, and cases where we've fallen back to treating image data
as files.

Rebaselined existing LayoutTests to match new behavior.
Also covered by 4 new API tests:

PasteMixedContent.ImageDataAndPlainText
PasteMixedContent.ImageDataAndPlainTextAndURL
PasteMixedContent.ImageDataAndPlainTextAndURLAndHTML
UIPasteboardTests.DataTransferGetDataWhenPastingImageAndText

dom/DataTransfer.cpp:

(WebCore::DataTransfer::shouldSuppressGetAndSetDataToAvoidExposingFilePaths const):

If custom pasteboard data is enabled, suppress getData and setData if and only if we might actually expose file
paths (see Pasteboard::fileContentState).

(WebCore::DataTransfer::types const):

Only allow "text/html" or "text/uri-list" in the case where there are actual files in the pasteboard. If there's
only image data, add all of the DOM-safe types back into the list of types.

platform/Pasteboard.h:
platform/StaticPasteboard.h:

Add an enum type to represent the result of Pasteboard::fileContentState.

NoFileOrImageData indicates that there was nothing on the pasteboard that could be considered a file

from the point of view of the page.

InMemoryImage indicates that there are no files on the pasteboard, but there is image data that we consider

to be files, exposed via DataTransfer API.

MayContainFilePaths indicates that there might be file paths on the pasteboard. This means that the source

has either written file paths to the pasteboard (for example, through NSFilenamesPboardType) or the source
has written image data along with a URL type of some sort that does not match one of the allowed URL schemes
that are safe to expose (currently, these are http-family, data, or blob).

platform/cocoa/PasteboardCocoa.mm:

(WebCore::Pasteboard::fileContentState):

Refactor to return one of the three enum types described above.

(WebCore::Pasteboard::containsFiles): Deleted.

platform/gtk/PasteboardGtk.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

platform/win/PasteboardWin.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

platform/wpe/PasteboardWPE.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

Adjust for Pasteboard::fileContentState() tweaks.

Tools:

Add new API tests to cover scenarios in which we paste image data alongside text data.

TestWebKitAPI/Tests/WebKitCocoa/PasteMixedContent.mm:

(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/ios/UIPasteboardTests.mm:

(TestWebKitAPI::TEST):

LayoutTests:

Rebaseline some pasteboard-related layout tests, in which we now expose text/plain alongside files that were
written to the DataTransfer by the page itself.

editing/pasteboard/data-transfer-item-list-add-file-multiple-times-expected.txt:
editing/pasteboard/data-transfer-item-list-add-file-on-copy-expected.txt:
editing/pasteboard/data-transfer-item-list-add-file-on-drag-expected.txt:

Mar 9, 2018:

9:27 PM Changeset in webkit [229502] by Chris Dumez

2 edits
1 copy
4 adds in trunk/LayoutTests

inspector/page/frameScheduledNavigation.html has different output with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183469

Reviewed by Ryosuke Niwa.

The test tracks 3 internal events:

frameScheduledNavigation
frameStartedLoading
frameClearedScheduledNavigation

Without async policy delegates, the events happen in this order. However, with asynchronous
policy delegates, frameStartedLoading happens *after* frameClearedScheduledNavigation. What
happens *before* frameClearedScheduledNavigation is the navigation policy check. When we
get the policy response to continue (asynchronously), we then actually start the load and
frameStartedLoading gets logged.

inspector/page/frameScheduledNavigation-async-delegates-expected.txt: Added.
inspector/page/frameScheduledNavigation-async-delegates.html: Copied from LayoutTests/inspector/page/frameScheduledNavigation.html.
inspector/page/frameScheduledNavigation.html:

8:44 PM Changeset in webkit [229501] by Dewei Zhu

3 edits in trunk/Websites/perf.webkit.org

Create analysis task should use build time as fallback when commit time is not available.
https://bugs.webkit.org/show_bug.cgi?id=183309

Reviewed by Ryosuke Niwa.

Added the ability to schedule analysis task for the range without commit time.

public/privileged-api/create-analysis-task.php: Use build time as fallback.
server-tests/privileged-api-create-analysis-task-tests.js: Added a unit test for this change.

7:53 PM Changeset in webkit [229500] by Chris Fleizach

5 edits
2 adds in trunk

AX: WebKit seems to be running spell checker even on non-editable content text
https://bugs.webkit.org/show_bug.cgi?id=183456
<rdar://problem/38076042>

Reviewed by Joanmarie Diggs.

Source/WebCore:

Test: accessibility/mac/attributed-string/attributed-string-does-not-includes-misspelled-for-non-editable.html

Only apply misspelled attributes if it's for editable text. It's not useful or performant to do this for static text.

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(AXAttributeStringSetSpelling):

LayoutTests:

accessibility/mac/attributed-string/attributed-string-does-not-includes-misspelled-for-non-editable-expected.txt: Added.
accessibility/mac/attributed-string/attributed-string-does-not-includes-misspelled-for-non-editable.html: Added.
accessibility/mac/attributed-string/attributed-string-for-range-with-options.html:
accessibility/mac/attributed-string/attributed-string-for-range.html:

Update tests to reflect that only editable content returns misspelled attributes.

7:37 PM Changeset in webkit [229499] by n_wang@apple.com

4 edits in trunk

AX: AOM: More accessibility events support
https://bugs.webkit.org/show_bug.cgi?id=183023
<rdar://problem/37764380>

Reviewed by Chris Fleizach.

Source/WebCore:

The test is crashing when we call updateBackingStore when
the AXObjectCache object is gone. Added a check to fix that.

Modified the test by using the right format of setTimeout and extended the delay.

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::updateBackingStore):

LayoutTests:

accessibility/mac/AOM-events-webarea-crash.html:

7:10 PM Changeset in webkit [229498] by Ross Kirsling

2 edits in trunk/Source/WebCore

Unreviewed. Fix WinCairo build after r229497.

platform/MIMETypeRegistry.cpp:

(WebCore::MIMETypeRegistry::getNormalizedMIMEType):

5:47 PM Changeset in webkit [229497] by Ross Kirsling

2 edits in trunk/Source/WebCore

Clean up MIMETypeRegistry::mimeTypeAssociationMap for Curl
https://bugs.webkit.org/show_bug.cgi?id=170529

Reviewed by Alex Christensen.

platform/MIMETypeRegistry.cpp:

(WebCore::MIMETypeRegistry::getNormalizedMIMEType):
(WebCore::mimeTypeAssociationMap): Deleted.
Create map with makeNeverDestroyed and a loop instead.

5:28 PM Changeset in webkit [229496] by Ryan Haddad

3 edits
2 deletes in trunk/LayoutTests

Unreviewed, rolling out r229468.

This change caused http/tests/security/frame-loading-via-
document-write.html to fail.

Reverted changeset:

"http/tests/security/frame-loading-via-document-write-async-
delegates.html fails with async delegates"
https://bugs.webkit.org/show_bug.cgi?id=183460
https://trac.webkit.org/changeset/229468

5:24 PM Changeset in webkit [229495] by Nikita Vasilyev

6 edits in trunk/Source/WebInspectorUI

Web Inspector: Sources: Open all resources in Sources tab instead of Resources/Debugger
https://bugs.webkit.org/show_bug.cgi?id=183317
<rdar://problem/38108455>

Reviewed by Matt Baker.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Base/Main.js:
UserInterface/Views/ContextMenuUtilities.js:

(WI.appendContextMenuItemsForURL):
Introduce preferredTabType option instead of listing ignoreResourcesTab, ignoreDebuggerTab, ignoreSearchTab, and ignoreNetworkTab.
The only correct outcome of selecting "Reveal in Sources Tab" context menu is to open Sources tab, not any other tab.

UserInterface/Views/SourceCodeTextEditor.js:

(WI.SourceCodeTextEditor.prototype.textEditorGutterContextMenu):

UserInterface/Views/TabBrowser.js:

(WI.TabBrowser.prototype.bestTabContentViewForRepresentedObject):

5:18 PM Changeset in webkit [229494] by jer.noble@apple.com

2 edits in trunk/Source/WebKit

Unconditionalize more methods in VideoFullscreenInterface (and related classes)
https://bugs.webkit.org/show_bug.cgi?id=183501
<rdar://problem/38312038>

Unreviewed build fix; add correct pragmas to code referencing m_playbackSessionManager.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::hasActiveVideoForControlsManager const):
(WebKit::WebPageProxy::requestControlledElementID const):
(WebKit::WebPageProxy::isPlayingVideoInEnhancedFullscreen const):

4:43 PM Changeset in webkit [229493] by BJ Burg

16 edits in trunk/Source

Web Inspector: there should only be one way for async backend commands to send failure
https://bugs.webkit.org/show_bug.cgi?id=183524

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

If this is an async command, errors should be reported with BackendDispatcher::CallbackBase::sendFailure.
To avoid mixups, don't include the ErrorString out-parameter in generated async command signatures.
This change only affects interfaces generated for C++ backend dispatchers.

inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:

(CppBackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):

inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:

(CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):

inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:

Source/WebCore:

Remove some useless ErrorString arguments. Fix some bugs where we
may never call the callback in an early exit situation.

Covered by existing Inspector and protocol generator tests.

inspector/agents/InspectorDatabaseAgent.cpp:

(WebCore::InspectorDatabaseAgent::executeSQL):

inspector/agents/InspectorDatabaseAgent.h:
inspector/agents/InspectorIndexedDBAgent.h:
inspector/agents/InspectorIndexedDBAgent.cpp:

(WebCore::getDocumentAndIDBFactoryFromFrameOrSendFailure):
(WebCore::InspectorIndexedDBAgent::requestDatabaseNames):
(WebCore::InspectorIndexedDBAgent::requestDatabase):
(WebCore::InspectorIndexedDBAgent::requestData):
(WebCore::InspectorIndexedDBAgent::clearObjectStore):
(WebCore::assertDocument): Deleted.
(WebCore::assertIDBFactory): Deleted.
Modernize this code a little bit to share the document/idbFactory extraction code.

inspector/agents/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::loadResource):

inspector/agents/InspectorNetworkAgent.h:

Source/WebKit:

Remove useless ErrorString argument from async commands.

For Automation protocol, introduce sync and async macros for filling
in and sending a failure response. Now that async commands don't have
an ErrorString and sync commands don't have a callback, trying to send
an error with the wrong macro is a compile-time error.

UIProcess/Automation/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::getBrowsingContexts):
(WebKit::WebAutomationSession::getBrowsingContext):
(WebKit::WebAutomationSession::createBrowsingContext):
(WebKit::WebAutomationSession::closeBrowsingContext):
(WebKit::WebAutomationSession::switchToBrowsingContext):
(WebKit::WebAutomationSession::setWindowFrameOfBrowsingContext):
(WebKit::WebAutomationSession::waitForNavigationToComplete):
(WebKit::WebAutomationSession::navigateBrowsingContext):
(WebKit::WebAutomationSession::goBackInBrowsingContext):
(WebKit::WebAutomationSession::goForwardInBrowsingContext):
(WebKit::WebAutomationSession::reloadBrowsingContext):
(WebKit::WebAutomationSession::evaluateJavaScriptFunction):
(WebKit::WebAutomationSession::resolveChildFrameHandle):
(WebKit::WebAutomationSession::resolveParentFrameHandle):
(WebKit::WebAutomationSession::computeElementLayout):
(WebKit::WebAutomationSession::selectOptionElement):
(WebKit::WebAutomationSession::isShowingJavaScriptDialog):
(WebKit::WebAutomationSession::dismissCurrentJavaScriptDialog):
(WebKit::WebAutomationSession::acceptCurrentJavaScriptDialog):
(WebKit::WebAutomationSession::messageOfCurrentJavaScriptDialog):
(WebKit::WebAutomationSession::setUserInputForCurrentJavaScriptPrompt):
(WebKit::WebAutomationSession::setFilesToSelectForFileUpload):
(WebKit::WebAutomationSession::getAllCookies):
(WebKit::WebAutomationSession::deleteSingleCookie):
(WebKit::WebAutomationSession::addSingleCookie):
(WebKit::WebAutomationSession::deleteAllCookies):
(WebKit::WebAutomationSession::setSessionPermissions):
(WebKit::WebAutomationSession::performMouseInteraction):
(WebKit::WebAutomationSession::performKeyboardInteractions):
(WebKit::WebAutomationSession::takeScreenshot):
(WebKit::WebAutomationSession::didTakeScreenshot):

UIProcess/Automation/WebAutomationSession.h:
UIProcess/Automation/WebAutomationSessionMacros.h:
UIProcess/Automation/mac/WebAutomationSessionMac.mm:

(WebKit::WebAutomationSession::inspectBrowsingContext):

4:41 PM Changeset in webkit [229492] by youenn@apple.com

2 edits in trunk/Source/WebCore

Crash in ServiceWorkerContainer::ready
https://bugs.webkit.org/show_bug.cgi?id=183380

Reviewed by Chris Dumez.

Not using 'this' through lambdas.
Instead rely on the last lambda that is passed a ScriptExecutionContext& to get back 'this' which is a ServiceWorkerContainer.

Should be covered by imported/w3c/web-platform-tests/service-workers/service-worker/register-default-scope.https.html no longer crashing.
Although it should probably be LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/ready.https.html that should crash
since this is the main test using ready.

workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::ready):

4:38 PM Changeset in webkit [229491] by youenn@apple.com

8 edits in trunk/Source/WebCore

RealtimeOutgoingAudioSource and RealtimeOutgoingVideoSource should be destroyed on the main thread
https://bugs.webkit.org/show_bug.cgi?id=183483
<rdar://problem/38214152>

Reviewed by Eric Carlson.

When dereferencing from libwebrtc code path, schedule a call to deref on main thread.
WebCore dereferencing is happening in the main thread so this guarantees destruction on the main thread.

Covered by updated mock libwebrtc peer connection backend.
We make mock senders to keep a reference to their source which are RealtimeOutgoingXXSource.
We then make mock peer connection backend to free the mock senders in a background thread.

Modules/mediastream/libwebrtc/LibWebRTCPeerConnectionBackend.cpp:

(WebCore::LibWebRTCPeerConnectionBackend::doStop):

platform/mediastream/RealtimeOutgoingAudioSource.cpp:

(WebCore::RealtimeOutgoingAudioSource::stop):

platform/mediastream/RealtimeOutgoingAudioSource.h:
platform/mediastream/RealtimeOutgoingVideoSource.cpp:

(WebCore::RealtimeOutgoingVideoSource::stop):

platform/mediastream/RealtimeOutgoingVideoSource.h:
testing/MockLibWebRTCPeerConnection.cpp:

(WebCore::ThreadKeeper::create):
(WebCore::ThreadKeeper::setThread):
(WebCore::MockLibWebRTCPeerConnection::~MockLibWebRTCPeerConnection):

testing/MockLibWebRTCPeerConnection.h:

4:12 PM Changeset in webkit [229490] by jer.noble@apple.com

2 edits in trunk/Source/WebKit

Don't pass NULL to the result parameter of SecTrustEvaluate()
https://bugs.webkit.org/show_bug.cgi?id=183495
<rdar://problem/38185688>

Reviewed by Andy Estes.

UIProcess/ios/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController _EVOrganizationName]):

3:45 PM Changeset in webkit [229489] by aakash_jain@apple.com

3 edits in trunk/Websites/perf.webkit.org

BuildbotBuildEntry for buildbot 0.9 uses incorrect buildrequestid
https://bugs.webkit.org/show_bug.cgi?id=183194

Reviewed by Ryosuke Niwa.

tools/js/buildbot-syncer.js:

(BuildbotBuildEntry.prototype.initialize): Updated _buildRequestId to use correct build-request-id, as set in syncer._buildRequestPropertyName.
(BuildbotSyncer.prototype.pathForPendingBuilds): Updated url to fetch properties for build-requests.

unit-tests/buildbot-syncer-tests.js:

(sampleBuildData): Updated sampleBuildData with correct build-request-id in properties. Added
properties to samplePendingBuildRequestData.

3:39 PM Changeset in webkit [229488] by dino@apple.com

5 edits in trunk/Source/WebKit

Allow NavigationState to intercept requests and send them to SystemPreviewController
https://bugs.webkit.org/show_bug.cgi?id=183526
<rdar://problem/37801140>

Reviewed by Tim Horton.

Implement a bit more of SystemPreviewController, such that it can be used
from NavigationState to identify and handle content that can be previewed.

UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationResponse):

If we'd in a download response policy, then check if SystemPreviewController
can show the content. We ignore the download, but pass the original URL onto
the preview. Ultimately, we'd want to avoid the navigation
but use the download destination URL for preview.

UIProcess/Cocoa/SystemPreviewControllerCocoa.mm:

(-[_WKPreviewControllerDataSource initWithURL:]):

Move the URL to property, to help use a single datasource object for all previews.

(-[_WKPreviewControllerDataSource previewController:previewItemAtIndex:]):
(-[_WKPreviewControllerDelegate initWithSystemPreviewController:]):

Add a delegate object, so we can detect when the preview is dismissed and return
to the previous page.

(-[_WKPreviewControllerDelegate previewControllerWillDismiss:]):
(WebKit::SystemPreviewController::showPreview):

Use single instances of the QLPreviewController, its datasource and delegate.

UIProcess/SystemPreviewController.cpp:

Add a helper to navigate back.

(WebKit::SystemPreviewController::SystemPreviewController):
(WebKit::SystemPreviewController::sendPageBack):

UIProcess/SystemPreviewController.h:

3:10 PM Changeset in webkit [229487] by jer.noble@apple.com

3 edits in trunk/Source/WebKit

webkitfullscreenchange event not fired at the same time as :-webkit-full-screen pseudo selector changes; causes glitchiness
https://bugs.webkit.org/show_bug.cgi?id=183383
<rdar://problem/38197028>

Reviewed by Eric Carlson.

Follow-up patch: now that the 'fullscreenchange' event is being fired slightly earlier, the
Fullscreen.TopContentInset tests triggers what appears to be an existing behavior: if you
exit in the middle of an enter fullscreen animation, the exit never happens, because the
NSWindow never starts the exit animation. The solution is to store the exit fullscreen
request, and only act upon it when the enter animation completes.

UIProcess/mac/WKFullScreenWindowController.h:
UIProcess/mac/WKFullScreenWindowController.mm:

(-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):
(-[WKFullScreenWindowController exitFullScreen]):

3:07 PM Changeset in webkit [229486] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Build fix after r229476.
https://bugs.webkit.org/show_bug.cgi?id=183488

Not reviewed.

runtime/StackAlignment.h:

2:56 PM Changeset in webkit [229485] by jer.noble@apple.com

19 edits in trunk/Source

Unconditionalize more methods in VideoFullscreenInterface (and related classes)
https://bugs.webkit.org/show_bug.cgi?id=183501

Reviewed by Eric Carlson.

Source/WebCore:

No need for these methods to be PLATFORM(MAC) only.

platform/cocoa/PlaybackSessionModel.h:

(WebCore::PlaybackSessionModelClient::ensureControlsManager):

platform/ios/VideoFullscreenInterfaceAVKit.h:
platform/ios/VideoFullscreenInterfaceAVKit.mm:

(VideoFullscreenInterfaceAVKit::isPlayingVideoInEnhancedFullscreen const):

platform/mac/VideoFullscreenInterfaceMac.h:

Source/WebKit:

No reason for these methods to be PLATFORM(MAC) only.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _videoControlsManagerDidChange]):

UIProcess/API/Cocoa/WKWebViewInternal.h:
UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:

(WebKit::PlaybackSessionManagerProxy::setUpPlaybackControlsManagerWithID):
(WebKit::PlaybackSessionManagerProxy::clearPlaybackControlsManager):

UIProcess/Cocoa/VideoFullscreenManagerProxy.h:
UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:
UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::isPlayingMediaDidChange):
(WebKit::WebPageProxy::handleControlledElementIDResponse const):
(WebKit::WebPageProxy::isPlayingVideoInEnhancedFullscreen const):

UIProcess/WebPageProxy.h:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::videoControlsManagerDidChange):

UIProcess/ios/WKFullScreenWindowControllerIOS.h:
UIProcess/ios/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController videoControlsManagerDidChange]):

WebProcess/cocoa/PlaybackSessionManager.mm:

(WebKit::PlaybackSessionManager::setUpPlaybackControlsManager):

2:43 PM Changeset in webkit [229484] by pvollan@apple.com

4 edits in trunk/Source/WebKit

Create CA layer contexts with +remoteContextWithOptions.
https://bugs.webkit.org/show_bug.cgi?id=182747

Reviewed by Brent Fulgham.

CA layer contexts (CAContext) are currently created with +contextWithCGSConnection, which is
using the main WindowServer connection to create the context. Instead, the contexts can be
created with +remoteContextWithOptions, which does not use the main WindowServer connection.
This is a step towards limiting the access the WebContent process has to the window server.
To make the +remoteContextWithOptions call succeed, the sandbox has to be modified to allow
access to CARenderServer. Also, access to the WindowServer should be denied by calling
CGSSetDenyWindowServerConnections(true) before entering the sandbox. This is planned to do
in a follow-up patch. The call to +remoteContextWithOptions will open up WindowServer
connections, since the WindowServer is the system default CA render server, but these
connections come with limited WindowServer exposure. In addition, we need to open up the
sandbox for accessing some IOKit properties.

Platform/mac/LayerHostingContext.mm:

(WebKit::LayerHostingContext::createForExternalHostingProcess):

Shared/mac/HangDetectionDisablerMac.mm:

(WebKit::setClientsMayIgnoreEvents):

WebProcess/com.apple.WebProcess.sb.in:

1:47 PM Changeset in webkit [229483] by youenn@apple.com

3 edits
4 adds in trunk

ServiceWorker should respect IDB and DOMCache partitioning
https://bugs.webkit.org/show_bug.cgi?id=183496

Reviewed by Brady Eidson.

Source/WebCore:

Test: http/wpt/service-workers/third-party-registration.html

Set the correct top origin of service worker ScriptExecutionContext.

workers/service/context/ServiceWorkerThread.cpp:

(WebCore::ServiceWorkerThread::ServiceWorkerThread):

LayoutTests:

http/wpt/service-workers/resources/third-party-registration-frame.html: Added.
http/wpt/service-workers/resources/third-party-worker.js: Added.
http/wpt/service-workers/third-party-registration-expected.txt: Added.
http/wpt/service-workers/third-party-registration.html: Added.

1:45 PM Changeset in webkit [229482] by mark.lam@apple.com

6 edits in trunk/Source/JavaScriptCore

[Re-landing] Add support for ARM64E.
https://bugs.webkit.org/show_bug.cgi?id=183398
<rdar://problem/38212621>

Reviewed by Michael Saboff.

assembler/MacroAssembler.h:
llint/LLIntOfflineAsmConfig.h:
llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter64.asm:
offlineasm/backends.rb:

1:35 PM Changeset in webkit [229481] by mark.lam@apple.com

20 edits
1 add in trunk/Source

[Re-landing] Prepare LLInt code to support pointer profiling.
https://bugs.webkit.org/show_bug.cgi?id=183387
<rdar://problem/38199678>

Reviewed by JF Bastien.

Source/JavaScriptCore:

Introduced PtrTag enums for supporting pointer profiling later.

Also introduced tagging, untagging, retagging, and tag removal placeholder template functions for the same purpose.

Prepare the offlineasm for supporting pointer profiling later.

Tagged some pointers in LLInt asm code. Currently, these should have no effect on behavior.

Removed returnToThrowForThrownException() because it is not used anywhere.

Added the offlineasm folder to JavaScriptCore Xcode project so that it's easier to view and edit these files in Xcode.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::unlink):

llint/LLIntData.cpp:

(JSC::LLInt::initialize):

llint/LLIntData.h:
llint/LLIntExceptions.cpp:

(JSC::LLInt::returnToThrowForThrownException): Deleted.

llint/LLIntExceptions.h:
llint/LLIntOfflineAsmConfig.h:
llint/LLIntOffsetsExtractor.cpp:
llint/LLIntPCRanges.h:

(JSC::LLInt::isLLIntPC):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::handleHostCall):
(JSC::LLInt::setUpCall):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
offlineasm/ast.rb:
offlineasm/instructions.rb:
offlineasm/risc.rb:
runtime/PtrTag.h: Added.

(JSC::uniquePtrTagID):
(JSC::ptrTag):
(JSC::tagCodePtr):
(JSC::untagCodePtr):
(JSC::retagCodePtr):
(JSC::removeCodePtrTag):

Source/WTF:

wtf/Platform.h:

1:31 PM Changeset in webkit [229480] by Brent Fulgham

9 edits in trunk/Source/WebKit

Remove cookie API access from WebContent Process
https://bugs.webkit.org/show_bug.cgi?id=183519
<rdar://problem/35368802>

Reviewed by Alex Christensen.

All cookie access is now handled in the Network Process. However, there are vestiges of the original logic that used CFNetwork APIs in the WebContent process.

This patch removes CFNetwork calls from the WebProcess code paths, since they serve no purpose in modern WebKit.

No tests because this is a code cleanup with no expected change in behavior.

NetworkProcess/Cookies/mac/WebCookieManagerMac.mm:

(WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy): Moved from WebFrameNetworkingContext.

NetworkProcess/NetworkProcess.h:
NetworkProcess/cocoa/NetworkProcessCocoa.mm:

(WebKit::NetworkProcess::setSharedHTTPCookieStorage): Moved from ChildProcess, since this should only be
called in the NetworkProcess.

Shared/ChildProcess.h:
Shared/mac/ChildProcessMac.mm:

(WebKit::ChildProcess::setSharedHTTPCookieStorage): Deleted.

WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.h:
WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.mm:

(WebKit::WebFrameNetworkingContext::ensureWebsiteDataStoreSession): Remove CFNetwork code. This version of
'ensureWebsiteDataStoreSession' is needed to maintain a dictionary on the WebProcess side so we can refer to
the same network session in both the WebContent and Network processes.
(WebKit::WebFrameNetworkingContext::webFrameLoaderClient const):
(WebKit::WebFrameNetworkingContext::setCookieAcceptPolicyForAllContexts): Deleted.

WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess): Remove calls to CFNetwork.

1:14 PM Changeset in webkit [229479] by youenn@apple.com

2 edits in trunk/Source/WebCore

Cannot change audio input source device
https://bugs.webkit.org/show_bug.cgi?id=175975
<rdar://problem/34073589>

Reviewed by Eric Carlson.

Covered by manually testing https://webrtc.github.io/samples/src/content/devices/input-output/ with a USB web cam.

platform/mediastream/mac/CoreAudioCaptureSource.cpp:

(WebCore::CoreAudioSharedUnit::setCaptureDeviceID):
(WebCore::CoreAudioCaptureSource::CoreAudioCaptureSource):

1:04 PM Changeset in webkit [229478] by mark.lam@apple.com

14 edits in trunk/Source/JavaScriptCore

Remove unused LLINT_STATS feature.
https://bugs.webkit.org/show_bug.cgi?id=183522
<rdar://problem/38313139>

Rubber-stamped by Keith Miller.

We haven't used this in a while, and it is one more option that makes offlineasm
build slower. We can always re-introduce this later if we need it.

jsc.cpp:
llint/LLIntCommon.h:
llint/LLIntData.cpp:

(JSC::LLInt::initialize):
(JSC::LLInt::Data::finalizeStats): Deleted.
(JSC::LLInt::compareStats): Deleted.
(JSC::LLInt::Data::dumpStats): Deleted.
(JSC::LLInt::Data::ensureStats): Deleted.
(JSC::LLInt::Data::loadStats): Deleted.
(JSC::LLInt::Data::resetStats): Deleted.
(JSC::LLInt::Data::saveStats): Deleted.

llint/LLIntData.h:

(): Deleted.
(JSC::LLInt::Data::opcodeStats): Deleted.

llint/LLIntOfflineAsmConfig.h:
llint/LLIntSlowPaths.cpp:
llint/LLIntSlowPaths.h:
llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/Options.cpp:

(JSC::Options::isAvailable):
(JSC::recomputeDependentOptions):

runtime/Options.h:
runtime/TestRunnerUtils.cpp:

(JSC::finalizeStatsAtEndOfTesting):

12:47 PM Changeset in webkit [229477] by youenn@apple.com

4 edits in trunk

ServiceWorkerClientFetch should send data to its resource loader once the didReceiveResponse completion handler is called
https://bugs.webkit.org/show_bug.cgi?id=183110

Reviewed by Chris Dumez.

Buffering data/finish event/fail event until the response completion handler is called.

WebProcess/Storage/ServiceWorkerClientFetch.cpp:

(WebKit::ServiceWorkerClientFetch::didReceiveResponse):
(WebKit::ServiceWorkerClientFetch::didReceiveData):
(WebKit::ServiceWorkerClientFetch::didFinish):
(WebKit::ServiceWorkerClientFetch::didFail):
(WebKit::ServiceWorkerClientFetch::didNotHandle):
(WebKit::ServiceWorkerClientFetch::cancel):
(WebKit::ServiceWorkerClientFetch::continueLoadingAfterCheckingResponse):

WebProcess/Storage/ServiceWorkerClientFetch.h:

12:27 PM Changeset in webkit [229476] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

Relanding "testmasm crashes in testBranchTruncateDoubleToInt32() on ARM64"
https://bugs.webkit.org/show_bug.cgi?id=183488

It applied and built just fine locally.

assembler/testmasm.cpp:

(JSC::testBranchTruncateDoubleToInt32):

11:20 AM Changeset in webkit [229475] by jer.noble@apple.com

16 edits
4 adds in trunk

Add new CSS env constants for use with fullscreen
https://bugs.webkit.org/show_bug.cgi?id=183498

Reviewed by Dean Jackson.

Source/WebCore:

Tests: fullscreen/fullscreen-auto-hide-delay.html

fullscreen/fullscreen-inset-top.html

dom/ConstantPropertyMap.cpp:

(WebCore::ConstantPropertyMap::nameForProperty const):
(WebCore::variableDataForPositiveDuration):
(WebCore::ConstantPropertyMap::setFullscreenInsetTop):
(WebCore::ConstantPropertyMap::setFullscreenAutoHideDelay):

dom/ConstantPropertyMap.h:
page/Page.cpp:

(WebCore::Page::setFullscreenInsetTop):
(WebCore::Page::setFullscreenAutoHideDelay):

page/Page.h:
testing/Internals.cpp:

(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::setFullscreenInsetTop):
(WebCore::Internals::setFullscreenAutoHideDelay):

testing/Internals.h:
testing/Internals.idl:

Source/WebKit:

Pass the values given to WebFullScreenManagerProxy through the process boundary and
into WebCore.

UIProcess/WebFullScreenManagerProxy.cpp:

(WebKit::WebFullScreenManagerProxy::setFullscreenInsetTop):
(WebKit::WebFullScreenManagerProxy::setFullscreenAutoHideDelay):

UIProcess/WebFullScreenManagerProxy.h:
WebProcess/FullScreen/WebFullScreenManager.cpp:

(WebKit::WebFullScreenManager::didExitFullScreen):
(WebKit::WebFullScreenManager::setFullscreenInsetTop):
(WebKit::WebFullScreenManager::setFullscreenAutoHideDelay):

WebProcess/FullScreen/WebFullScreenManager.h:
WebProcess/FullScreen/WebFullScreenManager.messages.in:

LayoutTests:

fullscreen/full-screen-test.js:

(run):

fullscreen/fullscreen-auto-hide-delay-expected.txt: Added.
fullscreen/fullscreen-auto-hide-delay.html: Added.
fullscreen/fullscreen-inset-top-expected.txt: Added.
fullscreen/fullscreen-inset-top.html: Added.

11:14 AM Changeset in webkit [229474] by Alan Bujtas

9 edits
2 adds in trunk

RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
https://bugs.webkit.org/show_bug.cgi?id=183493
<rdar://problem/38030461>

Reviewed by Antti Koivisto.

Source/WebCore:

Multicolumn spanners are taken out of their original position and placed next
to a RenderMultiColumnSet. splitAnonymousBoxesAroundChild needs to know the original parent (in the render tree context).

Test: fast/multicol/adjust-beforeChild-for-spanner-crash.html

rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):

rendering/updating/RenderTreeBuilder.h:
rendering/updating/RenderTreeBuilderBlock.cpp:

(WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):

rendering/updating/RenderTreeBuilderMultiColumn.cpp:

(WebCore::RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded):

rendering/updating/RenderTreeBuilderMultiColumn.h:
rendering/updating/RenderTreeBuilderRuby.cpp:

(WebCore::RenderTreeBuilder::Ruby::moveChildrenInternal):

rendering/updating/RenderTreeBuilderTable.cpp:

(WebCore::RenderTreeBuilder::Table::attach):

LayoutTests:

fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt: Added.
fast/multicol/adjust-beforeChild-for-spanner-crash.html: Added.

11:10 AM Changeset in webkit [229473] by Alan Bujtas

1 edit
97 adds in trunk/Tools

[LayoutReloaded] Initial commit -block formatting context.
https://bugs.webkit.org/show_bug.cgi?id=183462

Reviewed by Antti Koivisto.

See README.md

LayoutReloaded/BlockContainer.js: Added.

(BlockContainer):
(BlockContainer.prototype.establishesInlineFormattingContext):

LayoutReloaded/BlockFormattingContext.js: Added.

LayoutReloaded/BlockMarginCollapse.js: Added.

LayoutReloaded/Box.js: Added.

LayoutReloaded/Container.js: Added.

LayoutReloaded/FloatingContext.js: Added.

LayoutReloaded/FormattingContext.js: Added.

LayoutReloaded/InitialBlockContainer.js: Added.

(InitialBlockContainer):
(InitialBlockContainer.prototype.establishesBlockFormattingContext):
(InitialBlockContainer.prototype.paddingBox):
(InitialBlockContainer.prototype.contentBox):

LayoutReloaded/InlineBox.js: Added.

(InlineBox):
(InlineBox.prototype.setText):
(InlineBox.prototype.text):

LayoutReloaded/InlineFormattingContext.js: Added.

(InlineFormattingContext):
(InlineFormattingContext.prototype.layout):
(InlineFormattingContext.prototype._handleInlineBox):
(InlineFormattingContext.prototype._handleText):

LayoutReloaded/Layout.js: Added.

(layout):

LayoutReloaded/LayoutContext.js: Added.

(LayoutContext):
(LayoutContext.prototype.layoutFormattingContext):

LayoutReloaded/LayoutReloaded.xcworkspace/contents.xcworkspacedata: Added.
LayoutReloaded/LayoutReloaded.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist: Added.
LayoutReloaded/README.md: Added.
LayoutReloaded/Text.js: Added.

(Text):

LayoutReloaded/TreeBuilder.js: Added.

(TreeBuilder.prototype.createTree):
(TreeBuilder.prototype._createAndAttachBox):
(TreeBuilder.prototype._appendChild):
(TreeBuilder.prototype._findBox):
(TreeBuilder.prototype._findNode):
(TreeBuilder):

LayoutReloaded/Utils.js: Added.

(LayoutPoint):
(LayoutPoint.prototype.setLeft):
(LayoutPoint.prototype.setTop):
(LayoutPoint.prototype.left):
(LayoutPoint.prototype.top):
(LayoutPoint.prototype.shiftLeft):
(LayoutPoint.prototype.shiftTop):
(LayoutPoint.prototype.moveBy):
(LayoutPoint.prototype.equal):
(LayoutPoint.prototype.clone):
(LayoutSize):
(LayoutSize.prototype.setWidth):
(LayoutSize.prototype.setHeight):
(LayoutSize.prototype.width):
(LayoutSize.prototype.height):
(LayoutSize.prototype.growBy):
(LayoutSize.prototype.shrinkBy):
(LayoutSize.prototype.isEmpty):
(LayoutSize.prototype.equal):
(LayoutSize.prototype.clone):
(LayoutRect):
(LayoutRect.prototype.setTop):
(LayoutRect.prototype.setLeft):
(LayoutRect.prototype.setBottom):
(LayoutRect.prototype.setRight):
(LayoutRect.prototype.left):
(LayoutRect.prototype.top):
(LayoutRect.prototype.bottom):
(LayoutRect.prototype.right):
(LayoutRect.prototype.setTopLeft):
(LayoutRect.prototype.topLeft):
(LayoutRect.prototype.topRight):
(LayoutRect.prototype.bottomRight):
(LayoutRect.prototype.setWidth):
(LayoutRect.prototype.setHeight):
(LayoutRect.prototype.setSize):
(LayoutRect.prototype.size):
(LayoutRect.prototype.width):
(LayoutRect.prototype.height):
(LayoutRect.prototype.growBy):
(LayoutRect.prototype.shrinkBy):
(LayoutRect.prototype.moveBy):
(LayoutRect.prototype.isEmpty):
(LayoutRect.prototype.equal):
(LayoutRect.prototype.intersects):
(LayoutRect.prototype.contains):
(LayoutRect.prototype.clone):
(ASSERT_NOT_REACHED):
(ASSERT):
(Utils.computedValue):
(Utils.propertyIsAuto):
(Utils.isWidthAuto):
(Utils.isHeightAuto):
(Utils.isTopAuto):
(Utils.isLeftAuto):
(Utils.isBottomAuto):
(Utils.isRightAuto):
(Utils.width):
(Utils.height):
(Utils.top):
(Utils.bottom):
(Utils.left):
(Utils.right):
(Utils.hasBorderTop):
(Utils.hasBorderBottom):
(Utils.hasPaddingTop):
(Utils.hasPaddingBottom):
(Utils.computedMarginTop):
(Utils.computedMarginLeft):
(Utils.computedMarginBottom):
(Utils.computedMarginRight):
(Utils.computedBorderTopLeft):
(Utils.computedBorderBottomRight):
(Utils.computedPaddingTopLeft):
(Utils.computedPaddingBottomRight):
(Utils.computedBorderAndPaddingTop):
(Utils.computedBorderAndPaddingLeft):
(Utils.computedBorderAndPaddingBottom):
(Utils.computedBorderAndPaddingRight):
(Utils.computedHorizontalBorderAndPadding):
(Utils.computedVerticalBorderAndPadding):
(Utils.hasClear):
(Utils.hasClearLeft):
(Utils.hasClearRight):
(Utils.hasClearBoth):
(Utils.isBlockLevelElement):
(Utils.isBlockContainerElement):
(Utils.isInlineLevelElement):
(Utils.isTableElement):
(Utils.isRelativePositioned):
(Utils.isAbsolutePositioned):
(Utils.isFixedPositioned):
(Utils.isOverflowVisible):
(Utils.isFloatingPositioned):
(Utils.isFloatingLeft):
(Utils.mapToContainer):
(Utils.mapStaticToAbsolute):
(Utils.collectOutOfFlowDescendants):
(Utils.nextBreakingOpportunity):
(Utils.measureText):
(Utils.layoutTreeDump):
(Utils._dumpBox):
(Utils._dumpTree):
(Utils):

LayoutReloaded/misc/LayoutReloadedWebKit.patch: Added.
LayoutReloaded/misc/headers/BlockContainer.h: Added.
LayoutReloaded/misc/headers/BlockFormattingContext.h: Added.
LayoutReloaded/misc/headers/BlockMarginCollapse.h: Added.
LayoutReloaded/misc/headers/Box.h: Added.
LayoutReloaded/misc/headers/Container.h: Added.
LayoutReloaded/misc/headers/FloatingContext.h: Added.
LayoutReloaded/misc/headers/FormattingContext.h: Added.
LayoutReloaded/misc/headers/InitialBlockContainer.h: Added.
LayoutReloaded/misc/headers/InlineBox.h: Added.
LayoutReloaded/misc/headers/LayoutContext.h: Added.
LayoutReloaded/misc/headers/Text.h: Added.
LayoutReloaded/test/TestHarness.js: Added.

(verifyLayoutTreeDump):
(runLayout):

LayoutReloaded/test/absolute-auto-with-sibling-margin-bottom.html: Added.
LayoutReloaded/test/absolute-bottom.html: Added.
LayoutReloaded/test/absolute-height-stretch.html: Added.
LayoutReloaded/test/absolute-left-auto.html: Added.
LayoutReloaded/test/absolute-left-right-top-bottom-auto.html: Added.
LayoutReloaded/test/absolute-nested.html: Added.
LayoutReloaded/test/absolute-nested2.html: Added.
LayoutReloaded/test/absolute-simple.html: Added.
LayoutReloaded/test/absolute-width-shrink-to-fit.html: Added.
LayoutReloaded/test/absolute-width-stretch.html: Added.
LayoutReloaded/test/absolute-with-inline-preferred-width.html: Added.
LayoutReloaded/test/absolute-with-static-block-position-nested.html: Added.
LayoutReloaded/test/almost-intruding-left-float-simple.html: Added.
LayoutReloaded/test/border-simple.html: Added.
LayoutReloaded/test/fixed-nested.html: Added.
LayoutReloaded/test/float-left-when-container-has-padding-margin.html: Added.
LayoutReloaded/test/floating-box-clear-both-simple.html: Added.
LayoutReloaded/test/floating-box-clear-right-simple.html: Added.
LayoutReloaded/test/floating-box-left-and-right-multiple-with-top-offset.html: Added.
LayoutReloaded/test/floating-box-left-and-right-multiple.html: Added.
LayoutReloaded/test/floating-box-right-simple.html: Added.
LayoutReloaded/test/floating-box-with-clear-siblings.html: Added.
LayoutReloaded/test/floating-box-with-clear-simple.html: Added.
LayoutReloaded/test/floating-box-with-new-formatting-context.html: Added.
LayoutReloaded/test/floating-box-with-relative-positioned-sibling.html: Added.
LayoutReloaded/test/floating-left-right-simple.html: Added.
LayoutReloaded/test/floating-left-right-with-all-margins.html: Added.
LayoutReloaded/test/floating-lefts-and-rights-simple.html: Added.
LayoutReloaded/test/floating-multiple-lefts-in-body.html: Added.
LayoutReloaded/test/floating-multiple-lefts-multiple-lines.html: Added.
LayoutReloaded/test/floating-multiple-lefts.html: Added.
LayoutReloaded/test/floating-sizing.html: Added.
LayoutReloaded/test/floating-sizing2.html: Added.
LayoutReloaded/test/floating-sizing3.html: Added.
LayoutReloaded/test/floating-with-new-block-formatting-context.html: Added.
LayoutReloaded/test/index.html: Added.
LayoutReloaded/test/inline-content-simple.html: Added.
LayoutReloaded/test/intruding-left-float-simple.html: Added.
LayoutReloaded/test/margin-collapse-bottom-bottom.html: Added.
LayoutReloaded/test/margin-collapse-bottom-nested.html: Added.
LayoutReloaded/test/margin-collapse-first-last-are-floating.html: Added.
LayoutReloaded/test/margin-collapse-simple.html: Added.
LayoutReloaded/test/margin-collapse-top-nested.html: Added.
LayoutReloaded/test/margin-collapse-when-child-has-padding-border.html: Added.
LayoutReloaded/test/margin-collapse-with-block-formatting-context.html: Added.
LayoutReloaded/test/margin-collapse-with-block-formatting-context2.html: Added.
LayoutReloaded/test/margin-left-right-sizing-out-of-flow.html: Added.
LayoutReloaded/test/margin-left-right-sizing.html: Added.
LayoutReloaded/test/margin-propagation-simple-content-height.html: Added.
LayoutReloaded/test/margin-sibling-collapse-propagated.html: Added.
LayoutReloaded/test/margin-simple.html: Added.
LayoutReloaded/test/negative-margin-simple.html: Added.
LayoutReloaded/test/padding-nested.html: Added.
LayoutReloaded/test/padding-simple.html: Added.
LayoutReloaded/test/relative-auto-with-parent-offset.html: Added.
LayoutReloaded/test/relative-auto.html: Added.
LayoutReloaded/test/relative-bottom.html: Added.
LayoutReloaded/test/relative-right.html: Added.
LayoutReloaded/test/relative-siblings.html: Added.
LayoutReloaded/test/relative-simple.html: Added.

10:59 AM Changeset in webkit [229472] by jer.noble@apple.com

9 edits in trunk/Source

Add isPictureInPictureActive messaging across WebKit process boundary
https://bugs.webkit.org/show_bug.cgi?id=183499

Reviewed by Eric Carlson.

Source/WebCore:

platform/cocoa/PlaybackSessionModel.h:

(WebCore::PlaybackSessionModelClient::pictureInPictureActiveChanged):

platform/cocoa/PlaybackSessionModelMediaElement.h:
platform/cocoa/PlaybackSessionModelMediaElement.mm:

(WebCore::PlaybackSessionModelMediaElement::updateForEventName):
(WebCore::PlaybackSessionModelMediaElement::isPictureInPictureActive const):

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(VideoFullscreenControllerContext::isPictureInPictureActive const):

Source/WebKit:

UIProcess/Cocoa/PlaybackSessionManagerProxy.h:
UIProcess/Cocoa/PlaybackSessionManagerProxy.messages.in:
UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:

(WebKit::PlaybackSessionModelContext::pictureInPictureActiveChanged):
(WebKit::PlaybackSessionManagerProxy::pictureInPictureActiveChanged):

10:51 AM Changeset in webkit [229471] by commit-queue@webkit.org

6 edits in trunk/Source/WebCore

[Curl] Implement connection limit.
https://bugs.webkit.org/show_bug.cgi?id=183016

Implement both connection limit per host and total
connection limit on curl network layer.

Patch by Basuke Suzuki <Basuke Suzuki> on 2018-03-09
Reviewed by Youenn Fablet.

No new tests because there's no behavior change.

platform/network/curl/CurlContext.cpp:

(WebCore::EnvironmentVariableReader::sscanTemplate<signed>):
(WebCore::CurlContext::CurlContext):
(WebCore::CurlMultiHandle::setMaxConnects):
(WebCore::CurlMultiHandle::setMaxTotalConnections):
(WebCore::CurlMultiHandle::setMaxHostConnections):

platform/network/curl/CurlContext.h:

(WebCore::CurlContext::scheduler):

platform/network/curl/CurlRequest.cpp:

(WebCore::CurlRequest::startWithJobManager):
(WebCore::CurlRequest::cancel):
(WebCore::CurlRequest::invokeDidReceiveResponseForFile):
(WebCore::CurlRequest::completeDidReceiveResponse):
(WebCore::CurlRequest::pausedStatusChanged):

platform/network/curl/CurlRequestScheduler.cpp:

(WebCore::CurlRequestScheduler::CurlRequestScheduler):
(WebCore::CurlRequestScheduler::workerThread):
(WebCore::CurlRequestScheduler::singleton): Deleted.

platform/network/curl/CurlRequestScheduler.h:

10:51 AM Changeset in webkit [229470] by commit-queue@webkit.org

2 edits in trunk/Tools

WebKitTestRunner: Do not build accessibility files/idl when !HAVE(ACCESSIBILITY)
https://bugs.webkit.org/show_bug.cgi?id=183516

Patch by Stephan Szabo <stephan.szabo@sony.com> on 2018-03-09
Reviewed by Alex Christensen.

WebKitTestRunner/CMakeLists.txt:

10:48 AM Changeset in webkit [229469] by commit-queue@webkit.org

8 edits
1 add in trunk

[webkitpy, WinCairo] Launch Apache HTTPD for HTTP Tests.
https://bugs.webkit.org/show_bug.cgi?id=183265

Patch by Basuke Suzuki <Basuke Suzuki> on 2018-03-09
Reviewed by Daniel Bates.

Launch apache httpd server from python script for WinCairo HTTP LayoutTests. By now, AppleWin uses
Cygwin to launch httpd server. This patch enables native Windows to run HTTP LayoutTests by starting
and stopping httpd server from the script.

Tools:

Scripts/webkitpy/layout_tests/servers/apache_http_server.py:

(LayoutTestApacheHttpd.init):
(LayoutTestApacheHttpd._copy_apache_config_file):
(LayoutTestApacheHttpd):
(LayoutTestApacheHttpd.platform):
(LayoutTestApacheHttpd._spawn_process):
(LayoutTestApacheHttpd._stop_running_server):
(LayoutTestApacheHttpd._run):
(LayoutTestApacheHttpd._server_error):

Scripts/webkitpy/layout_tests/servers/http_server_base.py:

(HttpServerBase.aliases):
(HttpServerBase):
(HttpServerBase._build_alias_path_pairs):
(HttpServerBase._build_alias_path_pairs._make_path):

Scripts/webkitpy/layout_tests/servers/http_server_base_unittest.py:

(TestHttpServerBase.test_corrupt_pid_file):
(TestHttpServerBase):
(TestHttpServerBase.test_build_alias_path_pairs):

Scripts/webkitpy/port/base.py:

(Port._apache_config_file_name_for_platform):

Scripts/webkitpy/port/port_testcase.py:

(test_apache_config_file_name_for_platform):

Scripts/webkitpy/port/win.py:

(WinPort._path_to_apache):
(WinCairoPort.default_baseline_search_path):
(WinCairoPort):
(WinCairoPort.check_httpd):

LayoutTests:

http/conf/win-httpd-2.4-php7.conf: Added.

For WinCairo from native Windows environment.

10:45 AM Changeset in webkit [229468] by Chris Dumez

3 edits
1 copy
1 add in trunk/LayoutTests

http/tests/security/frame-loading-via-document-write-async-delegates.html fails with async delegates
https://bugs.webkit.org/show_bug.cgi?id=183460

Reviewed by Alex Christensen.

The test has 3 frames which all initially load "about:blank". Then using document.write(), it inserts
HTML in each frame.
Frame 1: body has an onload event handler, which calls JS is click an anchor link to navigate the frame.
Frame 2: body has an onload event handler to do some logging
Frame 3: body has an onload event handler and finishes the test (calls testRunner.notifyDone())

The issue is that with asynchronous policy delegates, the first frame may not have navigated yet by the
time the third frame is loaded. Indeed, the onload event of the first frame merely clicks am anchor link
which will trigger a navigation policy check and then later navigate.

To make the test more robust, we now count the number of loads and call testRunner.notifyDone() when
we've reached the expected number of loads.

http/tests/security/frame-loading-via-document-write-async-delegates-expected.txt: Added.
http/tests/security/frame-loading-via-document-write-async-delegates.html: Copied from LayoutTests/http/tests/security/frame-loading-via-document-write.html.
http/tests/security/frame-loading-via-document-write.html:
http/tests/security/resources/frame-loading-via-document-write.js:

10:40 AM Changeset in webkit [229467] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit

Add guard for wtf/glib include
https://bugs.webkit.org/show_bug.cgi?id=183521

Patch by Stephan Szabo <stephan.szabo@sony.com> on 2018-03-09
Reviewed by Alex Christensen.

Shared/CoordinatedGraphics/threadedcompositor/ThreadedDisplayRefreshMonitor.cpp:

10:21 AM Changeset in webkit [229466] by jer.noble@apple.com

8 edits in trunk

webkitfullscreenchange event not fired at the same time as :-webkit-full-screen pseudo selector changes; causes glitchiness
https://bugs.webkit.org/show_bug.cgi?id=183383

Source/WebCore:

Reviewed by Eric Carlson.

Fire the webkitfullscreenchange event at the same time as the pseudo class selector changes, during the handling
of webkitDidEnterFullScreenForElement. For WebKit2 clients, this is guaranteed to be asynchronous, since the
calling method originates in the UIProcess. For WebKit1 clients (and WKTR and DRT), there's the possibility that
webkitWillEnterFullScreenForElement will be called synchronously from within
Document::requestFullScreenForElement(), so break that synchronousness by starting the
ChromeClient::enterFullScreenForElement(...) process in a async task.

Previously, the firing of the fullscreenchange event was done through a zero-length timer. Use a
GenericTaskQueue instead.

A number of layout tests depend on the behavior that the element will be in fullscreen when the 'playing' event
fires. This was true for DRT (but not WKTR), since its fullscreen implementations were deliberately synchronous, but
won't necessarily be true for all ports. Fix this in a subsequent patch.

dom/Document.cpp:

(WebCore::Document::requestFullScreenForElement):
(WebCore::Document::webkitExitFullscreen):
(WebCore::Document::webkitWillEnterFullScreenForElement):
(WebCore::Document::webkitDidEnterFullScreenForElement):
(WebCore::Document::webkitDidExitFullScreenForElement):
(WebCore::Document::dispatchFullScreenChangeEvents):

dom/Document.h:
html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setReadyState):
(WebCore::HTMLMediaElement::playInternal):
(WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
(WebCore::HTMLMediaElement::updatePlayState):
(WebCore::HTMLMediaElement::setPlaying):

LayoutTests:

Fix a couple tests that depended on non-standard behavior, and skip other tests to be fixed later.

Reviewed by Eric Carlson.

media/fullscreen-video-going-into-pip.html:
media/video-fullscreeen-only-playback.html:
platform/mac/TestExpectations:

10:02 AM Changeset in webkit [229465] by Yusuke Suzuki

5 edits in trunk/Source/JavaScriptCore

Unreviewed, remove WebAssemblyFunctionType
https://bugs.webkit.org/show_bug.cgi?id=183429

Drop WebAssemblyFunctionType since it is no longer used. This breaks
JSCast assumption that all the derived classes of JSFunction use
JSFunctionType. We also add ASSERT for JSFunction::finishCreation.

runtime/JSFunction.cpp:

(JSC::JSFunction::finishCreation):

runtime/JSType.h:
wasm/js/WebAssemblyFunction.cpp:

(JSC::WebAssemblyFunction::createStructure):

wasm/js/WebAssemblyFunction.h:

9:59 AM Changeset in webkit [229464] by Ryan Haddad

2 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r229446.

This change relies on changes that have been rolled out.

Reverted changeset:

"testmasm crashes in testBranchTruncateDoubleToInt32() on
ARM64"
https://bugs.webkit.org/show_bug.cgi?id=183488
https://trac.webkit.org/changeset/229446

9:57 AM Changeset in webkit [229463] by fred.wang@free.fr

2 edits
1 delete in trunk/LayoutTests

Unreviewed GTK+ gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2018-03-09

platform/gtk/TestExpectations: Skip test requiring DASHBOARD_SUPPORT.
platform/gtk/mathml/mathml-in-dashboard-expected.txt: Removed.

7:11 AM Changeset in webkit [229462] by aestes@apple.com

7 edits in trunk

[Mac] WebKit fails to receive file promises when the embedding app is sandboxed
https://bugs.webkit.org/show_bug.cgi?id=183489
<rdar://problem/38267517>

Source/WebKit:

WebKit calls -[NSFilePromiseReceiver receivePromisedFilesAtDestination:...] with
NSTemporaryDirectory() as the destination for receiving file promise drops. AppKit attempts
to issue a sandbox extension for this directory, but for security reasons App Sandbox
refuses to do so for NSTemporaryDirectory() itself. As a result, AppKit will call our reader
block with a nil error and a valid file URL, but no file will actually exist at that URL.

In order for App Sandbox to grant issuing the sandbox extension needed by AppKit, we need to
use some other destination directory. This patch uses FileSystem::createTemporaryDirectory()
to securely create a unique temporary directory inside NSTemporaryDirectory() for use as the
drop destination.

Reviewed by Wenson Hsieh.

UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::performDragOperation):

Source/WebKitLegacy/mac:

WebKitLegacy calls -[NSFilePromiseReceiver receivePromisedFilesAtDestination:...] with
NSTemporaryDirectory() as the destination for receiving file promise drops. AppKit attempts
to issue a sandbox extension for this directory, but for security reasons App Sandbox
refuses to do so for NSTemporaryDirectory() itself. As a result, AppKit will call our reader
block with a nil error and a valid file URL, but no file will actually exist at that URL.

Reviewed by Wenson Hsieh.

WebView/WebView.mm:

(-[WebView performDragOperation:]):

LayoutTests:

Reviewed by Wenson Hsieh.

Now that we create a unique temporary directory per drop, this test no longer encounters a
name conflict for apple.gif.

editing/pasteboard/file-input-files-access-promise-expected.txt:
editing/pasteboard/file-input-files-access-promise.html:

6:41 AM Changeset in webkit [229461] by Carlos Garcia Campos

4 edits in trunk

[GTK] Do not use WebKitDOMHTMLFormElement as argument of signal WebKitWebPage::will-submit-form
https://bugs.webkit.org/show_bug.cgi?id=183510

Reviewed by Michael Catanzaro.

Source/WebKit:

In 2.22 WebKitDOMHTMLFormElement will be deprecated in GTK+ port and won't still exist in WPE. The new
JavaScript GLib API will be used to replace most of the DOM API, but a few classes will remain with a minimal
API for things that can't be done with JavaScript. WebKitDOMElement will stay and will be added to WPE as well,
so if we change the signal parameter to WebKitDOMElement we will be able to keep using
WebKitWebPage::will-submit-form without any changes. WPE will gain this signal and the rest of the API that uses
DOM.

WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp:

(webkit_web_page_class_init):

Tools:

Update the test to use WebKitDOMElement instead and fix a memory leak.

TestWebKitAPI/Tests/WebKitGLib/WebExtensionTest.cpp:

(handleFormSubmissionCallback):
(willSubmitFormCallback):

6:03 AM Changeset in webkit [229460] by zandobersek@gmail.com

6 edits
4 adds in trunk/Source/WebCore

[Nicosia] Add threaded PaintingEngine implementation
https://bugs.webkit.org/show_bug.cgi?id=183511

Reviewed by Carlos Garcia Campos.

Add Nicosia::PaintingEngineThreaded, class that internally uses a thread
pool in which painting tasks are executed.

Implementation for now defaults to using GLib's GThreadPool, defaulting
to 4 threads that are exclusive to this pool. These parameters should be
fine-tuned in the future, or even made configurable, but are a solid
basis for testing.

In PaintingEngineThreaded::paint(), PaintingContext implementation is
used to record all the operations, and the gathered Vector is combined
with the Buffer object and dispatched into the thread pool. In the
thread function, the provided buffer and painting operations are run
through the PaintingContext implementation, replaying all the operations
on a painting context that draws into the given buffer.

The recorded operation objects implement the PaintingOperation interface
contain all the data necessary to replay a given operation. They can be
executed against a PaintingOperationReplay object, as is the case during
PaintingContext::replay(), or they can be dumped into a TextStream
object for debugging purposes.

PaintingContext now also provides the record() and replay() static
functions. PaintingContext objects now differ per purpose, which can be
either for painting or for recording. paint() and replay() use a
for-painting PaintingContext, and record() uses a for-recording one.
The for-painting PaintingContext receives a Buffer object, i.e. a memory
area on which it can draw, while the for-recording PaintingContext uses
the passed-in PaintingOperations Vector that should store all the
recorded operations.

The current Cairo implementation of PaintingContext is moved into
PaintingContextCairo::ForPainting. PaintingContextCairo::ForRecording is
added but is currently no-op until a Cairo-specific GraphicsContextImpl
with recording capabilities is added, allowing any call on the
GraphicsContext object used in PaintingContext::record() to be recorded
for later replay. PaintingOperationReplayCairo, inheriting from
PaintingOperationReplay, will be used for replay purposes, providing
only reference to the PlatformContextCairo object that is constructed in
PaintingContextCairo::ForPainting.

The Cairo-specific GraphicsContextImpl implementation will be added in
a separate patch. After that, PaintingEngine::create() will be modified
so that the Nicosia::PaintingEngineThreaded implementation can be used
for testing purposes, probably by setting an environment variable.

platform/TextureMapper.cmake:
platform/graphics/nicosia/NicosiaPaintingContext.cpp:

(Nicosia::PaintingContext::createForPainting):
(Nicosia::PaintingContext::createForRecording):
(Nicosia::PaintingContext::create): Deleted.

platform/graphics/nicosia/NicosiaPaintingContext.h:

(Nicosia::PaintingContext::paint):
(Nicosia::PaintingContext::record):
(Nicosia::PaintingContext::replay):

platform/graphics/nicosia/NicosiaPaintingEngineThreaded.cpp: Added.

(Nicosia::s_threadFunc):
(Nicosia::paintLayer):
(Nicosia::PaintingEngineThreaded::PaintingEngineThreaded):
(Nicosia::PaintingEngineThreaded::~PaintingEngineThreaded):
(Nicosia::PaintingEngineThreaded::paint):

platform/graphics/nicosia/NicosiaPaintingEngineThreaded.h: Copied from Source/WebCore/platform/graphics/nicosia/NicosiaPaintingContext.cpp.
platform/graphics/nicosia/NicosiaPaintingOperation.h: Copied from Source/WebCore/platform/graphics/nicosia/NicosiaPaintingContext.cpp.
platform/graphics/nicosia/cairo/NicosiaPaintingContextCairo.cpp:

(Nicosia::PaintingContextCairo::ForPainting::ForPainting):
(Nicosia::PaintingContextCairo::ForPainting::~ForPainting):
(Nicosia::PaintingContextCairo::ForPainting::graphicsContext):
(Nicosia::PaintingContextCairo::ForPainting::replay):
(Nicosia::PaintingContextCairo::ForRecording::ForRecording):
(Nicosia::PaintingContextCairo::ForRecording::graphicsContext):
(Nicosia::PaintingContextCairo::ForRecording::replay):
(Nicosia::PaintingContextCairo::PaintingContextCairo): Deleted.
(Nicosia::PaintingContextCairo::~PaintingContextCairo): Deleted.
(Nicosia::PaintingContextCairo::graphicsContext): Deleted.

platform/graphics/nicosia/cairo/NicosiaPaintingContextCairo.h:
platform/graphics/nicosia/cairo/NicosiaPaintingOperationReplayCairo.h: Copied from Source/WebCore/platform/graphics/nicosia/NicosiaPaintingContext.cpp.

(Nicosia::PaintingOperationReplayCairo::PaintingOperationReplayCairo):

5:43 AM Changeset in webkit [229459] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

Remove some unused cruft in TextureMapperLayer.

The ScrollingClient class is not used anymore since r229318.
findScrollableContentsLayerAt() is similarly unused, but also lacking
an actual definition. ContentsLayerCount enum can also be purged.

Rubber-stamped by Carlos Garcia Campos.

platform/graphics/texmap/TextureMapperLayer.h:

2:58 AM Changeset in webkit [229458] by Carlos Garcia Campos

13 edits in releases/WebKitGTK/webkit-2.20

Revert "[GTK][WPE] Add API to configure and enable resource load statistics"

This reverts commit 6fe1852f8509b29ef0869f9030179ef099cac864.

2:37 AM Changeset in webkit [229457] by Carlos Garcia Campos

4 edits in trunk/Source/WebKit

Unreviewed. [GTK][WPE] Bump Since tags of resource load stats API.

The functionality hasn't been properly tested to be released in WebKitGTK+ 2.20.

UIProcess/API/glib/WebKitWebsiteDataManager.cpp:

(webkit_website_data_manager_class_init):

UIProcess/API/gtk/WebKitWebsiteData.h:
UIProcess/API/wpe/WebKitWebsiteData.h:

2:18 AM Changeset in webkit [229456] by Carlos Garcia Campos

2 edits in trunk

Unreviewed. Bump WebKitGTK+ version to 2.21.0.

Source/cmake/OptionsGTK.cmake:

1:13 AM Changeset in webkit [229455] by zandobersek@gmail.com

3 edits in trunk/LayoutTests

Unreviewed GTK+ gardening.

platform/gtk/TestExpectations: Add a failure expectation for the

http/tests/preconnect/link-header-rel-preconnect-http.html test.

platform/gtk/js/dom/dom-static-property-for-in-iteration-expected.txt:

Update baseline after r229310.

Mar 8, 2018:

11:50 PM Changeset in webkit [229454] by zandobersek@gmail.com

3 edits in trunk/Source/WebCore

Add basic synchronization capability to Nicosia::Buffer
https://bugs.webkit.org/show_bug.cgi?id=183500

Reviewed by Carlos Garcia Campos.

Have Nicosia::Buffer track a painting state, and allow that state to be
modified and accessed from different threads. The PaintingState enum
value is protected by a Lock object, and can be modified via the
beginPainting() and completePainting() methods. Additionally, the
waitUntilPaintingComplete() method allows the caller to wait until the
painting is complete for the given Nicosia::Buffer object.

This added state doesn't affect a Nicosia::Buffer object internally, and
doesn't have any effect on existing usages of Nicosia::Buffer (which
are not multi-threaded).

platform/graphics/nicosia/NicosiaBuffer.cpp:

(Nicosia::Buffer::beginPainting):
(Nicosia::Buffer::completePainting):
(Nicosia::Buffer::waitUntilPaintingComplete):

platform/graphics/nicosia/NicosiaBuffer.h:

11:42 PM Changeset in webkit [229453] by zandobersek@gmail.com

2 edits
3 adds
2 deletes in trunk/Source/WebCore

Move NicosiaPaintingContextCairo files under Cairo-specific directory
https://bugs.webkit.org/show_bug.cgi?id=183497

Reviewed by Carlos Garcia Campos.

Pack Cairo-specific files in the Nicosia subsystem under cairo/.

platform/TextureMapper.cmake:
platform/graphics/nicosia/cairo/NicosiaPaintingContextCairo.cpp: Renamed from Source/WebCore/platform/graphics/nicosia/NicosiaPaintingContextCairo.cpp.
platform/graphics/nicosia/cairo/NicosiaPaintingContextCairo.h: Renamed from Source/WebCore/platform/graphics/nicosia/NicosiaPaintingContextCairo.h.

11:35 PM Changeset in webkit [229452] by n_wang@apple.com

4 edits
2 adds in trunk

AX: AOM: More accessibility events support
https://bugs.webkit.org/show_bug.cgi?id=183023
<rdar://problem/37764380>

Reviewed by Chris Fleizach.

Source/WebCore:

Fixed the crash that we shouldn't dispatch the accessibility events if the
event path is empty.

Also added a check to not dispatch events if the runtime flag is not enabled.

Test: accessibility/mac/AOM-events-webarea-crash.html

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::shouldDispatchAccessibilityEvent const):
(WebCore::AccessibilityObject::dispatchAccessibilityEvent const):

accessibility/AccessibilityObject.h:

LayoutTests:

accessibility/mac/AOM-events-webarea-crash-expected.txt: Added.
accessibility/mac/AOM-events-webarea-crash.html: Added.

11:12 PM Changeset in webkit [229451] by Chris Dumez

7 edits in trunk

Safari not handling undefined global variables with same name as element Id correctly.
https://bugs.webkit.org/show_bug.cgi?id=183087
<rdar://problem/37927596>

Reviewed by Ryosuke Niwa.

Source/JavaScriptCore:

global variables (var foo;) should not be hidden by:

Named properties
Properties on the prototype chain

Therefore, we now have JSGlobalObject::addVar() call JSGlobalObject::addGlobalVar()
if !hasOwnProperty() instead of !hasProperty.

This aligns our behavior with Chrome and Firefox.

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::addVar):

LayoutTests:

fast/dom/Window/es52-globals-expected.txt:

Rebaseline test now that we are passing more checks. This covers the code change.

fast/forms/listbox-visible-size.html:
js/dom/var-declarations-shadowing-expected.txt:
js/dom/var-declarations-shadowing.html:

Tweak existing tests due to behavior change. I have checked that these tests
were failing in other browsers as well.

11:00 PM Changeset in webkit [229450] by zandobersek@gmail.com

2 edits in trunk/Source/WebKit

Unreviewed. Suppress GCC warnings in SystemPreviewController.cpp by
using the cross-platform #include directives for header inclusion,
instead of #import.

UIProcess/SystemPreviewController.cpp:

9:56 PM Changeset in webkit [229449] by Chris Dumez

3 edits
2 copies in trunk/LayoutTests

fast/events/before-unload-returnValue.html times out with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183472

Reviewed by Ryosuke Niwa.

Delay setting the beforeunload handler on the iframe until after the initial load
(of resources/onclick.html). With asynchronous policy delegates, the beforeunload
handler was set too early, during the async policy decision for navigating to
"resources/onclick.html". As a result, the beforeunload handler would get called
for the load to "resources/onclick.html", after receiving the navigation policy
decision, which the test does not expect. The test only expects the beforeunload
handler to be called for later navigations to "resources/does-not-exist.html".

fast/events/before-unload-returnValue-async-delegates-expected.txt: Copied from LayoutTests/fast/events/before-unload-returnValue-expected.txt.
fast/events/before-unload-returnValue-async-delegates.html: Copied from LayoutTests/fast/events/before-unload-returnValue.html.
fast/events/before-unload-returnValue-expected.txt:
fast/events/before-unload-returnValue.html:

8:55 PM Changeset in webkit [229448] by Megan Gardner

45 edits in trunk/Source

Allow WebViews to disable system appearance
https://bugs.webkit.org/show_bug.cgi?id=183418
<rdar://problem/36975642>

Reviewed by Tim Horton.
Source/WebCore:

Not currently testable, tests will be added in a later patch.

Allow webviews to choose whether or not to follow the default system appearance.

css/StyleColor.cpp:

(WebCore::StyleColor::colorFromKeyword):

css/StyleColor.h:
css/StyleResolver.cpp:

(WebCore::StyleResolver::colorFromPrimitiveValue const):

css/parser/CSSParser.cpp:

(WebCore::CSSParser::parseSystemColor):

css/parser/CSSParser.h:
css/parser/CSSParserMode.h:
html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal):

html/canvas/CanvasRenderingContext2DBase.cpp:

(WebCore::CanvasRenderingContext2DBase::setStrokeColor):
(WebCore::CanvasRenderingContext2DBase::setFillColor):

html/canvas/CanvasStyle.cpp:

(WebCore::parseColor):
(WebCore::parseColorOrCurrentColor):
(WebCore::CanvasStyle::createFromString):
(WebCore::CanvasStyle::createFromStringWithOverrideAlpha):

html/canvas/CanvasStyle.h:
page/Page.h:

(WebCore::Page::useSystemAppearance const):
(WebCore::Page::setUseSystemAppearance):

platform/Theme.cpp:

(WebCore::Theme::paint):

platform/Theme.h:
platform/mac/LocalDefaultSystemAppearance.h:
platform/mac/LocalDefaultSystemAppearance.mm:

(WebCore::LocalDefaultSystemAppearance::LocalDefaultSystemAppearance):
(WebCore::LocalDefaultSystemAppearance::~LocalDefaultSystemAppearance):

platform/mac/ThemeMac.h:
platform/mac/ThemeMac.mm:

(-[WebCoreThemeView initWithUseSystemAppearance:]):
(WebCore::paintToggleButton):
(WebCore::paintButton):
(WebCore::ThemeMac::ensuredView):
(WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
(WebCore::ThemeMac::paint):
(-[WebCoreThemeView init]): Deleted.

rendering/RenderTheme.cpp:

(WebCore::RenderTheme::paint):
(WebCore::RenderTheme::systemColor const):
(WebCore::RenderTheme::focusRingColor):

rendering/RenderTheme.h:

(WebCore::RenderTheme::platformFocusRingColor const):

rendering/RenderThemeIOS.mm:

(WebCore::RenderThemeIOS::systemColor const):

rendering/RenderThemeMac.h:
rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::documentViewFor const):
(WebCore::RenderThemeMac::platformFocusRingColor const):
(WebCore::RenderThemeMac::systemColor const):
(WebCore::RenderThemeMac::paintCellAndSetFocusedElementNeedsRepaintIfNecessary):
(WebCore::RenderThemeMac::paintSliderThumb):

rendering/TextPaintStyle.cpp:

(WebCore::computeTextPaintStyle):

Source/WebKit:

Allow webviews to choose whether or not to follow the default system appearance.

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _useSystemAppearance]):
(-[WKWebView _setUseSystemAppearance:]):

UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters):
(WebKit::WebPageProxy::setUseSystemAppearance):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::useSystemAppearance const):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::setUseSystemAppearance):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

Allow webviews to choose whether or not to follow the default system appearance.

WebView/WebView.mm:

(-[WebView _setUseSystemAppearance:]):
(-[WebView _useSystemAppearance]):

WebView/WebViewPrivate.h:

6:16 PM Changeset in webkit [229447] by Ryan Haddad

22 edits
1 delete in trunk/Source

Unreviewed, rolling out r229354 and r229364.
https://bugs.webkit.org/show_bug.cgi?id=183492

Breaks internal builds (Requested by ryanhaddad on #webkit).

Reverted changesets:

"Prepare LLInt code to support pointer profiling."
https://bugs.webkit.org/show_bug.cgi?id=183387
https://trac.webkit.org/changeset/229354

"Add support for ARM64E."
https://bugs.webkit.org/show_bug.cgi?id=183398
https://trac.webkit.org/changeset/229364

Patch by Commit Queue <commit-queue@webkit.org> on 2018-03-08

5:46 PM Changeset in webkit [229446] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

testmasm crashes in testBranchTruncateDoubleToInt32() on ARM64
https://bugs.webkit.org/show_bug.cgi?id=183488

Reviewed by Mark Lam.

Using stackAlignmentBytes() will keep the stack properly aligned.

assembler/testmasm.cpp:

(JSC::testBranchTruncateDoubleToInt32):

5:41 PM Changeset in webkit [229445] by msaboff@apple.com

1 edit in trunk/Source/JavaScriptCore/runtime/Options.h

Unreviewed fix. Meant to land the prior patch with Options::zeroStackFrame set to false.

5:38 PM Changeset in webkit [229444] by msaboff@apple.com

10 edits in trunk/Source/JavaScriptCore

Emit code to zero the stack frame on function entry
Nhttps://bugs.webkit.org/show_bug.cgi?id=183391

Reviewed by Mark Lam.

Added code to zero incoming stack frame behind a new JSC option, zeroStackFrame.
The default setting of the option is off.

Did some minor refactoring of the YarrJIT stack alignment code.

b3/air/AirCode.cpp:

(JSC::B3::Air::defaultPrologueGenerator):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::clearStackFrame):

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

llint/LowLevelInterpreter.asm:
runtime/Options.h:
yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::ialignCallFrameSizeInBytesnitCallFrame):
(JSC::Yarr::YarrGenerator::initCallFrame):
(JSC::Yarr::YarrGenerator::removeCallFrame):

5:32 PM Changeset in webkit [229443] by Nikita Vasilyev

3 edits
3 adds in trunk/Source/WebInspectorUI

Web Inspector: Sources: add SourcesTabContentView and SourceSidebarPanel classes
https://bugs.webkit.org/show_bug.cgi?id=183316
<rdar://problem/38107639>

Reviewed by Matt Baker.

Add Sources tab and sidebar panel, which are copies of the corresponding Resources classes.
The Sources tab is shown when it's enabled in the experimental settings. This patch doesn't
remove existing Resources and Debugger tabs.

UserInterface/Base/Main.js:

(WI.contentLoaded):

UserInterface/Main.html:
UserInterface/Views/SourcesSidebarPanel.css: Added.

(.sidebar > .panel.navigation.sources > .content):
(.sidebar > .panel.navigation.sources > .navigation-bar):

UserInterface/Views/SourcesSidebarPanel.js: Added.

(WI.SourcesSidebarPanel):
(WI.SourcesSidebarPanel.shouldPlaceResourcesAtTopLevel):
(WI.SourcesSidebarPanel.prototype.get minimumWidth):
(WI.SourcesSidebarPanel.prototype.closed):
(WI.SourcesSidebarPanel.prototype.showDefaultContentView):
(WI.SourcesSidebarPanel.prototype.treeElementForRepresentedObject.isAncestor):
(WI.SourcesSidebarPanel.prototype.treeElementForRepresentedObject.getParent):
(WI.SourcesSidebarPanel.prototype.treeElementForRepresentedObject):
(WI.SourcesSidebarPanel.prototype.initialLayout):
(WI.SourcesSidebarPanel.prototype.hasCustomFilters):
(WI.SourcesSidebarPanel.prototype.matchTreeElementAgainstCustomFilters.match):
(WI.SourcesSidebarPanel.prototype.matchTreeElementAgainstCustomFilters):
(WI.SourcesSidebarPanel.prototype._mainResourceDidChange):
(WI.SourcesSidebarPanel.prototype._mainFrameDidChange):
(WI.SourcesSidebarPanel.prototype._mainFrameMainResourceDidChange.delayedWork):
(WI.SourcesSidebarPanel.prototype._mainFrameMainResourceDidChange):
(WI.SourcesSidebarPanel.prototype._scriptWasAdded):
(WI.SourcesSidebarPanel.prototype._addScript):
(WI.SourcesSidebarPanel.prototype._scriptWasRemoved):
(WI.SourcesSidebarPanel.prototype._scriptsCleared):
(WI.SourcesSidebarPanel.prototype._styleSheetAdded):
(WI.SourcesSidebarPanel.prototype._addTargetWithMainResource):
(WI.SourcesSidebarPanel.prototype._targetRemoved):
(WI.SourcesSidebarPanel.prototype._treeSelectionDidChange):
(WI.SourcesSidebarPanel.prototype._compareTreeElements):
(WI.SourcesSidebarPanel.prototype._extraDomainsActivated):
(WI.SourcesSidebarPanel.prototype._scopeBarSelectionDidChange):

UserInterface/Views/SourcesTabContentView.js: Added.

(WI.SourcesTabContentView):
(WI.SourcesTabContentView.tabInfo):
(WI.SourcesTabContentView.isTabAllowed):
(WI.SourcesTabContentView.prototype.get type):
(WI.SourcesTabContentView.prototype.get supportsSplitContentBrowser):
(WI.SourcesTabContentView.prototype.canShowRepresentedObject):

4:59 PM Changeset in webkit [229442] by Michael Catanzaro

2 edits in trunk/Source/WebKit

Unreviewed, speculative attempt to fix CMake build after r229426
https://bugs.webkit.org/show_bug.cgi?id=183382
<rdar://problem/38191450>

CMakeLists.txt:

4:18 PM Changeset in webkit [229441] by jmarcell@apple.com

3 edits
2 deletes in tags/Safari-606.1.8

Revert r229310. rdar://problem/37764380

4:18 PM Changeset in webkit [229440] by jmarcell@apple.com

5 edits in tags/Safari-606.1.8

Revert r229344. rdar://problem/38188685

3:27 PM Changeset in webkit [229439] by commit-queue@webkit.org

3 edits in trunk/Tools

WebKitTestRunner: Don't use accessibility controller when !HAVE(ACCESSIBILITY)
https://bugs.webkit.org/show_bug.cgi?id=183475

Patch by Stephan Szabo <stephan.szabo@sony.com> on 2018-03-08
Reviewed by Youenn Fablet.

WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::done):

WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::InjectedBundlePage::didClearWindowForFrame):

3:20 PM Changeset in webkit [229438] by Megan Gardner

2 edits in trunk/Source/WebCore

Ensure default appearance for selection form control
https://bugs.webkit.org/show_bug.cgi?id=183482
<rdar://problem/38274894>

Reviewed by Tim Horton.

The appearance for selection form controls was not set to default.

Not currently testable, will add tests in a later patch.

rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor const):

3:07 PM Changeset in webkit [229437] by Wenson Hsieh

3 edits in trunk/Source/WebKit

[Extra zoom mode] Support resigning first responder status when focusing a form control
https://bugs.webkit.org/show_bug.cgi?id=183477
<rdar://problem/38225994>

Reviewed by Tim Horton.

Currently, when presenting an input view controller in extra zoom mode, if the web view loses first responder
status, we will blur the focused element, which dismisses all focused form control UI. For certain types of form
controls, this prevents the user from using key pieces of functionality.

To address this, disconnect the notion of first responder status from DOM element focus while the form control
overlay is shown. Later, when the active input session ends, if the web content view was first responder before
upon focusing the element, restore first responder status on the web view. This extra tweak is needed to ensure
that certain UI affordances which require first responder status on the web view continue to work after
interacting with a form control that changes the first responder.

UIProcess/ios/WKContentViewInteraction.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView presentFocusedFormControlViewController:]):
(-[WKContentView dismissFocusedFormControlViewController:]):

2:58 PM Changeset in webkit [229436] by fpizlo@apple.com

8 edits in trunk/Source

bmalloc mutex should be adaptive
https://bugs.webkit.org/show_bug.cgi?id=177839

Reviewed by Michael Saboff.

Source/bmalloc:

This pulls the WordLock algorithm into bmalloc, mostly by copy-pasting the code. We need to
copy paste because sometimes we build WTF without bmalloc, so WTF cannot rely on bmalloc for
anything other than malloc.

Reland after failing to reproduce the WasmBench crash that caused it to get rolled out. Maybe that fixed
itself somehow?

bmalloc/Algorithm.h:

(bmalloc::compareExchangeWeak):
(bmalloc::compareExchangeStrong):

bmalloc/PerThread.h:
bmalloc/StaticMutex.cpp:

(bmalloc::StaticMutex::lockSlow):
(bmalloc::StaticMutex::unlockSlow):
(bmalloc::StaticMutex::lockSlowCase): Deleted.

bmalloc/StaticMutex.h:

(bmalloc::StaticMutex::try_lock):
(bmalloc::StaticMutex::isLocked const):
(bmalloc::StaticMutex::init):
(bmalloc::StaticMutex::tryLock):
(bmalloc::StaticMutex::lock):
(bmalloc::StaticMutex::unlock):
(bmalloc::sleep): Deleted.
(bmalloc::waitUntilFalse): Deleted.

Source/WTF:

Add some comments that I thought of while copy-pasting this code.

Reland after failing to reproduce the WasmBench crash that caused it to get rolled out. Maybe that fixed
itself somehow?

wtf/LockAlgorithmInlines.h:
wtf/WordLock.cpp:

(WTF::WordLock::unlockSlow):

2:47 PM Changeset in webkit [229435] by Kocsen Chung

13 edits in tags/Safari-606.1.8

Revert r229310. rdar://problem/37764380

2:15 PM Changeset in webkit [229434] by pvollan@apple.com

3 edits in trunk/Source/WebCore

[Win] Compile error: pal/ExportMacros.h not found.
https://bugs.webkit.org/show_bug.cgi?id=183467

Reviewed by Brent Fulgham.

PAL header files are no longer located under the WebCore folder in forwarding headers. An additional
build step is required to copy the PAL header files to the internal include folder.

No new tests, no change in functionality.

PlatformWin.cmake:
WebCore.vcxproj/WebCore.proj:

1:55 PM Changeset in webkit [229433] by Kocsen Chung

2 edits in tags/Safari-606.1.8/Source/WebKit

Cherry-pick r229386. rdar://problem/38191574

1:44 PM Changeset in webkit [229432] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, another attempt at fixing the Windows build.
I guess the pragma must be outside the function...

jit/CCallHelpers.h:

(JSC::CCallHelpers::clampArrayToSize):

1:35 PM Changeset in webkit [229431] by wilander@apple.com

2 edits in trunk/Source/WebKit

Resource Load Statistics: Revert defaults read of zero values
https://bugs.webkit.org/show_bug.cgi?id=183476

Unreviewed revert of three small changes landed in r229427.

UIProcess/Cocoa/WebResourceLoadStatisticsStoreCocoa.mm:

(WebKit::WebResourceLoadStatisticsStore::registerUserDefaultsIfNeeded):

Reverted back to strict check of greater than zero for defaults reads.

1:30 PM Changeset in webkit [229430] by Megan Gardner

2 edits in trunk/Source/WebCore

Ensure system appearance is default for legacy webkit
https://bugs.webkit.org/show_bug.cgi?id=183473
<rdar://problem/38210306>

Reviewed by Tim Horton.

Need to set the appearance on the window for legacy webkit due to differences in drawing.

Not currently testable, will add tests in a later patch.

platform/mac/ThemeMac.mm:

(WebCore::paintButton):

1:25 PM Changeset in webkit [229429] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

Don't have SafariServices in minimal simulator build
https://bugs.webkit.org/show_bug.cgi?id=183436
<rdar://problem/38254778>

Reviewed by Dan Bernstein.

config.h:

1:19 PM Changeset in webkit [229428] by timothy_horton@apple.com

2 edits in trunk

Add a way to not build libwebrtc when building WebKit via Makefiles
https://bugs.webkit.org/show_bug.cgi?id=183437
<rdar://problem/38254840>

Reviewed by Dan Bernstein.

Source/Makefile:

1:11 PM Changeset in webkit [229427] by wilander@apple.com

4 edits in trunk/Source/WebKit

Resource Load Statistics: Make debug mode always partition prevalent resources
https://bugs.webkit.org/show_bug.cgi?id=183468
<rdar://problem/38269437>

Reviewed by Brent Fulgham.

After some testing we decided that a 30 second timeout in ITP debug mode just makes
it confusing. We should instead always partition prevalent resources in debug mode
to make it easy to understand. The partitioned state is what developers want to test
anyway.

UIProcess/Cocoa/WebResourceLoadStatisticsStoreCocoa.mm:

(WebKit::WebResourceLoadStatisticsStore::registerUserDefaultsIfNeeded):

Minor change to include 0 as valid setting.

UIProcess/WebResourceLoadStatisticsStore.cpp:

(WebKit::WebResourceLoadStatisticsStore::setResourceLoadStatisticsDebugMode):

Now just stores the setting of debug mode instead of changing the timeout.

(WebKit::WebResourceLoadStatisticsStore::logUserInteraction):

Now does not disable partitioning under debug mode.

(WebKit::WebResourceLoadStatisticsStore::shouldPartitionCookies const):

Now returns true for prevalent resources with user interaction under debug mode.

(WebKit::WebResourceLoadStatisticsStore::updateCookiePartitioning):

Removed duplicate debug logging statement.

UIProcess/WebResourceLoadStatisticsStore.h:

Added member m_debugModeEnabled.

12:43 PM Changeset in webkit [229426] by Brent Fulgham

12 edits
6 copies
4 adds
1 delete in trunk/Source/WebKit

Remove WebCookieManager and messaging from WebContent process.
https://bugs.webkit.org/show_bug.cgi?id=183382
<rdar://problem/38191450>

Reviewed by Alex Christensen.

Networking access was fully removed from the WebContent process in Bug 183192 (and related bugs). The
UIProcess no longer needs to ask the WebContent process about networking-related things, and shouldn't
waste everyone's time doing so.

This bug removes some left-over WebCookieManager API stuff, and is a first step in purging the
WebContent Process from accessing cookie data.

NetworkProcess/Cookies: Copied from WebProcess/Cookies.
NetworkProcess/Cookies/WebCookieManager.h:
WebKit.xcodeproj/project.pbxproj:
WebProcess/Cookies: Removed.
WebProcess/Cookies/WebCookieManager.cpp: Removed.
WebProcess/Cookies/WebCookieManager.h: Removed.
WebProcess/Cookies/WebCookieManager.messages.in: Removed.
WebProcess/Cookies/curl: Removed.
WebProcess/Cookies/curl/WebCookieManagerCurl.cpp: Removed.
WebProcess/Cookies/mac: Removed.
WebProcess/Cookies/mac/WebCookieManagerMac.mm: Removed.
WebProcess/Cookies/soup: Removed.
WebProcess/Cookies/soup/WebCookieManagerSoup.cpp: Removed.
WebProcess/InjectedBundle/InjectedBundle.cpp: Remove 'WebCookieManager.h" header.
WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Ditto.
WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.mm: Ditto.
WebProcess/WebProcess.cpp:

(WebKit::WebProcess::WebProcess): Remove call to add WebCookieManager as a
WebProcessSupplement.

CMakeLists.txt: Revised paths.
DerivedSources.make: Ditto.
PlatformMac.cmake: Ditto.
PlatformWin.cmake: Ditto.
SourcesGTK.txt: Ditto.
SourcesWPE.txt: Ditto.

12:38 PM Changeset in webkit [229425] by Chris Dumez

3 edits in trunk/LayoutTests

fast/html/marquee-reparent-check.html is flaky with async delegates
https://bugs.webkit.org/show_bug.cgi?id=183425

Reviewed by Youenn Fablet.

The test was missing the "TEST COMPLETE" line at the end of its output.
When enabling async delegates, the "TEST COMPLETE" line would sometimes
show. Move the test away from js-test.js and to js-test-pre.js / js-test-post.js
so that the "TEST COMPLETE" line gets printed out consistently.

fast/html/marquee-reparent-check-expected.txt:
fast/html/marquee-reparent-check.html:

12:19 PM Changeset in webkit [229424] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, one last try at fixing the windows build before rollout.

jit/CCallHelpers.h:

(JSC::CCallHelpers::clampArrayToSize):

11:55 AM Changeset in webkit [229423] by Chris Dumez

2 edits in trunk/LayoutTests

Unreviewed, skip imported/w3c/web-platform-tests/cors/remote-origin.htm

This test is timing out via testharness.js, there is no point in running it and
it slows down running layout tests.

TestExpectations:

11:34 AM Changeset in webkit [229422] by keith_miller@apple.com

2 edits in trunk/Source/WTF

Disable JIT on Cocoa 32-bit ARM.
https://bugs.webkit.org/show_bug.cgi?id=183426

Reviewed by Michael Saboff.

wtf/Platform.h:

11:32 AM Changeset in webkit [229421] by youenn@apple.com

9 edits in trunk/Source

libwebrtc update broke internal builds
https://bugs.webkit.org/show_bug.cgi?id=183454

Reviewed by Eric Carlson.

Source/WebCore:

No change of behavior.
Fixed header search paths.
Removed deleted file from XCode project as an additional clean-up.

Configurations/WebCore.xcconfig:
WebCore.xcodeproj/project.pbxproj:

Source/WebKit:

Configurations/BaseTarget.xcconfig:

Source/WebKitLegacy/mac:

Configurations/WebKitLegacy.xcconfig:

11:25 AM Changeset in webkit [229420] by keith_miller@apple.com

2 edits in trunk/Source/WTF

Use asm instead of asm in WTFBreakpointTrap so MSVC builds
https://bugs.webkit.org/show_bug.cgi?id=183465

Reviewed by Michael Saboff.

wtf/Assertions.h:

11:12 AM Changeset in webkit [229419] by pvollan@apple.com

2 edits in trunk/Source/WebCore

NSAnimation is not working in the WebContent process when WindowServer access is blocked.
https://bugs.webkit.org/show_bug.cgi?id=183291

Reviewed by Dean Jackson.

The animation can be implemented by using an NSTimer instead. Use the existing Bezier timing
function to create a smooth animation.

No new tests. This code is used to fade scrollbars in and out by animating the alpha value.
This scrollbar setting is not the default in macOS, which makes it non trivial to create
layout tests for this.

platform/mac/ScrollAnimatorMac.mm:

(-[WebScrollbarPartAnimation initWithScrollbar:featureToAnimate:animateFrom:animateTo:duration:]):
(-[WebScrollbarPartAnimation startAnimation]):
(-[WebScrollbarPartAnimation setCurrentProgress:setCurrentProgress:]):
(-[WebScrollbarPartAnimation invalidate]):
(-[WebScrollbarPartAnimation setDuration:]):
(-[WebScrollbarPartAnimation stopAnimation]):
(-[WebScrollbarPartAnimation setCurrentProgress:]): Deleted.

11:06 AM Changeset in webkit [229418] by youenn@apple.com

2 edits in trunk/Source/WebKit

PluginInfoStore::isSupportedPlugin should check for empty mime type
https://bugs.webkit.org/show_bug.cgi?id=183457
<rdar://problem/38159575>

Reviewed by Chris Dumez.

UIProcess/Plugins/PluginInfoStore.cpp:

(WebKit::PluginInfoStore::isSupportedPlugin):

10:47 AM Changeset in webkit [229417] by commit-queue@webkit.org

31 edits
1 add
1 delete in trunk/Source/WebCore

Templatize SVGAnimatedType
https://bugs.webkit.org/show_bug.cgi?id=183017

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2018-03-08
Reviewed by Dean Jackson.

This is a work toward https://bugs.webkit.org/show_bug.cgi?id=168586. The
goal to have SVGAnimatedType be type independent. The appropriate method
of this template will be implicitly instantiated based to the type of the
animated attribute(s).

Sources.txt: Delete SVGAnimatedType.cpp since its function became template

functions or short enough to be inline functions.

WebCore.xcodeproj/project.pbxproj:
svg/SVGAnimatedAngle.cpp:

(WebCore::SVGAnimatedAngleAnimator::constructFromString):
(WebCore::SVGAnimatedAngleAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedAngleAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedAngleAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):
Use the template functions SVGAnimatedType::create<>() and SVGAnimatedType::as<>().

svg/SVGAnimatedBoolean.cpp:

(WebCore::SVGAnimatedBooleanAnimator::constructFromString):
(WebCore::SVGAnimatedBooleanAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedBooleanAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedBooleanAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedColor.cpp:

(WebCore::SVGAnimatedColorAnimator::constructFromString):
(WebCore::SVGAnimatedColorAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedColorAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedEnumeration.cpp:

(WebCore::SVGAnimatedEnumerationAnimator::constructFromString):
(WebCore::SVGAnimatedEnumerationAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedEnumerationAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedEnumerationAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedInteger.cpp:

(WebCore::SVGAnimatedIntegerAnimator::constructFromString):
(WebCore::SVGAnimatedIntegerAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedIntegerAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedIntegerAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedIntegerAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedIntegerOptionalInteger.cpp:

(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::constructFromString):
(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedLength.cpp:

(WebCore::SVGAnimatedLengthAnimator::constructFromString):
(WebCore::SVGAnimatedLengthAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedLengthAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedLengthAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedLengthAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedLengthList.cpp:

(WebCore::SVGAnimatedLengthListAnimator::constructFromString):
(WebCore::SVGAnimatedLengthListAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedLengthListAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedLengthListAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedLengthListAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedNumber.cpp:

(WebCore::SVGAnimatedNumberAnimator::constructFromString):
(WebCore::SVGAnimatedNumberAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedNumberAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedNumberAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedNumberAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedNumberList.cpp:

(WebCore::SVGAnimatedNumberListAnimator::constructFromString):
(WebCore::SVGAnimatedNumberListAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedNumberListAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedNumberListAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedNumberListAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedNumberOptionalNumber.cpp:

(WebCore::SVGAnimatedNumberOptionalNumberAnimator::constructFromString):
(WebCore::SVGAnimatedNumberOptionalNumberAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedNumberOptionalNumberAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedNumberOptionalNumberAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedNumberOptionalNumberAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedPath.cpp:

(WebCore::SVGAnimatedPathAnimator::constructFromString):
(WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedPathAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedPathAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedPointList.cpp:

(WebCore::SVGAnimatedPointListAnimator::constructFromString):
(WebCore::SVGAnimatedPointListAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedPointListAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedPointListAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedPointListAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedPreserveAspectRatio.cpp:

(WebCore::SVGAnimatedPreserveAspectRatioAnimator::constructFromString):
(WebCore::SVGAnimatedPreserveAspectRatioAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedPreserveAspectRatioAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedPreserveAspectRatioAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedRect.cpp:

(WebCore::SVGAnimatedRectAnimator::constructFromString):
(WebCore::SVGAnimatedRectAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedRectAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedRectAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedRectAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedString.cpp:

(WebCore::SVGAnimatedStringAnimator::constructFromString):
(WebCore::SVGAnimatedStringAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedStringAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedStringAnimator::calculateAnimatedValue):
Ditto.

svg/SVGAnimatedTransformList.cpp:

(WebCore::SVGAnimatedTransformListAnimator::constructFromString):
(WebCore::SVGAnimatedTransformListAnimator::startAnimValAnimation):
(WebCore::SVGAnimatedTransformListAnimator::resetAnimValToBaseVal):
(WebCore::SVGAnimatedTransformListAnimator::addAnimatedTypes):
(WebCore::SVGAnimatedTransformListAnimator::calculateAnimatedValue):
(WebCore::SVGAnimatedTransformListAnimator::calculateDistance):
Ditto.

svg/SVGAnimatedType.cpp: Removed.
svg/SVGAnimatedType.h:

(WebCore::SVGAnimatedType::create):
(WebCore::SVGAnimatedType::SVGAnimatedType):
(WebCore::SVGAnimatedType::~SVGAnimatedType):
(WebCore::SVGAnimatedType::as const):
(WebCore::SVGAnimatedType::as):
(WebCore::SVGAnimatedType::type const):
(WebCore::SVGAnimatedType::valueAsString const):
(WebCore::SVGAnimatedType::setValueAsString):
(WebCore::SVGAnimatedType::supportsAnimVal):
(WebCore::SVGAnimatedType::angleAndEnumeration const): Deleted.
(WebCore::SVGAnimatedType::boolean const): Deleted.
(WebCore::SVGAnimatedType::color const): Deleted.
(WebCore::SVGAnimatedType::enumeration const): Deleted.
(WebCore::SVGAnimatedType::integer const): Deleted.
(WebCore::SVGAnimatedType::integerOptionalInteger const): Deleted.
(WebCore::SVGAnimatedType::length const): Deleted.
(WebCore::SVGAnimatedType::lengthList const): Deleted.
(WebCore::SVGAnimatedType::number const): Deleted.
(WebCore::SVGAnimatedType::numberList const): Deleted.
(WebCore::SVGAnimatedType::numberOptionalNumber const): Deleted.
(WebCore::SVGAnimatedType::path const): Deleted.
(WebCore::SVGAnimatedType::pointList const): Deleted.
(WebCore::SVGAnimatedType::preserveAspectRatio const): Deleted.
(WebCore::SVGAnimatedType::rect const): Deleted.
(WebCore::SVGAnimatedType::string const): Deleted.
(WebCore::SVGAnimatedType::transformList const): Deleted.
(WebCore::SVGAnimatedType::angleAndEnumeration): Deleted.
(WebCore::SVGAnimatedType::boolean): Deleted.
(WebCore::SVGAnimatedType::color): Deleted.
(WebCore::SVGAnimatedType::enumeration): Deleted.
(WebCore::SVGAnimatedType::integer): Deleted.
(WebCore::SVGAnimatedType::integerOptionalInteger): Deleted.
(WebCore::SVGAnimatedType::length): Deleted.
(WebCore::SVGAnimatedType::lengthList): Deleted.
(WebCore::SVGAnimatedType::number): Deleted.
(WebCore::SVGAnimatedType::numberList): Deleted.
(WebCore::SVGAnimatedType::numberOptionalNumber): Deleted.
(WebCore::SVGAnimatedType::path): Deleted.
(WebCore::SVGAnimatedType::pointList): Deleted.
(WebCore::SVGAnimatedType::preserveAspectRatio): Deleted.
(WebCore::SVGAnimatedType::rect): Deleted.
(WebCore::SVGAnimatedType::string): Deleted.
(WebCore::SVGAnimatedType::transformList): Deleted.
Replace the union by a Variant. Replace all the type specific functions
by the template functions create() and as(). Use WTF::visit to get the
value stored in the variant. Use the SVGPropertyTraits to perform the
required operation.

svg/SVGAnimatedTypeAnimator.h:

(WebCore::SVGAnimatedTypeAnimator::constructFromBaseValue):
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
(WebCore::SVGAnimatedTypeAnimator::stopAnimValAnimationForType):
(WebCore::SVGAnimatedTypeAnimator::animValDidChangeForType):
(WebCore::SVGAnimatedTypeAnimator::animValWillChangeForType):
(WebCore::SVGAnimatedTypeAnimator::constructFromBaseValues):
(WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):
(WebCore::SVGAnimatedTypeAnimator::stopAnimValAnimationForTypes):
(WebCore::SVGAnimatedTypeAnimator::animValDidChangeForTypes):
(WebCore::SVGAnimatedTypeAnimator::animValWillChangeForTypes):
(WebCore::SVGAnimatedTypeAnimator::executeAction):
Rename the parameters and the local variables to match their types. Use
the SVGAnimatedType template functions create() and as().

svg/SVGLengthValue.h:

(WebCore::SVGPropertyTraits<SVGLengthValue>::parse): This was moved from
SVGAnimatedType::setValueAsString()
(WebCore::SVGPropertyTraits<SVGLengthValue>::toString): This was moved from
SVGAnimatedType::valueAsString().

svg/SVGMarkerTypes.h: Add placeholders for parse() and toString() so

SVGAnimatedType::valueAsString() and setValueAsString() can compile for
all types.

svg/SVGNumberListValues.h:

(WebCore::SVGPropertyTraits<SVGNumberListValues>::parse):

svg/SVGPathByteStream.h:

(WebCore::SVGPropertyTraits<SVGPathByteStream>::parse):
(WebCore::SVGPropertyTraits<SVGPathByteStream>::toString):

svg/SVGPointListValues.h:

(WebCore::SVGPropertyTraits<SVGPointListValues>::parse):
(WebCore::SVGPropertyTraits<SVGPointListValues>::toString):

svg/SVGPreserveAspectRatioValue.h:

(WebCore::SVGPropertyTraits<SVGPreserveAspectRatioValue>::fromString):
(WebCore::SVGPropertyTraits<SVGPreserveAspectRatioValue>::parse):
(WebCore::SVGPropertyTraits<SVGPreserveAspectRatioValue>::toString):
Ditto.

svg/SVGTransformListValues.h:

(WebCore::SVGPropertyTraits<SVGTransformListValues>::parse):
Ditto.

svg/SVGValue.h: Added. SVGValueVariant is the replacement of the union

SVGAnimatedType::DataUnion.

svg/properties/SVGPropertyInfo.h:

Add a minimum and maximum AnimatedPropertyType so, SVGAnimatedType::type()
can assert that the index of the variant is in the range of this enum.

svg/properties/SVGPropertyTraits.h:

(WebCore::SVGPropertyTraits<bool>::parse):
(WebCore::SVGPropertyTraits<unsigned>::parse):
(WebCore::SVGPropertyTraits<int>::parse):
Ditto.

10:38 AM Changeset in webkit [229416] by Yusuke Suzuki

94 edits
1 delete in trunk/Source

[JSC][WebCore] Extend jsDynamicCast for WebCore types in WebCore and remove jsDynamicDowncast
https://bugs.webkit.org/show_bug.cgi?id=183449

Reviewed by Mark Lam.

Source/WebCore:

This patch removes jsDynamicDowncast. Our JSC::jsDynamicCast can have a way to inject a fast
path that is similar to jsDynamicDowncast. WebCore can leverage this functionality to add
a fast path for WebCore's extended JS object types (JSEvent, JSElement, JSNode, and JSDocument).

No behavior change.

WebCore.xcodeproj/project.pbxproj:
bindings/js/CommonVM.cpp:

(WebCore::lexicalFrameFromCommonVM):

bindings/js/JSDOMConvertBufferSource.h:

(WebCore::toPossiblySharedArrayBufferView):

bindings/js/JSDOMConvertPromise.h:

(WebCore::Converter<IDLPromise<T>>::convert):

bindings/js/JSDOMExceptionHandling.cpp:

(WebCore::reportException):
(WebCore::retrieveErrorMessage):

bindings/js/JSDOMIterator.h:

(WebCore::IteratorTraits>::next):

bindings/js/JSDOMWindowProxy.cpp:

(WebCore::JSDOMWindowProxy::toWrapped):

bindings/js/JSDOMWrapperCache.h:
bindings/js/JSDocumentCustom.h:

(JSC::JSCastingHelpers::InheritsTraits<WebCore::JSDocument>::inherits):
(WebCore::jsDocumentCast): Deleted.

bindings/js/JSDynamicDowncast.h: Removed.
bindings/js/JSElementCustom.h:

(JSC::JSCastingHelpers::InheritsTraits<WebCore::JSElement>::inherits):
(WebCore::jsElementCast): Deleted.

bindings/js/JSEventCustom.h:

(JSC::JSCastingHelpers::InheritsTraits<WebCore::JSEvent>::inherits):
(WebCore::jsEventCast): Deleted.

bindings/js/JSEventTargetCustom.cpp:

(WebCore::jsEventTargetCast):

bindings/js/JSNodeCustom.h:

(JSC::JSCastingHelpers::InheritsTraits<WebCore::JSNode>::inherits):
(WebCore::jsNodeCast): Deleted.

bindings/js/JSPluginElementFunctions.cpp:

(WebCore::pluginElementPropertyGetter):

bindings/js/JSReadableStreamSourceCustom.cpp:

(WebCore::JSReadableStreamSource::start):

bindings/js/JSWorkerGlobalScopeBase.cpp:

(WebCore::toJSDedicatedWorkerGlobalScope):
(WebCore::toJSWorkerGlobalScope):
(WebCore::toJSServiceWorkerGlobalScope):

bindings/js/ReadableStream.cpp:

(WebCore::ReadableStream::create):
(WebCore::ReadableStream::isDisturbed):

bindings/js/ReadableStream.h:

(WebCore::JSReadableStreamWrapperConverter::toWrapped):

bindings/js/ScriptModuleLoader.cpp:

(WebCore::ScriptModuleLoader::evaluate):

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneSerializer::serialize):

bindings/js/StructuredClone.cpp:

(WebCore::structuredCloneArrayBufferView):

bindings/scripts/CodeGeneratorJS.pm:

(GetCastingHelperForThisObject):
(GenerateImplementation):

bindings/scripts/test/JS/JSInterfaceName.cpp:

(WebCore::jsInterfaceNameConstructor):
(WebCore::setJSInterfaceNameConstructor):
(WebCore::JSInterfaceName::toWrapped):

bindings/scripts/test/JS/JSMapLike.cpp:

(WebCore::IDLAttribute<JSMapLike>::cast):
(WebCore::IDLOperation<JSMapLike>::cast):
(WebCore::jsMapLikeConstructor):
(WebCore::setJSMapLikeConstructor):
(WebCore::JSMapLike::toWrapped):

bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:

(WebCore::IDLAttribute<JSReadOnlyMapLike>::cast):
(WebCore::IDLOperation<JSReadOnlyMapLike>::cast):
(WebCore::jsReadOnlyMapLikeConstructor):
(WebCore::setJSReadOnlyMapLikeConstructor):
(WebCore::JSReadOnlyMapLike::toWrapped):

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

(WebCore::IDLAttribute<JSTestActiveDOMObject>::cast):
(WebCore::IDLOperation<JSTestActiveDOMObject>::cast):
(WebCore::jsTestActiveDOMObjectConstructor):
(WebCore::setJSTestActiveDOMObjectConstructor):
(WebCore::JSTestActiveDOMObject::toWrapped):

bindings/scripts/test/JS/JSTestCEReactions.cpp:

(WebCore::IDLAttribute<JSTestCEReactions>::cast):
(WebCore::IDLOperation<JSTestCEReactions>::cast):
(WebCore::jsTestCEReactionsConstructor):
(WebCore::setJSTestCEReactionsConstructor):
(WebCore::JSTestCEReactions::toWrapped):

bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:

(WebCore::IDLAttribute<JSTestCEReactionsStringifier>::cast):
(WebCore::IDLOperation<JSTestCEReactionsStringifier>::cast):
(WebCore::jsTestCEReactionsStringifierConstructor):
(WebCore::setJSTestCEReactionsStringifierConstructor):
(WebCore::JSTestCEReactionsStringifier::toWrapped):

bindings/scripts/test/JS/JSTestCallTracer.cpp:

(WebCore::IDLAttribute<JSTestCallTracer>::cast):
(WebCore::IDLOperation<JSTestCallTracer>::cast):
(WebCore::jsTestCallTracerConstructor):
(WebCore::setJSTestCallTracerConstructor):
(WebCore::JSTestCallTracer::toWrapped):

bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
(WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
(WebCore::JSTestClassWithJSBuiltinConstructor::toWrapped):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
(WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::toWrapped):

bindings/scripts/test/JS/JSTestDOMJIT.cpp:

(WebCore::IDLAttribute<JSTestDOMJIT>::cast):
(WebCore::IDLOperation<JSTestDOMJIT>::cast):
(WebCore::jsTestDOMJITConstructor):
(WebCore::setJSTestDOMJITConstructor):

bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:

(WebCore::IDLAttribute<JSTestEnabledBySetting>::cast):
(WebCore::IDLOperation<JSTestEnabledBySetting>::cast):
(WebCore::jsTestEnabledBySettingConstructor):
(WebCore::setJSTestEnabledBySettingConstructor):
(WebCore::JSTestEnabledBySetting::toWrapped):

bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::IDLAttribute<JSTestEventConstructor>::cast):
(WebCore::jsTestEventConstructorConstructor):
(WebCore::setJSTestEventConstructorConstructor):

bindings/scripts/test/JS/JSTestEventTarget.cpp:

(WebCore::IDLOperation<JSTestEventTarget>::cast):
(WebCore::jsTestEventTargetConstructor):
(WebCore::setJSTestEventTargetConstructor):
(WebCore::JSTestEventTarget::toWrapped):

bindings/scripts/test/JS/JSTestException.cpp:

(WebCore::IDLAttribute<JSTestException>::cast):
(WebCore::jsTestExceptionConstructor):
(WebCore::setJSTestExceptionConstructor):
(WebCore::JSTestException::toWrapped):

bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::IDLAttribute<JSTestGenerateIsReachable>::cast):
(WebCore::jsTestGenerateIsReachableConstructor):
(WebCore::setJSTestGenerateIsReachableConstructor):
(WebCore::JSTestGenerateIsReachable::toWrapped):

bindings/scripts/test/JS/JSTestGlobalObject.cpp:

(WebCore::IDLAttribute<JSTestGlobalObject>::cast):
(WebCore::IDLOperation<JSTestGlobalObject>::cast):
(WebCore::jsTestGlobalObjectConstructor):
(WebCore::setJSTestGlobalObjectConstructor):
(WebCore::JSTestGlobalObject::toWrapped):

bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:

(WebCore::jsTestIndexedSetterNoIdentifierConstructor):
(WebCore::setJSTestIndexedSetterNoIdentifierConstructor):
(WebCore::JSTestIndexedSetterNoIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:

(WebCore::jsTestIndexedSetterThrowingExceptionConstructor):
(WebCore::setJSTestIndexedSetterThrowingExceptionConstructor):
(WebCore::JSTestIndexedSetterThrowingException::toWrapped):

bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:

(WebCore::IDLOperation<JSTestIndexedSetterWithIdentifier>::cast):
(WebCore::jsTestIndexedSetterWithIdentifierConstructor):
(WebCore::setJSTestIndexedSetterWithIdentifierConstructor):
(WebCore::JSTestIndexedSetterWithIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::IDLAttribute<JSTestInterface>::cast):
(WebCore::IDLOperation<JSTestInterface>::cast):
(WebCore::jsTestInterfaceConstructor):
(WebCore::setJSTestInterfaceConstructor):
(WebCore::JSTestInterface::toWrapped):

bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:

(WebCore::IDLAttribute<JSTestInterfaceLeadingUnderscore>::cast):
(WebCore::jsTestInterfaceLeadingUnderscoreConstructor):
(WebCore::setJSTestInterfaceLeadingUnderscoreConstructor):
(WebCore::JSTestInterfaceLeadingUnderscore::toWrapped):

bindings/scripts/test/JS/JSTestIterable.cpp:

(WebCore::IDLOperation<JSTestIterable>::cast):
(WebCore::jsTestIterableConstructor):
(WebCore::setJSTestIterableConstructor):
(WebCore::JSTestIterable::toWrapped):

bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:

(WebCore::IDLAttribute<JSTestJSBuiltinConstructor>::cast):
(WebCore::IDLOperation<JSTestJSBuiltinConstructor>::cast):
(WebCore::jsTestJSBuiltinConstructorConstructor):
(WebCore::setJSTestJSBuiltinConstructorConstructor):

bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

(WebCore::IDLOperation<JSTestMediaQueryListListener>::cast):
(WebCore::jsTestMediaQueryListListenerConstructor):
(WebCore::setJSTestMediaQueryListListenerConstructor):
(WebCore::JSTestMediaQueryListListener::toWrapped):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:

(WebCore::jsTestNamedAndIndexedSetterNoIdentifierConstructor):
(WebCore::setJSTestNamedAndIndexedSetterNoIdentifierConstructor):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:

(WebCore::jsTestNamedAndIndexedSetterThrowingExceptionConstructor):
(WebCore::setJSTestNamedAndIndexedSetterThrowingExceptionConstructor):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::toWrapped):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:

(WebCore::IDLOperation<JSTestNamedAndIndexedSetterWithIdentifier>::cast):
(WebCore::jsTestNamedAndIndexedSetterWithIdentifierConstructor):
(WebCore::setJSTestNamedAndIndexedSetterWithIdentifierConstructor):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

(WebCore::jsTestNamedConstructorConstructor):
(WebCore::setJSTestNamedConstructorConstructor):
(WebCore::JSTestNamedConstructor::toWrapped):

bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:

(WebCore::jsTestNamedDeleterNoIdentifierConstructor):
(WebCore::setJSTestNamedDeleterNoIdentifierConstructor):
(WebCore::JSTestNamedDeleterNoIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:

(WebCore::jsTestNamedDeleterThrowingExceptionConstructor):
(WebCore::setJSTestNamedDeleterThrowingExceptionConstructor):
(WebCore::JSTestNamedDeleterThrowingException::toWrapped):

bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:

(WebCore::IDLOperation<JSTestNamedDeleterWithIdentifier>::cast):
(WebCore::jsTestNamedDeleterWithIdentifierConstructor):
(WebCore::setJSTestNamedDeleterWithIdentifierConstructor):
(WebCore::JSTestNamedDeleterWithIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:

(WebCore::jsTestNamedDeleterWithIndexedGetterConstructor):
(WebCore::setJSTestNamedDeleterWithIndexedGetterConstructor):
(WebCore::JSTestNamedDeleterWithIndexedGetter::toWrapped):

bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:

(WebCore::jsTestNamedGetterCallWithConstructor):
(WebCore::setJSTestNamedGetterCallWithConstructor):
(WebCore::JSTestNamedGetterCallWith::toWrapped):

bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:

(WebCore::jsTestNamedGetterNoIdentifierConstructor):
(WebCore::setJSTestNamedGetterNoIdentifierConstructor):
(WebCore::JSTestNamedGetterNoIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:

(WebCore::IDLOperation<JSTestNamedGetterWithIdentifier>::cast):
(WebCore::jsTestNamedGetterWithIdentifierConstructor):
(WebCore::setJSTestNamedGetterWithIdentifierConstructor):
(WebCore::JSTestNamedGetterWithIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:

(WebCore::jsTestNamedSetterNoIdentifierConstructor):
(WebCore::setJSTestNamedSetterNoIdentifierConstructor):
(WebCore::JSTestNamedSetterNoIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:

(WebCore::jsTestNamedSetterThrowingExceptionConstructor):
(WebCore::setJSTestNamedSetterThrowingExceptionConstructor):
(WebCore::JSTestNamedSetterThrowingException::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:

(WebCore::IDLOperation<JSTestNamedSetterWithIdentifier>::cast):
(WebCore::jsTestNamedSetterWithIdentifierConstructor):
(WebCore::setJSTestNamedSetterWithIdentifierConstructor):
(WebCore::JSTestNamedSetterWithIdentifier::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:

(WebCore::IDLOperation<JSTestNamedSetterWithIndexedGetter>::cast):
(WebCore::jsTestNamedSetterWithIndexedGetterConstructor):
(WebCore::setJSTestNamedSetterWithIndexedGetterConstructor):
(WebCore::JSTestNamedSetterWithIndexedGetter::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:

(WebCore::IDLOperation<JSTestNamedSetterWithIndexedGetterAndSetter>::cast):
(WebCore::jsTestNamedSetterWithIndexedGetterAndSetterConstructor):
(WebCore::setJSTestNamedSetterWithIndexedGetterAndSetterConstructor):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp:

(WebCore::jsTestNamedSetterWithOverrideBuiltinsConstructor):
(WebCore::setJSTestNamedSetterWithOverrideBuiltinsConstructor):
(WebCore::JSTestNamedSetterWithOverrideBuiltins::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp:

(WebCore::IDLAttribute<JSTestNamedSetterWithUnforgableProperties>::cast):
(WebCore::IDLOperation<JSTestNamedSetterWithUnforgableProperties>::cast):
(WebCore::jsTestNamedSetterWithUnforgablePropertiesConstructor):
(WebCore::setJSTestNamedSetterWithUnforgablePropertiesConstructor):
(WebCore::JSTestNamedSetterWithUnforgableProperties::toWrapped):

bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp:

(WebCore::IDLAttribute<JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins>::cast):
(WebCore::IDLOperation<JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins>::cast):
(WebCore::jsTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsConstructor):
(WebCore::setJSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsConstructor):
(WebCore::JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins::toWrapped):

bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::IDLAttribute<JSTestNode>::cast):
(WebCore::IDLOperation<JSTestNode>::cast):
(WebCore::jsTestNodeConstructor):
(WebCore::setJSTestNodeConstructor):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::IDLAttribute<JSTestObj>::cast):
(WebCore::IDLOperation<JSTestObj>::cast):
(WebCore::jsTestObjConstructor):
(WebCore::setJSTestObjConstructor):
(WebCore::JSTestObj::toWrapped):

bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::jsTestOverloadedConstructorsConstructor):
(WebCore::setJSTestOverloadedConstructorsConstructor):
(WebCore::JSTestOverloadedConstructors::toWrapped):

bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:

(WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):
(WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):
(WebCore::JSTestOverloadedConstructorsWithSequence::toWrapped):

bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

(WebCore::IDLOperation<JSTestOverrideBuiltins>::cast):
(WebCore::jsTestOverrideBuiltinsConstructor):
(WebCore::setJSTestOverrideBuiltinsConstructor):
(WebCore::JSTestOverrideBuiltins::toWrapped):

bindings/scripts/test/JS/JSTestPluginInterface.cpp:

(WebCore::jsTestPluginInterfaceConstructor):
(WebCore::setJSTestPluginInterfaceConstructor):
(WebCore::JSTestPluginInterface::toWrapped):

bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:

(WebCore::IDLAttribute<JSTestPromiseRejectionEvent>::cast):
(WebCore::jsTestPromiseRejectionEventConstructor):
(WebCore::setJSTestPromiseRejectionEventConstructor):

bindings/scripts/test/JS/JSTestSerialization.cpp:

(WebCore::IDLAttribute<JSTestSerialization>::cast):
(WebCore::IDLOperation<JSTestSerialization>::cast):
(WebCore::jsTestSerializationConstructor):
(WebCore::setJSTestSerializationConstructor):
(WebCore::JSTestSerialization::toWrapped):

bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp:

(WebCore::jsTestSerializationIndirectInheritanceConstructor):
(WebCore::setJSTestSerializationIndirectInheritanceConstructor):

bindings/scripts/test/JS/JSTestSerializationInherit.cpp:

(WebCore::IDLAttribute<JSTestSerializationInherit>::cast):
(WebCore::IDLOperation<JSTestSerializationInherit>::cast):
(WebCore::jsTestSerializationInheritConstructor):
(WebCore::setJSTestSerializationInheritConstructor):

bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp:

(WebCore::IDLAttribute<JSTestSerializationInheritFinal>::cast):
(WebCore::IDLOperation<JSTestSerializationInheritFinal>::cast):
(WebCore::jsTestSerializationInheritFinalConstructor):
(WebCore::setJSTestSerializationInheritFinalConstructor):

bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

(WebCore::IDLAttribute<JSTestSerializedScriptValueInterface>::cast):
(WebCore::IDLOperation<JSTestSerializedScriptValueInterface>::cast):
(WebCore::jsTestSerializedScriptValueInterfaceConstructor):
(WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
(WebCore::JSTestSerializedScriptValueInterface::toWrapped):

bindings/scripts/test/JS/JSTestStringifier.cpp:

(WebCore::IDLOperation<JSTestStringifier>::cast):
(WebCore::jsTestStringifierConstructor):
(WebCore::setJSTestStringifierConstructor):
(WebCore::JSTestStringifier::toWrapped):

bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:

(WebCore::IDLOperation<JSTestStringifierAnonymousOperation>::cast):
(WebCore::jsTestStringifierAnonymousOperationConstructor):
(WebCore::setJSTestStringifierAnonymousOperationConstructor):
(WebCore::JSTestStringifierAnonymousOperation::toWrapped):

bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:

(WebCore::IDLOperation<JSTestStringifierNamedOperation>::cast):
(WebCore::jsTestStringifierNamedOperationConstructor):
(WebCore::setJSTestStringifierNamedOperationConstructor):
(WebCore::JSTestStringifierNamedOperation::toWrapped):

bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:

(WebCore::IDLOperation<JSTestStringifierOperationImplementedAs>::cast):
(WebCore::jsTestStringifierOperationImplementedAsConstructor):
(WebCore::setJSTestStringifierOperationImplementedAsConstructor):
(WebCore::JSTestStringifierOperationImplementedAs::toWrapped):

bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:

(WebCore::IDLOperation<JSTestStringifierOperationNamedToString>::cast):
(WebCore::jsTestStringifierOperationNamedToStringConstructor):
(WebCore::setJSTestStringifierOperationNamedToStringConstructor):
(WebCore::JSTestStringifierOperationNamedToString::toWrapped):

bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:

(WebCore::IDLAttribute<JSTestStringifierReadOnlyAttribute>::cast):
(WebCore::IDLOperation<JSTestStringifierReadOnlyAttribute>::cast):
(WebCore::jsTestStringifierReadOnlyAttributeConstructor):
(WebCore::setJSTestStringifierReadOnlyAttributeConstructor):
(WebCore::JSTestStringifierReadOnlyAttribute::toWrapped):

bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:

(WebCore::IDLAttribute<JSTestStringifierReadWriteAttribute>::cast):
(WebCore::IDLOperation<JSTestStringifierReadWriteAttribute>::cast):
(WebCore::jsTestStringifierReadWriteAttributeConstructor):
(WebCore::setJSTestStringifierReadWriteAttributeConstructor):
(WebCore::JSTestStringifierReadWriteAttribute::toWrapped):

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::IDLAttribute<JSTestTypedefs>::cast):
(WebCore::IDLOperation<JSTestTypedefs>::cast):
(WebCore::jsTestTypedefsConstructor):
(WebCore::setJSTestTypedefsConstructor):
(WebCore::JSTestTypedefs::toWrapped):

bridge/objc/WebScriptObject.mm:

(-[WebScriptObject setValue:forKey:]):

bridge/runtime_array.cpp:

(JSC::RuntimeArray::lengthGetter):

bridge/runtime_method.cpp:

(JSC::RuntimeMethod::lengthGetter):

html/HTMLMediaElement.cpp:

(WebCore::controllerJSValue):
(WebCore::HTMLMediaElement::updateCaptionContainer):
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):

inspector/agents/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildObjectForEventListener):

Source/WebKit:

WebProcess/Automation/WebAutomationSessionProxy.cpp:

(WebKit::WebAutomationSessionProxy::elementForNodeHandle):

WebProcess/WebPage/WebFrame.cpp:

(WebKit::WebFrame::frameForContext):

10:35 AM Changeset in webkit [229415] by Ryan Haddad

1 edit
2 copies
1 delete in trunk/LayoutTests

Move a test from fast/DOM to fast/dom and delete the fast/DOM directory.

Unreviewed test gardening.

fast/dom/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Renamed from LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt.
fast/dom/HTMLInputElement/input-value-and-type-change-crash.html: Renamed from LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html.

10:29 AM Changeset in webkit [229414] by Chris Dumez

2 edits in trunk/Source/WebKitLegacy/mac

Possible null dereference of the page under WebFrameNetworkingContext::storageSession()
https://bugs.webkit.org/show_bug.cgi?id=183455
<rdar://problem/38191749>

Reviewed by Youenn Fablet.

Add a null check for the page as we have evidence from crashes that it can be null.
Other functions in WebFrameNetworkingContext already null check the page as well,
not just the frame so this is consistent.

WebCoreSupport/WebFrameNetworkingContext.mm:

(WebFrameNetworkingContext::storageSession const):

10:24 AM Changeset in webkit [229413] by Yusuke Suzuki

149 edits in trunk/Source/JavaScriptCore

[JSC] Optimize inherits<T> if T is final type
https://bugs.webkit.org/show_bug.cgi?id=183435

Reviewed by Mark Lam.

If the type T is a final type (std::is_final<T>::value == true), there is no
classes which is derived from T. It means that jsDynamicCast<T> only needs
to check the given cell's classInfo(vm) is T::info().

This patch adds a new specialization for jsDynamicCast<T> / inherits<T> for a
final type. And we also add final annotations to JS cell types in JSC. This
offers,

Readability. If the given class is annotated with final, we do not need to

consider about the derived classes of T.

Static Checking. If your class is not intended to be used as a base class, attaching

final can ensure this invariant.

Performance. jsDynamicCast<T> and inherits<T> can be optimized and the code size should

be smaller.

API/JSCallbackConstructor.h:

(JSC::JSCallbackConstructor::create): Deleted.
(JSC::JSCallbackConstructor::classRef const): Deleted.
(JSC::JSCallbackConstructor::callback const): Deleted.
(JSC::JSCallbackConstructor::createStructure): Deleted.
(JSC::JSCallbackConstructor::constructCallback): Deleted.

API/JSCallbackFunction.h:

(JSC::JSCallbackFunction::createStructure): Deleted.
(JSC::JSCallbackFunction::functionCallback): Deleted.

API/JSCallbackObject.h:

(JSC::JSCallbackObject::create): Deleted.
(JSC::JSCallbackObject::destroy): Deleted.
(JSC::JSCallbackObject::classRef const): Deleted.
(JSC::JSCallbackObject::getPrivateProperty const): Deleted.
(JSC::JSCallbackObject::setPrivateProperty): Deleted.
(JSC::JSCallbackObject::deletePrivateProperty): Deleted.
(JSC::JSCallbackObject::visitChildren): Deleted.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::setConstantRegisters):

bytecode/ExecutableToCodeBlockEdge.h:

(JSC::ExecutableToCodeBlockEdge::subspaceFor): Deleted.
(JSC::ExecutableToCodeBlockEdge::codeBlock const): Deleted.
(JSC::ExecutableToCodeBlockEdge::unwrap): Deleted.

bytecode/FunctionCodeBlock.h:

(JSC::FunctionCodeBlock::subspaceFor): Deleted.
(JSC::FunctionCodeBlock::create): Deleted.
(JSC::FunctionCodeBlock::createStructure): Deleted.
(JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.

debugger/DebuggerScope.h:

(JSC::DebuggerScope::createStructure): Deleted.
(JSC::DebuggerScope::iterator::iterator): Deleted.
(JSC::DebuggerScope::iterator::get): Deleted.
(JSC::DebuggerScope::iterator::operator++): Deleted.
(JSC::DebuggerScope::iterator::operator== const): Deleted.
(JSC::DebuggerScope::iterator::operator!= const): Deleted.
(JSC::DebuggerScope::isValid const): Deleted.
(JSC::DebuggerScope::jsScope const): Deleted.

inspector/JSInjectedScriptHost.h:

(Inspector::JSInjectedScriptHost::createStructure): Deleted.
(Inspector::JSInjectedScriptHost::create): Deleted.
(Inspector::JSInjectedScriptHost::impl const): Deleted.

inspector/JSInjectedScriptHostPrototype.h:

(Inspector::JSInjectedScriptHostPrototype::create): Deleted.
(Inspector::JSInjectedScriptHostPrototype::createStructure): Deleted.
(Inspector::JSInjectedScriptHostPrototype::JSInjectedScriptHostPrototype): Deleted.

inspector/JSJavaScriptCallFrame.h:

(Inspector::JSJavaScriptCallFrame::createStructure): Deleted.
(Inspector::JSJavaScriptCallFrame::create): Deleted.
(Inspector::JSJavaScriptCallFrame::impl const): Deleted.

inspector/JSJavaScriptCallFramePrototype.h:

(Inspector::JSJavaScriptCallFramePrototype::create): Deleted.
(Inspector::JSJavaScriptCallFramePrototype::createStructure): Deleted.
(Inspector::JSJavaScriptCallFramePrototype::JSJavaScriptCallFramePrototype): Deleted.

jit/Repatch.cpp:

(JSC::tryCacheGetByID):

runtime/ArrayConstructor.h:

(JSC::ArrayConstructor::create): Deleted.
(JSC::ArrayConstructor::createStructure): Deleted.

runtime/ArrayIteratorPrototype.h:

(JSC::ArrayIteratorPrototype::create): Deleted.
(JSC::ArrayIteratorPrototype::createStructure): Deleted.
(JSC::ArrayIteratorPrototype::ArrayIteratorPrototype): Deleted.

runtime/ArrayPrototype.h:

(JSC::ArrayPrototype::createStructure): Deleted.

runtime/AsyncFromSyncIteratorPrototype.h:

(JSC::AsyncFromSyncIteratorPrototype::createStructure): Deleted.

runtime/AsyncFunctionConstructor.h:

(JSC::AsyncFunctionConstructor::create): Deleted.
(JSC::AsyncFunctionConstructor::createStructure): Deleted.

runtime/AsyncFunctionPrototype.h:

(JSC::AsyncFunctionPrototype::create): Deleted.
(JSC::AsyncFunctionPrototype::createStructure): Deleted.

runtime/AsyncGeneratorFunctionConstructor.h:

(JSC::AsyncGeneratorFunctionConstructor::create): Deleted.
(JSC::AsyncGeneratorFunctionConstructor::createStructure): Deleted.

runtime/AsyncGeneratorFunctionPrototype.h:

(JSC::AsyncGeneratorFunctionPrototype::create): Deleted.
(JSC::AsyncGeneratorFunctionPrototype::createStructure): Deleted.

runtime/AsyncGeneratorPrototype.h:

(JSC::AsyncGeneratorPrototype::create): Deleted.
(JSC::AsyncGeneratorPrototype::createStructure): Deleted.
(JSC::AsyncGeneratorPrototype::AsyncGeneratorPrototype): Deleted.

runtime/AsyncIteratorPrototype.h:

(JSC::AsyncIteratorPrototype::create): Deleted.
(JSC::AsyncIteratorPrototype::createStructure): Deleted.
(JSC::AsyncIteratorPrototype::AsyncIteratorPrototype): Deleted.

runtime/AtomicsObject.h:
runtime/BigIntConstructor.h:

(JSC::BigIntConstructor::create): Deleted.
(JSC::BigIntConstructor::createStructure): Deleted.

runtime/BigIntObject.h:

(JSC::BigIntObject::create): Deleted.
(JSC::BigIntObject::internalValue const): Deleted.
(JSC::BigIntObject::createStructure): Deleted.

runtime/BigIntPrototype.h:

(JSC::BigIntPrototype::create): Deleted.
(JSC::BigIntPrototype::createStructure): Deleted.

runtime/BooleanConstructor.h:

(JSC::BooleanConstructor::create): Deleted.
(JSC::BooleanConstructor::createStructure): Deleted.

runtime/BooleanPrototype.h:

(JSC::BooleanPrototype::create): Deleted.
(JSC::BooleanPrototype::createStructure): Deleted.

runtime/ConsoleObject.h:

(JSC::ConsoleObject::create): Deleted.
(JSC::ConsoleObject::createStructure): Deleted.

runtime/DOMAttributeGetterSetter.h:

(JSC::isDOMAttributeGetterSetter): Deleted.

runtime/DateConstructor.h:

(JSC::DateConstructor::create): Deleted.
(JSC::DateConstructor::createStructure): Deleted.

runtime/DateInstance.h:

(JSC::DateInstance::create): Deleted.
(JSC::DateInstance::internalNumber const): Deleted.
(JSC::DateInstance::gregorianDateTime const): Deleted.
(JSC::DateInstance::gregorianDateTimeUTC const): Deleted.
(JSC::DateInstance::createStructure): Deleted.

runtime/DatePrototype.h:

(JSC::DatePrototype::create): Deleted.
(JSC::DatePrototype::createStructure): Deleted.

runtime/Error.h:

(JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction): Deleted.
(JSC::StrictModeTypeErrorFunction::create): Deleted.
(JSC::StrictModeTypeErrorFunction::constructThrowTypeError): Deleted.
(JSC::StrictModeTypeErrorFunction::callThrowTypeError): Deleted.
(JSC::StrictModeTypeErrorFunction::createStructure): Deleted.

runtime/ErrorConstructor.h:

(JSC::ErrorConstructor::create): Deleted.
(JSC::ErrorConstructor::createStructure): Deleted.
(JSC::ErrorConstructor::stackTraceLimit const): Deleted.

runtime/Exception.h:

(JSC::Exception::valueOffset): Deleted.
(JSC::Exception::value const): Deleted.
(JSC::Exception::stack const): Deleted.
(JSC::Exception::didNotifyInspectorOfThrow const): Deleted.
(JSC::Exception::setDidNotifyInspectorOfThrow): Deleted.

runtime/FunctionConstructor.h:

(JSC::FunctionConstructor::create): Deleted.
(JSC::FunctionConstructor::createStructure): Deleted.

runtime/FunctionPrototype.h:

(JSC::FunctionPrototype::create): Deleted.
(JSC::FunctionPrototype::createStructure): Deleted.

runtime/FunctionRareData.h:

(JSC::FunctionRareData::offsetOfObjectAllocationProfile): Deleted.
(JSC::FunctionRareData::objectAllocationProfile): Deleted.
(JSC::FunctionRareData::objectAllocationStructure): Deleted.
(JSC::FunctionRareData::allocationProfileWatchpointSet): Deleted.
(JSC::FunctionRareData::isObjectAllocationProfileInitialized): Deleted.
(JSC::FunctionRareData::internalFunctionAllocationStructure): Deleted.
(JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase): Deleted.
(JSC::FunctionRareData::clearInternalFunctionAllocationProfile): Deleted.
(JSC::FunctionRareData::getBoundFunctionStructure): Deleted.
(JSC::FunctionRareData::setBoundFunctionStructure): Deleted.
(JSC::FunctionRareData::hasReifiedLength const): Deleted.
(JSC::FunctionRareData::setHasReifiedLength): Deleted.
(JSC::FunctionRareData::hasReifiedName const): Deleted.
(JSC::FunctionRareData::setHasReifiedName): Deleted.
(JSC::FunctionRareData::hasAllocationProfileClearingWatchpoint const): Deleted.
(JSC::FunctionRareData::createAllocationProfileClearingWatchpoint): Deleted.
(JSC::FunctionRareData::AllocationProfileClearingWatchpoint::AllocationProfileClearingWatchpoint): Deleted.

runtime/GeneratorFunctionConstructor.h:

(JSC::GeneratorFunctionConstructor::create): Deleted.
(JSC::GeneratorFunctionConstructor::createStructure): Deleted.

runtime/GeneratorFunctionPrototype.h:

(JSC::GeneratorFunctionPrototype::create): Deleted.
(JSC::GeneratorFunctionPrototype::createStructure): Deleted.

runtime/GeneratorPrototype.h:

(JSC::GeneratorPrototype::create): Deleted.
(JSC::GeneratorPrototype::createStructure): Deleted.
(JSC::GeneratorPrototype::GeneratorPrototype): Deleted.

runtime/InferredValue.h:

(JSC::InferredValue::subspaceFor): Deleted.
(JSC::InferredValue::inferredValue): Deleted.
(JSC::InferredValue::state const): Deleted.
(JSC::InferredValue::isStillValid const): Deleted.
(JSC::InferredValue::hasBeenInvalidated const): Deleted.
(JSC::InferredValue::add): Deleted.
(JSC::InferredValue::notifyWrite): Deleted.
(JSC::InferredValue::invalidate): Deleted.

runtime/InspectorInstrumentationObject.h:

(JSC::InspectorInstrumentationObject::create): Deleted.
(JSC::InspectorInstrumentationObject::createStructure): Deleted.

runtime/IntlCollator.h:

(JSC::IntlCollator::boundCompare const): Deleted.

runtime/IntlCollatorConstructor.h:

(JSC::IntlCollatorConstructor::collatorStructure const): Deleted.

runtime/IntlCollatorPrototype.h:
runtime/IntlDateTimeFormat.h:

(JSC::IntlDateTimeFormat::boundFormat const): Deleted.

runtime/IntlDateTimeFormatConstructor.h:

(JSC::IntlDateTimeFormatConstructor::dateTimeFormatStructure const): Deleted.

runtime/IntlDateTimeFormatPrototype.h:
runtime/IntlNumberFormat.h:

(JSC::IntlNumberFormat::boundFormat const): Deleted.

runtime/IntlNumberFormatConstructor.h:

(JSC::IntlNumberFormatConstructor::numberFormatStructure const): Deleted.

runtime/IntlNumberFormatPrototype.h:
runtime/IntlObject.h:
runtime/IteratorPrototype.h:

(JSC::IteratorPrototype::create): Deleted.
(JSC::IteratorPrototype::createStructure): Deleted.
(JSC::IteratorPrototype::IteratorPrototype): Deleted.

runtime/JSAPIValueWrapper.h:

(JSC::JSAPIValueWrapper::value const): Deleted.
(JSC::JSAPIValueWrapper::createStructure): Deleted.
(JSC::JSAPIValueWrapper::create): Deleted.
(JSC::JSAPIValueWrapper::finishCreation): Deleted.
(JSC::JSAPIValueWrapper::JSAPIValueWrapper): Deleted.

runtime/JSArrayBufferConstructor.h:

(JSC::JSArrayBufferConstructor::sharingMode const): Deleted.

runtime/JSArrayBufferPrototype.h:
runtime/JSAsyncFunction.h:

(JSC::JSAsyncFunction::subspaceFor): Deleted.
(JSC::JSAsyncFunction::allocationSize): Deleted.
(JSC::JSAsyncFunction::createStructure): Deleted.

runtime/JSAsyncGeneratorFunction.h:

(JSC::JSAsyncGeneratorFunction::subspaceFor): Deleted.
(JSC::JSAsyncGeneratorFunction::allocationSize): Deleted.
(JSC::JSAsyncGeneratorFunction::createStructure): Deleted.

runtime/JSBigInt.h:

(JSC::JSBigInt::setSign): Deleted.
(JSC::JSBigInt::sign const): Deleted.
(JSC::JSBigInt::setLength): Deleted.
(JSC::JSBigInt::length const): Deleted.

runtime/JSBoundFunction.h:

(JSC::JSBoundFunction::subspaceFor): Deleted.
(JSC::JSBoundFunction::targetFunction): Deleted.
(JSC::JSBoundFunction::boundThis): Deleted.
(JSC::JSBoundFunction::boundArgs): Deleted.
(JSC::JSBoundFunction::createStructure): Deleted.
(JSC::JSBoundFunction::offsetOfTargetFunction): Deleted.
(JSC::JSBoundFunction::offsetOfBoundThis): Deleted.

runtime/JSCast.h:

(JSC::JSCastingHelpers::FinalTypeDispatcher::inheritsGeneric):
(JSC::JSCastingHelpers::inheritsJSTypeImpl):
(JSC::JSCastingHelpers::InheritsTraits::inherits):
(JSC::JSCastingHelpers::inheritsGenericImpl): Deleted.

runtime/JSCustomGetterSetterFunction.cpp:

(JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):

runtime/JSCustomGetterSetterFunction.h:

(JSC::JSCustomGetterSetterFunction::subspaceFor): Deleted.
(JSC::JSCustomGetterSetterFunction::createStructure): Deleted.
(JSC::JSCustomGetterSetterFunction::customGetterSetter const): Deleted.
(JSC::JSCustomGetterSetterFunction::isSetter const): Deleted.
(JSC::JSCustomGetterSetterFunction::propertyName const): Deleted.

runtime/JSDataView.h:

(JSC::JSDataView::possiblySharedBuffer const): Deleted.
(JSC::JSDataView::unsharedBuffer const): Deleted.

runtime/JSDataViewPrototype.h:
runtime/JSFixedArray.h:

(JSC::JSFixedArray::createStructure): Deleted.
(JSC::JSFixedArray::tryCreate): Deleted.
(JSC::JSFixedArray::create): Deleted.
(JSC::JSFixedArray::createFromArray): Deleted.
(JSC::JSFixedArray::get const): Deleted.
(JSC::JSFixedArray::set): Deleted.
(JSC::JSFixedArray::buffer): Deleted.
(JSC::JSFixedArray::buffer const): Deleted.
(JSC::JSFixedArray::values const): Deleted.
(JSC::JSFixedArray::size const): Deleted.
(JSC::JSFixedArray::length const): Deleted.
(JSC::JSFixedArray::offsetOfSize): Deleted.
(JSC::JSFixedArray::offsetOfData): Deleted.
(JSC::JSFixedArray::JSFixedArray): Deleted.
(JSC::JSFixedArray::allocationSize): Deleted.

runtime/JSGeneratorFunction.h:

(JSC::JSGeneratorFunction::subspaceFor): Deleted.
(JSC::JSGeneratorFunction::allocationSize): Deleted.
(JSC::JSGeneratorFunction::createStructure): Deleted.

runtime/JSGenericTypedArrayView.h:

(JSC::JSGenericTypedArrayView::byteLength const): Deleted.
(JSC::JSGenericTypedArrayView::byteSize const): Deleted.
(JSC::JSGenericTypedArrayView::typedVector const): Deleted.
(JSC::JSGenericTypedArrayView::typedVector): Deleted.
(JSC::JSGenericTypedArrayView::canGetIndexQuickly): Deleted.
(JSC::JSGenericTypedArrayView::canSetIndexQuickly): Deleted.
(JSC::JSGenericTypedArrayView::getIndexQuicklyAsNativeValue): Deleted.
(JSC::JSGenericTypedArrayView::getIndexQuicklyAsDouble): Deleted.
(JSC::JSGenericTypedArrayView::getIndexQuickly): Deleted.
(JSC::JSGenericTypedArrayView::setIndexQuicklyToNativeValue): Deleted.
(JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble): Deleted.
(JSC::JSGenericTypedArrayView::setIndexQuickly): Deleted.
(JSC::JSGenericTypedArrayView::setIndex): Deleted.
(JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue): Deleted.
(JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion): Deleted.
(JSC::JSGenericTypedArrayView::sort): Deleted.
(JSC::JSGenericTypedArrayView::canAccessRangeQuickly): Deleted.
(JSC::JSGenericTypedArrayView::createStructure): Deleted.
(JSC::JSGenericTypedArrayView::info): Deleted.
(JSC::JSGenericTypedArrayView::purifyArray): Deleted.
(JSC::JSGenericTypedArrayView::sortComparison): Deleted.
(JSC::JSGenericTypedArrayView::sortFloat): Deleted.

runtime/JSGenericTypedArrayViewConstructor.h:
runtime/JSGenericTypedArrayViewPrototype.h:
runtime/JSInternalPromise.h:
runtime/JSInternalPromiseConstructor.h:
runtime/JSInternalPromisePrototype.h:
runtime/JSMapIterator.h:

(JSC::JSMapIterator::createStructure): Deleted.
(JSC::JSMapIterator::create): Deleted.
(JSC::JSMapIterator::advanceIter): Deleted.
(JSC::JSMapIterator::next): Deleted.
(JSC::JSMapIterator::nextKeyValue): Deleted.
(JSC::JSMapIterator::kind const): Deleted.
(JSC::JSMapIterator::iteratedValue const): Deleted.
(JSC::JSMapIterator::JSMapIterator): Deleted.
(JSC::JSMapIterator::setIterator): Deleted.

runtime/JSModuleLoader.h:

(JSC::JSModuleLoader::create): Deleted.
(JSC::JSModuleLoader::createStructure): Deleted.

runtime/JSModuleNamespaceObject.h:

(JSC::isJSModuleNamespaceObject): Deleted.

runtime/JSModuleRecord.h:

(JSC::JSModuleRecord::sourceCode const): Deleted.
(JSC::JSModuleRecord::declaredVariables const): Deleted.
(JSC::JSModuleRecord::lexicalVariables const): Deleted.

runtime/JSNativeStdFunction.h:

(JSC::JSNativeStdFunction::subspaceFor): Deleted.
(JSC::JSNativeStdFunction::createStructure): Deleted.
(JSC::JSNativeStdFunction::nativeStdFunctionCell): Deleted.

runtime/JSONObject.h:

(JSC::JSONObject::create): Deleted.
(JSC::JSONObject::createStructure): Deleted.

runtime/JSObject.h:

(JSC::JSObject::fillCustomGetterPropertySlot):

runtime/JSScriptFetchParameters.h:

(JSC::JSScriptFetchParameters::createStructure): Deleted.
(JSC::JSScriptFetchParameters::create): Deleted.
(JSC::JSScriptFetchParameters::parameters const): Deleted.
(JSC::JSScriptFetchParameters::JSScriptFetchParameters): Deleted.

runtime/JSScriptFetcher.h:

(JSC::JSScriptFetcher::createStructure): Deleted.
(JSC::JSScriptFetcher::create): Deleted.
(JSC::JSScriptFetcher::fetcher const): Deleted.
(JSC::JSScriptFetcher::JSScriptFetcher): Deleted.

runtime/JSSetIterator.h:

(JSC::JSSetIterator::createStructure): Deleted.
(JSC::JSSetIterator::create): Deleted.
(JSC::JSSetIterator::advanceIter): Deleted.
(JSC::JSSetIterator::next): Deleted.
(JSC::JSSetIterator::kind const): Deleted.
(JSC::JSSetIterator::iteratedValue const): Deleted.
(JSC::JSSetIterator::JSSetIterator): Deleted.
(JSC::JSSetIterator::setIterator): Deleted.

runtime/JSSourceCode.h:

(JSC::JSSourceCode::createStructure): Deleted.
(JSC::JSSourceCode::create): Deleted.
(JSC::JSSourceCode::sourceCode const): Deleted.
(JSC::JSSourceCode::JSSourceCode): Deleted.

runtime/JSStringIterator.h:

(JSC::JSStringIterator::createStructure): Deleted.
(JSC::JSStringIterator::create): Deleted.
(JSC::JSStringIterator::JSStringIterator): Deleted.

runtime/JSTemplateObjectDescriptor.h:

(JSC::isTemplateObjectDescriptor): Deleted.

runtime/JSTypedArrayViewConstructor.h:

(JSC::JSTypedArrayViewConstructor::create): Deleted.

runtime/JSTypedArrayViewPrototype.h:
runtime/MapConstructor.h:

(JSC::MapConstructor::create): Deleted.
(JSC::MapConstructor::createStructure): Deleted.

runtime/MapIteratorPrototype.h:

(JSC::MapIteratorPrototype::create): Deleted.
(JSC::MapIteratorPrototype::createStructure): Deleted.
(JSC::MapIteratorPrototype::MapIteratorPrototype): Deleted.

runtime/MapPrototype.h:

(JSC::MapPrototype::create): Deleted.
(JSC::MapPrototype::createStructure): Deleted.
(JSC::MapPrototype::MapPrototype): Deleted.

runtime/MathObject.h:

(JSC::MathObject::create): Deleted.
(JSC::MathObject::createStructure): Deleted.

runtime/ModuleLoaderPrototype.h:

(JSC::ModuleLoaderPrototype::create): Deleted.
(JSC::ModuleLoaderPrototype::createStructure): Deleted.

runtime/NativeErrorConstructor.h:

(JSC::NativeErrorConstructor::create): Deleted.
(JSC::NativeErrorConstructor::createStructure): Deleted.
(JSC::NativeErrorConstructor::errorStructure): Deleted.

runtime/NativeErrorPrototype.h:

(JSC::NativeErrorPrototype::create): Deleted.

runtime/NativeStdFunctionCell.h:

(JSC::NativeStdFunctionCell::createStructure): Deleted.
(JSC::NativeStdFunctionCell::function const): Deleted.

runtime/NullGetterFunction.h:

(JSC::NullGetterFunction::create): Deleted.
(JSC::NullGetterFunction::createStructure): Deleted.

runtime/NullSetterFunction.h:

(JSC::NullSetterFunction::create): Deleted.
(JSC::NullSetterFunction::createStructure): Deleted.

runtime/NumberConstructor.h:

(JSC::NumberConstructor::create): Deleted.
(JSC::NumberConstructor::createStructure): Deleted.
(JSC::NumberConstructor::isIntegerImpl): Deleted.

runtime/NumberPrototype.h:

(JSC::NumberPrototype::create): Deleted.
(JSC::NumberPrototype::createStructure): Deleted.

runtime/ObjectConstructor.h:

(JSC::ObjectConstructor::create): Deleted.
(JSC::ObjectConstructor::createStructure): Deleted.

runtime/ObjectPrototype.h:

(JSC::ObjectPrototype::createStructure): Deleted.

runtime/ProxyConstructor.h:

(JSC::ProxyConstructor::createStructure): Deleted.

runtime/ProxyRevoke.h:

(JSC::ProxyRevoke::createStructure): Deleted.
(JSC::ProxyRevoke::proxy): Deleted.
(JSC::ProxyRevoke::setProxyToNull): Deleted.

runtime/ReflectObject.h:

(JSC::ReflectObject::create): Deleted.
(JSC::ReflectObject::createStructure): Deleted.

runtime/RegExpConstructor.cpp:

(JSC::regExpConstructorDollar):
(JSC::regExpConstructorInput):
(JSC::regExpConstructorMultiline):
(JSC::regExpConstructorLastMatch):
(JSC::regExpConstructorLastParen):
(JSC::regExpConstructorLeftContext):
(JSC::regExpConstructorRightContext):

runtime/RegExpConstructor.h:

(JSC::RegExpConstructor::create): Deleted.
(JSC::RegExpConstructor::createStructure): Deleted.
(JSC::RegExpConstructor::setMultiline): Deleted.
(JSC::RegExpConstructor::multiline const): Deleted.
(JSC::RegExpConstructor::setInput): Deleted.
(JSC::RegExpConstructor::input): Deleted.
(JSC::RegExpConstructor::offsetOfCachedResult): Deleted.
(JSC::asRegExpConstructor): Deleted.

runtime/RegExpPrototype.h:

(JSC::RegExpPrototype::create): Deleted.
(JSC::RegExpPrototype::createStructure): Deleted.
(JSC::RegExpPrototype::emptyRegExp const): Deleted.

runtime/SetConstructor.h:

(JSC::SetConstructor::create): Deleted.
(JSC::SetConstructor::createStructure): Deleted.

runtime/SetIteratorPrototype.h:

(JSC::SetIteratorPrototype::create): Deleted.
(JSC::SetIteratorPrototype::createStructure): Deleted.
(JSC::SetIteratorPrototype::SetIteratorPrototype): Deleted.

runtime/SetPrototype.h:

(JSC::SetPrototype::create): Deleted.
(JSC::SetPrototype::createStructure): Deleted.
(JSC::SetPrototype::SetPrototype): Deleted.

runtime/StringConstructor.h:

(JSC::StringConstructor::create): Deleted.
(JSC::StringConstructor::createStructure): Deleted.

runtime/StringIteratorPrototype.h:

(JSC::StringIteratorPrototype::create): Deleted.
(JSC::StringIteratorPrototype::createStructure): Deleted.
(JSC::StringIteratorPrototype::StringIteratorPrototype): Deleted.

runtime/StringPrototype.h:

(JSC::StringPrototype::createStructure): Deleted.

runtime/SymbolConstructor.h:

(JSC::SymbolConstructor::create): Deleted.
(JSC::SymbolConstructor::createStructure): Deleted.

runtime/SymbolObject.h:

(JSC::SymbolObject::create): Deleted.
(JSC::SymbolObject::internalValue const): Deleted.
(JSC::SymbolObject::createStructure): Deleted.

runtime/SymbolPrototype.h:

(JSC::SymbolPrototype::create): Deleted.
(JSC::SymbolPrototype::createStructure): Deleted.

runtime/WeakMapConstructor.h:

(JSC::WeakMapConstructor::create): Deleted.
(JSC::WeakMapConstructor::createStructure): Deleted.

runtime/WeakMapPrototype.h:

(JSC::WeakMapPrototype::create): Deleted.
(JSC::WeakMapPrototype::createStructure): Deleted.
(JSC::WeakMapPrototype::WeakMapPrototype): Deleted.

runtime/WeakSetConstructor.h:

(JSC::WeakSetConstructor::create): Deleted.
(JSC::WeakSetConstructor::createStructure): Deleted.

runtime/WeakSetPrototype.h:

(JSC::WeakSetPrototype::create): Deleted.
(JSC::WeakSetPrototype::createStructure): Deleted.
(JSC::WeakSetPrototype::WeakSetPrototype): Deleted.

tools/JSDollarVM.h:

(JSC::JSDollarVM::createStructure): Deleted.
(JSC::JSDollarVM::create): Deleted.
(JSC::JSDollarVM::JSDollarVM): Deleted.

wasm/js/JSWebAssembly.h:
wasm/js/JSWebAssemblyCompileError.h:

(JSC::JSWebAssemblyCompileError::create): Deleted.

wasm/js/JSWebAssemblyInstance.h:

(JSC::JSWebAssemblyInstance::instance): Deleted.
(JSC::JSWebAssemblyInstance::moduleNamespaceObject): Deleted.
(JSC::JSWebAssemblyInstance::webAssemblyToJSCallee): Deleted.
(JSC::JSWebAssemblyInstance::memory): Deleted.
(JSC::JSWebAssemblyInstance::setMemory): Deleted.
(JSC::JSWebAssemblyInstance::memoryMode): Deleted.
(JSC::JSWebAssemblyInstance::table): Deleted.
(JSC::JSWebAssemblyInstance::setTable): Deleted.
(JSC::JSWebAssemblyInstance::offsetOfPoisonedInstance): Deleted.
(JSC::JSWebAssemblyInstance::offsetOfPoisonedCallee): Deleted.
(JSC::JSWebAssemblyInstance::module const): Deleted.

wasm/js/JSWebAssemblyLinkError.h:

(JSC::JSWebAssemblyLinkError::create): Deleted.

wasm/js/JSWebAssemblyMemory.h:

(JSC::JSWebAssemblyMemory::subspaceFor): Deleted.
(JSC::JSWebAssemblyMemory::memory): Deleted.

wasm/js/JSWebAssemblyModule.h:
wasm/js/JSWebAssemblyRuntimeError.h:

(JSC::JSWebAssemblyRuntimeError::create): Deleted.

wasm/js/JSWebAssemblyTable.h:

(JSC::JSWebAssemblyTable::isValidLength): Deleted.
(JSC::JSWebAssemblyTable::maximum const): Deleted.
(JSC::JSWebAssemblyTable::length const): Deleted.
(JSC::JSWebAssemblyTable::allocatedLength const): Deleted.
(JSC::JSWebAssemblyTable::table): Deleted.

wasm/js/WebAssemblyCompileErrorConstructor.h:
wasm/js/WebAssemblyCompileErrorPrototype.h:
wasm/js/WebAssemblyInstanceConstructor.h:
wasm/js/WebAssemblyInstancePrototype.h:
wasm/js/WebAssemblyLinkErrorConstructor.h:
wasm/js/WebAssemblyLinkErrorPrototype.h:
wasm/js/WebAssemblyMemoryConstructor.h:
wasm/js/WebAssemblyMemoryPrototype.h:
wasm/js/WebAssemblyModuleConstructor.h:
wasm/js/WebAssemblyModulePrototype.h:
wasm/js/WebAssemblyModuleRecord.h:
wasm/js/WebAssemblyPrototype.h:
wasm/js/WebAssemblyRuntimeErrorConstructor.h:
wasm/js/WebAssemblyRuntimeErrorPrototype.h:
wasm/js/WebAssemblyTableConstructor.h:
wasm/js/WebAssemblyTablePrototype.h:

9:11 AM Changeset in webkit [229412] by fpizlo@apple.com

6 edits in trunk/Source

Make it possible to randomize register allocation
https://bugs.webkit.org/show_bug.cgi?id=183416

Reviewed by Keith Miller.
Source/JavaScriptCore:

This is disabled by default for now, because it reveals a regalloc bug in wasm.

b3/air/AirCode.cpp:

(JSC::B3::Air::Code::Code):

b3/air/AirCode.h:

(JSC::B3::Air::Code::weakRandom):

runtime/Options.h:

Source/WTF:

wtf/MathExtras.h:

(WTF::shuffleVector):

8:58 AM Changeset in webkit [229411] by fred.wang@free.fr

3 edits in trunk/LayoutTests

Add references to bug 160161 for some MathML failures on iOS and macOS.

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2018-03-08

platform/ios/TestExpectations:
platform/mac/TestExpectations:

8:06 AM Changeset in webkit [229410] by Yusuke Suzuki

86 edits in trunk/Source

[JSC] Add inherits<T>(VM&) leveraging JSCast fast path
https://bugs.webkit.org/show_bug.cgi?id=183429

Reviewed by Mark Lam.

Source/JavaScriptCore:

Add new member function, JSCell::inherits<T>(VM&) and JSValue::inherits<T>(VM&).
They depends on jsDynamicCast<T> implementation and leverage JSType-based fast
paths defined in JSCast.h. We extract checking part as JSCastingHelpers::inherit
and construct jsDynamicCast and JSCell::inherits based on this.

And we remove several unnecessary casting functions (asRegExpObject, asDateInstance etc.).
In addition, we add jsDynamicCast fast path for RegExpObject by using existing RegExpObjectType.

We also fix the implementation of jsDynamicCast for JSObject since it uses LastJSCObjectType.
The embedder can add their extended object types after that.

API/JSObjectRef.cpp:

(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):

API/JSValue.mm:

(isDate):
(isArray):

API/JSValueRef.cpp:

(JSValueIsArray):
(JSValueIsDate):
(JSValueIsObjectOfClass):

API/JSWeakObjectMapRefPrivate.cpp:
API/JSWrapperMap.mm:

(tryUnwrapObjcObject):

API/ObjCCallbackFunction.mm:

(tryUnwrapConstructor):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGOperations.cpp:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):

ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::subtype):
(Inspector::JSInjectedScriptHost::functionDetails):

inspector/agents/InspectorHeapAgent.cpp:

(Inspector::InspectorHeapAgent::getPreview):

interpreter/Interpreter.cpp:

(JSC::notifyDebuggerOfUnwinding):

interpreter/ShadowChicken.cpp:

(JSC::ShadowChicken::update):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JITOperations.cpp:

(JSC::operationNewFunctionCommon):

jsc.cpp:

(checkException):

runtime/BooleanObject.h:

(JSC::asBooleanObject): Deleted.

runtime/BooleanPrototype.cpp:

(JSC::booleanProtoFuncToString):
(JSC::booleanProtoFuncValueOf):

runtime/DateConstructor.cpp:

(JSC::constructDate):

runtime/DateInstance.h:

(JSC::asDateInstance): Deleted.

runtime/DatePrototype.cpp:

(JSC::formateDateInstance):
(JSC::dateProtoFuncToISOString):
(JSC::dateProtoFuncToLocaleString):
(JSC::dateProtoFuncToLocaleDateString):
(JSC::dateProtoFuncToLocaleTimeString):
(JSC::dateProtoFuncGetTime):
(JSC::dateProtoFuncGetFullYear):
(JSC::dateProtoFuncGetUTCFullYear):
(JSC::dateProtoFuncGetMonth):
(JSC::dateProtoFuncGetUTCMonth):
(JSC::dateProtoFuncGetDate):
(JSC::dateProtoFuncGetUTCDate):
(JSC::dateProtoFuncGetDay):
(JSC::dateProtoFuncGetUTCDay):
(JSC::dateProtoFuncGetHours):
(JSC::dateProtoFuncGetUTCHours):
(JSC::dateProtoFuncGetMinutes):
(JSC::dateProtoFuncGetUTCMinutes):
(JSC::dateProtoFuncGetSeconds):
(JSC::dateProtoFuncGetUTCSeconds):
(JSC::dateProtoFuncGetMilliSeconds):
(JSC::dateProtoFuncGetUTCMilliseconds):
(JSC::dateProtoFuncGetTimezoneOffset):
(JSC::dateProtoFuncSetTime):
(JSC::setNewValueFromTimeArgs):
(JSC::setNewValueFromDateArgs):
(JSC::dateProtoFuncSetYear):
(JSC::dateProtoFuncGetYear):

runtime/ExceptionHelpers.cpp:

(JSC::isTerminatedExecutionException):

runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

runtime/InternalFunction.h:

(JSC::asInternalFunction):

runtime/JSArray.h:

(JSC::asArray):

runtime/JSCJSValue.cpp:

(JSC::JSValue::dumpForBacktrace const):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::inherits const):

runtime/JSCast.h:

(JSC::JSCastingHelpers::inheritsGenericImpl):
(JSC::JSCastingHelpers::inheritsJSTypeImpl):
(JSC::JSCastingHelpers::InheritsTraits::inherits):
(JSC::JSCastingHelpers::inherits):
(JSC::jsDynamicCast):
(JSC::JSCastingHelpers::jsDynamicCastGenericImpl): Deleted.
(JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl): Deleted.
(JSC::JSCastingHelpers::JSDynamicCastTraits::cast): Deleted.

runtime/JSCell.h:
runtime/JSCellInlines.h:

(JSC::JSCell::inherits const):

runtime/JSFunction.cpp:

(JSC::RetrieveCallerFunctionFunctor::operator() const):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::getOwnNonIndexPropertyNames):
(JSC::JSFunction::reifyLazyBoundNameIfNeeded):

runtime/JSGlobalObject.cpp:

(JSC::enqueueJob):

runtime/JSGlobalObject.h:

(JSC::asGlobalObject): Deleted.

runtime/JSInternalPromiseDeferred.cpp:

(JSC::JSInternalPromiseDeferred::create):

runtime/JSLexicalEnvironment.h:

(JSC::asActivation):

runtime/JSONObject.cpp:

(JSC::unwrapBoxedPrimitive):
(JSC::Stringifier::Stringifier):
(JSC::Walker::walk):

runtime/JSPromise.cpp:

(JSC::JSPromise::resolve):

runtime/JSPromiseDeferred.cpp:

(JSC::JSPromiseDeferred::create):

runtime/JSType.h:
runtime/ProxyObject.h:

(JSC::ProxyObject::create): Deleted.
(JSC::ProxyObject::createStructure): Deleted.
(JSC::ProxyObject::target const): Deleted.
(JSC::ProxyObject::handler const): Deleted.

runtime/RegExpConstructor.cpp:

(JSC::constructRegExp):

runtime/RegExpConstructor.h:

(JSC::asRegExpConstructor):
(JSC::isRegExp):

runtime/RegExpObject.cpp:

(JSC::RegExpObject::finishCreation):
(JSC::RegExpObject::getOwnPropertySlot):
(JSC::RegExpObject::defineOwnProperty):
(JSC::regExpObjectSetLastIndexStrict):
(JSC::regExpObjectSetLastIndexNonStrict):
(JSC::RegExpObject::put):

runtime/RegExpObject.h:

(JSC::RegExpObject::create): Deleted.
(JSC::RegExpObject::setRegExp): Deleted.
(JSC::RegExpObject::regExp const): Deleted.
(JSC::RegExpObject::setLastIndex): Deleted.
(JSC::RegExpObject::getLastIndex const): Deleted.
(JSC::RegExpObject::test): Deleted.
(JSC::RegExpObject::testInline): Deleted.
(JSC::RegExpObject::createStructure): Deleted.
(JSC::RegExpObject::offsetOfRegExp): Deleted.
(JSC::RegExpObject::offsetOfLastIndex): Deleted.
(JSC::RegExpObject::offsetOfLastIndexIsWritable): Deleted.
(JSC::RegExpObject::allocationSize): Deleted.
(JSC::asRegExpObject): Deleted.

runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncTestFast):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncMatchFast):
(JSC::regExpProtoFuncCompile):
(JSC::regExpProtoGetterGlobal):
(JSC::regExpProtoGetterIgnoreCase):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterDotAll):
(JSC::regExpProtoGetterSticky):
(JSC::regExpProtoGetterUnicode):
(JSC::regExpProtoGetterSource):
(JSC::regExpProtoFuncSearchFast):
(JSC::regExpProtoFuncSplitFast):

runtime/StringObject.h:

(JSC::asStringObject): Deleted.

runtime/StringPrototype.cpp:

(JSC::replaceUsingRegExpSearch):
(JSC::replace):
(JSC::stringProtoFuncReplaceUsingRegExp):
(JSC::stringProtoFuncToString):

runtime/SymbolPrototype.cpp:

(JSC::symbolProtoFuncToString):
(JSC::symbolProtoFuncValueOf):

tools/JSDollarVM.cpp:

(WTF::customGetValue):
(WTF::customSetValue):

wasm/js/JSWebAssemblyHelpers.h:

(JSC::isWebAssemblyHostFunction):

wasm/js/WebAssemblyWrapperFunction.cpp:

(JSC::WebAssemblyWrapperFunction::create):

Source/WebCore:

bindings/js/IDBBindingUtilities.cpp:

(WebCore::createIDBKeyFromValue):

bindings/js/JSDOMConvertDate.cpp:

(WebCore::valueToDate):

bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::scriptExecutionContext const):

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::toWrapped):

bindings/js/JSEventTargetCustom.cpp:
bindings/js/JSNodeCustom.cpp:

(WebCore::JSNode::pushEventHandlerScope const):

bindings/js/JSXPathNSResolverCustom.cpp:

(WebCore::JSXPathNSResolver::toWrapped):

bindings/js/ScriptState.cpp:

(WebCore::domWindowFromExecState):
(WebCore::scriptExecutionContextFromExecState):

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::isArray):
(WebCore::CloneSerializer::isMap):
(WebCore::CloneSerializer::isSet):
(WebCore::CloneSerializer::dumpArrayBufferView):
(WebCore::CloneSerializer::dumpDOMPoint):
(WebCore::CloneSerializer::dumpDOMRect):
(WebCore::CloneSerializer::dumpDOMMatrix):
(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneDeserializer::CloneDeserializer):
(WebCore::CloneDeserializer::readArrayBufferView):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateOverloadDispatcher):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionOverloadedMethodOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameterOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnionOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnionsOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithNonDistinguishingUnionOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadWithNullableUnionOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionOverloadWithNullableNonDistinguishingParameterOverloadDispatcher):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunctionOverloadDispatcher):

bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::JSTestOverloadedConstructorsConstructor::construct):

bridge/c/c_instance.cpp:

(JSC::Bindings::CInstance::invokeMethod):

bridge/objc/WebScriptObject.mm:

(+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):

bridge/objc/objc_instance.mm:

(ObjcInstance::invokeMethod):

bridge/objc/objc_runtime.mm:

(JSC::Bindings::callObjCFallbackObject):

bridge/runtime_method.cpp:

(JSC::callRuntimeMethod):

bridge/runtime_object.cpp:

(JSC::Bindings::callRuntimeObject):
(JSC::Bindings::callRuntimeConstructor):

inspector/WebInjectedScriptHost.cpp:

(WebCore::WebInjectedScriptHost::subtype):
(WebCore::WebInjectedScriptHost::isHTMLAllCollection):

Source/WebKit:

WebProcess/Plugins/Netscape/JSNPMethod.cpp:

(WebKit::callMethod):

WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::callNPJSObject):
(WebKit::constructWithConstructor):

WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::create):

WebProcess/WebPage/WebFrame.cpp:

(WebKit::WebFrame::counterValue):

Source/WebKitLegacy/mac:

DOM/DOM.mm:

(+[DOMNode _nodeFromJSWrapper:]):

Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::retainLocalObject):
(WebKit::NetscapePluginInstanceProxy::releaseLocalObject):

Plugins/Hosted/ProxyInstance.mm:

(WebKit::ProxyInstance::invokeMethod):

WebView/WebView.mm:

(aeDescFromJSValue):

Source/WebKitLegacy/win:

WebFrame.cpp:

(WebFrame::stringByEvaluatingJavaScriptInScriptWorld):

7:47 AM Changeset in webkit [229409] by Yusuke Suzuki

2 edits in trunk/Source/WTF

[Win] Use debugbreak for WTFBreakpointTrap
https://bugs.webkit.org/show_bug.cgi?id=183450

Reviewed by Mark Lam.

This patch adds WTFBreakpointTrap() implementation for MSVC by using
debugbreak. It fixes build failure in Windows due to the use of
WTFBreakpointTrap().

wtf/Assertions.h:

7:06 AM Changeset in webkit [229408] by Ms2ger@igalia.com

2 edits in trunk/WebDriverTests

[GTK] Skip imported/w3c/webdriver/tests/interaction/element_clear.py::test_closed_context
https://bugs.webkit.org/show_bug.cgi?id=183452

Unreviewed test gardening.

TestExpectations.json:

5:04 AM Changeset in webkit [229407] by zandobersek@gmail.com

2 edits in trunk/Source/WebKit

Remove WebCore::TextureMapperAnimation as a special case in WebKit IPC
generation. Values of this type aren't being transferred across IPC.

Rubber-stamped by Carlos Garcia Campos.

Scripts/webkit/messages.py:

5:00 AM Changeset in webkit [229406] by zandobersek@gmail.com

2 edits in trunk/Source/WTF

[GLib] RunLoop::wakeUp(): use a zero value instead of the monotonic time
https://bugs.webkit.org/show_bug.cgi?id=183447

Reviewed by Carlos Garcia Campos.

wtf/glib/RunLoopGLib.cpp:

(WTF::RunLoop::wakeUp): Micro-optimize the wake-up schedule by using
a zero value as the GSource ready time, instead of retrieving and using
the current monotonic time.

4:43 AM Changeset in webkit [229405] by commit-queue@webkit.org

2 edits in trunk/LayoutTests

[iOS] Unskip MathML tests requiring a font with Mathematical Alphanumeric Symbols
https://bugs.webkit.org/show_bug.cgi?id=183445

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2018-03-08

platform/ios/TestExpectations: Unskip the tests.

2:58 AM Changeset in webkit [229404] by Antti Koivisto

2 edits in trunk/PerformanceTests

Update StyleBench version number in page title to 0.3

StyleBench/index.html:

There has been a bunch of changes, most notably the addition of attribute selector test step.

2:51 AM Changeset in webkit [229403] by fred.wang@free.fr

7 edits in trunk/LayoutTests

[iOS] Update PNG expectations for some MathML pixel tests.

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2018-03-08

platform/ios/TestExpectations: Remove ImageOnlyFailure for pixel tests, add reference to

bug 183441 for the reftest.

platform/ios/mathml/opentype/opentype-stretchy-expected.png: Update expectation.
platform/ios/mathml/presentation/menclose-notation-values-expected.png: Ditto.
platform/ios/mathml/presentation/mo-stretch-expected.png: Ditto.
platform/ios/mathml/presentation/roots-expected.png: Ditto.
platform/ios/mathml/radical-fallback-expected.png: Ditto.

2:31 AM Changeset in webkit [229402] by Ms2ger@igalia.com

2 edits in trunk/Tools

[WPE] Update expectations for API tests
https://bugs.webkit.org/show_bug.cgi?id=183434

Unreviewed test gardening.

TestWebKitAPI/glib/TestExpectations.json:

1:18 AM Changeset in webkit [229401] by timothy_horton@apple.com

2 edits in trunk/Source/WTF

Don't have Celestial in minimal simulator configuration
https://bugs.webkit.org/show_bug.cgi?id=183432
<rdar://problem/38252985>

Reviewed by Dan Bernstein.

wtf/Platform.h:

12:28 AM Changeset in webkit [229400] by timothy_horton@apple.com

28 edits in trunk/Source

Stop linking ApplicationServices directly
https://bugs.webkit.org/show_bug.cgi?id=182867
<rdar://problem/38252142>

Reviewed by Alex Christensen.

The frameworks that we use that live inside ApplicationServices
have mostly moved out, so import them directly.

Source/WebCore:

Configurations/WebCore.xcconfig:
html/canvas/CanvasRenderingContext2D.cpp:
html/canvas/CanvasRenderingContext2DBase.cpp:
platform/MIMETypeRegistry.cpp:
platform/graphics/ComplexTextController.cpp:
platform/graphics/cg/ColorCG.cpp:
platform/graphics/cg/ImageDecoderCG.cpp:
platform/graphics/cg/UTIRegistry.cpp:
platform/graphics/cocoa/FontCocoa.mm:
platform/graphics/mac/ComplexTextControllerCoreText.mm:
platform/graphics/mac/GlyphPageMac.cpp:
platform/graphics/mac/PDFDocumentImageMac.mm:
platform/graphics/mac/SimpleFontDataCoreText.cpp:
platform/graphics/win/FontCGWin.cpp:
platform/graphics/win/FontCacheWin.cpp:
platform/graphics/win/FontCustomPlatformData.cpp:
platform/graphics/win/FontPlatformDataCGWin.cpp:
platform/graphics/win/ImageCGWin.cpp:
platform/graphics/win/SimpleFontDataCGWin.cpp:

Source/WebKit:

Configurations/WebKit.xcconfig:

Source/WebKitLegacy/mac:

Carbon/CarbonUtils.h:
WebKitPrefix.h:
WebView/WebHTMLView.mm:
WebView/WebPDFView.mm:

Source/WebKitLegacy/win:

FullscreenVideoController.cpp:

12:16 AM Changeset in webkit [229399] by Wenson Hsieh

2 edits in trunk/Source/WebKit

[Extra zoom mode] Specify password mode as needed when inputting text
https://bugs.webkit.org/show_bug.cgi?id=183428
<rdar://problem/37609386>

Reviewed by Tim Horton.

If the focused element is a password field, or the input delegate has forced secure text entry, set a flag on
the text input view controller to opt in to password text input mode.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView presentTextInputViewController:]):

Mar 7, 2018:

11:14 PM Changeset in webkit [229398] by timothy_horton@apple.com

11 edits in trunk

Sort and separate FeatureDefines.xcconfig
https://bugs.webkit.org/show_bug.cgi?id=183427

Reviewed by Dan Bernstein.

Configurations/FeatureDefines.xcconfig:

Sort and split FeatureDefines into paragraphs
(to make it easier to sort later).

10:44 PM Changeset in webkit [229397] by Yusuke Suzuki

5 edits in trunk/Source/WTF

[WTF] Set canInitializeWithMemset = true if T is an integral type
https://bugs.webkit.org/show_bug.cgi?id=183357

Reviewed by Darin Adler.

This patch set canInitializeWithMemset = true if T is an integral type.
This can offer a chance to use memset if we use UniqueArray<T> where T is
an integral type. We also rename VectorTypeOperations::initialize to
VectorTypeOperations::initializeIfNonPOD, VectorTypeOperations::forceInitialize
to VectorTypeOperations::initialize respectively.

wtf/RefCountedArray.h:

(WTF::RefCountedArray::RefCountedArray):

wtf/UniqueArray.h:
wtf/Vector.h:

(WTF::VectorTypeOperations::initializeIfNonPOD):
(WTF::VectorTypeOperations::initialize):
(WTF::Vector::Vector):
(WTF::Malloc>::resize):
(WTF::Malloc>::grow):
(WTF::VectorTypeOperations::forceInitialize): Deleted.

wtf/VectorTraits.h:

10:37 PM Changeset in webkit [229396] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit

REGRESSION(r218089): [GTK] webkit_web_view_get_inspector() needs to be called, otherwise inspector does not close
https://bugs.webkit.org/show_bug.cgi?id=181126

Reviewed by Carlos Alberto Lopez Perez.

Fix the condition to decide whether to detach the inspector view ourselves.

UIProcess/gtk/WebInspectorProxyGtk.cpp:

(WebKit::WebInspectorProxy::platformDetach): Remove the inspector view from its parent if we don't have a client
or the client didn't detach it.

10:34 PM Changeset in webkit [229395] by Carlos Garcia Campos

17 edits in trunk

[GTK][WPE] Leak checker is not working in WebKitGLib web process tests
https://bugs.webkit.org/show_bug.cgi?id=183404

Reviewed by Michael Catanzaro.

Source/WebKit:

Add private helper for testing to do a garbage collection when the page is closing.

WebProcess/InjectedBundle/API/glib/WebKitWebExtension.cpp:

(webkitWebExtensionSetGarbageCollectOnPageDestroy):

WebProcess/InjectedBundle/API/glib/WebKitWebExtensionPrivate.h:
WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRectList.h: Fix annotation of

webkit_dom_client_rect_list_item(), it should be transfer full.

Tools:

This might have regressed when we started to use the JSC garbage collector timers. The thing is that we expect
that the WebProcessTester object that we expose to JavaScript is released when the web frame is destroyed, but
that's no longer the case. On window object cleared a GC is scheduled, but JSC timers do the actual garbage
collection later. In the case of tests that never happens because the web process finishes quickly after the
test. We need to force a garbage collection at some point when the web page is destroyed. We can't use the
WebKitWebPage destroy signal, since we are also checking that WebKitWebPage isn't leaked. The
API::InjectedBundle::Client::willDestroyPage() always happen when the page is closed, even if WebKitWebPage is
still alive, so we can force the GC at that point. The only problem is that the frame is detached right after
that point, so we can't check WebKitFrame leaks. The only frame in the tests is the main one, so we can assume
that if WebKitWebPage is released, the frame is too.

TestWebKitAPI/Tests/WebKitGLib/FrameTest.cpp:

(WebKitFrameTest::testMainFrame): Stop checking we don't leak WebKitFrame.
(WebKitFrameTest::testURI): Ditto.
(WebKitFrameTest::testJavaScriptContext): Ditto.

TestWebKitAPI/Tests/WebKitGLib/TestFrame.cpp:

(testWebKitFrameMainFrame): Use new WebViewTest::runWebProcessTest() API.
(testWebKitFrameURI): Ditto.
(testWebKitFrameJavaScriptContext): Ditto.
(webkitFrameTestRun): Deleted.

TestWebKitAPI/Tests/WebKitGLib/WebProcessTest.cpp:

(runTest): We no longer need the special case for dom-cache test.
(windowObjectClearedCallback): Only expose test runner object to JavaScript when loading tests.
(webkit_web_extension_initialize): Call webkitWebExtensionSetGarbageCollectOnPageDestroy() to ensure a garbage
collection is performed when the page is closing.

TestWebKitAPI/Tests/WebKitGtk/DOMClientRectTest.cpp:

(WebKitDOMClientRectTest::testDivClientRectsPositionAndLength): Fix memory leak,
webkit_dom_client_rect_list_item() returns a full reference.

TestWebKitAPI/Tests/WebKitGtk/TestAutocleanups.cpp:

(testWebProcessAutocleanups):Use new WebViewTest::runWebProcessTest() API.

TestWebKitAPI/Tests/WebKitGtk/TestDOMClientRect.cpp:

(testWebKitDOMClientRectDivBoundingClientRectPosition): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMClientRectDivClientRectsPositionAndLength): Use new WebViewTest::runWebProcessTest() API.
(prepareDOMForClientRectPositionTests): Deleted.

TestWebKitAPI/Tests/WebKitGtk/TestDOMNode.cpp:

(testWebKitDOMNodeHierarchyNavigation): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMNodeInsertion): Ditto.
(testWebKitDOMNodeTagNamesNodeList): Ditto.
(testWebKitDOMNodeTagNamesHTMLCollection): Ditto.
(testWebKitDOMObjectCache): We no longer need to run the test several times, since runWebProcessTest() loads
about blank after every test.
(prepareDOMForTagNamesTests): Deleted.

TestWebKitAPI/Tests/WebKitGtk/TestDOMNodeFilter.cpp:

(testWebKitDOMNodeFilterTreeWalker): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMNodeFilterNodeIterator): Ditto.
(runTest): Deleted.

TestWebKitAPI/Tests/WebKitGtk/TestDOMXPathNSResolver.cpp:

(testWebKitDOMXPathNSResolverNative): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMXPathNSResolverCustom): Ditto.

TestWebKitAPI/Tests/WebKitGtk/TestEditor.cpp:

(testWebKitWebEditorSelectionChanged): Use new WebViewTest::runWebProcessTest() API.

TestWebKitAPI/glib/WebKitGLib/WebViewTest.cpp:

(WebViewTest::runWebProcessTest): It now receives the contents, so it automatically loads the view using
"webprocess://test" as base URI, used to detect tests in the web process. It also loads about:blank after every
test to ensure that window object is cleared.

TestWebKitAPI/glib/WebKitGLib/WebViewTest.h:

8:18 PM Changeset in webkit [229394] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix 32-bit build.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

7:51 PM Changeset in webkit [229393] by Alan Bujtas

3 edits
4 adds in trunk

Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange()
https://bugs.webkit.org/show_bug.cgi?id=183385
<rdar://problem/38085397>

Reviewed by Antti Koivisto.

Source/WebCore:

When HTMLInputElement::updateType() is called with a dirty value, we eagerly change the m_inputType first
and then we take care of the dirty value by calling setAttributeWithoutSynchronization().
With a DOMSubtreeModified event listener attached, setAttributeWithoutSynchronization() can end up running some
layout code (offsetHeight) with a renderer - m_inputType mismatch.

This patch ensures that we don't change the m_inputType until after we finished setting the new value.

Test: fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::updateType):

LayoutTests:

fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Added.
fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html: Added.

7:31 PM Changeset in webkit [229392] by Chris Dumez

5 edits in trunk/Source/WebCore

Get rid of custom bindings for History's replaceState() / pushState()
https://bugs.webkit.org/show_bug.cgi?id=183372

Reviewed by Youenn Fablet.

Get rid of custom bindings for History's replaceState() / pushState() by
moving the cached state from the wrapper to the History implementation
object.

No new tests, no web-facing behavior change.

bindings/js/JSHistoryCustom.cpp:

(WebCore::JSHistory::state const):
(WebCore::JSHistory::visitAdditionalChildren):

page/History.cpp:

(WebCore::History::cachedState):
(WebCore::History::stateObjectAdded):

page/History.h:

(WebCore::History::pushState):
(WebCore::History::replaceState):

page/History.idl:

6:26 PM Changeset in webkit [229391] by keith_miller@apple.com

48 edits
1 add in trunk/Source

Meta-program setupArguments and callOperation
https://bugs.webkit.org/show_bug.cgi?id=183263

Rubber-stamped by Filip Pizlo.

Source/JavaScriptCore:

This patch removes all the custom overrides of callOperation and setupArguments
throughout the JITs. In their place there is a new setupArguments that marshalls
the arguments into place based on the type of the operation's function pointer.
There were a couple of design choices in the implementation of setupArguments:

1) We assume that no TrustedImm floating point values are passed.
2) If ExecState* is the first argument the callFrameRegister should be marshalled implicitly.
3) Types should not be implicitly converted (with the exception of DFG::RegisteredStructure -> Structure*)

The new callOperation/setupArguments do their best to make sure
it's hard to call a function with the wrong parameters. They will
only try to pattern match if the types match up with the next
passed argument. Additionally, the base case should static_assert
of the number of inferred arguments does not match the arity of
the operation's function pointer.

assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
(JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):

assembler/MacroAssembler.h:

(JSC::MacroAssembler::poke):
(JSC::MacroAssembler::move):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::swap):

assembler/MacroAssemblerX86.h:

(JSC::MacroAssemblerX86::storeDouble):

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::loadDouble):
(JSC::MacroAssemblerX86Common::swap):
(JSC::MacroAssemblerX86Common::move):

bytecode/AccessCase.cpp:

(JSC::AccessCase::generateImpl):

bytecode/AccessCaseSnippetParams.cpp:

(JSC::SlowPathCallGeneratorWithArguments::generateImpl):

bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::emitExplicitExceptionHandler):

dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
dfg/DFGNode.h:
dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::emitRestoreArguments):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::osrWriteBarrier):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSlowPathGenerator.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp):
(JSC::DFG::SpeculativeJIT::compileArithMod):
(JSC::DFG::SpeculativeJIT::compileArithRounding):
(JSC::DFG::SpeculativeJIT::compileArithSqrt):
(JSC::DFG::SpeculativeJIT::compileCreateActivation):
(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::operator MacroAssembler::TrustedImm const):
(JSC::DFG::SpeculativeJIT::initConstantInfo):
(JSC::DFG::SpeculativeJIT::callOperation):
(JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
(JSC::DFG::SpeculativeJIT::callCustomGetter): Deleted.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileCallEval):

ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

ftl/FTLSlowPathCall.h:

(JSC::FTL::callOperation):

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):

jit/CCallHelpers.cpp:

(JSC::CCallHelpers::ensureShadowChickenPacket):

jit/CCallHelpers.h:

(JSC::CCallHelpers::setupArgument):
(JSC::CCallHelpers::setupStubArgs):
(JSC::CCallHelpers::ArgCollection::ArgCollection):
(JSC::CCallHelpers::ArgCollection::pushRegArg):
(JSC::CCallHelpers::ArgCollection::addGPRArg):
(JSC::CCallHelpers::ArgCollection::addStackArg):
(JSC::CCallHelpers::ArgCollection::addPoke):
(JSC::CCallHelpers::ArgCollection::argCount):
(JSC::CCallHelpers::clampArrayToSize):
(JSC::CCallHelpers::pokeForArgument):
(JSC::CCallHelpers::marshallArgumentRegister):
(JSC::CCallHelpers::setupArgumentsImpl):
(JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
(JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
(JSC::CCallHelpers::setupArguments):
(JSC::CCallHelpers::prepareForTailCallSlow):
(JSC::CCallHelpers::setupArgumentsWithExecState): Deleted.
(JSC::CCallHelpers::resetCallArguments): Deleted.
(JSC::CCallHelpers::addCallArgument): Deleted.
(JSC::CCallHelpers::setupArgumentsExecState): Deleted.
(JSC::CCallHelpers::setupTwoStubArgsGPR): Deleted.
(JSC::CCallHelpers::setupThreeStubArgsGPR): Deleted.
(JSC::CCallHelpers::setupFourStubArgsGPR): Deleted.
(JSC::CCallHelpers::setupFiveStubArgsGPR): Deleted.
(JSC::CCallHelpers::setupTwoStubArgsFPR): Deleted.
(JSC::CCallHelpers::setupStubArguments): Deleted.
(JSC::CCallHelpers::setupArgumentsWithExecStateForCallWithSlowPathReturnType): Deleted.
(JSC::CCallHelpers::setupStubArguments134): Deleted.
(JSC::CCallHelpers::setupStubArgsGPR): Deleted.

jit/FPRInfo.h:

(JSC::toInfoFromReg):

jit/GPRInfo.h:

(JSC::JSValueRegs::JSValueRegs):
(JSC::toInfoFromReg):

jit/JIT.h:

(JSC::JIT::callOperation):
(JSC::JIT::callOperationWithProfile):
(JSC::JIT::callOperationWithResult):
(JSC::JIT::callOperationNoExceptionCheck):
(JSC::JIT::callOperationWithCallFrameRollbackOnException):

jit/JITArithmetic.cpp:

(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):

jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_compareAndJumpSlow):

jit/JITCall32_64.cpp:

(JSC::JIT::compileSetupVarargsFrame):

jit/JITInlines.h:

(JSC::JIT::callOperation): Deleted.
(JSC::JIT::callOperationNoExceptionCheck): Deleted.
(JSC::JIT::callOperationWithCallFrameRollbackOnException): Deleted.

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_new_array_with_size):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emitSlow_op_has_indexed_property):

jit/JITOperations.cpp:
jit/JITOperations.h:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_from_scope):

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_by_index):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emitSlow_op_get_from_scope):

jit/RegisterSet.h:

(JSC::RegisterSet::RegisterSet):

jit/ThunkGenerators.cpp:

(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::slowPathFor):

jsc.cpp:

(GlobalObject::finishCreation):
(functionBreakpoint):

runtime/JSCJSValue.h:
wasm/js/WasmToJS.cpp:

(JSC::Wasm::wasmToJS):

Source/WTF:

Add a new function traits struct that provides interesting
information about the provided function pointer. Right now it only
provides information for function pointers, in theory we could
also get it to work for other types.

WTF.xcodeproj/project.pbxproj:
wtf/Bitmap.h:

(WTF::WordType>::Bitmap):

wtf/CMakeLists.txt:
wtf/FunctionTraits.h: Added.

(WTF::slotsForCCallArgument):
(WTF::computeCCallSlots):
(WTF::FunctionTraits<Result):

6:06 PM Changeset in webkit [229390] by youenn@apple.com

29 edits in trunk

Match unsupported plugins based on domains and not origin
https://bugs.webkit.org/show_bug.cgi?id=183384

Reviewed by Chris Dumez.

Source/WebCore:

Move from an origin-keyed map to a vector of plugins.
We iterate through the vector and a match happens if the page host name ends with the provided matching domain.
This allows supporting rules for *.mydomain.com by passing 'mydomain.com'.
Covered by existing tests.
We are not testing subdomains like www.localhost since there is no support in our CI but this is tested through Unit tests.

loader/EmptyClients.cpp:
platform/URL.cpp:

(WebCore::URL::isMatchingDomain const):

platform/URL.h:
plugins/PluginData.h:

(WebCore::isSupportedPlugin):
(WebCore::SupportedPluginName::decode):
(WebCore::SupportedPluginName::encode const):

plugins/PluginInfoProvider.h:

Source/WebKit:

Moved from a HashMap of plugins to a Vector of plugins since we cannot match exactly based on the origin.

Scripts/webkit/messages.py:
UIProcess/API/C/WKContext.cpp:

(WKContextAddSupportedPlugin):

UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _addSupportedPlugin:named:withMimeTypes:withExtensions:]):

UIProcess/Plugins/PluginInfoStore.cpp:

(WebKit::PluginInfoStore::isSupportedPlugin):
(WebKit::PluginInfoStore::supportedPluginNames):
(WebKit::PluginInfoStore::addSupportedPlugin):

UIProcess/Plugins/PluginInfoStore.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::addSupportedPlugin):

UIProcess/WebProcessPool.h:
UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::getPlugins):

UIProcess/WebProcessProxy.h:
UIProcess/WebProcessProxy.messages.in:
WebProcess/Plugins/WebPluginInfoProvider.cpp:

(WebKit::WebPluginInfoProvider::getPluginInfo):
(WebKit::WebPluginInfoProvider::getWebVisiblePluginInfo):

WebProcess/Plugins/WebPluginInfoProvider.h:

Source/WebKitLegacy/mac:

WebCoreSupport/WebPluginInfoProvider.h:
WebCoreSupport/WebPluginInfoProvider.mm:

(WebPluginInfoProvider::getPluginInfo):
(WebPluginInfoProvider::getWebVisiblePluginInfo):

Tools:

TestWebKitAPI/Tests/WebCore/URL.cpp:

(TestWebKitAPI::TEST_F):

WebKitTestRunner/TestController.cpp:

(WTR::TestController::setPluginSupportedMode): Update to whitelist
localhost and not http://localhost:8080

5:33 PM Changeset in webkit [229389] by youenn@apple.com

1 edit
102 deletes in trunk/Source/ThirdParty/libwebrtc

Update to libwebrtc revision 4e70a72571dd26b85c2385e9c618e343428df5d3
https://bugs.webkit.org/show_bug.cgi?id=180843

Unreviewed.
Removed empty unused files.

5:26 PM Changeset in webkit [229388] by Kocsen Chung

1 copy in tags/Safari-606.1.8

Tag Safari-606.1.8.

5:15 PM Changeset in webkit [229387] by timothy_horton@apple.com

3 edits in trunk/Source/WTF

Shuffle around some feature flags for minimal simulator mode
https://bugs.webkit.org/show_bug.cgi?id=183419
<rdar://problem/37694987>

Reviewed by Beth Dakin.

wtf/FeatureDefines.h:
wtf/Platform.h:

4:39 PM Changeset in webkit [229386] by Brent Fulgham

2 edits in trunk/Source/WebKit

REGRESSION (r229093): Media playback on Facebook and Hulu require mDNSResponder access
https://bugs.webkit.org/show_bug.cgi?id=183421
<rdar://problem/38191574>

Reviewed by Dean Jackson.

CoreMedia fails to properly play back media on Facebook and Hulu if access to the
mDNSResponder is blocked by the sandbox. This Bug unblocks that access while we
investigate the underlying issue.

WebProcess/com.apple.WebProcess.sb.in:

4:32 PM Changeset in webkit [229385] by youenn@apple.com

1 edit
375 deletes in trunk/Source/ThirdParty/libwebrtc

Update to libwebrtc revision 4e70a72571dd26b85c2385e9c618e343428df5d3
https://bugs.webkit.org/show_bug.cgi?id=180843

Unreviewed.
Removed folder as it is now unused and is confusing mac internal bots.

Source/webrtc/base: Removed.

4:24 PM Changeset in webkit [229384] by dino@apple.com

2 edits in trunk/Source/WebKit/UIProcess

Better build fix for watchOS and tvOS.

UIProcess/Cocoa/SystemPreviewControllerCocoa.mm:
UIProcess/SystemPreviewController.cpp:

4:23 PM Changeset in webkit [229383] by Ryan Haddad

3 edits in trunk/LayoutTests

Update TestExpectations for media/modern-media-controls/fullscreen-support/fullscreen-support-press.html.
https://bugs.webkit.org/show_bug.cgi?id=173946

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:
platform/mac/TestExpectations:

4:18 PM Changeset in webkit [229382] by dino@apple.com

3 edits in trunk/Source/WebKit

Try to fix build for watchOS and tvOS.

UIProcess/Cocoa/SystemPreviewControllerCocoa.mm:
UIProcess/SystemPreviewController.cpp:

4:16 PM Changeset in webkit [229381] by Jonathan Bedard

2 edits in trunk/Tools

webkitpy: Allow apple_additions() to define additional ports
https://bugs.webkit.org/show_bug.cgi?id=183412
<rdar://problem/38232353>

Reviewed by Aakash Jain.

Scripts/webkitpy/port/factory.py:

(PortFactory.get): Allow apple_additions to define port classes to be used
in run-webkit-tests.

4:13 PM Changeset in webkit [229380] by Jonathan Bedard

2 edits in trunk/Tools

webkitpy: Remove obsolete function from MockAppleAdditions
https://bugs.webkit.org/show_bug.cgi?id=183415
<rdar://problem/38236407>

Reviewed by Aakash Jain.

Scripts/webkitpy/port/port_testcase.py:

(bind_mock_apple_additions.MockAppleAdditions):
(bind_mock_apple_additions.MockAppleAdditions.ios_os_name): Deleted.
(bind_mock_apple_additions.MockAppleAdditions.mac_os_name): Deleted.

4:07 PM Changeset in webkit [229379] by Jonathan Bedard

2 edits in trunk/Tools

webkitpy: --dedicated-simulators does not boot the correct number of simulators
https://bugs.webkit.org/show_bug.cgi?id=183409
<rdar://problem/38224631>

Reviewed by Aakash Jain.

Scripts/webkitpy/port/ios_simulator.py:

(IOSSimulatorPort.default_child_processes): When not using dedicated simulators,
we should use the number of booted simulators as our default child processes.

3:22 PM Changeset in webkit [229378] by youenn@apple.com

4558 edits
114 copies
2193 adds
2 deletes in trunk/Source

fix-180843

3:09 PM Changeset in webkit [229377] by webkit@devinrousso.com

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Canvas tab: ensure that the Recording TreeOutline has a specified height for virtualization
https://bugs.webkit.org/show_bug.cgi?id=183015

Reviewed by Matt Baker.

UserInterface/Views/CanvasSidebarPanel.js:

(WI.CanvasSidebarPanel):

UserInterface/Views/CanvasSidebarPanel.css:

(.sidebar > .panel.navigation.canvas > .content):
(.sidebar > .panel.navigation.canvas > .content > .navigation-bar):
(.sidebar > .panel.navigation.canvas.has-recordings > .content > .recording-content):
(.sidebar > .panel.navigation.canvas:not(.has-recordings) > .filter-bar,):
(.sidebar > .panel.navigation.canvas > .content > .recording-content > .navigation-bar): Deleted.
(.sidebar > .panel.navigation.canvas.has-recordings > .content > .tree-outline.canvas): Deleted.

UserInterface/Views/TreeElement.js:

(WI.TreeElement.prototype._detach):

2:37 PM Changeset in webkit [229376] by dino@apple.com

5 edits
3 adds in trunk/Source/WebKit

Add SystemPreviewController for showing system-level views of special file types
https://bugs.webkit.org/show_bug.cgi?id=183413
<rdar://problem/37800834>

Reviewed by Tim Horton.

Add a new controller class that hangs off WebPageProxy, with the goal
of providing system-level viewing of some some file types. Specifically
those that can't be shown by WebKit.

This is the initial implementation which is quite simple. The controller
can be queried about whether it supports a MIME type, then it can be
asked to show a URL.

UIProcess/Cocoa/SystemPreviewControllerCocoa.mm: Added.

(-[_WKPreviewControllerDataSource initWithURL:]):
(-[_WKPreviewControllerDataSource numberOfPreviewItemsInPreviewController:]):
(-[_WKPreviewControllerDataSource previewController:previewItemAtIndex:]):
(WebKit::SystemPreviewController::canPreview const):
(WebKit::SystemPreviewController::showPreview):

UIProcess/SystemPreviewController.cpp: Added.

(WebKit::SystemPreviewController::SystemPreviewController):
(WebKit::SystemPreviewController::canPreview const):
(WebKit::SystemPreviewController::showPreview):

UIProcess/SystemPreviewController.h: Added.
UIProcess/WebPageProxy.cpp:

(WebKit::m_configurationPreferenceValues):
(WebKit::WebPageProxy::reattachToWebProcess):
(WebKit::WebPageProxy::resetState):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::systemPreviewController):

WebKit.xcodeproj/project.pbxproj:

2:09 PM Changeset in webkit [229375] by commit-queue@webkit.org

4 edits
2 adds in trunk

replaceState cause back/forward malfunction on html page with <base href="/"> tag
https://bugs.webkit.org/show_bug.cgi?id=182678
<rdar://problem/37517821>

Patch by Sihui Liu <sihui_liu@apple.com> on 2018-03-07
Reviewed by Chris Dumez.

Source/WebCore:

replaceState should not change URL when the URL argument is NULL, but should change URL when the URL argument is an empty string.

Test: http/tests/history/replacestate-no-url.html

page/History.cpp:

(WebCore::History::urlForState):

LayoutTests:

http/tests/history/replacestate-no-url-expected.txt: Added.
http/tests/history/replacestate-no-url.html: Added.

Add layout test coverage.

fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt:

Rebaseline a layout test as empty string for URL is handled differently.

2:00 PM Changeset in webkit [229374] by mitz@apple.com

9 copies
1 add in releases/Apple/Safari Technology Preview 51

Added a tag for Safari Technology Preview release 51.

1:10 PM Changeset in webkit [229373] by mark.lam@apple.com

3 edits in trunk/Source/JavaScriptCore

Rename ProtoCallFrame::arityMissMatch to hasArityMismatch.
https://bugs.webkit.org/show_bug.cgi?id=183414
<rdar://problem/38231678>

Reviewed by Michael Saboff.

interpreter/ProtoCallFrame.cpp:

(JSC::ProtoCallFrame::init):

interpreter/ProtoCallFrame.h:

12:29 PM Changeset in webkit [229372] by Antti Koivisto

8 edits in trunk/Source/WebCore

Don't invalidate descendants for sibling combinators unless needed
https://bugs.webkit.org/show_bug.cgi?id=183410
<rdar://problem/38227297>

Reviewed by Zalan Bujtas.

If we know the matched sibling combinator doesn't affect descendants we shouldn't invalidate them.

css/SelectorChecker.cpp:

(WebCore::SelectorChecker::matchRecursively const):

Use different bit for the descendant case.

cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::fragmentMatchesTheRightmostElement):

Remove unneeded context assert.

(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):

Use different bit for the descendant case.

(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorCheckerExcludingPseudoElements):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasPseudoElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateRequestedPseudoElementEqualsToSelectorPseudoElement):

dom/Element.cpp:

(WebCore::invalidateForSiblingCombinators):

Invalidate the target sibling or all descendants based on the bits.

dom/Element.h:

(WebCore::Element::descendantsAffectedByPreviousSibling const):
(WebCore::Element::setDescendantsAffectedByPreviousSibling const):

dom/Node.h:
style/StyleRelations.cpp:

(WebCore::Style::commitRelationsToRenderStyle):
(WebCore::Style::commitRelations):

style/StyleRelations.h:

Add DescendantsAffectedByPreviousSibling bit. AffectedByPreviousSibling is now just about the target element.

10:53 AM Changeset in webkit [229371] by Chris Dumez

2 edits
3 adds
4 deletes in trunk/LayoutTests

http/tests/misc/location-replace-crossdomain.html is failing with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183408

Reviewed by Alex Christensen.

The test was trying to navigate a cross-origin iframe via location.replace() and checking
that the load succeeded in a setTimeout(1). There is no guarantee that the frame has loaded
by that point. We would normally rely on the 'load' event but it is not feasible here since
the iframe is cross-origin. Instead, I opted to have the iframe to a page that posts a
message to its parent window to indicate that the load has succeeded.

http/tests/misc/location-replace-crossdomain-async-delegates-expected.txt: Added.
http/tests/misc/location-replace-crossdomain-async-delegates.html: Added.
http/tests/misc/location-replace-crossdomain-expected.txt: Added.
http/tests/misc/location-replace-crossdomain.html:
platform/gtk/http/tests/misc/location-replace-crossdomain-expected.txt: Removed.
platform/ios/http/tests/misc/location-replace-crossdomain-expected.txt: Removed.
platform/mac/http/tests/misc/location-replace-crossdomain-expected.txt: Removed.
platform/win/http/tests/misc/location-replace-crossdomain-expected.txt: Removed.

10:41 AM Changeset in webkit [229370] by pvollan@apple.com

2 edits in trunk/LayoutTests

Fix incorrect test expectations for http/wpt/resource-timing/rt-initiatorType-media.html.

Unreviewed test gardening.

platform/win/TestExpectations:

10:38 AM Changeset in webkit [229369] by Chris Dumez

3 edits
2 adds in trunk/LayoutTests

http/tests/dom/window-open-about-webkit-org-and-access-document.html is failing with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183394

Reviewed by Alex Christensen.

http/tests/dom/window-open-about-webkit-org-and-access-document.html is failing with async policy delegates.
The issue is that the test calls window.open() with a cross-origin URL and then right away tries to access
newWindow.document, expecting it to throw. However, there is no guarantee that the cross origin URL has
started loading at this point. In particular, when the navigation policy decision is made asynchronously,
the URL is initially "about:blank" and it is OK to access the newWindow's document at this point.

We would normally rely on the window's load event before doing the check. However, this would not work
here since the window is cross origin. As a result, I am using a setInterval() in order to wait for the
cross-origin URL to load and for newWindow.document to start throwing.

http/tests/dom/window-open-about-webkit-org-and-access-document-async-delegates-expected.txt: Added.
http/tests/dom/window-open-about-webkit-org-and-access-document-async-delegates.html: Added.
http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt:
http/tests/dom/window-open-about-webkit-org-and-access-document.html:

10:27 AM Changeset in webkit [229368] by Antti Koivisto

3 edits in trunk/Source/WebCore

checkForSiblingStyleChanges should use internal versions of the invalidation functions
https://bugs.webkit.org/show_bug.cgi?id=183405
<rdar://problem/38218310>

Reviewed by Zalan Bujtas.

Non-internal invalidateStyleForElement/Subtree() implement sibling combinator invalidation. Checking this
is only needed if the element in question changed somehow. In checkForSiblingStyleChanges we know that
another element changed and we really just want to invalidate.

css/SelectorChecker.cpp:

(WebCore::isFirstOfType):
(WebCore::SelectorChecker::checkOne const):

Also make :first-of-type use ChildrenAffectedByForwardPositionalRules for invalidation similar to :last-of-type
for more correct invalidation.

dom/Element.cpp:

(WebCore::checkForSiblingStyleChanges):

10:21 AM Changeset in webkit [229367] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Simplify the variants of FunctionPtr constructors.
https://bugs.webkit.org/show_bug.cgi?id=183399
<rdar://problem/38212980>

Reviewed by Yusuke Suzuki.

assembler/MacroAssemblerCodeRef.h:

(JSC::FunctionPtr::FunctionPtr):

10:14 AM Changeset in webkit [229366] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

MarkedArgumentsBuffer should allocate from the JSValue Gigacage
https://bugs.webkit.org/show_bug.cgi?id=183377

Reviewed by Michael Saboff.

That prevents it from being used to pivot UAF on malloc memory into corruption in the JS heap.

runtime/ArgList.cpp:

(JSC::MarkedArgumentBuffer::expandCapacity):

10:09 AM Changeset in webkit [229365] by commit-queue@webkit.org

2 edits in trunk/JSTests

Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
https://bugs.webkit.org/show_bug.cgi?id=183334

Patch by Dominik Infuehr <dinfuehr@igalia.com> on 2018-03-07
Reviewed by Žan Doberšek.

stress/var-injection-cache-invalidation.js:

10:04 AM Changeset in webkit [229364] by mark.lam@apple.com

6 edits in trunk/Source/JavaScriptCore

Add support for ARM64E.
https://bugs.webkit.org/show_bug.cgi?id=183398
<rdar://problem/38212621>

Reviewed by Michael Saboff.

assembler/MacroAssembler.h:
llint/LLIntOfflineAsmConfig.h:
llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter64.asm:
offlineasm/backends.rb:

9:44 AM Changeset in webkit [229363] by Yusuke Suzuki

8 edits in trunk

HTML pattern attribute should set u flag for regular expressions
https://bugs.webkit.org/show_bug.cgi?id=151598

Reviewed by Chris Dumez.

Source/JavaScriptCore:

Add UnicodeMode for JSC::Yarr::RegularExpression.

yarr/RegularExpression.cpp:

(JSC::Yarr::RegularExpression::Private::create):
(JSC::Yarr::RegularExpression::Private::Private):
(JSC::Yarr::RegularExpression::Private::compile):
(JSC::Yarr::RegularExpression::RegularExpression):

yarr/RegularExpression.h:

Source/WebCore:

This patch attaches "u" flag to the RegExp compiled for HTML "pattern" attribute[1].

[1]: https://html.spec.whatwg.org/multipage/forms.html#the-pattern-attribute

html/BaseTextInputType.cpp:

(WebCore::BaseTextInputType::patternMismatch const):

LayoutTests:

fast/forms/ValidityState-patternMismatch-expected.txt:
fast/forms/ValidityState-patternMismatch.html:

9:18 AM Changeset in webkit [229362] by Yusuke Suzuki

33 edits in trunk/Source/JavaScriptCore

[JSC] Add more JSType based fast path for jsDynamicCast
https://bugs.webkit.org/show_bug.cgi?id=183403

Reviewed by Mark Lam.

We add more JSType based fast path for jsDynamicCast. Basically, we add miscellaneous JSTypes which
are used for jsDynamicCast in JSC, arguments types, and scope types.

We also add ClassInfo to JSScope and JSSegmentedVariableObject since they are used with jsDynamicCast.

jit/JITOperations.cpp:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setUpCall):

runtime/ClonedArguments.h:

(JSC::ClonedArguments::specialsMaterialized const): Deleted.

runtime/DirectArguments.h:

(JSC::DirectArguments::subspaceFor): Deleted.
(JSC::DirectArguments::internalLength const): Deleted.
(JSC::DirectArguments::length const): Deleted.
(JSC::DirectArguments::isMappedArgument const): Deleted.
(JSC::DirectArguments::isMappedArgumentInDFG const): Deleted.
(JSC::DirectArguments::getIndexQuickly const): Deleted.
(JSC::DirectArguments::setIndexQuickly): Deleted.
(JSC::DirectArguments::callee): Deleted.
(JSC::DirectArguments::argument): Deleted.
(JSC::DirectArguments::overrodeThings const): Deleted.
(JSC::DirectArguments::initModifiedArgumentsDescriptorIfNecessary): Deleted.
(JSC::DirectArguments::setModifiedArgumentDescriptor): Deleted.
(JSC::DirectArguments::isModifiedArgumentDescriptor): Deleted.
(JSC::DirectArguments::offsetOfCallee): Deleted.
(JSC::DirectArguments::offsetOfLength): Deleted.
(JSC::DirectArguments::offsetOfMinCapacity): Deleted.
(JSC::DirectArguments::offsetOfMappedArguments): Deleted.
(JSC::DirectArguments::offsetOfModifiedArgumentsDescriptor): Deleted.
(JSC::DirectArguments::storageOffset): Deleted.
(JSC::DirectArguments::offsetOfSlot): Deleted.
(JSC::DirectArguments::allocationSize): Deleted.
(JSC::DirectArguments::storage): Deleted.

runtime/JSCast.h:
runtime/JSGlobalLexicalEnvironment.h:

(JSC::JSGlobalLexicalEnvironment::create): Deleted.
(JSC::JSGlobalLexicalEnvironment::isEmpty const): Deleted.
(JSC::JSGlobalLexicalEnvironment::createStructure): Deleted.
(JSC::JSGlobalLexicalEnvironment::JSGlobalLexicalEnvironment): Deleted.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::finishCreation):

runtime/JSMap.h:

(JSC::isJSMap): Deleted.

runtime/JSModuleEnvironment.h:

(JSC::JSModuleEnvironment::create): Deleted.
(JSC::JSModuleEnvironment::createStructure): Deleted.
(JSC::JSModuleEnvironment::offsetOfModuleRecord): Deleted.
(JSC::JSModuleEnvironment::allocationSize): Deleted.
(JSC::JSModuleEnvironment::moduleRecord): Deleted.
(JSC::JSModuleEnvironment::moduleRecordSlot): Deleted.

runtime/JSObject.cpp:

(JSC::canDoFastPutDirectIndex):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):

runtime/JSObject.h:

(JSC::JSFinalObject::allocationSize): Deleted.
(JSC::JSFinalObject::typeInfo): Deleted.
(JSC::JSFinalObject::defaultInlineCapacity): Deleted.
(JSC::JSFinalObject::maxInlineCapacity): Deleted.
(JSC::JSFinalObject::createStructure): Deleted.
(JSC::JSFinalObject::finishCreation): Deleted.
(JSC::JSFinalObject::JSFinalObject): Deleted.
(JSC::isJSFinalObject): Deleted.

runtime/JSScope.cpp:
runtime/JSScope.h:
runtime/JSSegmentedVariableObject.cpp:
runtime/JSSegmentedVariableObject.h:
runtime/JSSet.h:

(JSC::isJSSet): Deleted.

runtime/JSType.h:
runtime/JSWeakMap.h:

(JSC::isJSWeakMap): Deleted.

runtime/JSWeakSet.h:

(JSC::isJSWeakSet): Deleted.

runtime/JSWithScope.h:

(JSC::JSWithScope::object): Deleted.

runtime/MapConstructor.cpp:

(JSC::constructMap):
(JSC::mapPrivateFuncMapBucketHead):

runtime/MapPrototype.cpp:

(JSC::getMap):

runtime/NumberObject.cpp:

(JSC::NumberObject::finishCreation):

runtime/NumberPrototype.cpp:

(JSC::toThisNumber):
(JSC::numberProtoFuncToExponential):
(JSC::numberProtoFuncToFixed):
(JSC::numberProtoFuncToPrecision):
(JSC::numberProtoFuncToString):
(JSC::numberProtoFuncToLocaleString):
(JSC::numberProtoFuncValueOf):

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSeal):
(JSC::objectConstructorFreeze):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::finishCreation):

runtime/ScopedArguments.h:

(JSC::ScopedArguments::subspaceFor): Deleted.
(JSC::ScopedArguments::internalLength const): Deleted.
(JSC::ScopedArguments::length const): Deleted.
(JSC::ScopedArguments::isMappedArgument const): Deleted.
(JSC::ScopedArguments::isMappedArgumentInDFG const): Deleted.
(JSC::ScopedArguments::getIndexQuickly const): Deleted.
(JSC::ScopedArguments::setIndexQuickly): Deleted.
(JSC::ScopedArguments::callee): Deleted.
(JSC::ScopedArguments::overrodeThings const): Deleted.
(JSC::ScopedArguments::initModifiedArgumentsDescriptorIfNecessary): Deleted.
(JSC::ScopedArguments::setModifiedArgumentDescriptor): Deleted.
(JSC::ScopedArguments::isModifiedArgumentDescriptor): Deleted.
(JSC::ScopedArguments::offsetOfOverrodeThings): Deleted.
(JSC::ScopedArguments::offsetOfTotalLength): Deleted.
(JSC::ScopedArguments::offsetOfTable): Deleted.
(JSC::ScopedArguments::offsetOfScope): Deleted.
(JSC::ScopedArguments::overflowStorageOffset): Deleted.
(JSC::ScopedArguments::allocationSize): Deleted.
(JSC::ScopedArguments::overflowStorage const): Deleted.

runtime/SetConstructor.cpp:

(JSC::constructSet):
(JSC::setPrivateFuncSetBucketHead):

runtime/SetPrototype.cpp:

(JSC::getSet):

runtime/StrictEvalActivation.h:

(JSC::StrictEvalActivation::create): Deleted.
(JSC::StrictEvalActivation::createStructure): Deleted.

runtime/WeakMapPrototype.cpp:

(JSC::getWeakMap):

runtime/WeakSetPrototype.cpp:

(JSC::getWeakSet):

9:11 AM Changeset in webkit [229361] by fred.wang@free.fr

6 edits
2 adds in trunk

Relayout frames after AsyncFrameScrolling or FrameFlattening option is changed
https://bugs.webkit.org/show_bug.cgi?id=183081

Patch by Frederic Wang <fwang@igalia.com> on 2018-03-07
Reviewed by Antonio Gomes.

Source/WebCore:

The frames may be resized when the FrameFlattening option is modified and hence this patch
forces a relayout. It also does that when AsyncFrameScrolling is modified too, since that
may imply changes in frame flattening after bug 173704. Forcing a relayout will also be
enough to trigger other updates for async frame scrolling in the future (see bug 149264 and
bug 171667).

Test: platform/ios/fast/frames/flattening/iframe-flattening-async-frame-scrolling-dynamic.html

page/Settings.yaml: Call setNeedsRelayoutAllFrames when one of the AsyncFrameScrolling or

FrameFlattening options is changed.

page/SettingsBase.cpp: Include RenderWidget to make call on frame->ownerRenderer().

(WebCore::SettingsBase::setNeedsRelayoutAllFrames): Make layout and preferred widths dirty
on all frames in the page and schedule a relayout.

page/SettingsBase.h: Declare setNeedsRelayoutAllFrames().

LayoutTests:

Add a test to check whether an iframe changes its flattening status after one of the option
AsyncFrameScrolling/FrameFlattening is enabled/disabled.

platform/ios-simulator/TestExpectations: Remove failure for scrolling-in-object.html.
platform/ios/fast/frames/flattening/iframe-flattening-async-frame-scrolling-dynamic-expected.txt: Added.
platform/ios/fast/frames/flattening/iframe-flattening-async-frame-scrolling-dynamic.html: Added.

8:19 AM Changeset in webkit [229360] by pvollan@apple.com

2 edits in trunk/LayoutTests

Mark http/wpt/resource-timing/rt-initiatorType-media.html as a flaky crash on Windows.
https://bugs.webkit.org/show_bug.cgi?id=179297

Unreviewed test gardening.

platform/win/TestExpectations:

7:21 AM Changeset in webkit [229359] by commit-queue@webkit.org

18 edits
6 copies
3 moves
1 add in trunk

Make NetworkRTCResolver port agnostic
https://bugs.webkit.org/show_bug.cgi?id=178855

Patch by Alejandro G. Castro <alex@igalia.com> on 2018-03-07
Reviewed by Youenn Fablet.

Source/WebCore:

Add new API in the DNSResolveQueue allowing to revolve hostnames and get the result. Add platform
specific code for soup platform and refactor the other platforms. Added new API to the DNS API header
and move the general code to the DNS.cpp file, that way we can reuse that code in all the platforms
and leave the ResolveQueue class of the platforms in a file.

No new tests because this is a refactor.

PlatformAppleWin.cmake: Move the DNSCFNet class to DNSResolveQueueCFNet.
PlatformMac.cmake: Ditto.
Sources.txt: Add the DNS.cpp for compilation.
SourcesCocoa.txt: Move the DNSCFNet class to DNSResolveQueueCFNet.
WebCore.xcodeproj/project.pbxproj: Move the DNSCFNet class to DNSResolveQueueCFNet, add the DNS.cpp

for compilation. Add the new DNSResolveQueueCFNet class.

platform/Curl.cmake: Move the DNSCFNet class to DNSResolveQueueCurl.
platform/network/DNS.cpp: Add this file with the default implementation of the DNS functions for

all the platforms.
(WebCore::prefetchDNS): Copied from every platform implementation.
(WebCore::resolveDNS): Add the function, resolves a hostname, receives the identifier of the operation
and the completion handler.
(WebCore::stopResolveDNS): Add the function, stops a resolution operation, receives the identifier
of the operation.

platform/network/DNS.h: Add the new APIs resolveDNS and stopResolveDNS with the classes used for the

implementation.
(WebCore::IPAddress::IPAddress): Add this class used to send the resolved address information, it does
not depend on libwebrtc rtc classes.
(WebCore::IPAddress::get): Get a reference to the struct sockaddr_in in the IPAddress class.
(WebCore::DNSCompletionHandler): Add this CompletionHandler type to be used when resolving the DNS
address.

platform/network/DNSResolveQueue.cpp: Add the DNSResolveQueue platform instantiation in the singleton.

(WebCore::DNSResolveQueue::singleton): Use DNSResolveQueue platform classes when creating the singleton..
(WebCore::DNSResolveQueue::resolve): Add this method to get the address of a hostname, it sends the
identifier and the completion handler to use when returning the result.
(WebCore::DNSResolveQueue::stopResolve): Add this method to stop the resolve operation when required.

platform/network/DNSResolveQueue.h: Add the new methods and make the class abstract, so that every

platform can implement the functions.

platform/network/cf/DNSResolveQueueCFNet.cpp: Renamed from Source/WebCore/platform/network/cf/DNSCFNet.cpp.

Add the methods to the new class DNSResolveQueueCFNet, move the prefetchDNS to the DNS.cpp general
implementation.

platform/network/cf/DNSResolveQueueCFNet.h: Add the new class inheriting from the DNSResolveQueue. Add the

new methods, we have to implement these methods and move the NetworkRTCResolver for COCOA code here.
(WebCore::DNSResolveQueueCF::resolve): Dummy method, not implemented.
(WebCore::DNSResolveQueueCF::stopResolve): Ditto.

platform/network/curl/DNSResolveQueueCurl.cpp: Renamed from Source/WebCore/platform/network/curl/DNSCurl.cpp.
platform/network/curl/DNSResolveQueueCurl.h: Add the new class inheriting from the DNSResolveQueue.

(WebCore::DNSResolveQueueCurl::resolve): Ditto.
(WebCore::DNSResolveQueueCurl::stopResolve): Ditto.

platform/network/soup/DNSResolveQueueSoup.h: New class inheriting from the DNSResolveQueue class, adding

a HasMap with the active operations, it allows stopping them.

platform/network/soup/DNSResolveQueueSoup.cpp: Renamed from Source/WebCore/platform/network/curl/DNSSoup.cpp.

(WebCore::resolvedWithObserverCallback): Called when the result address from the soup platform is ready,
sends the address to the completion handler.
(WebCore::DNSResolveQueueSoup::resolve): Launch the resolve operation with the soup library.
(WebCore::DNSResolveQueueSoup::stopResolve): Stop the resolve operation on process with a GCancellable.

Source/WebKit:

Create a specific Cocoa class to isolate the generic code in the base class, make the base implementation port
agnostic and dependent on DNS API in the platform directory which encapsulates the platform specific details.

NetworkProcess/webrtc/NetworkRTCProvider.cpp: Create an alias class name defined per platform to instantiate the resolver.

(WebKit::NetworkRTCProvider::createResolver): Used the alias class name and receive a new IPAddress class that is not
dependent on rtc libwebrtc library.

NetworkProcess/webrtc/NetworkRTCResolver.cpp: Remove the platform specific code. Use the DNS API to implement the

platform specific code in the default start and stop methods. Add the identifier of the resolve operation to the class.
(WebKit::NetworkRTCResolver::NetworkRTCResolver): Add the identifier in the initialization.
(WebKit::NetworkRTCResolver::~NetworkRTCResolver): Remove the platform specific code.
(WebKit::NetworkRTCResolver::completed): Ditto.
(WebKit::NetworkRTCResolver::start): Add a new implementation using the DNS API.
(WebKit::NetworkRTCResolver::stop): Ditto

NetworkProcess/webrtc/NetworkRTCResolver.h: Remove the platform specific code and use the DNSResolveQueue for a general

solution to implement the platform specific code. Avoid using the IPAddress class that depends on libwertc classes to make
it more general regarding DNS name resolution.
(WebKit::NetworkRTCResolver::start): Make this class virtual.
(WebKit::NetworkRTCResolver::stop): Ditto.

NetworkProcess/webrtc/NetworkRTCResolverCocoa.cpp: Copied Cocoa code from Source/WebKit/NetworkProcess/webrtc/NetworkRTCResolver.cpp.

Now this class overrides the start and stop methods that use DNS, cocoa implementation should use the DNS methods in the future and
remove this class, making sure all the platform specific class is in the platform directory.

NetworkProcess/webrtc/NetworkRTCResolverCocoa.h: Copied Cocoa code from Source/WebKit/NetworkProcess/webrtc/NetworkRTCResolver.h.
PlatformGTK.cmake: Add NetworkRTCResolver compilation for GTK.
WebKit.xcodeproj/project.pbxproj: Add the NetworkRTCResolverCocoa class to the compilation.

Tools:

Added new unit tests for he resolve and stopResolve functions. We need to compile them for the
other platforms when the APIs are supported.

TestWebKitAPI/PlatformGTK.cmake:
TestWebKitAPI/Tests/WebCore/DNS.cpp:

3:59 AM Changeset in webkit [229358] by Ms2ger@igalia.com

6 edits
6 adds in trunk

[WPE] Test gardening
https://bugs.webkit.org/show_bug.cgi?id=183402

Unreviewed test gardening.

WebDriverTests:

TestExpectations.json: mark element_clear.py::test_closed_context as passing.

LayoutTests:

platform/gtk/TestExpectations: skip some more appcache-sw tests.
platform/wpe/TestExpectations:
- Mark http/tests/appcache/different-https-origin-resource-main.html as passing after r228892.
- Mark fast/canvas/canvas-createPattern-video-modify.html as passing after r228221.
- Mark storage/indexeddb/modern/index-3-private.html as passing since r228560.
- Skip some more appcache - service worker tests.
- Mark some svg/animations tests as flaky (as they already are on GTK).
- Mark imported/w3c/web-platform-tests/encrypted-media/clearkey-mp4-setmediakeys-multiple-times-with-the-same-mediakeys.html as passing after r228983.
- Mark http/tests/appcache/fail-on-update-2.html as flaky.
platform/wpe/imported/w3c/web-platform-tests/web-animations/animation-model/animation-types/accumulation-per-property-expected.txt: Added baseline.
platform/wpe/imported/w3c/web-platform-tests/web-animations/animation-model/animation-types/addition-per-property-expected.txt: Added baseline.
platform/wpe/imported/w3c/web-platform-tests/web-animations/animation-model/animation-types/interpolation-per-property-expected.txt: Added baseline.
platform/wpe/js/dom/dom-static-property-for-in-iteration-expected.txt: rebaseline.

3:32 AM Changeset in webkit [229357] by Ms2ger@igalia.com

2 edits in trunk/WebDriverTests

Mark get_element_property.py::test_element as passing.
https://bugs.webkit.org/show_bug.cgi?id=180414

Unreviewed test gardening.

It has been passing since the test was updated to expect the correct value
in r229166.

TestExpectations.json:

3:21 AM WebKitGTK/Gardening/Calendar edited by Ms2ger@igalia.com

(diff)

1:38 AM Changeset in webkit [229356] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

[ARM] offlineasm: fix indentation in armOpcodeReversedOperands
https://bugs.webkit.org/show_bug.cgi?id=183400

Patch by Dominik Infuehr <dinfuehr@igalia.com> on 2018-03-07
Reviewed by Mark Lam.

offlineasm/arm.rb:

1:17 AM Changeset in webkit [229355] by Claudio Saavedra

2 edits in trunk/LayoutTests

[GTK] fast/animation/request-animation-frame-during-modal.html sometimes crashing

Context Navigation

Timeline

Mar 11, 2018:

Mar 10, 2018:

Mar 9, 2018:

Mar 8, 2018:

Mar 7, 2018:

Download in other formats: