Context Navigation

REGRESSION (r219757): Accessing response getter of XHR instance from IFRAME sets constructor to Object from the IFRAME
https://bugs.webkit.org/show_bug.cgi?id=187411
<rdar://problem/41920593>

Reviewed by Sam Weinig.

Source/WebCore:

Update JSXMLHttpRequest::response() to use the XMLHttpRequest's global object exec when constructing a JSONObject
for the response instead of the caller's exec.

Test: http/tests/xmlhttprequest/xhr-response-constructor-subframe.html

bindings/js/JSXMLHttpRequestCustom.cpp:

(WebCore::JSXMLHttpRequest::response const):

LayoutTests:

Add layout test coverage. I have verified locally that it passes in Chromium as well.

http/tests/xmlhttprequest/resources/data.json: Added.
http/tests/xmlhttprequest/resources/xhr-response-constructor-iframe.html: Added.
http/tests/xmlhttprequest/xhr-response-constructor-subframe-expected.txt: Added.
http/tests/xmlhttprequest/xhr-response-constructor-subframe.html: Added.

9:09 PM Changeset in webkit [234187] by Simon Fraser

8 edits
2 adds in trunk

Animation stops with object-fit:contain on an animated 2d canvas
https://bugs.webkit.org/show_bug.cgi?id=187840

Reviewed by Zalan Bujtas.
Source/WebCore:

If a canvas has object-fit: cover or contain, repaints need to mapped through
the rect that is used to position the canvas in the element bounds, which is replacedContentRect().

Add a version of replacedContentRect() that doesn't require passing the intrinsicSize() since
all but RenderVideo just pass the RenderReplaced's intrinsicSize.

Test: fast/repaint/canvas-object-fit.html

html/HTMLCanvasElement.cpp:

(WebCore::HTMLCanvasElement::didDraw):

rendering/RenderHTMLCanvas.cpp:

(WebCore::RenderHTMLCanvas::paintReplaced):

rendering/RenderImage.cpp:

(WebCore::RenderImage::updateInnerContentRect):
(WebCore::RenderImage::paintReplaced):

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::contentsBox const):

rendering/RenderReplaced.h:

(WebCore::RenderReplaced::replacedContentRect const):

rendering/shapes/ShapeOutsideInfo.cpp:

(WebCore::ShapeOutsideInfo::createShapeForImage const):

LayoutTests:

fast/repaint/canvas-object-fit-expected.txt: Added.
fast/repaint/canvas-object-fit.html: Added.

8:31 PM Changeset in webkit [234186] by Basuke Suzuki

7 edits in trunk

[Curl] Add support for wss:// websockets
https://bugs.webkit.org/show_bug.cgi?id=172630

Reviewed by Fujii Hironori.

Source/WebCore:

To support secure WebSocket connection, it is almost rewritten by using existing
backend for CurlHandle to handle TLS connection and proxy support.

Test: http/tests/websocket/tests/hybi/simple-wss.html

platform/network/curl/CurlContext.cpp:

(WebCore::CurlSocketHandle::CurlSocketHandle):
(WebCore::CurlSocketHandle::connect):
(WebCore::CurlSocketHandle::send):
(WebCore::CurlSocketHandle::receive):
(WebCore::CurlSocketHandle::wait):

platform/network/curl/CurlContext.h:
platform/network/curl/SocketStreamHandleImpl.h:

(WebCore::SocketStreamHandleImpl::SocketData::SocketData): Deleted.

platform/network/curl/SocketStreamHandleImplCurl.cpp:

(WebCore::SocketStreamHandleImpl::SocketStreamHandleImpl):
(WebCore::SocketStreamHandleImpl::~SocketStreamHandleImpl):
(WebCore::SocketStreamHandleImpl::platformSendInternal):
(WebCore::SocketStreamHandleImpl::platformClose):
(WebCore::SocketStreamHandleImpl::threadEntryPoint):
(WebCore::SocketStreamHandleImpl::handleError):
(WebCore::SocketStreamHandleImpl::stopThread):
(WebCore::createCopy): Deleted.
(WebCore::SocketStreamHandleImpl::readData): Deleted.
(WebCore::SocketStreamHandleImpl::sendData): Deleted.
(WebCore::SocketStreamHandleImpl::waitForAvailableData): Deleted.
(WebCore::SocketStreamHandleImpl::startThread): Deleted.
(WebCore::SocketStreamHandleImpl::didReceiveData): Deleted.
(WebCore::SocketStreamHandleImpl::didOpenSocket): Deleted.

LayoutTests:

Pass simple-wss.html.

platform/wincairo/TestExpectations:

7:09 PM Changeset in webkit [234185] by sbarati@apple.com

2 edits in trunk/Source/bmalloc

Revert back to using phys_footprint to calculate isUnderMemoryPressure()
https://bugs.webkit.org/show_bug.cgi?id=187919
<rdar://problem/42552888>

Reviewed by Simon Fraser.

Currently on iOS, bmalloc will run the scavenger more frequently when it detects
that the process is under memory pressure. However, it only uses bmalloc's
own footprint as a percentage of the HW available memory to determine if
the process is under memory pressure. This is a change I recently made
in an effort to run the scavenger less when bmalloc wasn't contributing
to the dirty footprint in the process. However, this fails to run the
scavenger eagerly when the process in question has a heap split
between a lot of dirty bmalloc memory as well as a lot of dirty memory
from elsewhere. We also have evidence that we may have increased jetsams
in the Web Content process. Since my original change was not a measurable
speedup, this patch reverts isUnderMemoryPressure() to its previous
behavior of using phys_footprint to determine if 75% of the available
HW memory is being used.

bmalloc/AvailableMemory.cpp:

(bmalloc::memoryStatus):

6:53 PM Changeset in webkit [234184] by commit-queue@webkit.org

12 edits
1 delete in trunk

Unreviewed, rolling out r234183.
https://bugs.webkit.org/show_bug.cgi?id=187983

cause regression in Kraken gaussian blur and desaturate
(Requested by yusukesuzuki on #webkit).

Reverted changeset:

"[JSC] Record CoW status in ArrayProfile"
https://bugs.webkit.org/show_bug.cgi?id=187949
https://trac.webkit.org/changeset/234183

5:41 PM Changeset in webkit [234183] by Yusuke Suzuki

12 edits
1 add in trunk

[JSC] Record CoW status in ArrayProfile
https://bugs.webkit.org/show_bug.cgi?id=187949

Reviewed by Saam Barati.

JSTests:

stress/array-profile-should-record-copy-on-write.js: Added.

(shouldBe):
(test1):
(test2):
(test3):

Source/JavaScriptCore:

Once CoW array is converted to non-CoW array, subsequent operations are done for this non-CoW array.
Even though these operations are performed onto both CoW and non-CoW arrays in the code, array profiles
in these code typically record only non-CoW arrays since array profiles hold only one StructureID recently
seen. This results emitting CheckStructure for non-CoW arrays in DFG, and it soon causes OSR exits due to
CoW arrays.

In this patch, we record CoW status in ArrayProfile separately to construct more appropriate DFG::ArrayMode
speculation. To do so efficiently, we store union of seen IndexingMode in ArrayProfile.

This patch removes one of Kraken/stanford-crypto-aes's OSR exit reason, and improves the performance by 6-7%.

baseline patched

stanford-crypto-aes 60.893+-1.346 ^{57.412+-1.298} definitely 1.0606x faster
stanford-crypto-ccm 62.124+-1.992 58.921+-1.844 might be 1.0544x faster

bytecode/ArrayProfile.cpp:

(JSC::ArrayProfile::briefDescriptionWithoutUpdating):

bytecode/ArrayProfile.h:

(JSC::asArrayModes):
We simplify asArrayModes instead of giving up Int8ArrayMode - Float64ArrayMode contiguous sequence.

(JSC::ArrayProfile::ArrayProfile):
(JSC::ArrayProfile::addressOfObservedIndexingModes):
(JSC::ArrayProfile::observedIndexingModes const):
Currently, our macro assembler and offlineasm only support or32 / ori operation onto addresses.
So storing the union of seen IndexingMode in unsigned instead.

dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::fromObserved):

dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::withProfile const):

jit/JITCall.cpp:

(JSC::JIT::compileOpCall):

jit/JITCall32_64.cpp:

(JSC::JIT::compileOpCall):

jit/JITInlines.h:

(JSC::JIT::emitArrayProfilingSiteWithCell):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:

5:21 PM Changeset in webkit [234182] by commit-queue@webkit.org

10 edits
2 deletes in trunk/Tools

Remove support for the double type from WHLSL
https://bugs.webkit.org/show_bug.cgi?id=187977

Patch by Thomas Denney <tdenney@apple.com> on 2018-07-24
Reviewed by Myles C. Maxfield.

WebGPUShadingLanguageRI/All.js: Removed DoubleLiteral.js and DoubleLiteralType.js include.
WebGPUShadingLanguageRI/DoubleLiteral.js: Removed.
WebGPUShadingLanguageRI/DoubleLiteralType.js: Removed.
WebGPUShadingLanguageRI/Intrinsics.js: Removed double arithmetic functions.
WebGPUShadingLanguageRI/Parse.js:

(parseTerm): Removed parsing of double literals.

WebGPUShadingLanguageRI/SPIRV.html: Removed DoubleLiteral.js and DoubleLiteralType.js include.
WebGPUShadingLanguageRI/SPIRVCodegen.js: Removed double type logic.
WebGPUShadingLanguageRI/StandardLibrary.js: Removed double type declarations.
WebGPUShadingLanguageRI/Test.html: Removed DoubleLiteral.js and DoubleLiteralType.js include.
WebGPUShadingLanguageRI/Test.js: Removed tests that test doubles or ported them to use floats.
WebGPUShadingLanguageRI/index.html: Removed DoubleLiteral.js and DoubleLiteralType.js include.

5:18 PM Changeset in webkit [234181] by timothy_horton@apple.com

12 edits in trunk

Enable Web Content Filtering on watchOS
https://bugs.webkit.org/show_bug.cgi?id=187979
<rdar://problem/42559346>

Reviewed by Wenson Hsieh.

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore/PAL:

Configurations/FeatureDefines.xcconfig:

Source/WebKit:

Configurations/FeatureDefines.xcconfig:

Source/WebKitLegacy/mac:

Configurations/FeatureDefines.xcconfig:

Tools:

TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

4:42 PM Changeset in webkit [234180] by Tadeu Zagallo

5 edits in trunk/Source/JavaScriptCore

Don't modify Options when setting JIT thread limits
https://bugs.webkit.org/show_bug.cgi?id=187886

Reviewed by Filip Pizlo.

Previously, when setting the JIT thread limit prior to the worklist
initialization, it'd be set via Options, which didn't work if Options
hadn't been initialized yet. Change it to use a static variable in the
Worklist instead.

API/JSVirtualMachine.mm:

(+[JSVirtualMachine setNumberOfDFGCompilerThreads:]):
(+[JSVirtualMachine setNumberOfFTLCompilerThreads:]):

API/tests/testapi.mm:

(testObjectiveCAPIMain):

dfg/DFGWorklist.cpp:

(JSC::DFG::getNumberOfDFGCompilerThreads):
(JSC::DFG::getNumberOfFTLCompilerThreads):
(JSC::DFG::setNumberOfDFGCompilerThreads):
(JSC::DFG::setNumberOfFTLCompilerThreads):
(JSC::DFG::ensureGlobalDFGWorklist):
(JSC::DFG::ensureGlobalFTLWorklist):

dfg/DFGWorklist.h:

4:29 PM Changeset in webkit [234179] by dbates@webkit.org

6 edits
2 adds in trunk

Move-constructing NeverDestroyed should move construct underlying object instead of copy constructing it
https://bugs.webkit.org/show_bug.cgi?id=187971

Reviewed by Saam Barati.

Source/WTF:

Fixes an issue where move constructing a NeverDestroyed<T> would always copy construct T into
the destination storage buffer regardless of whether T is move constructable. For example:

{

static NeverDestroyed<T> x;
static NeverDestroyed<T> y { WTFMove(x) }; currently makes a copy of x's T even if T is move constructable

}

Currently the NeverDestroyed<T> instantiates T into the destination storage buffer by WTFMove()ing
the NeverDestroyed<T> into it, implicitly converting it to const T& by way of const T& conversion
operator. As a result the compiler picks the copy constructor for T to invoke instead of evaluating
whether T can be move constructed. Instead we should explicitly WTFMove() the underlying T so that
the compiler can choose to either move-construct T or copy construct it.

A side benefit of this change it is now possible to invoke makeNeverDestroyed() with the result
of a function that returns a move-only type (e.g. RenderStyle):

static auto sharedStyle = makeNeverDestroyed([] {

auto style = RenderStyle::create();
...
return style;

}());

wtf/NeverDestroyed.h:

(WTF::NeverDestroyed::NeverDestroyed):

Tools:

Add unit tests to cover move constructing a NeverDestroyed with a non-const and const data type
as well as invoking makeNeverDestroyed() with the result of a function that returns a move-only
data type.

TestWebKitAPI/CMakeLists.txt:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WTF/MoveOnlyLifecycleLogger.cpp: Added.

(TestWebKitAPI::MoveOnlyLifecycleLogger::MoveOnlyLifecycleLogger):
(TestWebKitAPI::MoveOnlyLifecycleLogger::~MoveOnlyLifecycleLogger):
(TestWebKitAPI::MoveOnlyLifecycleLogger::operator=):
(TestWebKitAPI::MoveOnlyLifecycleLogger::setName):
(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WTF/MoveOnlyLifecycleLogger.h: Added.
TestWebKitAPI/Tests/WTF/NeverDestroyed.cpp:

(TestWebKitAPI::TEST):

4:14 PM Changeset in webkit [234178] by mark.lam@apple.com

40 edits in trunk/Source/JavaScriptCore

Refactoring: make DFG::Plan a class.
https://bugs.webkit.org/show_bug.cgi?id=187968

Reviewed by Saam Barati.

This patch makes all the DFG::Plan fields private, and provide accessor methods
for them. This makes it easier to reason about how these fields are used and
modified.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleVarargsCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleDOMJITGetter):
(JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
(JSC::DFG::ByteCodeParser::parseCodeBlock):
(JSC::DFG::ByteCodeParser::parse):

dfg/DFGCFAPhase.cpp:

(JSC::DFG::CFAPhase::run):
(JSC::DFG::CFAPhase::injectOSR):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGCommonData.cpp:

(JSC::DFG::CommonData::notifyCompilingStructureTransition):

dfg/DFGCommonData.h:
dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDriver.cpp:

(JSC::DFG::compileImpl):

dfg/DFGFinalizer.h:
dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::Graph):
(JSC::DFG::Graph::watchCondition):
(JSC::DFG::Graph::inferredTypeFor):
(JSC::DFG::Graph::requiredRegisterCountForExit):
(JSC::DFG::Graph::registerFrozenValues):
(JSC::DFG::Graph::registerStructure):
(JSC::DFG::Graph::registerAndWatchStructureTransition):
(JSC::DFG::Graph::assertIsRegistered):

dfg/DFGGraph.h:

(JSC::DFG::Graph::compilation):
(JSC::DFG::Graph::identifiers):
(JSC::DFG::Graph::watchpoints):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::JITCompiler):
(JSC::DFG::JITCompiler::link):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):
(JSC::DFG::JITCompiler::disassemble):

dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addWeakReference):

dfg/DFGJITFinalizer.cpp:

(JSC::DFG::JITFinalizer::finalize):
(JSC::DFG::JITFinalizer::finalizeFunction):
(JSC::DFG::JITFinalizer::finalizeCommon):

dfg/DFGOSREntrypointCreationPhase.cpp:

(JSC::DFG::OSREntrypointCreationPhase::run):

dfg/DFGPhase.cpp:

(JSC::DFG::Phase::beginPhase):

dfg/DFGPhase.h:

(JSC::DFG::runAndLog):

dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan):
(JSC::DFG::Plan::computeCompileTimes const):
(JSC::DFG::Plan::reportCompileTimes const):
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::isStillValid):
(JSC::DFG::Plan::reallyAdd):
(JSC::DFG::Plan::notifyCompiling):
(JSC::DFG::Plan::notifyReady):
(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
(JSC::DFG::Plan::finalizeAndNotifyCallback):
(JSC::DFG::Plan::key):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::finalizeInGC):
(JSC::DFG::Plan::isKnownToBeLiveDuringGC):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):

dfg/DFGPlan.h:

(JSC::DFG::Plan::canTierUpAndOSREnter const):
(JSC::DFG::Plan::vm const):
(JSC::DFG::Plan::codeBlock):
(JSC::DFG::Plan::mode const):
(JSC::DFG::Plan::osrEntryBytecodeIndex const):
(JSC::DFG::Plan::mustHandleValues const):
(JSC::DFG::Plan::threadData const):
(JSC::DFG::Plan::compilation const):
(JSC::DFG::Plan::finalizer const):
(JSC::DFG::Plan::setFinalizer):
(JSC::DFG::Plan::inlineCallFrames const):
(JSC::DFG::Plan::watchpoints):
(JSC::DFG::Plan::identifiers):
(JSC::DFG::Plan::weakReferences):
(JSC::DFG::Plan::transitions):
(JSC::DFG::Plan::recordedStatuses):
(JSC::DFG::Plan::willTryToTierUp const):
(JSC::DFG::Plan::setWillTryToTierUp):
(JSC::DFG::Plan::tierUpInLoopHierarchy):
(JSC::DFG::Plan::tierUpAndOSREnterBytecodes):
(JSC::DFG::Plan::stage const):
(JSC::DFG::Plan::callback const):
(JSC::DFG::Plan::setCallback):

dfg/DFGPlanInlines.h:

(JSC::DFG::Plan::iterateCodeBlocksForGC):

dfg/DFGPreciseLocalClobberize.h:

(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

dfg/DFGPredictionInjectionPhase.cpp:

(JSC::DFG::PredictionInjectionPhase::run):

dfg/DFGSafepoint.cpp:

(JSC::DFG::Safepoint::Safepoint):
(JSC::DFG::Safepoint::~Safepoint):
(JSC::DFG::Safepoint::begin):

dfg/DFGSafepoint.h:
dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):

dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):

dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::disableHoistingAcrossOSREntries):

dfg/DFGWorklist.cpp:

(JSC::DFG::Worklist::isActiveForVM const):
(JSC::DFG::Worklist::compilationState):
(JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
(JSC::DFG::Worklist::removeAllReadyPlansForVM):
(JSC::DFG::Worklist::completeAllReadyPlansForVM):
(JSC::DFG::Worklist::visitWeakReferences):
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::removeNonCompilingPlansForVM):

dfg/DFGWorklistInlines.h:

(JSC::DFG::Worklist::iterateCodeBlocksForGC):

ftl/FTLCompile.cpp:

(JSC::FTL::compile):

ftl/FTLFail.cpp:

(JSC::FTL::fail):

ftl/FTLJITFinalizer.cpp:

(JSC::FTL::JITFinalizer::finalizeCommon):

ftl/FTLLink.cpp:

(JSC::FTL::link):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
(JSC::FTL::DFG::LowerDFGToB3::addWeakReference):

ftl/FTLState.cpp:

(JSC::FTL::State::State):

4:13 PM Changeset in webkit [234177] by Chris Dumez

25 edits
2 deletes in trunk

Unreviewed, rolling out r233496 and r233571.

Likely cause of <rdar://problem/42160890> and
<rdar://problem/42329658> as ActiveDOMObjects can now be
constructed / destroyed while we are iterating over them.

Reverted changesets:

"Nullptr crash accessing Document in
GenericEventQueue::dispatchOneEvent()"
https://bugs.webkit.org/show_bug.cgi?id=187284
https://trac.webkit.org/changeset/233496

"REGRESSION(r233496): macOS Sierra hits debug assertions in
TrackListBase::suspend"
https://bugs.webkit.org/show_bug.cgi?id=187378
https://trac.webkit.org/changeset/233571

4:12 PM Changeset in webkit [234176] by bshafiei@apple.com

1 copy in tags/Safari-606.1.30

Tag Safari-606.1.30.

4:08 PM Changeset in webkit [234175] by commit-queue@webkit.org

18 edits
1 add in trunk/Tools

Minor changes to the WHLSL interpreter to support the new compiler
https://bugs.webkit.org/show_bug.cgi?id=187728

Patch by Thomas Denney <tdenney@apple.com> on 2018-07-24
Reviewed by Myles C. Maxfield.

This bug contains small changes that are make minor changes to the
behaviour of the existing interpreter (the tests are unaffected and all
still pass).

WebGPUShadingLanguageRI/EnumType.js:

(EnumType.prototype.get isEnum): Property added to EnumType and Type

WebGPUShadingLanguageRI/Evaluator.js: Correct typo
WebGPUShadingLanguageRI/Func.js:

(Func.prototype.get isEntryPoint): Add boolean property

WebGPUShadingLanguageRI/FuncInstantiator.js:

(FuncInstantiator.prototype.get instances): Public accessor for existing
private field

WebGPUShadingLanguageRI/FunctionLikeBlock.js: Refactored the class so

that it directly wraps a Func instance (therefore the only interface
change is to the constructor and the addition of the func accessor).
This change allows the de-inlining of functions.
(FunctionLikeBlock):
(FunctionLikeBlock.prototype.get func):
(FunctionLikeBlock.prototype.get returnType):
(FunctionLikeBlock.prototype.get parameters):
(FunctionLikeBlock.prototype.get body):

WebGPUShadingLanguageRI/Inliner.js: Use the new FunctionLikeBlock

constructor
(Inliner.prototype.visitCallExpression):
(Inliner):

WebGPUShadingLanguageRI/Intrinsics.js: Migrate the swizzle operators

to native functions (with additional support in StandardLibrary.js).
This reduces first-time compile-time from around 4s to around 0.1s.
(Intrinsics):

WebGPUShadingLanguageRI/Lexer.js: Ensure that the parsing of multiline

comments completes correctly
(Lexer.prototype.next):
(Lexer):

WebGPUShadingLanguageRI/MakeArrayRefExpression.js: Addition of type

property, which is based on the type of the lValue and the semantics of
the language (the @ operator yields an array reference with the thread
scope).
(MakeArrayRefExpression):
(MakeArrayRefExpression.prototype.get type):

WebGPUShadingLanguageRI/NativeFunc.js: Add setter/getter for

implementationData to support swizzle operator change
(NativeFunc.prototype.get implementationData):
(NativeFunc.prototype.set implementationData):

WebGPUShadingLanguageRI/Rewriter.js: Use new FunctionLikeBlock

constructor
(Rewriter.prototype.visitFunctionLikeBlock):

WebGPUShadingLanguageRI/StandardLibrary.js:

(_generateSwizzle): Deleted.

WebGPUShadingLanguageRI/SwizzleOp.js: Introduces a new class for

carrying metadata about swizzle operators so that they are implemented
as native functions rather than generated at compile time.
(SwizzleOp):
(SwizzleOp.prototype.get outSize):
(SwizzleOp.prototype.get components):
(SwizzleOp.prototype.get inSize):
(SwizzleOp.prototype.toString):
(SwizzleOp.allSwizzleOperators.):
(SwizzleOp.allSwizzleOperators):

WebGPUShadingLanguageRI/StandardLibrary.js: + (SwizzleOp):

(SwizzleOp.prototype.get outSize):
(SwizzleOp.prototype.get components):
(SwizzleOp.prototype.get inSize):
(SwizzleOp.prototype.toString):
(generateSwizzles):
(_generateSwizzle): Deleted.

WebGPUShadingLanguageRI/Type.js: Addition of isEnum property, as

above.
(Type.prototype.get isEnum):

3:20 PM Changeset in webkit [234174] by Ryan Haddad

2 edits in branches/safari-606-branch/Tools

Cherry-pick r234115. rdar://problem/42557644

DRT relies on [webView display] to call -viewWillDraw on the WebHTMLView
https://bugs.webkit.org/show_bug.cgi?id=187924
<rdar://problem/41745884>

Reviewed by Simon Fraser.

WebKit relies on -viewWillDraw getting called on WebHTMLView, even though that view has not been marked as needing display.

DumpRenderTree/mac/PixelDumpSupportMac.mm: (createBitmapContextFromWebView):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@234115 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:50 PM Changeset in webkit [234173] by tsaunier@gnome.org

3 edits in trunk/LayoutTests

Unreviewed WPE/GTK gardening.

Disabled newly added webrtc tests that depend on implementing WebAudioSourceProviderGStreamer.

Namely:

webrtc/peer-connection-createMediaStreamDestination.html

platform/gtk/TestExpectations:
platform/wpe/TestExpectations:

2:46 PM Changeset in webkit [234172] by commit-queue@webkit.org

21 edits
2 adds in trunk/Source

[Datalist][macOS] Display suggestions for input[type=color]
https://bugs.webkit.org/show_bug.cgi?id=187794

Patch by Aditya Keerthi <Aditya Keerthi> on 2018-07-24
Reviewed by Tim Horton.

Source/WebCore:

html/ColorInputType.cpp:

(WebCore::ColorInputType::shouldRespectListAttribute):

Source/WebCore/PAL:

Added methods to enable customization of NSPopoverColorWell.

PAL.xcodeproj/project.pbxproj:
pal/spi/mac/NSColorWellSPI.h: Added.
pal/spi/mac/NSPopoverColorWellSPI.h: Added.
pal/spi/mac/NSPopoverSPI.h:

Source/WebKit:

An input[type=color] element that has an associated datalist element should
display the color values provided. We now support 1-12 suggested colors, that
will be displayed at the top of the color selection popover. If no suggestions
are specified we keep the existing default colors.

Created an NSPopoverColorWell subclass that allows custom colors to be specified
in the form of an NSColorList.

Also fixed a bug where an additional color well was displayed when clicking on
the input element.

Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<Color>::decode):

Shared/WebCoreArgumentCoders.h:
UIProcess/API/gtk/PageClientImpl.cpp:

(WebKit::PageClientImpl::createColorPicker):

UIProcess/API/gtk/PageClientImpl.h:
UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::showColorPicker):

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::createColorPicker):

UIProcess/mac/PageClientImplMac.h:
UIProcess/mac/PageClientImplMac.mm:

(WebKit::PageClientImpl::createColorPicker):

UIProcess/mac/WebColorPickerMac.h:
UIProcess/mac/WebColorPickerMac.mm:

(WebKit::WebColorPickerMac::create):
(WebKit::WebColorPickerMac::WebColorPickerMac):
(WebKit::WebColorPickerMac::showColorPicker):
(+[WKPopoverColorWell _colorPopoverCreateIfNecessary:]):
(-[WKPopoverColorWell _showPopover]):
(-[WKPopoverColorWell setSuggestedColors:]):
(-[WKColorPopoverMac initWithFrame:inView:]):
(-[WKColorPopoverMac setAndShowPicker:withColor:suggestions:]):
(-[WKColorPanelMac setAndShowPicker:withColor:suggestions:]):

WebProcess/WebCoreSupport/WebColorChooser.cpp:

(WebKit::WebColorChooser::WebColorChooser):
(WebKit::WebColorChooser::reattachColorChooser):

2:42 PM Changeset in webkit [234171] by sbarati@apple.com

4 edits in trunk/Source/JavaScriptCore

Make VM::canUseJIT an inlined function
https://bugs.webkit.org/show_bug.cgi?id=187583

Reviewed by Mark Lam.

We know the answer to this query in initializeThreading after initializing
the executable allocator. This patch makes it so that we just hold this value
in a static variable and have an inlined function that just returns the value
of that static variable.

runtime/InitializeThreading.cpp:

(JSC::initializeThreading):

runtime/VM.cpp:

(JSC::VM::computeCanUseJIT):
(JSC::VM::canUseJIT): Deleted.

runtime/VM.h:

(JSC::VM::canUseJIT):

1:29 PM Changeset in webkit [234170] by Ryan Haddad

3 edits in trunk/LayoutTests

Mark http/tests/workers/service/serviceworkerclients-matchAll.https.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=183705

Unreviewed test gardening.

platform/ios-wk2/TestExpectations:
platform/mac-wk2/TestExpectations:

1:14 PM Changeset in webkit [234169] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Modernize NavigationState
https://bugs.webkit.org/show_bug.cgi?id=187966

Reviewed by Andy Estes.

Don't ignore switch warnings any more.
Use BlockPtr.

UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationAction):
(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationResponse):

1:11 PM Changeset in webkit [234168] by achristensen@apple.com

9 edits in trunk/Source/WebKit

Remove WebFramePolicyListenerProxy::changeWebsiteDataStore
https://bugs.webkit.org/show_bug.cgi?id=187967

Reviewed by Andy Estes.

We need to call WebFrameProxy::changeWebsiteDataStore if the _WKWebsitePolicies has a WKWebsiteDataStore.
We're doing that in a weird way that is not in the right layer. Inside the call to WebFramePolicyListenerProxy::use
we can inform the frame if there's a new WebsiteDataStore.

No change in behavior, as verified by the WebKit.WebsitePoliciesDataStore API test.
This is a step towards using lambdas in WebFramePolicyListenerProxy.

UIProcess/API/APINavigationClient.h:

(API::NavigationClient::decidePolicyForNavigationAction):
(API::NavigationClient::decidePolicyForNavigationResponse):

UIProcess/API/APIPolicyClient.h:

(API::PolicyClient::decidePolicyForNavigationAction):
(API::PolicyClient::decidePolicyForNewWindowAction):
(API::PolicyClient::decidePolicyForResponse):

UIProcess/API/C/WKFramePolicyListener.cpp:

(WKFramePolicyListenerUse):
(WKFramePolicyListenerUseInNewProcess):
(useWithPolicies):

UIProcess/API/C/WKPage.cpp:

(WKPageSetPagePolicyClient):
(WKPageSetPageNavigationClient):

UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationAction):
(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationResponse):

UIProcess/WebFramePolicyListenerProxy.cpp:

(WebKit::WebFramePolicyListenerProxy::use):
(WebKit::WebFramePolicyListenerProxy::changeWebsiteDataStore): Deleted.

UIProcess/WebFramePolicyListenerProxy.h:
UIProcess/WebPageProxy.cpp:
UIProcess/mac/PageClientImplMac.mm:

12:57 PM Changeset in webkit [234167] by Ryan Haddad

24 edits
6 deletes in trunk

Unreviewed, rolling out r234121.

Caused perf test failures.

Reverted changeset:

"We should cache the compiled sandbox profile in a data vault"
https://bugs.webkit.org/show_bug.cgi?id=184991
https://trac.webkit.org/changeset/234121

12:35 PM Changeset in webkit [234166] by graouts@webkit.org

2 edits in trunk/Source/WebCore

[Web Animations] Add an ASSERT() to check the contract that a CSSTransition has a valid effect in setTimingProperties()
https://bugs.webkit.org/show_bug.cgi?id=187954

Reviewed by Dean Jackson.

animation/CSSTransition.cpp:

(WebCore::CSSTransition::setTimingProperties):

12:32 PM Changeset in webkit [234165] by graouts@webkit.org

3 edits
2 adds in trunk

[Web Animations] Crash when setting an animation style on an existing animation that had its effect set to null
https://bugs.webkit.org/show_bug.cgi?id=187953

Reviewed by Dean Jackson.

Source/WebCore:

Test: webanimations/setting-css-animation-timing-property-via-style-after-clearing-effect.html

Ensure that we have a valid effect before proceeding to update its timing.

animation/CSSAnimation.cpp:

(WebCore::CSSAnimation::syncPropertiesWithBackingAnimation):

LayoutTests:

Add a new test that sets an animation property via style after setting the initial animation's effect to null.

webanimations/setting-css-animation-timing-property-via-style-after-clearing-effect-expected.txt: Added.
webanimations/setting-css-animation-timing-property-via-style-after-clearing-effect.html: Added.

12:31 PM Changeset in webkit [234164] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

[MediaStream] Restructure getDisplayMedia classes
https://bugs.webkit.org/show_bug.cgi?id=187905
<rdar://problem/42500215>

Unreviewed build fix.

platform/mediastream/mac/DisplayCaptureSourceCocoa.cpp:

12:30 PM Changeset in webkit [234163] by graouts@webkit.org

3 edits
2 adds in trunk

[Web Animations] Crash when setting "animation: none" after clearing an animation's effect
https://bugs.webkit.org/show_bug.cgi?id=187952

Reviewed by Dean Jackson.

Source/WebCore:

Test: webanimations/setting-css-animation-none-after-clearing-effect.html

We need to ensure that the animation we're trying to remove has not had its effect cleared via the
Web Animations API since its creation before trying to check its phase.

animation/AnimationTimeline.cpp:

(WebCore::AnimationTimeline::cancelOrRemoveDeclarativeAnimation):

LayoutTests:

Add a new test that checks that setting "animation: none" on an element that previously had a valid
CSS animation and for which the effect was set to null does not crash.

webanimations/setting-css-animation-none-after-clearing-effect-expected.txt: Added.
webanimations/setting-css-animation-none-after-clearing-effect.html: Added.

12:29 PM Changeset in webkit [234162] by bshafiei@apple.com

3 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234158. rdar://problem/42551556

[Cocoa] Stop crashing in lastResortFallbackFont()
https://bugs.webkit.org/show_bug.cgi?id=187936

Reviewed by Jon Lee.

CoreText can get into a state where both Times and Lucida Grande are inaccessible.
Instead of crashing, we should use the real LastResort, which is backed by a section
in the .rodata of the CoreText dylib, and as such should always exist.

platform/graphics/FontCache.cpp: (WebCore::FontCache::fontForFamily):
platform/graphics/cocoa/FontCacheCoreText.cpp: (WebCore::FontCache::lastResortFallbackFont):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:28 PM Changeset in webkit [234161] by graouts@webkit.org

3 edits
2 adds in trunk

[Web Animations] Crash accessing CSSAnimation::bindingsCurrentTime when effect has been set to null
https://bugs.webkit.org/show_bug.cgi?id=187950
<rdar://problem/42515747>

Reviewed by Dean Jackson.

Source/WebCore:

Test: webanimations/accessing-current-time-after-clearing-css-animation-effect.html

While a CSSAnimation has an effect created for it by the implementation, the developer may yet manipulate
its effect via the Web Animations API and set it to null. As such, we must not assume it's always non-null.

animation/CSSAnimation.cpp:

(WebCore::CSSAnimation::bindingsCurrentTime const):

LayoutTests:

Add a new test where we check that the current time of a CSSAnimation can be accessed after setting its effect to null.

webanimations/accessing-current-time-after-clearing-css-animation-effect-expected.txt: Added.
webanimations/accessing-current-time-after-clearing-css-animation-effect.html: Added.

12:02 PM Changeset in webkit [234160] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Placate exception check verification after recent changes.
https://bugs.webkit.org/show_bug.cgi?id=187961
<rdar://problem/42545394>

Reviewed by Saam Barati.

runtime/IntlObject.cpp:

(JSC::intlNumberOption):

11:48 AM Changeset in webkit [234159] by Alan Bujtas

2 edits in trunk/Source/WebCore

[LFC][IFC] BlockContainer::establishesInlineFormattingContext should only check the first inflow child.
https://bugs.webkit.org/show_bug.cgi?id=187965

Reviewed by Antti Koivisto.

layout/layouttree/LayoutBlockContainer.cpp:

(WebCore::Layout::BlockContainer::establishesInlineFormattingContext const):

11:34 AM Changeset in webkit [234158] by mmaxfield@apple.com

3 edits in trunk/Source/WebCore

[Cocoa] Stop crashing in lastResortFallbackFont()
https://bugs.webkit.org/show_bug.cgi?id=187936

Reviewed by Jon Lee.

CoreText can get into a state where both Times and Lucida Grande are inaccessible.
Instead of crashing, we should use the real LastResort, which is backed by a section
in the .rodata of the CoreText dylib, and as such should always exist.

platform/graphics/FontCache.cpp:

(WebCore::FontCache::fontForFamily):

platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::FontCache::lastResortFallbackFont):

10:47 AM Changeset in webkit [234157] by jeffm@apple.com

4 edits in trunk/Source/WebKit

WKUIDelegate needs an alternate decideDatabaseQuotaForSecurityOrigin method that provides the database name and display name
https://bugs.webkit.org/show_bug.cgi?id=187567

Reviewed by Alex Christensen.

UIProcess/API/Cocoa/WKUIDelegatePrivate.h:

Declare alternate decideDatabaseQuotaForSecurityOrigin method, copying the existing FIXME comment
from the old method.

UIProcess/Cocoa/UIDelegate.h:

Add flag for new delegate method.

UIProcess/Cocoa/UIDelegate.mm:

(WebKit::UIDelegate::setDelegate):
Initialize new flag.

(WebKit::UIDelegate::UIClient::exceededDatabaseQuota):
Prefer the new UIDelegate method that takes the database name and display name, falling back to the
existing method if the client doesn't implement it.

10:40 AM Changeset in webkit [234156] by stephan.szabo@sony.com

4 edits in trunk/Source/WebKit

[WinCairo] Add support to WebView for setting tooltips
https://bugs.webkit.org/show_bug.cgi?id=187930

Reviewed by Fujii Hironori.

UIProcess/win/PageClientImpl.cpp:

(WebKit::PageClientImpl::toolTipChanged): Set tooltip on WebView

UIProcess/win/WebView.cpp:

(WebKit::WebView::setToolTip): Add support for updating the
tooltip text in Windows.

UIProcess/win/WebView.h:

10:31 AM Changeset in webkit [234155] by Jon Davis

2 edits in trunk/Websites/webkit.org

Disable some vestibular trigger animations when prefers-reduced-motion is active.
https://bugs.webkit.org/show_bug.cgi?id=186529

Reviewed by Dean Jackson.

wp-content/themes/webkit/style.css:

(@media (prefers-reduced-motion)): Added to honor reduced motion settings.
(article,): Added to only use fade-in animation and prevent motion.

10:27 AM Changeset in webkit [234154] by achristensen@apple.com

11 edits in trunk/Source/WebKit

Reduce getters/setters in WebFramePolicyListenerProxy
https://bugs.webkit.org/show_bug.cgi?id=187830

Reviewed by Dean Jackson.

This is a step towards making it a lambda, which has no getters or setters.
No change in behavior.

setApplyPolicyInNewProcessIfPossible can be replaced by passing another parameter.
This bit was just piggy-backing on the WebFramePolicyListenerProxy.

isMainFrame was only used in an assert, which has a corresponding ObjC exception in
NavigationState::NavigationClient::decidePolicyForNavigationAction for the one relevant client.

UIProcess/API/C/WKFramePolicyListener.cpp:

(WKFramePolicyListenerUseInNewProcess):
(useWithPolicies):
(WKFramePolicyListenerUseWithPolicies):
(WKFramePolicyListenerUseInNewProcessWithPolicies):

UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationAction):

UIProcess/WebFramePolicyListenerProxy.cpp:

(WebKit::WebFramePolicyListenerProxy::receivedPolicyDecision):
(WebKit::WebFramePolicyListenerProxy::use):
(WebKit::WebFramePolicyListenerProxy::download):
(WebKit::WebFramePolicyListenerProxy::ignore):
(WebKit::WebFramePolicyListenerProxy::isMainFrame const): Deleted.

UIProcess/WebFramePolicyListenerProxy.h:

(WebKit::WebFramePolicyListenerProxy::setApplyPolicyInNewProcessIfPossible): Deleted.
(WebKit::WebFramePolicyListenerProxy::applyPolicyInNewProcessIfPossible const): Deleted.

UIProcess/WebFrameProxy.cpp:

(WebKit::WebFrameProxy::receivedPolicyDecision):

UIProcess/WebFrameProxy.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::receivedPolicyDecision):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):

UIProcess/WebPageProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::processForNavigation):
(WebKit::WebProcessPool::processForNavigationInternal):

UIProcess/WebProcessPool.h:

10:25 AM Changeset in webkit [234153] by achristensen@apple.com

4 edits in trunk/Source/WebKit

Remove WebFramePolicyListenerProxy::invalidate
https://bugs.webkit.org/show_bug.cgi?id=187833

Reviewed by Dean Jackson.

When we're invalidating the listener, calling ignore instead will at worst cause
an ignored message to be sent. The load will be cancelled either way.
Removing the invalidate method gets it closer to being a lambda.

UIProcess/WebFramePolicyListenerProxy.cpp:

(WebKit::WebFramePolicyListenerProxy::invalidate): Deleted.

UIProcess/WebFramePolicyListenerProxy.h:
UIProcess/WebFrameProxy.cpp:

(WebKit::WebFrameProxy::webProcessWillShutDown):
(WebKit::WebFrameProxy::setUpPolicyListenerProxy):

10:23 AM Changeset in webkit [234152] by bshafiei@apple.com

3 edits in branches/safari-606-branch/Source/JavaScriptCore

Cherry-pick r234106. rdar://problem/42545682

Add some asserts to help diagnose a crash.
https://bugs.webkit.org/show_bug.cgi?id=187915
<rdar://problem/42508166>

Reviewed by Michael Saboff.

Add some asserts to verify that an CodeBlock alternative should always have a
non-null jitCode. Also change a RELEASE_ASSERT_NOT_REACHED() in
CodeBlock::setOptimizationThresholdBasedOnCompilationResult() to a RELEASE_ASSERT()
so that we'll retain the state of the variables that failed the assertion (again
to help with diagnosis).

bytecode/CodeBlock.cpp: (JSC::CodeBlock::setAlternative): (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
dfg/DFGPlan.cpp: (JSC::DFG::Plan::Plan):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234106 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:16 AM Changeset in webkit [234151] by bshafiei@apple.com

7 edits in branches/safari-606-branch/Source

Versioning.

9:43 AM Changeset in webkit [234150] by commit-queue@webkit.org

2 edits in trunk/Tools

[Flatpak] Add openh264 as needed by WebRTC
https://bugs.webkit.org/show_bug.cgi?id=187956

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

flatpak/org.webkit.WebKit.yaml:

9:29 AM Changeset in webkit [234149] by dbates@webkit.org

11 edits
7 adds in trunk

Cannot view PDF's on my.gov.au: "Refused to load https://my.gov.au/attachment/viewAttachment because it
appears in neither the object-src directive nor the default-src directive of the Content Security Policy"
https://bugs.webkit.org/show_bug.cgi?id=187870
<rdar://problem/41190880>

Reviewed by Dean Jackson.

Source/WebCore:

Fixes an issue where opening attachments on my.gov.au would show a "Blocked Plug-in" message.

Opening an attachment on my.gov.au opens a same-origin plugin document in a child window. Currently
same-origin plugin documents inherit their CSP policy from their opener. If the opener's CSP policy
disallows embedding plugins then the plugin document would be blocked from loading a plugin. For now
we relax the inheritance model such that we only inherit the plugin-types and report-uri directives
from the opener.

Developers that want to block plugin content from being loaded in a same-origin child window must now
serve such plugin content with a CSP policy that includes "object-src 'none'". This matches the behavior
described in the second Note in section object-src of the CSP 3 spec: <https://w3c.github.io/webappsec-csp/#directive-object-src>
(Editor's Draft, 10 July 2018). It also makes the behavior in WebKit more closely aligned with the
behavior of Chrome and Firefox.

Tests: http/tests/security/contentSecurityPolicy/same-origin-plugin-document-allowed-in-child-window.html

http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report.php
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-with-csp-blocked-in-child-window.html

dom/Document.cpp:

(WebCore::Document::initContentSecurityPolicy): For plugin documents that have an opener call ContentSecurityPolicy::createPolicyForPluginDocumentFrom()
to only inherit the plugin-types and report-uri directives from its opener's CSP policy. Otherwise, call ContentSecurityPolicy::copyStateFrom()
to inherit all directives from the owner frame as we do now.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::createPolicyForPluginDocumentFrom): Create a new policy from the specified policy
inheriting only the plugin-types and report-uri directives.

page/csp/ContentSecurityPolicy.h: Define a new PolicyFrom enumerator, InheritedForPluginDocument, for plugin documents

loaded in a child window.

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::parse): When policyFrom is InheritedForPluginDocument then only
recognize the plugin-types and report-uri directives when parsing the policy.

LayoutTests:

Add new tests and fix up the existing test http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window.html
so that still tests a scenario where a same-origin plugin document loaded in a child window is blocked from
loading its plugin now that that "object-src: 'none'" is no longer inherited by the plugin document.

http/tests/plugins/resources/plugin-document-alert-and-notify-done.pl:
http/tests/security/contentSecurityPolicy/resources/checkDidSameOriginChildWindowLoad.js: Added.

(checkDidSameOriginChildWindowLoadAndNotifyDone):
(checkDidLoad):

http/tests/security/contentSecurityPolicy/same-origin-plugin-document-allowed-in-child-window-expected.txt: Added.
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-allowed-in-child-window.html: Added.
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-expected.txt:
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report-expected.txt: Added.
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report.php: Added.
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window.html:
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-with-csp-blocked-in-child-window-expected.txt: Added.
http/tests/security/contentSecurityPolicy/same-origin-plugin-document-with-csp-blocked-in-child-window.html: Added.
platform/ios/TestExpectations: Skip the included tests as we do not support plugins on iOS.
platform/win/TestExpectations: Skip the included tests as plugins do not seem to work on Windows. We currently skip many

(if not all) plugin tests on Windows despite <rdar://problem/5074411> being marked as Closed (why?).

9:27 AM Changeset in webkit [234148] by dbates@webkit.org

5 edits in trunk/Source/WebCore

Rename Document::firstPartyForSameSiteCookies() to siteForCookies()
https://bugs.webkit.org/show_bug.cgi?id=187892

Reviewed by Dean Jackson.

Standardize on the spec. language "site for cookies" for the names of the setter and getter
on Document. The latest description of Same-Site cookies is in <https://httpwg.org/http-extensions/rfc6265bis.html>.

No functionality changed. So, no new tests.

dom/Document.h:

(WebCore::Document::siteForCookies const):
(WebCore::Document::setSiteForCookies):
(WebCore::Document::firstPartyForSameSiteCookies const): Deleted.
(WebCore::Document::setFirstPartyForSameSiteCookies): Deleted.

loader/FrameLoader.cpp:

(WebCore::FrameLoader::setFirstPartyForCookies):
(WebCore::FrameLoader::addSameSiteInfoToRequestIfNeeded):

workers/service/context/ServiceWorkerThreadProxy.cpp:

(WebCore::createPageForServiceWorker):

xml/XSLTProcessor.cpp:

(WebCore::XSLTProcessor::createDocumentFromSource):

8:15 AM Changeset in webkit [234147] by Ross Kirsling

4 edits in trunk

WebCore::URL::hostIsIPAddress needs a Windows implementation
https://bugs.webkit.org/show_bug.cgi?id=187859

Reviewed by Fujii Hironori.

Source/WebCore:

platform/URL.cpp:

(WebCore::isIPv4Address): Added.
(WebCore::isIPv6Address): Added.
(WebCore::URL::hostIsIPAddress):
Turn this stub into a platform-agnostic default implementation.

Tools:

TestWebKitAPI/Tests/WebCore/URL.cpp:

Check for a few other ways an IP address could be invalid.

8:04 AM Changeset in webkit [234146] by eric.carlson@apple.com

10 edits in trunk/Source/WebCore

[MediaStream] Restructure getDisplayMedia classes
https://bugs.webkit.org/show_bug.cgi?id=187905

Reviewed by Dean Jackson.

No new tests, no functional changes.

platform/mediastream/CaptureDeviceManager.h:

(WebCore::CaptureDeviceManager::refreshCaptureDevices): Deleted, no need for it to be a
virtual method.

platform/mediastream/mac/AVCaptureDeviceManager.h:

platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.h: refreshCaptureDevices is

no longer virtual.

platform/mediastream/mac/DisplayCaptureManagerCocoa.cpp:

(WebCore::DisplayCaptureManagerCocoa::captureDevices):
(WebCore::DisplayCaptureManagerCocoa::updateDisplayCaptureDevices): Moved functionality
to ScreenDisplayCaptureSourceMac.
(WebCore::DisplayCaptureManagerCocoa::screenCaptureDeviceWithPersistentID): Ditto.
(WebCore::displayReconfigurationCallBack): Deleted, moved to ScreenDisplayCaptureSourceMac.
(WebCore::DisplayCaptureManagerCocoa::~DisplayCaptureManagerCocoa): Deleted.
(WebCore::DisplayCaptureManagerCocoa::refreshCaptureDevices): Deleted.

platform/mediastream/mac/DisplayCaptureManagerCocoa.h:

platform/mediastream/mac/DisplayCaptureSourceCocoa.cpp:

(WebCore::roundUpToMacroblockMultiple): Moved from ScreenDisplayCaptureSourceMac.
(WebCore::DisplayCaptureSourceCocoa::applySize): Ditto.
(WebCore::DisplayCaptureSourceCocoa::sampleBufferFromPixelBuffer): Ditto.
(WebCore::DisplayCaptureSourceCocoa::pixelBufferFromIOSurface): Ditto.

platform/mediastream/mac/DisplayCaptureSourceCocoa.h:

platform/mediastream/mac/ScreenDisplayCaptureSourceMac.h:
platform/mediastream/mac/ScreenDisplayCaptureSourceMac.mm:

(WebCore::updateDisplayID):
(WebCore::ScreenDisplayCaptureSourceMac::createDisplayStream): Fix log message.
(WebCore::ScreenDisplayCaptureSourceMac::startDisplayStream): Ditto.
(WebCore::ScreenDisplayCaptureSourceMac::applySize): Update for base class changes.
(WebCore::ScreenDisplayCaptureSourceMac::applyFrameRate): Ditto.
(WebCore::ScreenDisplayCaptureSourceMac::frameAvailable): Ditto.
(WebCore::ScreenDisplayCaptureSourceMac::screenCaptureDeviceWithPersistentID): Moved from
DisplayCaptureManagerCocoa.
(WebCore::ScreenDisplayCaptureSourceMac::screenCaptureDevices): Ditto.
(WebCore::roundUpToMacroblockMultiple): Moved to DisplayCaptureSourceCocoa.
(WebCore::ScreenDisplayCaptureSourceMac::updateDisplayID): Ditto.
(WebCore::ScreenDisplayCaptureSourceMac::sampleBufferFromPixelBuffer): Ditto.
(WebCore::ScreenDisplayCaptureSourceMac::pixelBufferFromIOSurface): Ditto.

7:47 AM Changeset in webkit [234145] by Alan Bujtas

7 edits
1 add in trunk/Source/WebCore

[LFC] Move geometry data structures to a dedicated file
https://bugs.webkit.org/show_bug.cgi?id=187939

Reviewed by Antti Koivisto.

WebCore.xcodeproj/project.pbxproj:
layout/FormattingContext.h:

(WebCore::Layout::FormattingContext::Geometry::Position::operator LayoutPoint const): Deleted.

layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedVerticalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedHorizontalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedHorizontalGeometry):
(WebCore::Layout::FormattingContext::Geometry::floatingNonReplacedHeightAndMargin):
(WebCore::Layout::FormattingContext::Geometry::floatingNonReplacedWidthAndMargin):
(WebCore::Layout::FormattingContext::Geometry::floatingReplacedHeightAndMargin):
(WebCore::Layout::FormattingContext::Geometry::floatingReplacedWidthAndMargin):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowVerticalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowHorizontalGeometry):
(WebCore::Layout::FormattingContext::Geometry::floatingHeightAndMargin):
(WebCore::Layout::FormattingContext::Geometry::floatingWidthAndMargin):
(WebCore::Layout::FormattingContext::Geometry::inlineReplacedHeightAndMargin):
(WebCore::Layout::FormattingContext::Geometry::inlineReplacedWidthAndMargin):
(WebCore::Layout::FormattingContext::Geometry::computedBorder):
(WebCore::Layout::FormattingContext::Geometry::computedPadding):
(WebCore::Layout::FormattingContext::Geometry::computedNonCollapsedHorizontalMarginValue):
(WebCore::Layout::FormattingContext::Geometry::computedNonCollapsedVerticalMarginValue):

layout/blockformatting/BlockFormattingContext.h:
layout/blockformatting/BlockFormattingContextGeometry.cpp:

(WebCore::Layout::BlockFormattingContext::Geometry::inFlowNonReplacedHeightAndMargin):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowNonReplacedWidthAndMargin):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowReplacedWidthAndMargin):
(WebCore::Layout::BlockFormattingContext::Geometry::staticPosition):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowPositionedPosition):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowHeightAndMargin):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowWidthAndMargin):

layout/displaytree/DisplayBox.h:

(WebCore::Display::Box::setHorizontalMargin):
(WebCore::Display::Box::setVerticalMargin):
(WebCore::Display::Box::setVerticalNonCollapsedMargin):
(WebCore::Display::Box::setBorder):
(WebCore::Display::Box::setPadding):

7:40 AM Changeset in webkit [234144] by cturner@igalia.com

2 edits in trunk/Tools

[Flatpak] Avoid consuming unknown arguments in flatpak wrapper
https://bugs.webkit.org/show_bug.cgi?id=187951

When running run-webkit-tests --wpe --debug, it was observed that
both self.platform != 'wpe' and self.debug != True. This turned
out to be because of the "args" argument consuming the remainder
of future arguments that came after it. Since the first argument
to load_from_args was the test script to run, it would end up
never processing the other arguments supplied to the wrapper
script.

Tested this by rebuilding GTK in debug mode, running the
minibrowser with various extra options, and running some tests
with various extra options.

Reviewed by Michael Catanzaro.

flatpak/flatpakutils.py:

(WebkitFlatpak.load_from_args):

7:16 AM WebKitGTK/2.20.x edited by Michael Catanzaro

Propose r229282 (resolves bug #183788) (diff)

6:22 AM Changeset in webkit [234143] by Chris Dumez

5 edits in trunk/Source/WebKit

WebFullScreenManagerProxy does not need to be ref counted
https://bugs.webkit.org/show_bug.cgi?id=187928

Reviewed by Eric Carlson.

WebFullScreenManagerProxy does not need to be ref counted, it is owned by WebPageProxy.
It is also error-prone because WebFullScreenManagerProxy has a raw pointer to its WebPageProxy
and anybody could extend the lifetime of the WebFullScreenManagerProxy by refing it, which
would make the WebPageProxy pointer stale.

UIProcess/WebFullScreenManagerProxy.cpp:

(WebKit::WebFullScreenManagerProxy::WebFullScreenManagerProxy):
(WebKit::WebFullScreenManagerProxy::willEnterFullScreen):
(WebKit::WebFullScreenManagerProxy::didEnterFullScreen):
(WebKit::WebFullScreenManagerProxy::willExitFullScreen):
(WebKit::WebFullScreenManagerProxy::didExitFullScreen):
(WebKit::WebFullScreenManagerProxy::setAnimatingFullScreen):
(WebKit::WebFullScreenManagerProxy::requestExitFullScreen):
(WebKit::WebFullScreenManagerProxy::saveScrollPosition):
(WebKit::WebFullScreenManagerProxy::restoreScrollPosition):
(WebKit::WebFullScreenManagerProxy::setFullscreenInsets):
(WebKit::WebFullScreenManagerProxy::setFullscreenAutoHideDuration):
(WebKit::WebFullScreenManagerProxy::setFullscreenControlsHidden):
(WebKit::WebFullScreenManagerProxy::invalidate):

UIProcess/WebFullScreenManagerProxy.h:
UIProcess/WebPageProxy.cpp:

(WebKit::m_resetRecentCrashCountTimer):
(WebKit::WebPageProxy::reattachToWebProcess):

UIProcess/WebPageProxy.h:

3:50 AM Changeset in webkit [234142] by zandobersek@gmail.com

1 edit
32 adds in trunk/LayoutTests

Unreviewed WPE gardening.

Adding WPE-specific baselines for WebGL2 conformance tests that are
already passing on this port.

platform/wpe/webgl: Added.
platform/wpe/webgl/2.0.0: Added.
platform/wpe/webgl/2.0.0/conformance2: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-as-return-value-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-assign-constructor-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-assign-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-complex-indexing-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-element-increment-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-equality-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/array-in-complex-expression-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/bool-type-cast-bug-uint-ivec-uvec-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/compare-structs-containing-arrays-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/compound-assignment-type-combination-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/const-array-init-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/forbidden-operators-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/frag-depth-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/invalid-default-precision-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/invalid-invariant-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/loops-with-side-effects-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/misplaced-version-directive-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/sampler-no-precision-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/sequence-operator-returns-non-constant-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/shader-linking-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/short-circuiting-in-loop-condition-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/texture-offset-uniform-texture-coordinate-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/tricky-loop-conditions-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/uniform-block-layout-match-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/uniform-block-layouts-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/valid-invariant-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/vector-dynamic-indexing-expected.txt: Added.
platform/wpe/webgl/2.0.0/conformance2/glsl3/vector-dynamic-indexing-nv-driver-bug-expected.txt: Added.

2:08 AM Changeset in webkit [234141] by commit-queue@webkit.org

5 edits in trunk/Source

[GStreamer] Implement bitrate modulation support in GStreamer based libwebrtc Encoders
https://bugs.webkit.org/show_bug.cgi?id=187643

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

Source/WebCore:

Problem being that we do not have a proper unified encoder API in GStreamer, some work
started at https://bugzilla.gnome.org/show_bug.cgi?id=796716 but it is quite controversial
and meanwhile we should just move forward working around that limitation.

Source/WebCore:

platform/mediastream/libwebrtc/GStreamerVideoEncoderFactory.cpp:

(WebCore::GStreamerVideoEncoder::GStreamerVideoEncoder):
(WebCore::GStreamerVideoEncoder::InitEncode):
(WebCore::GStreamerVideoEncoder::getBitrateSetter):
(WebCore::GStreamerVideoEncoder::createEncoder):
(WebCore::GStreamerVideoEncoder::AddCodecIfSupported):
(WebCore::GStreamerVideoEncoder::SetRestrictionCaps):
(WebCore::GStreamerVideoEncoder::CreateEncoder): Deleted.

Source/WTF:

Added support for GRegex in GRefPtr.

Source/WTF:

wtf/glib/GRefPtr.cpp:

(WTF::refGPtr):
(WTF::derefGPtr):

wtf/glib/GRefPtr.h:

1:55 AM Changeset in webkit [234140] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

REGRESSION(r234055): inverted return values in MediaPlayer::wouldTaintOrigin()
https://bugs.webkit.org/show_bug.cgi?id=187944

Reviewed by Carlos Garcia Campos.

The MediaPlayer::wouldTaintOrigin(), as introduced in r234055, should
return false when the URL protocol is data:, and should return true
when the given SecurityOrigin cannot access the media URL.

This matches behavior of CanvasRenderingContext::wouldTaintOrigin()
which the new method falls back to when the MediaPlayerPrivate
implementation doesn't or can't determine the would-taint result.

This fixes a bunch of failing and timing-out WebGL test cases on ports
using GStreamer (on which the MediaPlayerPrivate derivate doesn't
implement the wouldTaintOrigin() method).

platform/graphics/MediaPlayer.cpp:

(WebCore::MediaPlayer::wouldTaintOrigin const):

1:54 AM Changeset in webkit [234139] by zandobersek@gmail.com

10 edits in trunk/Source

[TextureMapper] Separate repaint counter state from debug visuals
https://bugs.webkit.org/show_bug.cgi?id=187946

Reviewed by Carlos Garcia Campos.

Instead of managing the repaint counter visibility along with the
debug border visuals, do that together with the repaint count value.

Source/WebCore:

TextureMapperLayer::setRepaintCount() is renamed to setRepaintCounter()
and now also sets the repaint counter visibility state instead of the
setDebugVisuals() method.

GraphicsLayerTextureMapper implementation is adjusted appropriately.
The unused setRepaintCount() method is also removed.

CoordinatedGraphicsLayerState now holds repaint counter state (both
visibility and count value) in a struct that's separate from debug
border state. CoordinatedGraphicsLayer implementation now updates
that state accordingly.

No new tests -- no change in behavior.

platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:

(WebCore::GraphicsLayerTextureMapper::setShowRepaintCounter):
(WebCore::GraphicsLayerTextureMapper::commitLayerChanges):
(WebCore::GraphicsLayerTextureMapper::setRepaintCount): Deleted.

platform/graphics/texmap/GraphicsLayerTextureMapper.h:
platform/graphics/texmap/TextureMapperLayer.cpp:

(WebCore::TextureMapperLayer::setDebugVisuals):
(WebCore::TextureMapperLayer::setRepaintCounter):
(WebCore::TextureMapperLayer::setRepaintCount): Deleted.

platform/graphics/texmap/TextureMapperLayer.h:
platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::didUpdateTileBuffers):
(WebCore::CoordinatedGraphicsLayer::setShowRepaintCounter):
(WebCore::CoordinatedGraphicsLayer::syncLayerState):

platform/graphics/texmap/coordinated/CoordinatedGraphicsState.h:

(WebCore::CoordinatedGraphicsLayerState::CoordinatedGraphicsLayerState):
(WebCore::DebugVisuals::DebugVisuals): Deleted.

Source/WebKit:

In the CoordinatedGraphicsScene class, remove the helper
setLayerRepaintCountIfNeeded() method that's only been called in one
place, and instead set the repaint count information on the
TextureMapperLayer object directly from setLayerState(). The repaint
counter visiblity and count value are gathered from the new struct
that's kept on the CoordinatedGraphicsLayerState object.

Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:

(WebKit::CoordinatedGraphicsScene::setLayerState):
(WebKit::CoordinatedGraphicsScene::setLayerRepaintCountIfNeeded): Deleted.

Shared/CoordinatedGraphics/CoordinatedGraphicsScene.h:

1:24 AM Changeset in webkit [234138] by commit-queue@webkit.org

26 edits
6 adds in trunk

.:
[WPE][GTK] Implement PeerConnection API on top of libwebrtc
https://bugs.webkit.org/show_bug.cgi?id=186932

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

Source/cmake/FindGStreamer.cmake: Look for gstreamer-codecparser as it needed for GStreamerVideoDecoder

Source/ThirdParty/libwebrtc:
[WPE][GTK] Implement PeerConnection API on top of libwebrtc
https://bugs.webkit.org/show_bug.cgi?id=186932

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

CMakeLists.txt: Properly set our build as WEBRTC_WEBKIT_BUILD

Source/WebCore:
[WPE][GTK] Implement PeerConnection API on top of libwebrtc
https://bugs.webkit.org/show_bug.cgi?id=186932

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

Enabled many webrtc tests.

platform/GStreamer.cmake: Build new files
platform/graphics/gstreamer/GStreamerCommon.cpp: Fix minor style issues
platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp: Add a way to give precise name to pipelines

and give useful names to pipelines with sources comming from a PeerConnection

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Ditto.
platform/mediastream/gstreamer/GStreamerVideoFrameLibWebRTC.cpp: Added. Implement a subclass of webrtc::VideoFrame

to represent a kNative GStreamer video frame.

platform/mediastream/gstreamer/GStreamerVideoFrameLibWebRTC.h: Added. Ditto.
platform/mediastream/gstreamer/RealtimeIncomingAudioSourceLibWebRTC.cpp: Handle incoming audio samples from libwebrtc.
platform/mediastream/gstreamer/RealtimeIncomingAudioSourceLibWebRTC.h: Ditto.
platform/mediastream/gstreamer/RealtimeIncomingVideoSourceLibWebRTC.cpp: Handle incoming video frames from libwebrtc.
platform/mediastream/gstreamer/RealtimeIncomingVideoSourceLibWebRTC.h: Ditto.
platform/mediastream/gstreamer/RealtimeOutgoingAudioSourceLibWebRTC.cpp: Handle passing locally captured audio sample to libwebrtc.
platform/mediastream/gstreamer/RealtimeOutgoingAudioSourceLibWebRTC.h: Ditto.
platform/mediastream/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp: Handle passing locally captured vidoe frames to libwebrtc.
platform/mediastream/libwebrtc/GStreamerVideoDecoderFactory.cpp: Added. Implement a video decoder factory and LibWebRTC Video decoders based on GStreamer.
platform/mediastream/libwebrtc/GStreamerVideoDecoderFactory.h: Added. Ditto.
platform/mediastream/libwebrtc/GStreamerVideoEncoderFactory.cpp: Added. Implement a video encoder factory and LibWebRTC H264/VP8 Video encoders based on GStreamer.
platform/mediastream/libwebrtc/GStreamerVideoEncoderFactory.h: Added. Ditto.
platform/mediastream/libwebrtc/LibWebRTCAudioFormat.h: Add information about signness of the LibWebRTC audio format.
platform/mediastream/libwebrtc/LibWebRTCProviderGlib.cpp: Add support for newly added Encoder/Decoder factories.
platform/mediastream/libwebrtc/LibWebRTCProviderGlib.h: Ditto.

Source/WebKit:
[WPE][GTK] Implement WebRTC based on libwebrtc
https://bugs.webkit.org/show_bug.cgi?id=186932

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

WebProcess/Network/webrtc/LibWebRTCProvider.h: Use LibWebRTCProviderGlib when building WPE or GTK ports.

LayoutTests:
[WPE][GTK] Implement PeerConnection API on top of libwebrtc
https://bugs.webkit.org/show_bug.cgi?id=186932

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

platform/gtk/TestExpectations: Enable webrtc tests.

1:15 AM Changeset in webkit [234137] by commit-queue@webkit.org

2 edits in trunk/Tools

[Flatpak] Remove now unnecessary 'hacks' for running tests
https://bugs.webkit.org/show_bug.cgi?id=187608

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-07-24
Reviewed by Philippe Normand.

We used to need to not share X11 with the sandbox when running tests
but it is not needed anymore as we do not mount /tmp on /tmp in the
sandbox (we mount it on /run/host/tmp now).

This has the advantage of making running the MiniBrowser to display test
results working again.

flatpak/flatpakutils.py:

(WebkitFlatpak.clean_args):
(WebkitFlatpak.run_in_sandbox):
(WebkitFlatpak._cleanup_faltpak_args_for_tests_if_needed): Deleted.

1:14 AM Changeset in webkit [234136] by krit@webkit.org

3 edits
2 adds in trunk

[css-masking] Black backdrop on -webkit-clip-path on SVG root
https://bugs.webkit.org/show_bug.cgi?id=187880

Source/WebCore:

Reviewed by Simon Fraser.

For SVG document root elements, we currently clip twice:
In RenderLayer and SVGRenderSupport.
Avoid clipping in RenderLayer which currently clips before we established a
backdrop for an SVG document.

Tests: svg/clip-path/clip-path-on-svg-005-expected.svg

svg/clip-path/clip-path-on-svg-005.svg

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::setupClipPath): Skip actual clipping.

LayoutTests:

Avoid duplicated clip in RenderLayer.

Reviewed by Simon Fraser.

svg/clip-path/clip-path-on-svg-005-expected.svg: Added.
svg/clip-path/clip-path-on-svg-005.svg: Added.

12:34 AM Changeset in webkit [234135] by zandobersek@gmail.com

3 edits in trunk/Source/WebCore

[Nicosia] Add TextureMapperAnimations member to CompositingLayer::LayerState
https://bugs.webkit.org/show_bug.cgi?id=187941

Reviewed by Carlos Garcia Campos.

Nicosia::CompositingLayer::LayerState gains a TextureMapperAnimations
member that will be assigned a list of all active animations during each
layer flush. Despite the name, TextureMapperAnimations doesn't depend on
any other TextureMapper class. It might be renamed and moved in the
future, but for now it's used as-is.

In CoordinatedGraphicsLayer, the syncAnimations() method now flips on
the animationsChanged flag in the LayerState::Delta struct. This causes
all the active animations to be copied over into the layer state in
flushCompositingStateForThisLayerOnly().

platform/graphics/nicosia/NicosiaPlatformLayer.h:
platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::syncAnimations):
(WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):

12:28 AM Changeset in webkit [234134] by zandobersek@gmail.com

3 edits in trunk/Source/WebCore

[Nicosia] Add FilterOperations member to CompositionLayer::LayerState
https://bugs.webkit.org/show_bug.cgi?id=187901

Reviewed by Carlos Garcia Campos.

Nicosia::CompositionLayer::LayerState gains a FilterOperations member
that can be assigned the list of filter operations for a given layer.
The corresponding filtersChanged boolean is added to LayerState::Delta.

CoordinatedGraphicsLayer::syncFilters() flips on that delta member,
which in turn causes the FilterOperations value to be updated during
the layer flush, in flushCompositingStateForThisLayerOnly().

platform/graphics/nicosia/NicosiaPlatformLayer.h:
platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::syncFilters):
(WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):

12:27 AM Changeset in webkit [234133] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

[CoordGraphics] Use adjusted position, anchor point, size values for Nicosia::CompositionLayer state
https://bugs.webkit.org/show_bug.cgi?id=187899

Reviewed by Carlos Garcia Campos.

As is done for the CoordinatedGraphicsLayerState, the scale-adjusted
position, anchor point and size values should be used when updating the
corresponding Nicosia::CompositionLayer::LayerState members.

platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):

Jul 23, 2018:

11:44 PM Changeset in webkit [234132] by pvollan@apple.com

2 edits in trunk/LayoutTests

The test webanimations/accessing-current-time-after-finished-css-animation-target-removal.html is failing on Windows.
https://bugs.webkit.org/show_bug.cgi?id=187943

Unreviewed test gardening.

platform/win/TestExpectations:

9:50 PM Changeset in webkit [234131] by Manuel Rego Casasnovas

6 edits
4 adds in trunk

[css-grid] Add support for calc() in gutter properties
https://bugs.webkit.org/show_bug.cgi?id=187902

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

Two new WPT tests are imported to verify the expected behavior.

web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002-expected.txt: Added.
web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002-rtl-expected.txt: Added.
web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002-rtl.html: Added.
web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002.html: Added.
web-platform-tests/css/css-grid/abspos/w3c-import.log:

Source/WebCore:

The parsing was already accepting calc() in grid row and column gaps,
however the code was not taking that into account properly.
If the calc() had a percentage it was ignored and that's wrong.

The fix is just a change in the ceck at RenderGrid::availableSpaceForGutters().

Tests: imported/w3c/web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002-rtl.html

imported/w3c/web-platform-tests/css/css-grid/abspos/grid-positioned-items-gaps-002.html
imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-011.html
imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-012.html

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::availableSpaceForGutters const):

LayoutTests:

Two tests are now passing thanks to this change.

TestExpectations:

7:18 PM Changeset in webkit [234130] by Fujii Hironori

2 edits in trunk/Tools

webkitpy.port.server_process_unittest.TestServerProcess.test_basic failed on Windows Python
https://bugs.webkit.org/show_bug.cgi?id=187581

Reviewed by Daniel Bates.

There are two failures in this test case:

proc.poll() doesn't return 0.
stderr is not output.

For failure #1, this is expected. the process should not exit at
the time. proc.poll() should return None because the process is
still alive.

This change added a new test to check proc.poll() becomes 0 after
the process successfully exits.

For failure #2, stderr is not flushed even though stdout is
flushed. This change uses '-u' command switch to force stdin,
stdout and stderr to be totally unbuffered.

Scripts/webkitpy/port/server_process_unittest.py:

(TestServerProcess.test_basic): Added -u command switch. Do not
flush stdout. Removed the special condition for Windows. Add a new
test to check proc.poll() returns 0.
(TestServerProcess.test_process_crashing): Added -u command
switch. Do not flush stdout.

6:35 PM Changeset in webkit [234129] by stephan.szabo@sony.com

4 edits in trunk/Source/WebKit

[WinCairo] Add implementation for setting cursors
https://bugs.webkit.org/show_bug.cgi?id=187868

Reviewed by Fujii Hironori.

UIProcess/win/PageClientImpl.cpp:

(WebKit::PageClientImpl::setCursor): Set cursor on the webview

UIProcess/win/WebView.cpp:

(WebKit::WebView::setCursor): Add implementation to set the
web cursor to update the Windows cursor

UIProcess/win/WebView.h:

6:32 PM Changeset in webkit [234128] by sbarati@apple.com

3 edits
1 add in trunk

need to didFoldClobberWorld when we constant fold GetByVal
https://bugs.webkit.org/show_bug.cgi?id=187917
<rdar://problem/42505095>

Reviewed by Yusuke Suzuki.

JSTests:

stress/get-by-val-fold-did-clobber-world.js: Added.

(f_443):

Source/JavaScriptCore:

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

6:05 PM Changeset in webkit [234127] by commit-queue@webkit.org

18 edits
2 adds in trunk

[INTL] Language tags are not canonicalized
https://bugs.webkit.org/show_bug.cgi?id=185836

Patch by Andy VanWagoner <andy@vanwagoner.family> on 2018-07-23
Reviewed by Keith Miller.

JSTests:

Remove expected failures that have been fixed.

test262/expectations.yaml:

Source/JavaScriptCore:

Canonicalize language tags, replacing deprecated tag parts with the
preferred values. Remove broken support for algorithmic numbering systems,
that can cause an error in icu, and are not supported in other engines.

Generate the lookup functions from the language-subtag-registry.

Also initialize the UNumberFormat in initializeNumberFormat so any
failures are thrown immediately instead of failing to format later.

CMakeLists.txt:
DerivedSources.make:
JavaScriptCore.xcodeproj/project.pbxproj:
Scripts/generateIntlCanonicalizeLanguage.py: Added.
runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::initializeDateTimeFormat):

runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::formatNumber):
(JSC::IntlNumberFormat::formatToParts):
(JSC::IntlNumberFormat::createNumberFormat): Deleted.

runtime/IntlNumberFormat.h:
runtime/IntlObject.cpp:

(JSC::intlNumberOption):
(JSC::intlDefaultNumberOption):
(JSC::preferredLanguage):
(JSC::preferredRegion):
(JSC::canonicalLangTag):
(JSC::canonicalizeLanguageTag):
(JSC::defaultLocale):
(JSC::removeUnicodeLocaleExtension):
(JSC::numberingSystemsForLocale):
(JSC::grandfatheredLangTag): Deleted.

runtime/IntlObject.h:
runtime/IntlPluralRules.cpp:

(JSC::IntlPluralRules::initializePluralRules):

runtime/JSGlobalObject.cpp:

(JSC::addMissingScriptLocales):
(JSC::JSGlobalObject::intlCollatorAvailableLocales):
(JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
(JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
(JSC::JSGlobalObject::intlPluralRulesAvailableLocales):

ucd/language-subtag-registry.txt: Added.

LayoutTests:

Use gregory instead of gregorian, matching test262/intl402 and other engines.
Remove tests for algorithmic numbering systems. Add NumberFormat numbering system tests.

js/intl-datetimeformat-expected.txt:
js/intl-numberformat-expected.txt:
js/script-tests/intl-datetimeformat.js:
js/script-tests/intl-numberformat.js:

(string_appeared_here):

5:42 PM Changeset in webkit [234126] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Remove extraneous #endif in html.css
https://bugs.webkit.org/show_bug.cgi?id=187934

Patch by Aditya Keerthi <Aditya Keerthi> on 2018-07-23
Reviewed by Tim Horton.

css/html.css: Remove extraneous #endif.

5:35 PM Changeset in webkit [234125] by sihui_liu@apple.com

9 edits in trunk

CrashTracer: com.apple.WebKit.Storage at WebCore: WebCore::encodeKey
https://bugs.webkit.org/show_bug.cgi?id=187927
LayoutTests/imported/w3c:

<rdar://problem/42516426>

Reviewed by Chris Dumez.

web-platform-tests/IndexedDB/key-conversion-exceptions-expected.txt:

Source/WebCore:

Reviewed by Chris Dumez.

IDBKeyData is valid only when each key of it is valid.

Test: LayoutTests/storage/indexeddb/index-multientry.html

Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::isValid const):

Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::isValid const): Deleted.

LayoutTests:

<rdar://problem/42516426>

Reviewed by Chris Dumez.

Add a new test case in existing test file to cover the crash case and update the expecation accordingly.

storage/indexeddb/index-multientry-expected.txt:
storage/indexeddb/index-multientry-private-expected.txt:
storage/indexeddb/resources/index-multientry.js:

(addData):

5:27 PM Changeset in webkit [234124] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit

Crash when loadViewIfRequired called while WKFullScreenViewController is being deallocated.
https://bugs.webkit.org/show_bug.cgi?id=187920
rdar://problem/41324023

Patch by Jeremy Jones <jeremyj@apple.com> on 2018-07-23
Reviewed by Eric Carlson.

Clear dangling weak-ref.
Prevent async playback state calls from instantiating the interface.
Release WKFullScreenViewController when it is no longer needed.

UIProcess/ios/fullscreen/WKFullScreenViewController.mm:

(-[WKFullScreenViewController dealloc]):
(-[WKFullScreenViewController setPlaying:]):
(-[WKFullScreenViewController setAnimating:]):

UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController _completedExitFullScreen]):

5:09 PM Changeset in webkit [234123] by timothy_horton@apple.com

3 edits in trunk/Source

Try to fix the build.

UIProcess/mac/ServicesController.mm:

(WebKit::hasCompatibleServicesForItems):

5:01 PM Changeset in webkit [234122] by Ross Kirsling

5 edits in trunk

WTF::StringView::split should have an allowEmptyEntries flag
https://bugs.webkit.org/show_bug.cgi?id=187864

Reviewed by Konstantin Tokarev.

Source/WTF:

wtf/text/StringView.cpp:

(WTF::StringView::SplitResult::Iterator::findNextSubstring):
(WTF::StringView::SplitResult::Iterator::operator++):

wtf/text/StringView.h:

(WTF::StringView::split const):
(WTF::StringView::SplitResult::SplitResult):
(WTF::StringView::SplitResult::Iterator::operator== const):
We can't mimic String::split completely, because this one's iterator-based --
achieve desired behavior by adding m_allowEmptyEntries to SplitResult and m_isDone to its Iterator.
(The latter keeps us from hitting begin() == end() prematurely on a final empty entry.)

Tools:

TestWebKitAPI/Tests/WTF/StringView.cpp: Add test.

4:44 PM Changeset in webkit [234121] by commit-queue@webkit.org

24 edits
6 adds in trunk

We should cache the compiled sandbox profile in a data vault
https://bugs.webkit.org/show_bug.cgi?id=184991

Patch by Ben Richards <benton_richards@apple.com> on 2018-07-23
Reviewed by Ryosuke Niwa.

Source/WebCore:

Added functionality to FileHandle so that it can lock a file while open.
Added a function to FileSystem to delete non empty directories.

platform/FileHandle.cpp:

(WebCore::FileHandle::FileHandle):
(WebCore::FileHandle::open):
(WebCore::FileHandle::close):

platform/FileHandle.h:
platform/FileSystem.h:
platform/cocoa/FileSystemCocoa.mm:

(WebCore::FileSystem::deleteNonEmptyDirectory):

Source/WebKit:

This patch changes a few things (note: data vaults and sandbox entitlements are only used in internal builds):
(1) Instead of compiling a sandbox every time a process is launched, processes now look for a cached sandbox

in a process specific data vault on macOS platforms. (ChildProcessMac.mm)

(2) If a valid cached sandbox is not found, a process will create the data vault (or ensure that it exists),

compile a sandbox, and cache it.

(3) In order to create process specific data vaults, each process now has their own <process name>-OSX-sandbox.entitlements

file which contains an entitlement with a process specific "storage class" which ensures that each process
can only ever access its own data vault. (See the article on confluence "Data Vaults and Restricted Files" for more info)

(4) The sandbox entitlements file for the Network, WebContent and Plugin services are loaded dynamically

through Scripts/<process name>-process-entitlements.sh which is triggered in a new build phase for each service.
The Storage process sandbox entitlements are loaded directly in Configurations/StorageService.xcconfig.
The reason that the sandbox entitlements are applied dynamically is so that these sandbox entitlements
are only applied when WK_USE_RESTRICTED_ENTITLEMENTS is YES. This means that open source builds will still work.

Configurations/Network-OSX-sandbox.entitlements: Added.
Configurations/Plugin-OSX-sandbox.entitlements: Added.
Configurations/Storage-OSX-sandbox.entitlements: Added.
Configurations/StorageService.xcconfig:
Configurations/WebContent-OSX-sandbox.entitlements: Added.
Configurations/WebKit.xcconfig:
NetworkProcess/NetworkProcess.h:
PluginProcess/PluginProcess.h:
Scripts/process-network-entitlements.sh: Added.
Scripts/process-plugin-entitlements.sh: Added.
Scripts/process-webcontent-entitlements.sh:
Shared/ChildProcess.h:
Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:

(WebKit::XPCServiceInitializer):

Shared/SandboxInitializationParameters.h:

(WebKit::SandboxInitializationParameters::setOverrideSandboxProfilePath):
(WebKit::SandboxInitializationParameters::overrideSandboxProfilePath const):
(WebKit::SandboxInitializationParameters::setSandboxProfile):
(WebKit::SandboxInitializationParameters::sandboxProfile const):
(): Deleted.

Shared/mac/ChildProcessMac.mm:

(WebKit::SandboxProfileDeleter::operator()):
(WebKit::SandboxParametersDeleter::operator()):
(WebKit::SandboxInfo::SandboxInfo):
(WebKit::fileContents):
(WebKit::processStorageClass):
(WebKit::setAndSerializeSandboxParameters):
(WebKit::getUserCacheDirectory):
(WebKit::sandboxDataVaultParentDirectory):
(WebKit::sandboxDirectory):
(WebKit::sandboxFilePath):
(WebKit::ensureSandboxCacheDirectory):
(WebKit::writeSandboxDataToCacheFile):
(WebKit::compileAndCacheSandboxProfile):
(WebKit::tryApplyCachedSandbox):
(WebKit::webKit2Bundle):
(WebKit::sandboxProfilePath):
(WebKit::compileAndApplySandboxSlowCase):
(WebKit::applySandbox):
(WebKit::initializeSandboxParameters):
(WebKit::ChildProcess::initializeSandbox):

Shared/mac/SandboxInitialiationParametersMac.mm:

(WebKit::SandboxInitializationParameters::SandboxInitializationParameters):

StorageProcess/StorageProcess.h:
WebKit.xcodeproj/project.pbxproj:
WebProcess/WebProcess.h:

Source/WTF:

Added trace points for sandbox initialization and exposed functions needed for sandbox caching

wtf/SystemTracing.h:
wtf/spi/darwin/SandboxSPI.h:

Tools:

Added trace points for sandbox initialization

Tracing/SystemTracePoints.plist:

4:27 PM Changeset in webkit [234120] by timothy_horton@apple.com

5 edits in trunk/Source

Creating and loading content in a WKWebView triggers Main Thread Checker warnings under ServicesController
https://bugs.webkit.org/show_bug.cgi?id=186963
<rdar://problem/41393682>

Reviewed by Timothy Hatcher.

Source/WebCore/PAL:

pal/spi/mac/NSSharingServiceSPI.h:

Add the new SPI.

Source/WebKit:

UIProcess/mac/ServicesController.h:
UIProcess/mac/ServicesController.mm:

(WebKit::hasCompatibleServicesForItems):
(WebKit::ServicesController::refreshExistingServices):
Adopt async ShareKit SPI that is actually thread-safe instead of the not-quite-safe
synchronous API. Request all three sets of services immediately, and dispatch
to the Web Content processes when all three have returned.

4:25 PM Changeset in webkit [234119] by Basuke Suzuki

2 edits in trunk/LayoutTests

[Curl] Test gardening
https://bugs.webkit.org/show_bug.cgi?id=187932

Unreviewed test gardening.

Enable Secure WebSocket tests.

platform/wincairo/TestExpectations:

4:20 PM Changeset in webkit [234118] by commit-queue@webkit.org

39 edits in trunk/LayoutTests

Enable WebGL2 glsl3 tests with expected FAIL results
https://bugs.webkit.org/show_bug.cgi?id=187929
<rdar://problem/42516498>

Patch by Justin Fan <Justin Fan> on 2018-07-23
Reviewed by Dean Jackson.

Before enabling glsl ES 3 for WebGL2 work, enable corresponding webgl2 conformance tests.

TestExpectations:
webgl/2.0.0/conformance2/glsl3/array-as-return-value-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-assign-constructor-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-assign-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-complex-indexing-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-element-increment-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-equality-expected.txt:
webgl/2.0.0/conformance2/glsl3/array-in-complex-expression-expected.txt:
webgl/2.0.0/conformance2/glsl3/attrib-location-length-limits-expected.txt:
webgl/2.0.0/conformance2/glsl3/bool-type-cast-bug-uint-ivec-uvec-expected.txt:
webgl/2.0.0/conformance2/glsl3/compare-structs-containing-arrays-expected.txt:
webgl/2.0.0/conformance2/glsl3/compound-assignment-type-combination-expected.txt:
webgl/2.0.0/conformance2/glsl3/const-array-init-expected.txt:
webgl/2.0.0/conformance2/glsl3/forbidden-operators-expected.txt:
webgl/2.0.0/conformance2/glsl3/frag-depth-expected.txt:
webgl/2.0.0/conformance2/glsl3/invalid-default-precision-expected.txt:
webgl/2.0.0/conformance2/glsl3/invalid-invariant-expected.txt:
webgl/2.0.0/conformance2/glsl3/loops-with-side-effects-expected.txt:
webgl/2.0.0/conformance2/glsl3/misplaced-version-directive-expected.txt:
webgl/2.0.0/conformance2/glsl3/no-attribute-vertex-shader-expected.txt:
webgl/2.0.0/conformance2/glsl3/sampler-no-precision-expected.txt:
webgl/2.0.0/conformance2/glsl3/sequence-operator-returns-non-constant-expected.txt:
webgl/2.0.0/conformance2/glsl3/shader-linking-expected.txt:
webgl/2.0.0/conformance2/glsl3/shader-with-1024-character-define-expected.txt:
webgl/2.0.0/conformance2/glsl3/shader-with-1024-character-identifier.frag-expected.txt:
webgl/2.0.0/conformance2/glsl3/shader-with-invalid-characters-expected.txt:
webgl/2.0.0/conformance2/glsl3/shader-with-mis-matching-uniform-block-expected.txt:
webgl/2.0.0/conformance2/glsl3/short-circuiting-in-loop-condition-expected.txt:
webgl/2.0.0/conformance2/glsl3/texture-offset-out-of-range-expected.txt:
webgl/2.0.0/conformance2/glsl3/texture-offset-uniform-texture-coordinate-expected.txt:
webgl/2.0.0/conformance2/glsl3/tricky-loop-conditions-expected.txt:
webgl/2.0.0/conformance2/glsl3/unary-minus-operator-in-dynamic-loop-expected.txt:
webgl/2.0.0/conformance2/glsl3/uniform-block-layout-match-expected.txt:
webgl/2.0.0/conformance2/glsl3/uniform-block-layouts-expected.txt:
webgl/2.0.0/conformance2/glsl3/uniform-location-length-limits-expected.txt:
webgl/2.0.0/conformance2/glsl3/valid-invariant-expected.txt:
webgl/2.0.0/conformance2/glsl3/vector-dynamic-indexing-expected.txt:
webgl/2.0.0/conformance2/glsl3/vector-dynamic-indexing-nv-driver-bug-expected.txt:

4:20 PM Changeset in webkit [234117] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

[macOS] Ensure that WebGL contexts are always set to an accelerated virtual screen
https://bugs.webkit.org/show_bug.cgi?id=187923

Patch by Justin Fan <Justin Fan> on 2018-07-23
Reviewed by Dean Jackson.

On eGPU displays, it is possible that CGL does not match the preferred renderer.
In this case, and when the web process is blocked from accessing the window server,
3D contexts *may* default to the software renderer. Ensure that even if this occurs,
we set the context to use a hardware-accelerated renderer/virtual screen.

No new tests. Existing behavior covered by existing tests.
Requires multiple screens, at least one attached to an eGPU, to stress.

platform/graphics/cocoa/GraphicsContext3DCocoa.mm:

(WebCore::identifyAndSetCurrentGPU):

4:07 PM Changeset in webkit [234116] by commit-queue@webkit.org

7 edits in trunk/Source/WebCore

Convert some obvious never-null pointers to references in the editing code
https://bugs.webkit.org/show_bug.cgi?id=187914

Patch by Sam Weinig <sam@webkit.org> on 2018-07-23
Reviewed by Dean Jackson.

Fixup trivial cases of never-null pointers that really should be references.

editing/ApplyStyleCommand.cpp:

(WebCore::ApplyStyleCommand::shouldApplyInlineStyleToRun):
(WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
(WebCore::ApplyStyleCommand::removeImplicitlyStyledElement):
(WebCore::ApplyStyleCommand::removeCSSStyle):
(WebCore::ApplyStyleCommand::applyInlineStyleToPushDown):
(WebCore::ApplyStyleCommand::applyInlineStyleChange):

editing/EditingStyle.cpp:

(WebCore::EditingStyle::overrideWithStyle):
(WebCore::EditingStyle::conflictsWithInlineStyleOfElement const):
(WebCore::EditingStyle::conflictsWithImplicitStyleOfElement const):
(WebCore::EditingStyle::conflictsWithImplicitStyleOfAttributes const):
(WebCore::EditingStyle::extractConflictingImplicitStyleOfAttributes const):
(WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode const):
(WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
(WebCore::EditingStyle::mergeInlineStyleOfElement):
(WebCore::EditingStyle::wrappingStyleForSerialization):
(WebCore::EditingStyle::legacyFontSize const):
(WebCore::StyleChange::StyleChange):
(WebCore::StyleChange::extractTextStyles):
(WebCore::legacyFontSizeFromCSSValue):

editing/EditingStyle.h:

(WebCore::EditingStyle::conflictsWithInlineStyleOfElement const):

editing/Editor.cpp:

(WebCore::Editor::selectionStartCSSPropertyValue):

editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
(WebCore::isInlineNodeWithStyle):

editing/markup.cpp:

(WebCore::StyledMarkupAccumulator::appendElement):
(WebCore::StyledMarkupAccumulator::serializeNodes):

4:00 PM Changeset in webkit [234115] by Alan Bujtas

2 edits in trunk/Tools

DRT relies on [webView display] to call -viewWillDraw on the WebHTMLView
https://bugs.webkit.org/show_bug.cgi?id=187924
<rdar://problem/41745884>

Reviewed by Simon Fraser.

WebKit relies on -viewWillDraw getting called on WebHTMLView, even though that view has not been marked as needing display.

DumpRenderTree/mac/PixelDumpSupportMac.mm:

(createBitmapContextFromWebView):

3:53 PM Changeset in webkit [234114] by bshafiei@apple.com

1 copy in tags/Safari-606.1.29

Tag Safari-606.1.29.

3:16 PM Changeset in webkit [234113] by pvollan@apple.com

2 edits in trunk/Source/WebCore

WebCore::primaryScreenDisplayID() always return 0
https://bugs.webkit.org/show_bug.cgi?id=187922
<rdar://problem/42286933>

Reviewed by Geoffrey Garen.

This function should return a valid display ID.

No new tests. Testing this requires a dual monitor setup.

platform/mac/PlatformScreenMac.mm:

(WebCore::primaryScreenDisplayID):

2:24 PM Changeset in webkit [234112] by n_wang@apple.com

4 edits
2 adds in trunk

AX: Press tab to highlight items on a webpage is not working with voiceover enabled
https://bugs.webkit.org/show_bug.cgi?id=187824

Reviewed by Zalan Bujtas.

Source/WebCore:

We are deferring posting focused element change notification when the document needs a
style recalculation. However, we only perform the cache update after a layout is completed.
Added a timer to perform the cache update in the next runloop when non-layout type of mutation
happens.

Test: accessibility/mac/tab-focus-post-notification.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::AXObjectCache):
(WebCore::AXObjectCache::~AXObjectCache):
(WebCore::AXObjectCache::deferFocusedUIElementChangeIfNeeded):
(WebCore::AXObjectCache::performCacheUpdateTimerFired):

accessibility/AXObjectCache.h:

(WebCore::AXObjectCache::AXObjectCache):
(WebCore::AXObjectCache::performCacheUpdateTimerFired):

LayoutTests:

accessibility/mac/tab-focus-post-notification-expected.txt: Added.
accessibility/mac/tab-focus-post-notification.html: Added.

1:59 PM Changeset in webkit [234111] by Chris Dumez

12 edits
1 add in trunk

WebResourceLoadStatisticsStore fails to unregister itself as a MessageReceiver in its destructor
https://bugs.webkit.org/show_bug.cgi?id=187910
<rdar://problem/42356526>

Reviewed by Brent Fulgham.

Source/WebCore:

Add internals API that causes the ResourceLoadObserver to notify its observer, and avoid waiting
for the 5 second delay.

testing/Internals.cpp:

(WebCore::Internals::notifyResourceLoadObserver):

testing/Internals.h:
testing/Internals.idl:

Source/WebKit:

The WebResourceLoadStatisticsStore was only removing itself as a MessageReceiver from the WebProcessProxy
and that WebProcessProxy's connection was getting closed. However, it is possible for the
WebResourceLoadStatisticsStore to get destroyed before this happens. This would lead to crashes such as
the one in <rdar://problem/42356526>.

To address the issue, we let the WebsiteDataStore take care of registering / unregistering the
WebResourceLoadStatisticsStore as a MessageReceiver with the WebProcessProxy. This is more reliable since
the WebsiteDataStore is the one that subclasses WebProcessLifetimeObserver. Make sure the
WebResourceLoadStatisticsStore is removed as a MessageReceiver whenever the WebsiteDataStore is destroyed
or WebsiteDataStore::m_resourceLoadStatistics gets cleared.

UIProcess/WebResourceLoadStatisticsStore.cpp:
UIProcess/WebResourceLoadStatisticsStore.h:

Drop logic to add / remove the WebResourceLoadStatisticsStore as a receiver now that the
WebsiteDataStore takes care of it.

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::~WebsiteDataStore):
Make sure the WebResourceLoadStatisticsStore gets unregistered as a MessageReceiver from all associated
WebProcessProxy objects when the WebsiteDataStore gets destroyed.

(WebKit::WebsiteDataStore::webProcessWillOpenConnection):
(WebKit::WebsiteDataStore::webProcessDidCloseConnection):
Register / Unregister the WebResourceLoadStatisticsStore as a MessageReceiver with the WebProcessProxy.

(WebKit::WebsiteDataStore::setResourceLoadStatisticsEnabled):
Make sure we unregister the WebResourceLoadStatisticsStore as a MessageReceiver with all associated
WebProcessProxy objects before we clear m_resourceLoadStatistics as this will causes the
WebResourceLoadStatisticsStore to get destroyed.

(WebKit::WebsiteDataStore::unregisterWebResourceLoadStatisticsStoreAsMessageReceiver):
(WebKit::WebsiteDataStore::registerWebResourceLoadStatisticsStoreAsMessageReceiver):
Add utility functions to register / unregister WebResourceLoadStatisticsStore as a MessageReceiver with
all associated WebProcessProxy objects.

(WebKit::WebsiteDataStore::enableResourceLoadStatisticsAndSetTestingCallback):
Register the new WebResourceLoadStatisticsStore as a MessageReceiver with all associated WebProcessProxy
objects in case setResourceLoadStatisticsEnabled(true) gets called *after* we've already started
WebProcesses.

UIProcess/WebsiteData/WebsiteDataStore.h:

Tools:

Add API test coverage.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKitCocoa/ResourceLoadStatistics.mm:

(-[DisableITPDuringNavigationDelegate webView:didCommitNavigation:]):
(-[DisableITPDuringNavigationDelegate webView:didFinishNavigation:]):
(TEST):

TestWebKitAPI/Tests/WebKitCocoa/notify-resourceLoadObserver.html: Added.

1:30 PM Changeset in webkit [234110] by Alan Bujtas

6 edits in trunk/Source/WebCore

[LCF][IFC] Add support for hyphenation.
https://bugs.webkit.org/show_bug.cgi?id=187913

Reviewed by Antti Koivisto.

Move the hyphenation logic over from SimpleLineLayout::TextFragmentIterator.

layout/inlineformatting/textlayout/Runs.h:

(WebCore::Layout::TextRun::hasHyphen const):
(WebCore::Layout::LayoutRun::setHasHyphen):
(WebCore::Layout::LayoutRun::hasHyphen const):
(WebCore::Layout::LayoutRun::LayoutRun):
(WebCore::Layout::TextRun::createNonWhitespaceRunWithHyphen):
(WebCore::Layout::TextRun::TextRun):

layout/inlineformatting/textlayout/TextContentProvider.cpp:

(WebCore::Layout::TextContentProvider::findTextItemSlow const):
(WebCore::Layout::TextContentProvider::width const):
(WebCore::Layout::TextContentProvider::hyphenPositionBefore const):

layout/inlineformatting/textlayout/TextContentProvider.h:
layout/inlineformatting/textlayout/simple/SimpleLineBreaker.cpp:

(WebCore::Layout::SimpleLineBreaker::Line::setTextAlign):
(WebCore::Layout::SimpleLineBreaker::Line::justifyRuns):
(WebCore::Layout::SimpleLineBreaker::Line::adjustRunsForTextAlign):
(WebCore::Layout::SimpleLineBreaker::Line::collectExpansionOpportunities):
(WebCore::Layout::SimpleLineBreaker::Line::closeLastRun):
(WebCore::Layout::SimpleLineBreaker::Line::append):
(WebCore::Layout::SimpleLineBreaker::Line::reset):
(WebCore::Layout::SimpleLineBreaker::Style::Style):
(WebCore::Layout::SimpleLineBreaker::handleLineEnd):
(WebCore::Layout::SimpleLineBreaker::createRunsForLine):
(WebCore::Layout::SimpleLineBreaker::hyphenPositionBefore const):
(WebCore::Layout::SimpleLineBreaker::adjustSplitPositionWithHyphenation const):
(WebCore::Layout::SimpleLineBreaker::split const):

layout/inlineformatting/textlayout/simple/SimpleLineBreaker.h:

1:23 PM Changeset in webkit [234109] by graouts@webkit.org

9 edits
2 adds in trunk

[Web Animations] Querying the current time of a finished CSSAnimation after removing its target leads to a crash
https://bugs.webkit.org/show_bug.cgi?id=187906

Reviewed by Dean Jackson.

Source/WebCore:

Test: webanimations/accessing-current-time-after-finished-css-animation-target-removal.html

Because we carelessly look at a CSSAnimation's effect's timing in DeclarativeAnimation::bindingsCurrentTime
without checking that the effect is non-null, we can crash in the case where the animation is finished and
its target element has been removed, which caused the effect to be set to null.

We do not actually fix the lack of a null check, which will be the scope of a different patch, but instead
ensure that we do _not_ set the animation's effect to null when its target is removed, which used to be
performed via a call to WebAnimation::remove(). Instead, we introduce AnimationTimeline::elementWasRemoved()
which notifies the timeline of an element being removed such that we may stop referencing any animation
targeting this element from the various data structures holding strong references to the animation in question,
and we then cancel the animation silently, which is a new option that ensures promises aren't resolved or
rejected as a result.

Finally, the WebAnimation and AnimationEffectReadOnly classes established a ref-cycle as WebAnimation has
RefPtr<AnimationEffectReadOnly> m_effect and AnimationEffectReadOnly has RefPtr<WebAnimation> m_animation.
While it is correct that WebAnimation owns its effect, which is established by the DOM API, the
reverse is not correct since we only hold the reverse internally for the benefit of our implementation.
As such, we change AnimationEffectReadOnly's m_animation to be a WeakPtr<WebAnimation>. This means not
calling WebAnimation::remove() and simply removing the animation from the animation maps on the timeline
is sufficient to guarantee that the document timeline will not leak (and with it the document).

animation/AnimationEffectReadOnly.h:

(WebCore::AnimationEffectReadOnly::setAnimation):

animation/AnimationTimeline.cpp:

(WebCore::AnimationTimeline::elementWasRemoved):

animation/AnimationTimeline.h:
animation/WebAnimation.cpp:

(WebCore::WebAnimation::cancel):
(WebCore::WebAnimation::resetPendingTasks):

animation/WebAnimation.h:
dom/Element.cpp:

(WebCore::Element::removedFromAncestor):

rendering/updating/RenderTreeUpdater.cpp:

(WebCore::RenderTreeUpdater::tearDownRenderers):

LayoutTests:

Add a new test that checks the behavior of a CSSAnimation instance after its completion and removal of its target.

webanimations/accessing-current-time-after-finished-css-animation-target-removal-expected.txt: Added.
webanimations/accessing-current-time-after-finished-css-animation-target-removal.html: Added.

1:17 PM Changeset in webkit [234108] by wilander@apple.com

2 edits in trunk/Source/WebKit

Resource Load Statistics: Add logging of Storage Access API use in experimental debug mode
https://bugs.webkit.org/show_bug.cgi?id=187918
<rdar://problem/42509062>

Reviewed by Jiewen Tan.

Tested manually by looking at log output.

UIProcess/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::removeDataRecords):

This is just a clean-up change.

(WebKit::ResourceLoadStatisticsMemoryStore::requestStorageAccess):
(WebKit::ResourceLoadStatisticsMemoryStore::requestStorageAccessUnderOpener):

Both these now log proper info in debug mode.

12:33 PM Changeset in webkit [234107] by Chris Dumez

4 edits in trunk/LayoutTests

REGRESSION(PSON?): [ WK2 ] http/tests/workers/service/client-*-page-cache.html LayoutTests are flaky
https://bugs.webkit.org/show_bug.cgi?id=183705
<rdar://problem/42440606>

Unreviewed, attempting a better fix for http/tests/workers/service/serviceworkerclients-matchAll.https.html.
If it fixes the flakiness I'll do the same for the 2 page cache tests.

http/tests/workers/service/serviceworkerclients-matchAll-worker.js:

(waitFor):
(matchAllPromise2):
(async.doTestAfterMessage):
(matchAllPromise1): Deleted.
(then): Deleted.

platform/ios-wk2/TestExpectations:
platform/mac-wk2/TestExpectations:

12:32 PM Changeset in webkit [234106] by mark.lam@apple.com

3 edits in trunk/Source/JavaScriptCore

Add some asserts to help diagnose a crash.
https://bugs.webkit.org/show_bug.cgi?id=187915
<rdar://problem/42508166>

Reviewed by Michael Saboff.

Add some asserts to verify that an CodeBlock alternative should always have a
non-null jitCode. Also change a RELEASE_ASSERT_NOT_REACHED() in
CodeBlock::setOptimizationThresholdBasedOnCompilationResult() to a RELEASE_ASSERT()
so that we'll retain the state of the variables that failed the assertion (again
to help with diagnosis).

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::setAlternative):
(JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):

dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan):

12:13 PM Changeset in webkit [234105] by commit-queue@webkit.org

14 edits
4 adds in trunk/Source

[iOS] Add support for input[type=color]
https://bugs.webkit.org/show_bug.cgi?id=187871

Patch by Aditya Keerthi <Aditya Keerthi> on 2018-07-23
Reviewed by Tim Horton.

Source/WebCore:

css/html.css: Remove unwanted styling for color inputs with a list attribute.
html/ColorInputType.cpp: Make the element focusable.

(WebCore::ColorInputType::isMouseFocusable const):
(WebCore::ColorInputType::isKeyboardFocusable const):

html/ColorInputType.h:
html/HTMLInputElement.h: Expose isColorControl() to WebKit.
page/Chrome.cpp:

(WebCore::Chrome::createColorChooser):

Source/WebKit:

Created WKFormColorControl to display a color picker once a color input gains
focus. The control is presented as an inputView on iPhone and as a popover on
iPad. The picker itself consists of two color matrices. The first is a set of 12
default colors, displayed on the top row of the picker. In a subsequent patch,
this top row will be made customizable through the use of the datalist element.
The second matrix is a grid of 120 colors, provided by the system. Colors can be
selected from either matrix by tapping or with a pan gesture.

WKColorMatrixView represents a single color matrix and is comprised of
WKColorButtons that represent each color in the matrix.

Shared/AssistedNodeInformation.h:
UIProcess/API/Cocoa/_WKFocusedElementInfo.h:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::createColorPicker):

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKFocusedElementInfo initWithAssistedNodeInformation:isUserInitiated:userObject:]):
(-[WKContentView _requiresKeyboardWhenFirstResponder]):
(-[WKContentView inputView]):
(-[WKContentView requiresAccessoryView]):
(isAssistableInputType):
(-[WKContentView _startAssistingNode:userIsInteracting:blurPreviousNode:changingActivityState:userObject:]):
(-[WKContentView actionNameForFocusedFormControlView:]):

UIProcess/ios/forms/WKFormColorControl.h: Added.
UIProcess/ios/forms/WKFormColorControl.mm: Added.

(-[WKColorPopover initWithView:]):
(-[WKColorPopover controlView]):
(-[WKColorPopover controlBeginEditing]):
(-[WKColorPopover controlEndEditing]):
(-[WKFormColorControl initWithView:]):
(-[WKFormColorControl assistantView]):
(-[WKFormColorControl beginEditing]):
(-[WKFormColorControl endEditing]):

UIProcess/ios/forms/WKFormColorPicker.h: Added.
UIProcess/ios/forms/WKFormColorPicker.mm: Added.

(+[WKColorButton colorButtonWithColor:]):
(-[WKColorMatrixView initWithFrame:]):
(-[WKColorMatrixView initWithFrame:colorMatrix:]):
(-[WKColorMatrixView layoutSubviews]):
(-[WKColorMatrixView colorButtonTapped:]):
(+[WKColorPicker defaultTopColorMatrix]):
(-[WKColorPicker initWithView:]):
(-[WKColorPicker setControlValueFromUIColor:]):
(-[WKColorPicker controlView]):
(-[WKColorPicker controlBeginEditing]):
(-[WKColorPicker controlEndEditing]):
(-[WKColorPicker colorMatrixView:didTapColorButton:]):
(-[WKColorPicker didPanColors:]):

WebKit.xcodeproj/project.pbxproj:
WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::isAssistableElement):
(WebKit::WebPage::getAssistedNodeInformation):

10:56 AM Changeset in webkit [234104] by pvollan@apple.com

2 edits in trunk/LayoutTests

Layout test webanimations/empty-keyframes-crash.html is failing on Windows.
https://bugs.webkit.org/show_bug.cgi?id=187912

Unreviewed test gardening.

platform/win/TestExpectations:

10:52 AM Changeset in webkit [234103] by stephan.szabo@sony.com

2 edits in trunk/Source/WebKit

[WinCairo] Fix detection of held modifier keys for key events
https://bugs.webkit.org/show_bug.cgi?id=187862

Reviewed by Fujii Hironori.

Shared/win/WebEventFactory.cpp:

(WebKit::IsKeyInDownState): Use requested modifier not VK_MENU

10:49 AM Changeset in webkit [234102] by pvollan@apple.com

2 edits in trunk/LayoutTests

Skip crypto tests on Windows.
https://bugs.webkit.org/show_bug.cgi?id=165090

Unreviewed test gardening.

platform/win/TestExpectations:

10:40 AM Changeset in webkit [234101] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark http/tests/security/bypassing-cors-checks-for-extension-urls.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=187658

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

10:40 AM Changeset in webkit [234100] by Ryan Haddad

3 edits in trunk/LayoutTests

Mark three service worker clients tests as flaky.
https://bugs.webkit.org/show_bug.cgi?id=183705

Unreviewed test gardening.

platform/ios-wk2/TestExpectations:
platform/mac-wk2/TestExpectations:

10:02 AM Changeset in webkit [234099] by dbates@webkit.org

3 edits in trunk/Tools

test-webkitpy should take configuration command line options
https://bugs.webkit.org/show_bug.cgi?id=187872

Reviewed by David Kilzer.

Add --debug and --release optional command line options and teach the test bots to invoke test-webkitpy
with the appropriate configuration. At the moment these options are only meaningful on Mac since they
effect the configuration lldbWebKitTester is built with and we only build lldbWebKitTester on Mac.

BuildSlaveSupport/build.webkit.org-config/steps.py:

(RunPythonTests): Pass the configuration to test-webkitpy. On Mac this will effect
how lldbWebKitTester is built. All other ports do not make use of the specified configuration.

Scripts/webkitpy/test/main.py:

(_build_lldb_webkit_tester): Modified to take the configuration to build lldbWebKitTester. If
the specified configuration is None then we fall back to using the default configuration (as set
by script set-webkit-configuration).
(Tester._parse_args): Add command line options --debug and --release to build lldbWebKitTester
with a Debug configuration and a Release configuration, respectively
(Tester._run_tests): Pass the configuration to build lldbWebKitTester that we parsed from
the command line options. It may be None if neither --debug nor --release were passed.

9:53 AM Changeset in webkit [234098] by dino@apple.com

6 edits
2 adds in trunk

fullscreen env() variables should have initial values
https://bugs.webkit.org/show_bug.cgi?id=187897
<rdar://problem/42485682>

Reviewed by Sam Weinig.

Source/WebCore:

The env() values for fullscreen properties need to be
initialized, rather than wait for values to be set from WebKit.
Without this, feature detection doesn't work, and properties
won't parse correctly.

Test: fullscreen/fullscreen-env-initial.html

dom/ConstantPropertyMap.cpp:

(WebCore::ConstantPropertyMap::buildValues): Initialize the fullscreen values.
(WebCore::ConstantPropertyMap::updateConstantsForFullscreen): Renamed function, because it
also updates the duration value.
(WebCore::ConstantPropertyMap::didChangeFullscreenInsets): Call new name.
(WebCore::ConstantPropertyMap::updateConstantsForFullscreenInsets): Deleted.

dom/ConstantPropertyMap.h:
page/Page.cpp:

(WebCore::Page::setFullscreenAutoHideDuration): Don't change the value if it doesn't need it.

page/Page.h: Add accessor for fullscreenAutoHideDuration. Also add a member variable.

(WebCore::Page::fullscreenAutoHideDuration const):

LayoutTests:

fullscreen/fullscreen-env-initial-expected.html: Added.
fullscreen/fullscreen-env-initial.html: Added.

9:13 AM Changeset in webkit [234097] by fpizlo@apple.com

6 edits in trunk/Source/JavaScriptCore

Unreviewed, fix no-JIT build.

bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::computeFor):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finalizeUnconditionally):

bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFor):
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):

bytecode/InByIdStatus.cpp:
bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeForStubInfo):

7:12 AM Changeset in webkit [234096] by commit-queue@webkit.org

4 edits in trunk/Tools

Unreviewed, rolling out r233030.
https://bugs.webkit.org/show_bug.cgi?id=187904

Broke tarball builds (Requested by mcatanzaro on #webkit).

Reverted changeset:

"run-gtk-tests (glib/common.py) cannot determine build
directory when webKitBranchBuild=true"
https://bugs.webkit.org/show_bug.cgi?id=185643
https://trac.webkit.org/changeset/233030

12:09 AM Changeset in webkit [234095] by bshafiei@apple.com

3 edits
2 adds in branches/safari-606-branch

Cherry-pick r234075. rdar://problem/42451525

DFG AbstractInterpreter: CheckArray filters array modes for DirectArguments/ScopedArguments using only NonArray
https://bugs.webkit.org/show_bug.cgi?id=187827
rdar://problem/42146858

Reviewed by Saam Barati.

JSTests:

New regression tests.

stress/direct-arguments-check-array.js: Added. (setup.f2): (setup): (forOfArray): (forOfArgs): (callEveryOnArgs):
stress/scoped-arguments-check-array.js: Added. (setup.foo): (setup.f2): (setup): (forOfArray): (forOfArgs): (callEveryOnArgs):

Source/JavaScriptCore:

When filtering array modes for DirectArguments or ScopedArguments, we need to allow for the possibility
that they can either be NonArray or NonArrayWithArrayStorage (aka ArrayStorageShape).
We can't end up with other shapes, Int32, Double, etc because GenericArguments sets
InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero which will cause us to go down a
putByIndex() path that doesn't change the shape.

dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234075 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:09 AM Changeset in webkit [234094] by bshafiei@apple.com

8 edits
3 adds in branches/safari-606-branch

Cherry-pick r234073. rdar://problem/42451644

Remove completed animations from GraphicsLayer, thus avoiding excessive backing store allocation
https://bugs.webkit.org/show_bug.cgi?id=187844
rdar://problem/40387294

Reviewed by Dean Jackson.
Source/WebCore:

A keyframe animation which animates 3D transforms, and is fill-forwards, currently
leaves the GraphicsLayer in a state where it has a "running" animation. However, the
logic that computes animation extent in RenderLayerBacking::updateGeometry() only does
so for running or paused animations. GraphicsLayer then thinks that it has an active
transform animation with unknown extent, and refuses to detach its backing store.

This triggers excessive layer creation on some sites (e.g. https://www.kqed.org).

Fix by always removing animations from the GraphicsLayer when they finish, whether
or not they fill forwards. This is done by having KeyframeAnimation::onAnimationEnd()
always call endAnimation().

This change only fixes the non-Web Animation code path. webkit.org/b/187845 exists
to fix the other code path.

Also improve some logging that would have revealed this problem sooner.

Test: compositing/backing/backing-store-attachment-fill-forwards-animation.html

page/animation/AnimationBase.h: (WebCore::AnimationBase::endAnimation):
page/animation/ImplicitAnimation.cpp: (WebCore::ImplicitAnimation::endAnimation):
page/animation/ImplicitAnimation.h:
page/animation/KeyframeAnimation.cpp: (WebCore::KeyframeAnimation::endAnimation): (WebCore::KeyframeAnimation::onAnimationEnd):
page/animation/KeyframeAnimation.h:
platform/graphics/ca/GraphicsLayerCA.cpp: (WebCore::GraphicsLayerCA::addAnimation): (WebCore::GraphicsLayerCA::updateCoverage):

LayoutTests:

compositing/backing/backing-store-attachment-fill-forwards-animation-expected.txt: Added.
compositing/backing/backing-store-attachment-fill-forwards-animation.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234073 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:07 AM Changeset in webkit [234093] by bshafiei@apple.com

7 edits in branches/safari-606-branch/Source

Versioning.

Jul 22, 2018:

5:40 PM Changeset in webkit [234092] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Dark Mode: remove odd-looking top border
https://bugs.webkit.org/show_bug.cgi?id=187885

Reviewed by Matt Baker.

This border doesn't exist in the light mode, and it shouldn't be in the dark mode either.

UserInterface/Views/DarkMode.css:

(@media (prefers-dark-interface)):
(body .toolbar):

12:48 PM Changeset in webkit [234091] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][IFC] Add center/right/justify line alignment support.
https://bugs.webkit.org/show_bug.cgi?id=187890

Reviewed by Antti Koivisto.

Move over some more code from simple line layout.
(though text-align: justify is more preformant as now expansion opportunities are added as we process the text runs
-as opposed to iterting through the runs again when we reach the end of the line.)

layout/inlineformatting/textlayout/Runs.h:

(WebCore::Layout::LayoutRun::setLeft):
(WebCore::Layout::LayoutRun::setExpansion):

layout/inlineformatting/textlayout/simple/SimpleLineBreaker.cpp:

(WebCore::Layout::SimpleLineBreaker::Line::Line):
(WebCore::Layout::SimpleLineBreaker::Line::setTextAlign):
(WebCore::Layout::SimpleLineBreaker::Line::adjustedLeftForTextAlign const):
(WebCore::Layout::SimpleLineBreaker::Line::justifyRuns):
(WebCore::Layout::SimpleLineBreaker::Line::adjustRunsForTextAlign):
(WebCore::Layout::expansionOpportunity):
(WebCore::Layout::expansionBehavior):
(WebCore::Layout::SimpleLineBreaker::Line::collectExpansionOpportunities):
(WebCore::Layout::SimpleLineBreaker::Line::closeLastRun):
(WebCore::Layout::SimpleLineBreaker::Line::append):
(WebCore::Layout::SimpleLineBreaker::Line::collapseTrailingWhitespace):
(WebCore::Layout::SimpleLineBreaker::Line::reset):
(WebCore::Layout::SimpleLineBreaker::Style::Style):
(WebCore::Layout::SimpleLineBreaker::handleLineEnd):
(WebCore::Layout::SimpleLineBreaker::handleLineStart):
(WebCore::Layout::isTextAlignRight):
(WebCore::Layout::SimpleLineBreaker::createRunsForLine):

layout/inlineformatting/textlayout/simple/SimpleLineBreaker.h:

(WebCore::Layout::SimpleLineBreaker::Line::setAvailableWidth):
(WebCore::Layout::SimpleLineBreaker::Line::setCollapseWhitespace):

12:24 PM Changeset in webkit [234090] by Yusuke Suzuki

4 edits
2 adds in trunk

[JSC] GetByIdVariant and InByIdVariant do not need slot base if they are not "hit" variants
https://bugs.webkit.org/show_bug.cgi?id=187891

Reviewed by Saam Barati.

JSTests:

stress/in-miss-variant-merge.js: Added.

(shouldBe):
(test):

stress/miss-variant-merge.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

When merging GetByIdVariant and InByIdVariant, we accidentally make merging failed if
two variants are mergeable but they have "Miss" status. We make merging failed if
the merged OPCSet says hasOneSlotBaseCondition() is false. But it is only reasonable
if the variant has "Hit" status. This bug is revealed when we introduce CreateThis in FTL,
which patch have more chances to merge variants.

This patch fixes this issue by checking !isPropertyUnset() / isHit(). PutByIdVariant
is not related since it does not use this check in Transition case.

bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::attemptToMerge):

bytecode/InByIdVariant.cpp:

(JSC::InByIdVariant::attemptToMerge):

9:54 AM Changeset in webkit [234089] by Yusuke Suzuki

8 edits
3 adds in trunk

[DFG] Fold GetByVal if the indexed value is non configurable and non writable
https://bugs.webkit.org/show_bug.cgi?id=186462

Reviewed by Saam Barati.

JSTests:

stress/folding-get-by-val-with-read-only-dont-delete-object.js: Added.

(shouldBe):
(test1):
(test2):
(test3):
(test4):
(test5):

stress/folding-get-by-val-with-read-only-dont-delete-runtime-array.js: Added.

(shouldBe):
(test1):
(test2):
(test5):

stress/folding-get-by-val-with-read-only-dont-delete.js: Added.

(shouldBe):
(test1):
(test2):
(test3):
(test4):
(test5):

Source/JavaScriptCore:

Non-special DontDelete | ReadOnly properties mean that it won't be changed. If DFG AI can retrieve this
property, AI can fold it into a constant. This type of property can be seen when we use ES6 tagged templates.
Tagged templates' callsite includes indexed properties whose attributes are DontDelete | ReadOnly.

This patch attempts to fold such properties into constant in DFG AI. The challenge is that DFG AI runs
concurrently with the mutator thread. In this patch, we insert WTF::storeStoreFence between value setting
and attributes setting. The attributes must be set after the corresponding value is set. If the loaded
attributes (with WTF::loadLoadFence) include DontDelete | ReadOnly, it means the given value won't be
changed and we can safely use it. We arrange our existing code to use this protocol.

Since GetByVal folding requires the correct Structure & Butterfly pairs, it is only enabled in x86 architecture
since it is TSO. So, our WTF::storeStoreFence in SparseArrayValueMap is also emitted only in x86.

This patch improves SixSpeed/template_string_tag.es6.

baseline patched

template_string_tag.es6 237.0301+-4.8374 ^{9.8779+-0.3628} definitely 23.9960x faster

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

runtime/JSArray.cpp:

(JSC::JSArray::setLengthWithArrayStorage):

runtime/JSObject.cpp:

(JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::putIndexedDescriptor):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
(JSC::JSObject::putIndexedDescriptor): Deleted.

runtime/JSObject.h:
runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::SparseArrayValueMap):
(JSC::SparseArrayValueMap::add):
(JSC::SparseArrayValueMap::putDirect):
(JSC::SparseArrayValueMap::getConcurrently):
(JSC::SparseArrayEntry::get const):
(JSC::SparseArrayEntry::getConcurrently const):
(JSC::SparseArrayEntry::put):
(JSC::SparseArrayEntry::getNonSparseMode const):
(JSC::SparseArrayValueMap::visitChildren):
(JSC::SparseArrayValueMap::~SparseArrayValueMap): Deleted.

runtime/SparseArrayValueMap.h:

(JSC::SparseArrayEntry::SparseArrayEntry):
(JSC::SparseArrayEntry::attributes const):
(JSC::SparseArrayEntry::forceSet):
(JSC::SparseArrayEntry::asValue):

Jul 21, 2018:

9:56 PM Changeset in webkit [234088] by Simon Fraser

4 edits in trunk/Tools

Fix lldb summarizers for HashMaps and HashSets
https://bugs.webkit.org/show_bug.cgi?id=187883

Reviewed by Dan Bates.

HashMap and HashSet summarizers were broken in various ways.

The 'type summary add -x' regexp needs to match at the start and end of the string
to avoid finding types nested inside other templates.

The HashTable synthetic child code incorrectly used the type of the key, rather than
the value when synthesizing children.

Add HashMap and HashSet summarizers.

I tried to get synthetic children working directly for HashMap and HashSet, but was unable.

lldb/lldbWebKitTester/main.cpp:

(testSummaryProviders):

lldb/lldb_webkit.py:

(lldb_init_module):
(lldb_init_module.lldb_webkit):
(WTFHashMap_SummaryProvider):
(WTFHashSet_SummaryProvider):
(WebCoreColorProvider._to_string_extended):
(WebCoreURLProvider.to_string):
(WTFHashMapProvider):
(WTFHashMapProvider.init):
(WTFHashMapProvider.tableSize):
(WTFHashMapProvider.keyCount):
(WTFHashSetProvider):
(WTFHashSetProvider.init):
(WTFHashSetProvider.tableSize):
(WTFHashSetProvider.keyCount):
(WTFHashTableProvider.tableSize):
(WTFHashTableProvider):
(WTFHashTableProvider.keyCount):
(WTFHashTableProvider.get_child_at_index):
(WTFHashTableProvider.update):

lldb/lldb_webkit_unittest.py:

(TestSummaryProviders.serial_test_WTFVectorProvider_empty_vector):
(TestSummaryProviders.serial_test_WTFVectorProvider_vector_size_and_capacity):
(TestSummaryProviders):
(TestSummaryProviders.serial_test_WTFHashMap_tablesize_and_size):
(TestSummaryProviders.serial_test_WTFHashMap_of_vectors_tablesize_and_size):
(TestSummaryProviders.serial_test_WTFHashSet_tablesize_and_size):

9:09 PM Changeset in webkit [234087] by Simon Fraser

2 edits in trunk/Tools

Add lldb formatters for WebCore geometry types
https://bugs.webkit.org/show_bug.cgi?id=187884

Reviewed by Daniel Bates.

Add lldb formatters for IntPoint, IntSize, IntRect, FloatPoint, FloatSize, FloatRect
and LayoutRect.

Testing is blocked by webkit.org/b/187872.

lldb/lldbWebKitTester/main.cpp:

(testSummaryProviders):

lldb/lldb_webkit.py:

(lldb_init_module.lldb_webkit):
(lldb_init_module):
(WebCoreLayoutRect_SummaryProvider):
(WebCoreIntSize_SummaryProvider):
(WebCoreIntPoint_SummaryProvider):
(WebCoreFloatSize_SummaryProvider):
(WebCoreFloatPoint_SummaryProvider):
(WebCoreIntRect_SummaryProvider):
(WebCoreFloatRect_SummaryProvider):
(WebCoreLayoutRectProvider):
(WebCoreLayoutRectProvider.init):
(WebCoreLayoutRectProvider.get_x):
(WebCoreLayoutRectProvider.get_y):
(WebCoreLayoutRectProvider.get_width):
(WebCoreLayoutRectProvider.get_height):
(WebCoreIntPointProvider):
(WebCoreIntPointProvider.init):
(WebCoreIntPointProvider.get_x):
(WebCoreIntPointProvider.get_y):
(WebCoreIntSizeProvider):
(WebCoreIntSizeProvider.init):
(WebCoreIntSizeProvider.get_width):
(WebCoreIntSizeProvider.get_height):
(WebCoreIntRectProvider):
(WebCoreIntRectProvider.init):
(WebCoreIntRectProvider.get_x):
(WebCoreIntRectProvider.get_y):
(WebCoreIntRectProvider.get_width):
(WebCoreIntRectProvider.get_height):
(WebCoreFloatPointProvider):
(WebCoreFloatPointProvider.init):
(WebCoreFloatPointProvider.get_x):
(WebCoreFloatPointProvider.get_y):
(WebCoreFloatSizeProvider):
(WebCoreFloatSizeProvider.init):
(WebCoreFloatSizeProvider.get_width):
(WebCoreFloatSizeProvider.get_height):
(WebCoreFloatRectProvider):
(WebCoreFloatRectProvider.init):
(WebCoreFloatRectProvider.get_x):
(WebCoreFloatRectProvider.get_y):
(WebCoreFloatRectProvider.get_width):
(WebCoreFloatRectProvider.get_height):

7:48 PM Changeset in webkit [234086] by fpizlo@apple.com

79 edits
14 adds in trunk

We should support CreateThis in the FTL
https://bugs.webkit.org/show_bug.cgi?id=164904

Reviewed by Yusuke Suzuki.
JSTests:

microbenchmarks/polyvariant-get-by-id-shorter-tower.js: Added.

(polyvariant):
(Foo.prototype.func):
(Foo):
(foo):
(Bar.prototype.func):
(Bar):
(bar):

microbenchmarks/polyvariant-get-by-id-tower.js: Added.

(polyvariant):
(Foo.prototype.func):
(Foo):
(foo):
(Bar.prototype.func):
(Bar):
(bar):
(Baz.prototype.func):
(Baz):
(baz):

Source/JavaScriptCore:

This started with Saam's patch to implement CreateThis in the FTL, but turned into a type
inference adventure.

CreateThis in the FTL was a massive regression in raytrace because it disturbed that
benchmark's extremely perverse way of winning at type inference:

The benchmark wanted polyvariant devirtualization of an object construction helper. But, the polyvariant profiler wasn't powerful enough to reliably devirtualize that code. So, the benchmark was falling back to other mechanisms...

The construction helper could not tier up into the FTL. When the DFG compiled it, it would see that the IC had 4 cases. That's too polymorphic for the DFG. So, the DFG would emit a GetById. Shortly after the DFG compile, that get_by_id would see many more cases, but now that the helper was compiled by the DFG, the baseline get_by_id would not see those cases. The DFG's GetById would "hide" those cases. The number of cases the DFG's GetById would see is larger than our polymorphic list limit (limit = 8, case count = 13, I think).

Note that if the FTL compiles that construction helper, it sees the 4 cases, turns them
into a MultiGetByOffset, then suffers from exits when the new cases hit, and then exits to
baseline, which then sees those cases. Luckily, the FTL was not compiling the construction
helper because it had a CreateThis.

Compilations that inlined the construction helper would have gotten super lucky with parse-time constant folding, so they knew what structure the input to the get_by_id would have at parse time. This is only profitable if the get_by_id parsing computed a GetByIdStatus that had a finite number of cases. Because the 13 cases were being hidden by the DFG GetById and GetByIdStatus would only look at the baseline get_by_id, which had 4 cases, we would indeed get a finite number of cases. The parser would then prune those cases to just one - based on its knowledge of the structure - and that would result in that get_by_id being folded at parse time to a constant.

The subsequent op_call would inline based on parse-time knowledge of that constant.

This patch comprehensively fixes these issues, as well as other issues that come up along the
way. The short version is that raytrace was revealing sloppiness in our use of profiling for
type inference. This patch fixes the sloppiness by vastly expanding *polyvariant* profiling,
i.e. the profiling that considers call context. I was encouraged to do this by the fact that
even the old version of polyvariant profiling was a speed-up on JetStream, ARES-6, and
Speedometer 2 (it's easy to measure since it's a runtime flag). So, it seemed worthwhile to
attack raytrace's problem as a shortcoming of polyvariant profiling.

Polyvariant profiling now consults every DFG or FTL code block that participated in any subset of the inline stack that includes the IC we're profiling. For example, if we have an inline stack like foo->bar->baz, with baz on top, then we will consult DFG or FTL compilations for foo, bar, and baz. In foo, we'll look up foo->bar->baz; in bar we'll look up bar->baz; etc. This fixes two problems encountered in raytrace. First, it ensures that a DFG GetById cannot hide anything from the profiling of that get_by_id, since the polyvariant profiling code will always consult it. Second, it enables raytrace to benefit from polyvariant profling. Previously, the polyvariant profiler would only look at the previous DFG compilation of foo and look up foo->bar->baz. But that only works if DFG-foo had inlined bar and then baz. It may not have done that, because those calls could have required polyvariant profiling that was only available in the FTL.

A particularly interesting case is when some IC in foo-baseline is also available in foo-DFG. This case is encountered by the polyvariant profiler as it walks the inline stack. In the case of gathering profiling for foo-FTL, the polyvariant profiler finds foo-DFG via the trivial case of no inline stack. This also means that if foo ever gets inlined, we will find foo-DFG or foo-FTL in the final case of polyvariant profiling. In those cases, we now merge the IC of foo-baseline and foo-DFG. This avoids lots of unnecessary recompilations, because it warns us of historical polymorphism. Historical polymorphism usually means future polymorphism. IC status code already had some merging functionality, but I needed to beef it up a lot to make this work right.

Inlining an inline cache now preserves as much information as profiling. One challenge of polyvariant profiling is that the FTL compile for bar (that includes bar->baz) could have inlined an inline cache based on polyvariant profiling. So, when the FTL compile for foo (that includes foo->bar->baz) asks bar what it knows about that IC inside bar->baz, it will say "I don't have such an IC". At this point the DFG compilation that included that IC that gave us the information that we used to inline the IC is no longer alive. To keep us from losing the information we learned about the IC, there is now a RecordedStatuses data structure that preserves the statuses we use for inlining ICs. We also filter those statuses according to things we learn from AI. This further reduces the risk of information about an IC being forgotten.

Exit profiling now considers whether or not an exit happened from inline code. This protects us in the case where the not-inlined version of an IC exited a lot because of polymorphism that doesn't exist in the inlined version. So, when using polyvariant profiling data, we consider only inlined exits.

CallLinkInfo now records when it's repatched to the virtual call thunk. Previously, this would clear the CallLinkInfo, so CallLinkStatus would fall back to the lastSeenCallee. It's surprising that we've had this bug.

Altogether this patch is performance-neutral in run-jsc-benchmarks, except for speed-ups in
microbenchmarks and a compile time regression. Octane/deltablue speeds up by ~5%.
Octane/raytrace is regressed by a minuscule amount, which we could make up by implementing
prototype access folding in the bytecode parser and constant folder. That would require some
significant new logic in GetByIdStatus. That would also require a new benchmark - we want to
have a test that captures raytrace's behavior in the case that the parser cannot fold the
get_by_id.

This change is a 1.2% regression on V8Spider-CompileTime. That's a smaller regression than
recent compile time progressions, so I think that's an OK trade-off. Also, I would expect a
compile time regression anytime we fill in FTL coverage.

This is neutral on JetStream, ARES-6, and Speedometer2. JetStream agrees that deltablue
speeds up and that raytrace slows down, but these changes balance out and don't affect the
overall score. In ARES-6, it looks like individual tests have some significant 1-2% speed-ups
or slow-downs. Air-steady is definitely ~1.5% faster. Basic-worst is probably 2% slower (p ~
0.1, so it's not very certain). The JetStream, ARES-6, and Speedometer2 overall scores don't
see a significant difference. In all three cases the difference is <0.5% with a high p value,
with JetStream and Speedometer2 being insignificant infinitesimal speed-ups and ARES-6 being
an insignificant infinitesimal slow-down.

Oh, and this change means that the FTL now has 100% coverage of JavaScript. You could do an
eval in a for-in loop in a for-of loop inside a with block that uses try/catch for control
flow in a polymorphic constructor while having a bad time, and we'll still compile it.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
bytecode/ByValInfo.h:
bytecode/BytecodeDumper.cpp:

(JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
(JSC::BytecodeDumper<Block>::printPutByIdCacheStatus):
(JSC::BytecodeDumper<Block>::printInByIdCacheStatus):
(JSC::BytecodeDumper<Block>::dumpCallLinkStatus):
(JSC::BytecodeDumper<CodeBlock>::dumpCallLinkStatus):
(JSC::BytecodeDumper<Block>::printCallOp):
(JSC::BytecodeDumper<Block>::dumpBytecode):
(JSC::BytecodeDumper<Block>::dumpBlock):

bytecode/BytecodeDumper.h:
bytecode/CallLinkInfo.h:
bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::computeFor):
(JSC::CallLinkStatus::computeExitSiteData):
(JSC::CallLinkStatus::computeFromCallLinkInfo):
(JSC::CallLinkStatus::accountForExits):
(JSC::CallLinkStatus::finalize):
(JSC::CallLinkStatus::filter):
(JSC::CallLinkStatus::computeDFGStatuses): Deleted.

bytecode/CallLinkStatus.h:

(JSC::CallLinkStatus::operator bool const):
(JSC::CallLinkStatus::operator! const): Deleted.

bytecode/CallVariant.cpp:

(JSC::CallVariant::finalize):
(JSC::CallVariant::filter):

bytecode/CallVariant.h:

(JSC::CallVariant::operator bool const):
(JSC::CallVariant::operator! const): Deleted.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::getICStatusMap):
(JSC::CodeBlock::resetJITData):
(JSC::CodeBlock::getStubInfoMap): Deleted.
(JSC::CodeBlock::getCallLinkInfoMap): Deleted.
(JSC::CodeBlock::getByValInfoMap): Deleted.

bytecode/CodeBlock.h:
bytecode/CodeOrigin.cpp:

(JSC::CodeOrigin::isApproximatelyEqualTo const):
(JSC::CodeOrigin::approximateHash const):

bytecode/CodeOrigin.h:

(JSC::CodeOrigin::exitingInlineKind const):

bytecode/DFGExitProfile.cpp:

(JSC::DFG::FrequentExitSite::dump const):
(JSC::DFG::ExitProfile::add):

bytecode/DFGExitProfile.h:

(JSC::DFG::FrequentExitSite::FrequentExitSite):
(JSC::DFG::FrequentExitSite::operator== const):
(JSC::DFG::FrequentExitSite::subsumes const):
(JSC::DFG::FrequentExitSite::hash const):
(JSC::DFG::FrequentExitSite::inlineKind const):
(JSC::DFG::FrequentExitSite::withInlineKind const):
(JSC::DFG::QueryableExitProfile::hasExitSite const):
(JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificJITType const):
(JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificInlineKind const):

bytecode/ExitFlag.cpp: Added.

(JSC::ExitFlag::dump const):

bytecode/ExitFlag.h: Added.

(JSC::ExitFlag::ExitFlag):
(JSC::ExitFlag::operator| const):
(JSC::ExitFlag::operator|=):
(JSC::ExitFlag::operator& const):
(JSC::ExitFlag::operator&=):
(JSC::ExitFlag::operator bool const):
(JSC::ExitFlag::isSet const):

bytecode/ExitingInlineKind.cpp: Added.

(WTF::printInternal):

bytecode/ExitingInlineKind.h: Added.
bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFor):
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::slowVersion const):
(JSC::GetByIdStatus::markIfCheap):
(JSC::GetByIdStatus::finalize):
(JSC::GetByIdStatus::hasExitSite): Deleted.

bytecode/GetByIdStatus.h:
bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::markIfCheap):
(JSC::GetByIdVariant::finalize):

bytecode/GetByIdVariant.h:
bytecode/ICStatusMap.cpp: Added.

(JSC::ICStatusContext::get const):
(JSC::ICStatusContext::isInlined const):
(JSC::ICStatusContext::inlineKind const):

bytecode/ICStatusMap.h: Added.
bytecode/ICStatusUtils.cpp: Added.

(JSC::hasBadCacheExitSite):

bytecode/ICStatusUtils.h:
bytecode/InstanceOfStatus.cpp:

(JSC::InstanceOfStatus::computeFor):

bytecode/InstanceOfStatus.h:
bytecode/PolyProtoAccessChain.h:
bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::hasExitSite):
(JSC::PutByIdStatus::computeFor):
(JSC::PutByIdStatus::slowVersion const):
(JSC::PutByIdStatus::markIfCheap):
(JSC::PutByIdStatus::finalize):
(JSC::PutByIdStatus::filter):

bytecode/PutByIdStatus.h:
bytecode/PutByIdVariant.cpp:

(JSC::PutByIdVariant::markIfCheap):
(JSC::PutByIdVariant::finalize):

bytecode/PutByIdVariant.h:

(JSC::PutByIdVariant::structureSet const):

bytecode/RecordedStatuses.cpp: Added.

(JSC::RecordedStatuses::operator=):
(JSC::RecordedStatuses::RecordedStatuses):
(JSC::RecordedStatuses::addCallLinkStatus):
(JSC::RecordedStatuses::addGetByIdStatus):
(JSC::RecordedStatuses::addPutByIdStatus):
(JSC::RecordedStatuses::markIfCheap):
(JSC::RecordedStatuses::finalizeWithoutDeleting):
(JSC::RecordedStatuses::finalize):
(JSC::RecordedStatuses::shrinkToFit):

bytecode/RecordedStatuses.h: Added.

(JSC::RecordedStatuses::RecordedStatuses):
(JSC::RecordedStatuses::forEachVector):

bytecode/StructureSet.cpp:

(JSC::StructureSet::markIfCheap const):
(JSC::StructureSet::isStillAlive const):

bytecode/StructureSet.h:
bytecode/TerminatedCodeOrigin.h: Added.

(JSC::TerminatedCodeOrigin::TerminatedCodeOrigin):
(JSC::TerminatedCodeOriginHashTranslator::hash):
(JSC::TerminatedCodeOriginHashTranslator::equal):

bytecode/Watchpoint.cpp:

(WTF::printInternal):

bytecode/Watchpoint.h:
dfg/DFGAbstractInterpreter.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleVarargsCall):
(JSC::DFG::ByteCodeParser::handleDOMJITGetter):
(JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
(JSC::DFG::ByteCodeParser::InlineStackEntry::~InlineStackEntry):
(JSC::DFG::ByteCodeParser::parse):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

dfg/DFGCommonData.h:
dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDesiredWatchpoints.h:

(JSC::DFG::SetPointerAdaptor::hasBeenInvalidated):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

dfg/DFGMayExit.cpp:
dfg/DFGNode.h:

(JSC::DFG::Node::hasCallLinkStatus):
(JSC::DFG::Node::callLinkStatus):
(JSC::DFG::Node::hasGetByIdStatus):
(JSC::DFG::Node::getByIdStatus):
(JSC::DFG::Node::hasPutByIdStatus):
(JSC::DFG::Node::putByIdStatus):

dfg/DFGNodeType.h:
dfg/DFGOSRExitBase.cpp:

(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):

dfg/DFGObjectAllocationSinkingPhase.cpp:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::reallyAdd):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::finalizeInGC):

dfg/DFGPlan.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

dfg/DFGWorklist.cpp:

(JSC::DFG::Worklist::removeDeadPlans):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
(JSC::FTL::DFG::LowerDFGToB3::compileFilterICStatus):

jit/PolymorphicCallStubRoutine.cpp:

(JSC::PolymorphicCallStubRoutine::hasEdges const):
(JSC::PolymorphicCallStubRoutine::edges const):

jit/PolymorphicCallStubRoutine.h:
profiler/ProfilerBytecodeSequence.cpp:

(JSC::Profiler::BytecodeSequence::BytecodeSequence):

runtime/FunctionRareData.cpp:

(JSC::FunctionRareData::initializeObjectAllocationProfile):

runtime/Options.h:

Source/WTF:

wtf/TinyPtrSet.h:

(WTF::TinyPtrSet::operator!= const):

4:28 PM lldb formatters edited by Simon Fraser

(diff)

4:27 PM lldb formatters edited by Simon Fraser

(diff)

4:23 PM lldb formatters created by Simon Fraser

4:21 PM WikiStart edited by Simon Fraser

(diff)

11:49 AM Changeset in webkit [234085] by Alan Bujtas

5 edits in trunk/Source/WebCore

[LFC][IFC] Add verification for inline text runs.
https://bugs.webkit.org/show_bug.cgi?id=187879

Reviewed by Antti Koivisto.

layout/Verification.cpp:

(WebCore::Layout::outputMismatchingSimpleLineInformationIfNeeded):
(WebCore::Layout::outputMismatchingComplexLineInformationIfNeeded):
(WebCore::Layout::outputMismatchingBlockBoxInformationIfNeeded):
(WebCore::Layout::verifyAndOutputSubtree):
(WebCore::Layout::outputMismatchingBoxInformationIfNeeded): Deleted.

layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::layout const):

layout/inlineformatting/InlineFormattingState.h:

(WebCore::Layout::InlineFormattingState::addLayoutRuns):
(WebCore::Layout::InlineFormattingState::layoutRuns const):

layout/layouttree/LayoutTreeBuilder.cpp:

(WebCore::Layout::outputLayoutBox):
(WebCore::Layout::outputLayoutTree):
(WebCore::Layout::TreeBuilder::showLayoutTree):

11:47 AM Changeset in webkit [234084] by Alan Bujtas

9 edits in trunk/Source/WebCore

[LFC] Do not use virtual methods to construct floating/formatting states.
https://bugs.webkit.org/show_bug.cgi?id=187875

Reviewed by Antti Koivisto.

LayoutContext::establishedFormattingState() does not require FormattingContext anymore only the root of the context.

layout/FormattingContext.cpp:

(WebCore::Layout::FormattingContext::layoutOutOfFlowDescendants const):

layout/FormattingContext.h:
layout/LayoutContext.cpp:

(WebCore::Layout::LayoutContext::layoutFormattingContextSubtree):
(WebCore::Layout::LayoutContext::formattingStateForBox const):
(WebCore::Layout::LayoutContext::establishedFormattingState):

layout/LayoutContext.h:
layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::layoutFormattingContextRoot const):
(WebCore::Layout::BlockFormattingContext::instrinsicWidthConstraints const):
(WebCore::Layout::BlockFormattingContext::createFormattingState const): Deleted.
(WebCore::Layout::BlockFormattingContext::createOrFindFloatingState const): Deleted.

layout/blockformatting/BlockFormattingContext.h:
layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::createFormattingState const): Deleted.
(WebCore::Layout::InlineFormattingContext::createOrFindFloatingState const): Deleted.

layout/inlineformatting/InlineFormattingContext.h:

8:00 AM Changeset in webkit [234083] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][BFC] Do not collapse top/bottom margin with first/last inflow child from a non-block formatting context.
https://bugs.webkit.org/show_bug.cgi?id=187867

Reviewed by Antti Koivisto.

The box's top/bottom margin never collapses with a non-block inflow child.

layout/blockformatting/BlockMarginCollapse.cpp:

(WebCore::Layout::isMarginTopCollapsedWithSibling):
(WebCore::Layout::isMarginBottomCollapsedWithSibling):
(WebCore::Layout::isMarginTopCollapsedWithParent):
(WebCore::Layout::isMarginBottomCollapsedThrough):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::collapsedMarginTopFromFirstChild):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::nonCollapsedMarginTop):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::computedNonCollapsedMarginTop):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::computedNonCollapsedMarginBottom):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::marginTop):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::marginBottom):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::isMarginBottomCollapsedWithParent):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::collapsedMarginBottomFromLastChild):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::nonCollapsedMarginBottom):

layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::establishesBlockFormattingContextOnly const): <div style="overflow: hidden">foobar</div> establishes both inline and block formatting context (inline wins though).

layout/layouttree/LayoutBox.h: establishesBlockFormattingContext() does not need to be virtual since we can determine it by looking at the box's style. -while in case

of inline formatting context, it is about the content.

6:10 AM Changeset in webkit [234082] by Yusuke Suzuki

26 edits in trunk/Source

[JSC] Use Function / ScopedLambda / RecursableLambda instead of std::function
https://bugs.webkit.org/show_bug.cgi?id=187472

Reviewed by Mark Lam.

Source/JavaScriptCore:

std::function allocates memory from standard malloc instead of bmalloc. Instead of
using that, we should use WTF::{Function,ScopedLambda,RecursableLambda}.

This patch attempts to replace std::function with the above WTF function types.
If the function's lifetime can be the same to the stack, we can use ScopedLambda, which
is really efficient. Otherwise, we should use WTF::Function.
For recurring use cases, we can use RecursableLambda.

assembler/MacroAssembler.cpp:

(JSC::stdFunctionCallback):
(JSC::MacroAssembler::probe):

assembler/MacroAssembler.h:
b3/air/AirDisassembler.cpp:

(JSC::B3::Air::Disassembler::dump):

b3/air/AirDisassembler.h:
bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
(JSC::BytecodeGenerator::emitEnumeration):

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::ArrayNode::emitBytecode):
(JSC::ApplyFunctionCallDotNode::emitBytecode):
(JSC::ForOfNode::emitBytecode):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::addSlowPathGeneratorLambda):
(JSC::DFG::SpeculativeJIT::compileMathIC):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGValidate.cpp:
ftl/FTLCompile.cpp:

(JSC::FTL::compile):

heap/HeapSnapshotBuilder.cpp:

(JSC::HeapSnapshotBuilder::json):

heap/HeapSnapshotBuilder.h:
interpreter/StackVisitor.cpp:

(JSC::StackVisitor::Frame::dump const):

interpreter/StackVisitor.h:
runtime/PromiseDeferredTimer.h:
runtime/VM.cpp:

(JSC::VM::whenIdle):
(JSC::enableProfilerWithRespectToCount):
(JSC::disableProfilerWithRespectToCount):

runtime/VM.h:
runtime/VMEntryScope.cpp:

(JSC::VMEntryScope::addDidPopListener):

runtime/VMEntryScope.h:
tools/HeapVerifier.cpp:

(JSC::HeapVerifier::verifyCellList):
(JSC::HeapVerifier::validateCell):
(JSC::HeapVerifier::validateJSCell):

tools/HeapVerifier.h:

Source/WTF:

wtf/ScopedLambda.h:

(WTF::ScopedLambda<ResultType):

Jul 20, 2018:

8:50 PM Changeset in webkit [234081] by jer.noble@apple.com

2 edits in trunk/Source/WebKit

REGRESSION(r233925): Can't go into PiP twice
https://bugs.webkit.org/show_bug.cgi?id=187876
<rdar://problem/42444520>

Reviewed by Jon Lee.

We fail to enter PiP the second time because the video fullscreen interface no longer has a
model, and so gives a contentSize of 0x0. This happens because we disassociate the
interface from the model in didCleanupFullscreen. However, the interface and model can still
be re-used if they're kept alive by another client. We should delay disassociating the model
from the interface until just before the model is destroyed in removeClientForContext.

UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:

(WebKit::VideoFullscreenManagerProxy::removeClientForContext):
(WebKit::VideoFullscreenManagerProxy::didCleanupFullscreen):

8:10 PM Changeset in webkit [234080] by wilander@apple.com

21 edits
4 adds in trunk

Resource Load Statistics: Enable basic functionality in experimental debug mode
https://bugs.webkit.org/show_bug.cgi?id=187835
<rdar://problem/42408590>

Reviewed by Chris Dumez.

This patch makes the experimental ITP Debug Mode feature work, at least
Source/WebKit:

to a basic level. This means:

Debug logging on the INFO level.
Permanently treat 3rdpartytestwebkit.org as a prevalent resource.
Support manual setting of a custom permanently prevalent resource through user defaults on Cocoa platforms.

UIProcess/API/C/WKWebsiteDataStoreRef.cpp:

(WKWebsiteDataStoreSetResourceLoadStatisticsDebugModeWithCompletionHandler):
(WKWebsiteDataStoreSetResourceLoadStatisticsPrevalentResourceForDebugMode):

Test infrastructure.

UIProcess/API/C/WKWebsiteDataStoreRef.h:
UIProcess/Cocoa/ResourceLoadStatisticsMemoryStoreCocoa.mm:

(WebKit::ResourceLoadStatisticsMemoryStore::registerUserDefaultsIfNeeded):

Used to pick up custom set prevalent resource on Cocoa platforms (for debug mode).

UIProcess/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::isPrevalentDueToDebugMode):
(WebKit::ResourceLoadStatisticsMemoryStore::processStatisticsAndDataRecords):

Now skips processing of debug mode prevalent resources so that they
stay prevalent.

(WebKit::ResourceLoadStatisticsMemoryStore::ensurePrevalentResourcesForDebugMode):

Convenience function to make 3rdpartytestwebkit.org and any custom domain
set through ResourceLoadStatisticsMemoryStore::setPrevalentResourceForDebugMode()
be prevalent resources.

(WebKit::ResourceLoadStatisticsMemoryStore::setResourceLoadStatisticsDebugMode):
(WebKit::ResourceLoadStatisticsMemoryStore::setPrevalentResourceForDebugMode):

Sets a custom domain to always be treated as prevalent in debug mode.

(WebKit::ResourceLoadStatisticsMemoryStore::clear):

Now makes sure 3rdpartytestwebkit.org and any custom domain set through
ResourceLoadStatisticsMemoryStore::setPrevalentResourceForDebugMode()
are prevalent resources even after a clear of the store.

(WebKit::debugLogDomainsInBatches):

We may have too many domain names to fit in a single log statement.
This function logs them in batches of 50, if we have more than 50.

(WebKit::ResourceLoadStatisticsMemoryStore::updateCookiePartitioning):

Now makes use of debugLogDomainsInBatches() in debug mode.

UIProcess/ResourceLoadStatisticsMemoryStore.h:

(WebKit::ResourceLoadStatisticsMemoryStore::isDebugModeEnabled const):

UIProcess/ResourceLoadStatisticsPersistentStorage.cpp:

(WebKit::ResourceLoadStatisticsPersistentStorage::populateMemoryStoreFromDisk):

Now accepts a non-empty memory store in debug mode. This is to support a
pre-populated store with 3rdpartytestwebkit.org and any custom domain already
set as prevalent.

(WebKit::ResourceLoadStatisticsPersistentStorage::setResourceLoadStatisticsDebugMode):

UIProcess/WebResourceLoadStatisticsStore.cpp:

(WebKit::WebResourceLoadStatisticsStore::setResourceLoadStatisticsDebugMode):
(WebKit::WebResourceLoadStatisticsStore::setPrevalentResourceForDebugMode):

UIProcess/WebResourceLoadStatisticsStore.h:
UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::setResourceLoadStatisticsDebugMode):

UIProcess/WebsiteData/WebsiteDataStore.h:

Tools:

to a basic level. All of the changes to TestRunner are to support the
layout tests for the functionality.

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::didReceiveMessageToPage):

WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::setStatisticsDebugMode):
(WTR::TestRunner::statisticsCallDidSetDebugModeCallback):
(WTR::TestRunner::setStatisticsPrevalentResourceForDebugMode):
(WTR::TestRunner::statisticsCallDidSetPrevalentResourceForDebugModeCallback):

WebKitTestRunner/InjectedBundle/TestRunner.h:
WebKitTestRunner/TestController.cpp:

(WTR::TestController::setStatisticsDebugMode):
(WTR::TestController::setStatisticsPrevalentResourceForDebugMode):

WebKitTestRunner/TestController.h:
WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
(WTR::TestInvocation::didSetStatisticsDebugMode):
(WTR::TestInvocation::didSetPrevalentResourceForDebugMode):

WebKitTestRunner/TestInvocation.h:

LayoutTests:

to a basic level.

http/tests/resourceLoadStatistics/enable-debug-mode-expected.txt: Added.
http/tests/resourceLoadStatistics/enable-debug-mode.html: Added.
http/tests/resourceLoadStatistics/set-custom-prevalent-resource-in-debug-mode-expected.txt: Added.
http/tests/resourceLoadStatistics/set-custom-prevalent-resource-in-debug-mode.html: Added.

6:10 PM Changeset in webkit [234079] by bshafiei@apple.com

1 copy in tags/Safari-606.1.28

Tag Safari-606.1.28.

5:42 PM Changeset in webkit [234078] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

REGRESSION (r233974): Cannot close pip'd video; pops back into PiP.
https://bugs.webkit.org/show_bug.cgi?id=187873

Reviewed by Jon Lee.

When the PIP machinery on Mac wants to close the PIP window (due to the close button being clicked), it does
not consult our -shouldClosePiP handler; it just tells us that we're going to close. So we never setup the
necessary state on the WebProcess side and still think that our "targetIsFullscreen". When we get the "stop"
action, just request exit fullscreen, but set up the _pipState to think we're already exiting (because we are).

platform/mac/VideoFullscreenInterfaceMac.mm:

(-[WebVideoFullscreenInterfaceMacObjC pipActionStop:]):

5:41 PM Changeset in webkit [234077] by sihui_liu@apple.com

4 edits in trunk/LayoutTests

[ MacOS iOS ] Layout Test storage/indexeddb/modern/opendatabase-after-storage-crash.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=187648
<rdar://problem/42405935>

Reviewed by Brady Eidson.

Make test wait until requests finish to get correct result, because indexedDB operations are asynchronous.

storage/indexeddb/modern/opendatabase-after-storage-crash-expected.txt:
storage/indexeddb/modern/opendatabase-after-storage-crash.html:

5:30 PM Changeset in webkit [234076] by Nikita Vasilyev

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Dark Mode: Layers tab background should be dark
https://bugs.webkit.org/show_bug.cgi?id=187660
<rdar://problem/42179616>

Reviewed by Brian Burg.

UserInterface/Views/Layers3DContentView.js:

(WI.Layers3DContentView.prototype.initialLayout):

UserInterface/Views/Variables.css:

(:root):

4:48 PM Changeset in webkit [234075] by msaboff@apple.com

3 edits
2 adds in trunk

DFG AbstractInterpreter: CheckArray filters array modes for DirectArguments/ScopedArguments using only NonArray
https://bugs.webkit.org/show_bug.cgi?id=187827
rdar://problem/42146858

Reviewed by Saam Barati.

JSTests:

New regression tests.

stress/direct-arguments-check-array.js: Added.

(setup.f2):
(setup):
(forOfArray):
(forOfArgs):
(callEveryOnArgs):

stress/scoped-arguments-check-array.js: Added.

(setup.foo):
(setup.f2):
(setup):
(forOfArray):
(forOfArgs):
(callEveryOnArgs):

Source/JavaScriptCore:

When filtering array modes for DirectArguments or ScopedArguments, we need to allow for the possibility
that they can either be NonArray or NonArrayWithArrayStorage (aka ArrayStorageShape).
We can't end up with other shapes, Int32, Double, etc because GenericArguments sets
InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero which will cause us to go down a
putByIndex() path that doesn't change the shape.

dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):

4:43 PM Changeset in webkit [234074] by commit-queue@webkit.org

8 edits
2 adds in trunk/Source/WebCore

Safari WebGL does not consistently provide correct GPU context on eGPU systems
https://bugs.webkit.org/show_bug.cgi?id=187750
<rdar://problem/39531436>

Patch by Justin Fan <Justin Fan> on 2018-07-20
Reviewed by Dean Jackson.

Move GraphicsContext3DManager into its own class, and notify it when page/Chrome receives a
windowScreenDidChange message. Add a private data struct to track which hostWindow created each context.
Upon notification, Manager updates the contexts that match the hostWindow with the
provided displayID. Each context matches displayID to rendererID (set during process creation
if window server is blocked), which is matched to a virtual screen, and updates its GPU accordingly.

No new tests. This requires multiple GPUs or eGPUs, each with attached display(s), to test.

WebCore.xcodeproj/project.pbxproj:
page/Chrome.cpp:

(WebCore::Chrome::windowScreenDidChange): Now calls GraphicsContext3DManager::screenDidChange().

platform/PlatformScreen.h:
platform/ScreenProperties.h: Add rendererID to struct.

(WebCore::ScreenData::encode const):
(WebCore::ScreenData::decode):

platform/graphics/GraphicsContext3D.h:
platform/graphics/GraphicsContext3DManager.cpp: Added (copied out of GraphicsContext3DCocoa.mm).

(WebCore::attachToAppleGraphicsControl):
(WebCore::hasMuxCapability):
(WebCore::hasMuxableGPU):
(WebCore::GraphicsContext3DManager::sharedManager):
(WebCore::displayWasReconfigured):
(WebCore::GraphicsContext3DManager::updateAllContexts):
(WebCore::GraphicsContext3DManager::screenDidChange):
(WebCore::GraphicsContext3DManager::addContext):
(WebCore::GraphicsContext3DManager::removeContext):
(WebCore::GraphicsContext3DManager::hostWindowForContext const):
(WebCore::GraphicsContext3DManager::addContextRequiringHighPerformance):
(WebCore::GraphicsContext3DManager::removeContextRequiringHighPerformance):
(WebCore::GraphicsContext3DManager::updateHighPerformanceState):
(WebCore::GraphicsContext3DManager::disableHighPerformanceGPUTimerFired):
(WebCore::GraphicsContext3DManager::recycleContextIfNecessary):

platform/graphics/GraphicsContext3DManager.h: Added (copied out of GraphicsContext3DCocoa.mm).

(WebCore::GraphicsContext3DManager::hasTooManyContexts const):
(WebCore::GraphicsContext3DManager::GraphicsContext3DManager):

platform/graphics/cocoa/GraphicsContext3DCocoa.mm:

(WebCore::GraphicsContext3D::create):
(WebCore::GraphicsContext3D::createShared):
(WebCore::identifyAndSetCurrentGPU): Now matches rendererIDs to determine virtual screen.
(WebCore::GraphicsContext3D::GraphicsContext3D):
(WebCore::GraphicsContext3D::~GraphicsContext3D):
(WebCore::GraphicsContext3D::setContextVisibility):
(WebCore::GraphicsContext3D::simulateContextChanged):
(WebCore::GraphicsContext3D::screenDidChange):
(WebCore::attachToAppleGraphicsControl): Deleted.
(WebCore::hasMuxCapability): Deleted.
(WebCore::hasMuxableGPU): Deleted.
(WebCore::GraphicsContext3DManager::GraphicsContext3DManager): Deleted.
(WebCore::GraphicsContext3DManager::hasTooManyContexts const): Deleted.
(WebCore::manager): Deleted.
(WebCore::displayWasReconfigured): Deleted.
(WebCore::GraphicsContext3DManager::updateAllContexts): Deleted.
(WebCore::GraphicsContext3DManager::addContext): Deleted.
(WebCore::GraphicsContext3DManager::removeContext): Deleted.
(WebCore::GraphicsContext3DManager::addContextRequiringHighPerformance): Deleted.
(WebCore::GraphicsContext3DManager::removeContextRequiringHighPerformance): Deleted.
(WebCore::GraphicsContext3DManager::updateHighPerformanceState): Deleted.
(WebCore::GraphicsContext3DManager::disableHighPerformanceGPUTimerFired): Deleted.
(WebCore::GraphicsContext3DManager::recycleContextIfNecessary): Deleted.

platform/mac/PlatformScreenMac.mm: Provide a display's rendererID.

(WebCore::rendererIDForDisplayMask):
(WebCore::collectScreenProperties):
(WebCore::rendererIDForDisplay):
(WebCore::primaryRendererID):

4:33 PM Changeset in webkit [234073] by Simon Fraser

8 edits
3 adds in trunk

Remove completed animations from GraphicsLayer, thus avoiding excessive backing store allocation
https://bugs.webkit.org/show_bug.cgi?id=187844
rdar://problem/40387294

Reviewed by Dean Jackson.
Source/WebCore:

A keyframe animation which animates 3D transforms, and is fill-forwards, currently
leaves the GraphicsLayer in a state where it has a "running" animation. However, the
logic that computes animation extent in RenderLayerBacking::updateGeometry() only does
so for running or paused animations. GraphicsLayer then thinks that it has an active
transform animation with unknown extent, and refuses to detach its backing store.

This triggers excessive layer creation on some sites (e.g. https://www.kqed.org).

Fix by always removing animations from the GraphicsLayer when they finish, whether
or not they fill forwards. This is done by having KeyframeAnimation::onAnimationEnd()
always call endAnimation().

This change only fixes the non-Web Animation code path. webkit.org/b/187845 exists
to fix the other code path.

Also improve some logging that would have revealed this problem sooner.

Test: compositing/backing/backing-store-attachment-fill-forwards-animation.html

page/animation/AnimationBase.h:

(WebCore::AnimationBase::endAnimation):

page/animation/ImplicitAnimation.cpp:

(WebCore::ImplicitAnimation::endAnimation):

page/animation/ImplicitAnimation.h:
page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::endAnimation):
(WebCore::KeyframeAnimation::onAnimationEnd):

page/animation/KeyframeAnimation.h:
platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::addAnimation):
(WebCore::GraphicsLayerCA::updateCoverage):

LayoutTests:

compositing/backing/backing-store-attachment-fill-forwards-animation-expected.txt: Added.
compositing/backing/backing-store-attachment-fill-forwards-animation.html: Added.

3:55 PM Changeset in webkit [234072] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebKit

Revert r233925. rdar://problem/42354959

3:55 PM Changeset in webkit [234071] by bshafiei@apple.com

25 edits
4 adds
2 deletes in branches/safari-606-branch

Revert r233926. rdar://problem/42446531

3:55 PM Changeset in webkit [234070] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Revert r233930. rdar://problem/42446531

3:55 PM Changeset in webkit [234069] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Revert r233936. rdar://problem/42446531

3:55 PM Changeset in webkit [234068] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Revert r234044. rdar://problem/42433225

2:28 PM Changeset in webkit [234067] by timothy_horton@apple.com

3 edits in trunk/Source/WebKit

Occasional crash under -[WKFormInputSession setSuggestions:]
https://bugs.webkit.org/show_bug.cgi?id=187869
<rdar://problem/41357063>

Reviewed by Dean Jackson.

UIProcess/ios/WKContentViewInteraction.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView inputDelegate]):
Make inputDelegate weak.

2:25 PM Changeset in webkit [234066] by Yusuke Suzuki

3 edits
4 adds in trunk

[DFG] Fold GetByVal if Array is CoW
https://bugs.webkit.org/show_bug.cgi?id=186459

Reviewed by Saam Barati.

JSTests:

stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds-foldable.js: Added.

(shouldBe):
(test0):
(test1):
(test2):
(test3):
(test4):
(test5):

stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds.js: Added.

(shouldBe):
(test0):
(test1):
(test2):
(test3):
(test4):
(test5):

stress/folding-get-by-val-with-immutable-butterfly-with-types.js: Added.

(shouldBe):
(test0):
(test1):
(test2):
(test3):
(test4):
(test5):

stress/folding-get-by-val-with-immutable-butterfly.js: Added.

(shouldBe):
(checking):
(test):

Source/JavaScriptCore:

CoW indexing type means that we now tracks the changes in CoW Array by structure. So DFG has a chance to
fold GetByVal if the given array is CoW. This patch folds GetByVal onto the CoW Array. If the structure
is watched and the butterfly is JSImmutableButterfly, we can load the value from this butterfly.

This can be useful since these CoW arrays are used for a storage for constants. Constant-indexed access
to these constant arrays can be folded into an actual constant by this patch.

baseline patched

template_string.es6 4993.9853+-147.5308 ^{824.1685+-44.1839} definitely 6.0594x faster
template_string_tag.es5 67.0822+-2.0100 ^{9.3540+-0.5376} definitely 7.1715x faster

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

2:14 PM Changeset in webkit [234065] by Yusuke Suzuki

2 edits in trunk/Source/JavaScriptCore

[JSC] Remove cellLock in JSObject::convertContiguousToArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=186602

Reviewed by Saam Barati.

JSObject::convertContiguousToArrayStorage's cellLock() is not necessary since we do not
change the part of the butterfly, length etc. We prove that our procedure is safe, and
drop the cellLock() here.

runtime/JSObject.cpp:

(JSC::JSObject::convertContiguousToArrayStorage):

2:10 PM Changeset in webkit [234064] by commit-queue@webkit.org

21 edits
4 copies
2 moves
5 adds in trunk

Picking a color from the color panel for typing attributes needs to inverse transform through color-filter
https://bugs.webkit.org/show_bug.cgi?id=187846

Patch by Ryosuke Niwa <rniwa@apple.com> on 2018-07-20
Reviewed by Simon Fraser.

Source/WebCore:

This patch refines the color inversion for editing introduced in r234005 so that font panels and WebKit embedders
can get and set inverted colors using attributed strings for a selected text in an editable region.

More specifically, when font panels or WebKit embedders set a font color or a background color via WebView's
_applyStyleToSelection and _applyEditingStyleToSelection, WebKit would automatically invert the color before inserting
into DOM so that the color visible to the user matches that's given to WebKit. Conversely,
[WebView attributedSubstringFromRange:nsRange] now return the color visible to the user, i.e. the color after
the color filter had been applied, so that some WebKit embedders can present the visually identical color to the user.

Because DOM never sees the color filter's effect in the computed style, etc... this patch reverts the change made to
StyleChange in r234005 to avoid inverting the color passed to execCommand. This makes editing apps which is unaware
of the dark mode or -apple-color-filter continue to function (because the color picker implemented in DOM will be
applied of the same color filter before being presented to the user).

Finally, this patch introduces a testing hook in applyCommandToFrame so that executing foreColor or backColor with
the soruce of CommandFromMenuOrKeyBinding would trigger the same code path as the one taken by Objective-C

Tests: editing/execCommand/set-backColor-with-color-filter-from-scripts.html

editing/execCommand/set-foreColor-with-color-filter-from-scripts.html
editing/mac/attributed-string/attribute-string-for-copy-with-color-filter.html
editing/style/set-backColor-with-color-filter.html
editing/style/set-foreColor-with-color-filter.html

editing/EditingStyle.cpp:

(WebCore::EditingStyle::inverseTransformColorIfNeeded): Added.
(WebCore::StyleChange::StyleChange): Revert the change made in r234005 since this code is also used by execCommand
which is not desirable, and won't work for background color.
(WebCore::StyleChange::extractTextStyles): Ditto.

editing/EditingStyle.h:
editing/Editor.cpp:

(WebCore::Editor::applyStyle):
(WebCore::Editor::applyStyleToSelection): Call EditingStyle::inverseTransformColorIfNeeded when ColorFilterMode is
set to InvertColor.

editing/Editor.h:
editing/EditorCommand.cpp:

(WebCore::applyCommandToFrame): Added the aforementioned testing hook.

editing/cocoa/HTMLConverter.mm:

(WebCore::editingAttributedStringFromRange): Take the color filtr into account. Some WebKit embedders use this
function to compute the font color in the selected text. Note that this function is mostly used for input methods
so the color doesn't really matter, and its implementation is distinct from that of HTMLConverter.

Source/WebKitLegacy/mac:

Invert the filtered font and background colors when using font panels, font pasteboard, and other Objective-C APIs.

WebView/WebHTMLView.mm:

(-[WebHTMLView _applyStyleToSelection:withUndoAction:]): Share code with _applyEditingStyleToSelection.
(-[WebHTMLView _applyEditingStyleToSelection:withUndoAction:]):

Tools:

Fixed the bug that testRunner.execCommand was using the second argument as the value.

The second argument, aShowDefaultUI, should always be ignored in testRunner.execCommand,
and the third argument should be used as the value. DumpRenderTree's implementation does this already.

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::execCommand):

WebKitTestRunner/InjectedBundle/TestRunner.h:

LayoutTests:

Added tests to make sure foreground or background colors specified in execCommand don't get inverted.

Fixed the test which was asserting that textInputController.attributedSubstringFromRange doesn't invert the color
since that's exactly what WebKit embedders uses to compute the style for color pickers.

Added new tests for copy & paste case using textInputController.legacyAttributedString.

editing/execCommand/set-backColor-with-color-filter-from-scripts-expected.txt: Added.
editing/execCommand/set-backColor-with-color-filter-from-scripts.html: Added.
editing/execCommand/set-foreColor-with-color-filter-from-scripts-expected.txt: Added.
editing/execCommand/set-foreColor-with-color-filter-from-scripts.html: Added.
editing/mac/attributed-string/attrib-string-range-with-color-filter-expected.txt:
editing/mac/attributed-string/attrib-string-range-with-color-filter.html: This test uses attributedSubstringFromRange,

which implemented using editingAttributedStringFromRange in WebCore. Since this is exactly what WebKit embedders uses
to compute the current style of the selected text, we need to invert the color here. This API's main clinet is input methods
so this shouldn't affect other editing operations, in particular, copy and paste, which uses HTMLConverter.

editing/mac/attributed-string/attribute-string-for-copy-with-color-filter-expected.txt: Added.
editing/mac/attributed-string/attribute-string-for-copy-with-color-filter.html: Added. Make sure the attributed string

generated for copy & paste does not invert foreground or background colors via textInputController.legacyAttributedString.
This is testing HTMLConverter, not editingAttributedStringFromRange, used by WebKit embedders and input methods.

editing/mac/attributed-string/attributed-string-for-typing-with-color-filter-expected.txt:
editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html: Added background color in the test.
editing/style/set-backColor-with-color-filter-expected.txt: Added.
editing/style/set-backColor-with-color-filter.html: Added.
editing/style/set-foreColor-with-color-filter-expected.txt: Renamed from exec-command-foreColor-with-color-filter-expected.txt.
editing/style/set-foreColor-with-color-filter.html: Renamed from exec-command-foreColor-with-color-filter.html.

Updated the test to use testRunner.execCommand which uses CommandFromMenuOrKeyBinding in applyCommandToFrame since we're
trying to test the code path taken by WebKit embedders and font panel here.

2:03 PM Changeset in webkit [234063] by dino@apple.com

4 edits in trunk/Tools

Accidentally checked in the wrong version of these files.

lldb/lldbWebKitTester/lldbWebKitTester.xcodeproj/project.pbxproj:
lldb/lldbWebKitTester/main.cpp:

(testSummaryProviders):

lldb/lldb_webkit_unittest.py:

(TestSummaryProviders.serial_test_WTFVectorProvider_vector_size_and_capacity):
(TestSummaryProviders.serial_test_WebCoreColorProvider_invalid_color): Deleted.
(TestSummaryProviders.serial_test_WebCoreColorProvider_extended_color): Deleted.
(TestSummaryProviders.serial_test_WebCoreColorProvider_rgb_color): Deleted.
(TestSummaryProviders.serial_test_WebCoreColorProvider_rgba_color): Deleted.
(TestSummaryProviders.serial_test_WebCoreColorProvider_semantic_color): Deleted.

12:57 PM Changeset in webkit [234062] by dino@apple.com

5 edits in trunk/Tools

Provide an lldb type summary for WebCore::Color
https://bugs.webkit.org/show_bug.cgi?id=187776

Reviewed by Dan Bates.

lldb/lldbWebKitTester/lldbWebKitTester.xcodeproj/project.pbxproj: Link against WebKit

to get to WebCore.

lldb/lldbWebKitTester/main.cpp:

(testSummaryProviders): Create some Color objects for testing.

lldb/lldb_webkit.py: Add a Color summary provider.

(lldb_init_module):
(WebCoreColor_SummaryProvider):
(WebCoreColorProvider):
(WebCoreColorProvider.init):
(WebCoreColorProvider._is_extended):
(WebCoreColorProvider._is_valid):
(WebCoreColorProvider._is_semantic):
(WebCoreColorProvider._to_string_extended):
(WebCoreColorProvider.to_string):

lldb/lldb_webkit_unittest.py: Tests.

(TestSummaryProviders.serial_test_WTFVectorProvider_vector_size_and_capacity):
(TestSummaryProviders):
(TestSummaryProviders.serial_test_WebCoreColorProvider_invalid_color):
(TestSummaryProviders.serial_test_WebCoreColorProvider_extended_color):
(TestSummaryProviders.serial_test_WebCoreColorProvider_rgb_color):
(TestSummaryProviders.serial_test_WebCoreColorProvider_rgba_color):

12:34 PM Changeset in webkit [234061] by Chris Dumez

4 edits in trunk/LayoutTests

REGRESSION(PSON?): [ WK2 ] http/tests/workers/service/client-*-page-cache.html LayoutTests are flaky
https://bugs.webkit.org/show_bug.cgi?id=183705

Reviewed by Youenn Fablet.

At the beginning of the tests, wait for the client count to reach the expected value instead of
expecting it to be the right value right away. Clients unregister themselves asynchronously so
it is flaky otherwise.

http/tests/workers/service/client-added-to-clients-when-restored-from-page-cache.html:
http/tests/workers/service/client-removed-from-clients-while-in-page-cache.html:
http/tests/workers/service/serviceworkerclients-matchAll-worker.js:

(async.doTestAfterMessage):

12:16 PM Changeset in webkit [234060] by sbarati@apple.com

10 edits
1 add in trunk

CompareEq should be using KnownOtherUse instead of OtherUse
https://bugs.webkit.org/show_bug.cgi?id=186814
<rdar://problem/39720030>

Reviewed by Filip Pizlo.

JSTests:

stress/compare-eq-should-use-known-other-use.js: Added.

(bar):
(i.func):

Source/JavaScriptCore:

CompareEq in fixup phase was doing this:
insertCheck(child, OtherUse)
setUseKind(child, OtherUse)
And in the DFG/FTL backend, it would not emit a check for OtherUse. This could
lead to edge verification crashing because a phase may optimize the check out
by removing the node. However, AI may not be privy to that optimization, and
AI may think the incoming value may not be Other. AI is expecting the DFG/FTL
backend to actually emit a check here, but it does not.

This exact pattern is why we have KnownXYZ use kinds. This patch introduces
KnownOtherUse and changes the above pattern to be:
insertCheck(child, OtherUse)
setUseKind(child, KnownOtherUse)

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculate):

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::shouldNotHaveTypeCheck):
(JSC::DFG::checkMayCrashIfInputIsEmpty):

dfg/DFGWatchpointCollectionPhase.cpp:

(JSC::DFG::WatchpointCollectionPhase::handle):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
(JSC::FTL::DFG::LowerDFGToB3::speculate):

11:39 AM Changeset in webkit [234059] by david_fenton@apple.com

2 edits in trunk/PerformanceTests

REGRESSION (234006) ERROR: Blocked access to external URL http://code.jquery.com/jquery-1.9.1.min.js
https://bugs.webkit.org/show_bug.cgi?id=187858

Unreviewed test gardening, skipped test.

Skipped: LaunchTime

11:28 AM Changeset in webkit [234058] by Yusuke Suzuki

2 edits in trunk/Source/JavaScriptCore

[JSC] A bit performance improvement for Object.assign by cleaning up code
https://bugs.webkit.org/show_bug.cgi?id=187852

Reviewed by Saam Barati.

We clean up Object.assign code a bit.

Vector and MarkedArgumentBuffer are extracted out from the loop since repeatedly creating MarkedArgumentBuffer is costly.
canDoFastPath is not necessary. Restructuring the code to clean up things.

It improves the performance a bit.

baseline patched

object-assign.es6 237.7719+-5.5175 231.2856+-4.6907 might be 1.0280x faster

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorAssign):

11:05 AM Changeset in webkit [234057] by david_fenton@apple.com

2 edits in trunk/JSTests

stress/spread-forward-varargs-stack-overflow.js is timing out in 32 bit JSC tests.
https://bugs.webkit.org/show_bug.cgi?id=187698

Unreviewed test gardening, skipped test in 32 Bit JSC.

stress/spread-forward-varargs-stack-overflow.js:

11:03 AM Changeset in webkit [234056] by Basuke Suzuki

2 edits in trunk/LayoutTests

[Curl] Test gardening
https://bugs.webkit.org/show_bug.cgi?id=187863

Unreviewed test gardening.

Enable WebSocket tests.

platform/wincairo/TestExpectations:

10:59 AM Changeset in webkit [234055] by jer.noble@apple.com

14 edits
3 adds in trunk

HLS resources with remote subresources will not taint canvasses.
https://bugs.webkit.org/show_bug.cgi?id=187731
<rdar://problem/42290703>

Reviewed by Brady Eidson.

Source/WebCore:

Test: http/tests/security/canvas-remote-read-remote-video-hls.html

Most media sources are single-resource; they are accessed from a single origin. HLS manifests can contain many
subresources from arbitrary origins, and canvases should be tainted when painted from media elements whose
subresources were retrieved from tainting origins.

Add a new method to HTMLMediaElement, wouldTaintOrigin(), taking a SecurityOrigin, and returning whether the
media element would taint that origin. This gets piped all the way down to MediaPlayerPrivateAVFoundationObjC
which uses WebCoreNSURLSession to track all the origins of all the responses which resulted from the media
element's load.

Drive-by fix: also fix this issue for media elements which render to an AudioContext.

Drive-by fix #2: CanvasRenderingContext2DBase::createPattern() needs to check the return value of
ImageBuffer::create() before using it.

Modules/webaudio/MediaElementAudioSourceNode.cpp:

(WebCore::MediaElementAudioSourceNode::wouldTaintOrigin):

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::didAttachRenderers):
(WebCore::HTMLMediaElement::didDetachRenderers):
(WebCore::HTMLMediaElement::scheduleUpdateShouldAutoplay):

html/HTMLMediaElement.h:

(WebCore::HTMLMediaElement::wouldTaintOrigin const):

html/canvas/CanvasRenderingContext.cpp:

(WebCore::CanvasRenderingContext::wouldTaintOrigin):

html/canvas/CanvasRenderingContext2DBase.cpp:

(WebCore::CanvasRenderingContext2DBase::createPattern):

platform/graphics/MediaPlayer.cpp:

(WebCore::MediaPlayer::wouldTaintOrigin const):

platform/graphics/MediaPlayer.h:
platform/graphics/MediaPlayerPrivate.h:

(WebCore::MediaPlayerPrivateInterface::hasSingleSecurityOrigin const):
(WebCore::MediaPlayerPrivateInterface::wouldTaintOrigin const):

platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:

(WebCore::CDMSessionAVContentKeySession::update):

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::wouldTaintOrigin const):

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession task:didReceiveResponseFromOrigin:]):
(-[WebCoreNSURLSession wouldTaintOrigin:]):
(-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):

LayoutTests:

http/tests/media/resources/hls/test-vod-localhost.m3u8: Added.
http/tests/security/canvas-remote-read-remote-video-hls-expected.txt: Added.
http/tests/security/canvas-remote-read-remote-video-hls.html: Added.

10:45 AM Changeset in webkit [234054] by Brent Fulgham

2 edits in trunk/Source/WebKit

[macOS] Relax WebKit sandbox to permit proper App Store behavior
https://bugs.webkit.org/show_bug.cgi?id=187831
<rdar://problem/42047455>

Reviewed by Alexey Proskuryakov.

The Mac App Store is unable to perform some gift card redemption tasks on macOS due to missing sandbox permissions.
This patch adds those permissions.

PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:

10:36 AM Changeset in webkit [234053] by Alan Bujtas

2 edits in trunk/Source/WebCore

Update FrameView::paintContents to use release logging.
https://bugs.webkit.org/show_bug.cgi?id=187854
<rdar://problem/42432371>

Reviewed by Simon Fraser.

Adding release logging helps identifying blank content cases.

page/FrameView.cpp:

(WebCore::FrameView::paintContents):

10:33 AM Changeset in webkit [234052] by beidson@apple.com

10 edits in trunk

Add WKNavigation/WKNavigationAction related SPI.
https://bugs.webkit.org/show_bug.cgi?id=187826

Reviewed by Chris Dumez.

Source/WebKit:

UIProcess/API/APINavigationAction.h:

UIProcess/API/C/mac/WKPagePrivateMac.h:
UIProcess/API/C/mac/WKPagePrivateMac.mm:

(WKPageLoadURLRequestReturningNavigation):

UIProcess/API/Cocoa/WKNavigationAction.mm:

(-[WKNavigationAction _mainFrameNavigation]):

UIProcess/API/Cocoa/WKNavigationActionPrivate.h:

UIProcess/API/glib/WebKitUIClient.cpp:

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/Navigation.mm:

(-[NavigationActionHasNavigationDelegate webView:didFinishNavigation:]):
(-[NavigationActionHasNavigationDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):
(TEST):

10:29 AM Changeset in webkit [234051] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

First Auto-PiP from Fullscreen too small & animation blocks
https://bugs.webkit.org/show_bug.cgi?id=187745
<rdar://problem/42316583>

Reviewed by Jon Lee.

1) When Auto-PiPing, we don't have the luxury of setting up the fullscreen state
ahead of time; we get notified that PiP has already started. The area of the code
which does this just-in-time setup needs to set the video layer's frame so that the
transform within the PiP window is correct.

2) We generate a placeholder image when going into fullscreen, but we need to do
so synchronously. Create the AVPlayerItemVideoOutput up front at AVPlayerItem creation
time wherever AVPIVO is available.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem):

platform/ios/VideoFullscreenInterfaceAVKit.mm:

(VideoFullscreenInterfaceAVKit::doSetup):

10:17 AM Changeset in webkit [234050] by bshafiei@apple.com

6 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234045. rdar://problem/42434024

FetchResponse should close its stream when loading finishes
https://bugs.webkit.org/show_bug.cgi?id=187790

Reviewed by Chris Dumez.

It simplifies for a FetchResponse to push all its data into its stream if already created at end of load time.
Did some refactoring in FetchBodyOwner to have a cleaner relationship with the stream source.
Did a minor refactoring to expose the error description when loading fails as part of the rejected promise.
This is consistent to errors sent back through callbacks.

Covered by existing tests.

Modules/fetch/FetchBodyOwner.cpp: (WebCore::FetchBodyOwner::~FetchBodyOwner):
Modules/fetch/FetchBodyOwner.h:
Modules/fetch/FetchBodySource.cpp: (WebCore::FetchBodySource::FetchBodySource): (WebCore::FetchBodySource::setActive): (WebCore::FetchBodySource::setInactive): (WebCore::FetchBodySource::doStart): (WebCore::FetchBodySource::doPull): (WebCore::FetchBodySource::doCancel): (WebCore::FetchBodySource::cleanBodyOwner):
Modules/fetch/FetchBodySource.h:
Modules/fetch/FetchResponse.cpp: (WebCore::FetchResponse::BodyLoader::didSucceed): (WebCore::FetchResponse::BodyLoader::didFail):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234045 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:08 AM Changeset in webkit [234049] by graouts@webkit.org

4 edits in trunk/Source/WebCore

DeclarativeAnimation should suspend, resume, & stop m_eventQueue
https://bugs.webkit.org/show_bug.cgi?id=187216
<rdar://problem/41669739>

Reviewed by Ryosuke Niwa.

Suspend, resume and close the GenericEventQueue for DeclarativeAnimation as instructed through the DOMActiveObject protocol.

animation/DeclarativeAnimation.cpp:

(WebCore::DeclarativeAnimation::stop):
(WebCore::DeclarativeAnimation::suspend):
(WebCore::DeclarativeAnimation::resume):

animation/DeclarativeAnimation.h:
animation/WebAnimation.h:

10:05 AM Changeset in webkit [234048] by Alan Bujtas

8 edits in trunk/Source/WebCore

[LFC][Inline formatting context] Add basic text content handling.
https://bugs.webkit.org/show_bug.cgi?id=187860

Reviewed by Antti Koivisto.

InlineFormattingContext::layout() walks through the formatting root's descendant list in a post-order fashion and
feeds the TextContentProvider.
Eventually this would turn into a more generic loop where we stop and process the text content when finding a non-text content box (float, inline-box etc), but right now
this is about text content only.

layout/displaytree/DisplayBox.h:

(WebCore::Display::Box::contentBoxBottom const):
(WebCore::Display::Box::contentBoxRight const):

layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::layout const):

layout/inlineformatting/textlayout/TextContentProvider.cpp:

(WebCore::Layout::TextContentProvider::textRuns): Add a helper function to support the case when all we need is just the run list in one go.

layout/inlineformatting/textlayout/TextContentProvider.h:
layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::isDescendantOf const):

layout/layouttree/LayoutBox.h:
layout/layouttree/LayoutInlineBox.h:

(WebCore::Layout::InlineBox::textContent const):

10:01 AM Changeset in webkit [234047] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234044. rdar://problem/42433225

REGRESSION(r233969): ASSERT in -[WebAVPlayerLayer setVideoGravity:]
https://bugs.webkit.org/show_bug.cgi?id=187814
<rdar://problem/42391869>

Reviewed by Eric Carlson.

After r233969 caused models to disassociate themselves from interfaces, it is now possible that an
VideoFullscreenInterfaceAVKit can have a nil model. We should null-check, not ASSERT, now that the
assertion no longer holds true.

platform/ios/VideoFullscreenInterfaceAVKit.mm: (-[WebAVPlayerLayer layoutSublayers]): (-[WebAVPlayerLayer resolveBounds]): (-[WebAVPlayerLayer setVideoGravity:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234044 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:01 AM Changeset in webkit [234046] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebKit

Cherry-pick r233925. rdar://problem/42354959

Dissociate the VideoFullscreenInterface from its VideoFullscreenModel before removing it from the manager
https://bugs.webkit.org/show_bug.cgi?id=187775
<rdar://problem/42343229>

Reviewed by Jon Lee.

UIProcess/Cocoa/VideoFullscreenManagerProxy.mm: (WebKit::VideoFullscreenManagerProxy::didCleanupFullscreen):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:58 AM Changeset in webkit [234045] by youenn@apple.com

6 edits in trunk/Source/WebCore

FetchResponse should close its stream when loading finishes
https://bugs.webkit.org/show_bug.cgi?id=187790

Reviewed by Chris Dumez.

It simplifies for a FetchResponse to push all its data into its stream if already created at end of load time.
Did some refactoring in FetchBodyOwner to have a cleaner relationship with the stream source.
Did a minor refactoring to expose the error description when loading fails as part of the rejected promise.
This is consistent to errors sent back through callbacks.

Covered by existing tests.

Modules/fetch/FetchBodyOwner.cpp:

(WebCore::FetchBodyOwner::~FetchBodyOwner):

Modules/fetch/FetchBodyOwner.h:
Modules/fetch/FetchBodySource.cpp:

(WebCore::FetchBodySource::FetchBodySource):
(WebCore::FetchBodySource::setActive):
(WebCore::FetchBodySource::setInactive):
(WebCore::FetchBodySource::doStart):
(WebCore::FetchBodySource::doPull):
(WebCore::FetchBodySource::doCancel):
(WebCore::FetchBodySource::cleanBodyOwner):

Modules/fetch/FetchBodySource.h:
Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::BodyLoader::didSucceed):
(WebCore::FetchResponse::BodyLoader::didFail):

9:51 AM Changeset in webkit [234044] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

REGRESSION(r233969): ASSERT in -[WebAVPlayerLayer setVideoGravity:]
https://bugs.webkit.org/show_bug.cgi?id=187814
<rdar://problem/42391869>

Reviewed by Eric Carlson.

After r233969 caused models to disassociate themselves from interfaces, it is now possible that an
VideoFullscreenInterfaceAVKit can have a nil model. We should null-check, not ASSERT, now that the
assertion no longer holds true.

platform/ios/VideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerLayer layoutSublayers]):
(-[WebAVPlayerLayer resolveBounds]):
(-[WebAVPlayerLayer setVideoGravity:]):

9:51 AM Changeset in webkit [234043] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234002. rdar://problem/42432954

REGRESSION(r233926): media/modern-media-controls/media-controller/media-controller-inline-to-fullscreen-to-pip-to-inline.html is a TIMEOUT failure
https://bugs.webkit.org/show_bug.cgi?id=187813

Reviewed by Jon Lee.

In r233926, we changed the behavior of entering PiP to exit fullscreen only after entering PiP completes. The
test in question will immediately request "inline" presentation mode once the PiP animation begins, and thus
it's asking to "exit fullscreen" when both in standard fullscreen and also in PiP. The fix is not to bail out
early if we're in standard (element) fullscreen, but to allow the remaining steps to complete and exit PiP as
well.

html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::exitFullscreen):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234002 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:42 AM Changeset in webkit [234042] by Ryan Haddad

1 edit
1 add in branches/safari-606-branch/LayoutTests

Cherry-pick r234041. rdar://problem/42417113

Rebaseline editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html for Sierra.

Unreviewed test gardening.

platform/mac-sierra/editing/mac/attributed-string/attributed-string-for-typing-with-color-filter-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@234041 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:24 AM Changeset in webkit [234041] by Ryan Haddad

1 edit
1 add in trunk/LayoutTests

Rebaseline editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html for Sierra.

Unreviewed test gardening.

platform/mac-sierra/editing/mac/attributed-string/attributed-string-for-typing-with-color-filter-expected.txt: Added.

8:44 AM Changeset in webkit [234040] by commit-queue@webkit.org

7 edits in trunk/Tools

Unreviewed, rolling out r233943, r233988, r234004, and
r234012.
https://bugs.webkit.org/show_bug.cgi?id=187856

webkitpy tests are failing to build lldbWebKitTester
(Requested by ryanhaddad on #webkit).

Reverted changesets:

"Provide an lldb type summary for WebCore::Color"
https://bugs.webkit.org/show_bug.cgi?id=187776
https://trac.webkit.org/changeset/233943

"Provide an lldb type summary for WebCore::Color"
https://bugs.webkit.org/show_bug.cgi?id=187776
https://trac.webkit.org/changeset/233988

"Provide an lldb type summary for WebCore::Color"
https://bugs.webkit.org/show_bug.cgi?id=187776
https://trac.webkit.org/changeset/234004

"Provide an lldb type summary for WebCore::Color"
https://bugs.webkit.org/show_bug.cgi?id=187776
https://trac.webkit.org/changeset/234012

3:47 AM Changeset in webkit [234039] by commit-queue@webkit.org

18 edits
26 adds
1 delete in trunk/LayoutTests

Import new WPT tests for custom elements
https://bugs.webkit.org/show_bug.cgi?id=187806

Patch by Frederic Wang <fwang@igalia.com> on 2018-07-20
Reviewed by Javier Fernandez.

LayoutTests/imported/w3c:

web-platform-tests/custom-elements/Document-createElement-expected.txt:
web-platform-tests/custom-elements/Document-createElement-svg.svg: Added.
web-platform-tests/custom-elements/Document-createElement.html:
web-platform-tests/custom-elements/Document-createElementNS-expected.txt: Added.
web-platform-tests/custom-elements/Document-createElementNS.html: Added.
web-platform-tests/custom-elements/HTMLElement-constructor-expected.txt:
web-platform-tests/custom-elements/HTMLElement-constructor.html:
web-platform-tests/custom-elements/META.yml: Added.
web-platform-tests/custom-elements/OWNERS: Removed.
web-platform-tests/custom-elements/builtin-coverage-expected.txt: Added.
web-platform-tests/custom-elements/builtin-coverage.html: Added.
web-platform-tests/custom-elements/connected-callbacks-html-fragment-parsing-expected.txt: Added.
web-platform-tests/custom-elements/connected-callbacks-html-fragment-parsing.html: Added.
web-platform-tests/custom-elements/custom-element-registry/upgrade-expected.txt: Added.
web-platform-tests/custom-elements/custom-element-registry/upgrade.html: Added.
web-platform-tests/custom-elements/custom-element-registry/w3c-import.log:
web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt:
web-platform-tests/custom-elements/htmlconstructor/newtarget.html:
web-platform-tests/custom-elements/htmlconstructor/w3c-import.log:
web-platform-tests/custom-elements/parser/parser-constructs-custom-elements-with-is-expected.txt: Added.
web-platform-tests/custom-elements/parser/parser-constructs-custom-elements-with-is.html: Added.
web-platform-tests/custom-elements/parser/parser-uses-create-an-element-for-a-token-svg.svg: Added.
web-platform-tests/custom-elements/parser/parser-uses-registry-of-owner-document-expected.txt:
web-platform-tests/custom-elements/parser/serializing-html-fragments-expected.txt: Added.
web-platform-tests/custom-elements/parser/serializing-html-fragments.html: Added.
web-platform-tests/custom-elements/parser/w3c-import.log:
web-platform-tests/custom-elements/pseudo-class-defined-expected.txt: Added.
web-platform-tests/custom-elements/pseudo-class-defined.html: Added.
web-platform-tests/custom-elements/reactions/HTMLInputElement-expected.txt: Added.
web-platform-tests/custom-elements/reactions/HTMLInputElement.html: Added.
web-platform-tests/custom-elements/reactions/resources/w3c-import.log:
web-platform-tests/custom-elements/reactions/w3c-import.log:
web-platform-tests/custom-elements/reactions/with-exceptions.html: Added.
web-platform-tests/custom-elements/resources/my-custom-element-html-document.html: Added.
web-platform-tests/custom-elements/resources/w3c-import.log:
web-platform-tests/custom-elements/upgrading/Document-importNode-expected.txt: Added.
web-platform-tests/custom-elements/upgrading/Document-importNode.html: Added.
web-platform-tests/custom-elements/upgrading/w3c-import.log:
web-platform-tests/custom-elements/w3c-import.log:

LayoutTests:

Some tests crashing or timing out are skipped. Also, one test depending on the availability
of the @capture attribute of the HTMLInputElement element has a specific expectation on iOS.

TestExpectations: Skip some tests crashing or timing out.
platform/ios/imported/w3c/web-platform-tests/custom-elements/reactions/HTMLInputElement-expected.txt: Added.

2:00 AM Changeset in webkit [234038] by Philippe Normand

7 edits in trunk

[GTK][WPE] enable-media-capabilities websetting
https://bugs.webkit.org/show_bug.cgi?id=187847

Reviewed by Carlos Garcia Campos.

Source/WebKit:

Add a new WebKitSetting for the MediaCapabilities spec defined in:
https://wicg.github.io/media-capabilities/

UIProcess/API/glib/WebKitSettings.cpp:

(webKitSettingsSetProperty):
(webKitSettingsGetProperty):
(webkit_settings_class_init):
(webkit_settings_get_enable_media_capabilities):
(webkit_settings_set_enable_media_capabilities):

UIProcess/API/gtk/WebKitSettings.h:
UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
UIProcess/API/wpe/WebKitSettings.h:

Tools:

TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp:

(testWebKitSettings): Unit test for the new enable-media-capabilities setting.

1:05 AM Changeset in webkit [234037] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/JavaScriptCore

Cherry-pick r234022. rdar://problem/42417126

Conservatively make Object.assign's fast path do a two phase protocol of loading everything then storing everything to try to prevent a crash
https://bugs.webkit.org/show_bug.cgi?id=187836
<rdar://problem/42409527>

Reviewed by Mark Lam.

We have crash reports that we're crashing on source->getDirect in Object.assign's
fast path. Mark investigated this and determined we end up with a nullptr for
butterfly. This is curious, because source's Structure indicated that it has
out of line properties. My leading hypothesis for this at the moment is a bit
handwavy, but it's essentially:

We end up firing a watchpoint when assigning to the target (this can happen if a watchpoint was set up for storing to that particular field)
When we fire that watchpoint, we end up doing some kind work on the source, perhaps causing it to flattenDictionaryStructure. Therefore, we end up mutating source.

I'm not super convinced this is what we're running into, but just by reading
the code, I think it needs to be something similar to this. Seeing if this change
fixes the crasher will give us good data to determine if something like this is
happening or if the bug is something else entirely.

runtime/ObjectConstructor.cpp: (JSC::objectConstructorAssign):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234022 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234036] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebKit

Cherry-pick r234020. rdar://problem/42417121

[ITP] Crash under ResourceLoadStatisticsMemoryStore::removeDataRecords()
https://bugs.webkit.org/show_bug.cgi?id=187821
<rdar://problem/42112693>

Reviewed by David Kilzer.

In two cases, ResourceLoadStatisticsMemoryStore (which lives on a background queue) needs to call WebPageProxy
operations on the main thread and then dispatch back on the background queue when the operation completes.
However, it is possible for the ResourceLoadStatisticsMemoryStore to get destroyed on the background queue
during this time and we would then crash when trying to use m_workQueue to re-dispatch. To address the issue,
I now ref the work queue in the lambda so that we're guaranteed to be able to re-dispatch to the background
queue. When we're back on the background queue, we'll realize that weakThis in gone and we'll call the callback
and return early.

Note that I am not checking weakThis on the main thread as this would not be safe. weakThis should only be
used on the background queue.

UIProcess/ResourceLoadStatisticsMemoryStore.cpp: (WebKit::ResourceLoadStatisticsMemoryStore::removeDataRecords): (WebKit::ResourceLoadStatisticsMemoryStore::grandfatherExistingWebsiteData):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234020 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234035] by bshafiei@apple.com

2 edits in branches/safari-606-branch/LayoutTests

Cherry-pick r234014. rdar://problem/42417113

Fix the test.

editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234014 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234034] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234013. rdar://problem/42417130

Crash under WebCore::DocumentWriter::addData()
https://bugs.webkit.org/show_bug.cgi?id=187819
<rdar://problem/41328743>

Reviewed by Brady Eidson.

When AppCache is used a DocumentLoader may start a NetworkLoad even though it has substitute data.
In DocumentLoader::continueAfterContentPolicy(), if we have substitute data we commit this data
and call finishLoad(). However, if the case where there was a NetworkLoad started, we'll send the
ContinueDidReceiveResponse IPC back to the network process and it will start sending us data for
the load. This could lead to crashes such as <rdar://problem/41328743> since the DocumentLoader
has already committed data and finished loading when it gets the data from the network process.

To address the issue, we now call clearMainResource() in continueAfterContentPolicy(), after we've
decided to commit the substitute data. This effectively removes the DocumentLoader as a client of
the CachedResource so that its will not be notified of following load progress. We do not cancel
the load as other CachedResourceClients may be interested in the load (ApplicationCacheResourceLoader
in particular, in order to update its cached data).

loader/DocumentLoader.cpp: (WebCore::DocumentLoader::continueAfterContentPolicy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234013 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234033] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/ThirdParty/libwebrtc

Cherry-pick r234008. rdar://problem/42417141

PlatformThread::Run does not need to log the fact that it is running
https://bugs.webkit.org/show_bug.cgi?id=187801i
<rdar://problem/40331421>

Patch by Youenn Fablet <youenn@apple.com> on 2018-07-19
Reviewed by Chris Dumez.

Source/webrtc/rtc_base/platform_thread.cc:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234008 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234032] by bshafiei@apple.com

2 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r234007. rdar://problem/42417134

Ensure DocumentTimeline is kept alive until the VM::whenIdle callback is called
https://bugs.webkit.org/show_bug.cgi?id=187692

Reviewed by Ryosuke Niwa.

Ensure we keep the DocumentTimeline alive until the VM::whenIdle callback is called.

animation/DocumentTimeline.cpp: (WebCore::DocumentTimeline::currentTime):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234007 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234031] by bshafiei@apple.com

10 edits
10 adds in branches/safari-606-branch

Cherry-pick r234005. rdar://problem/42417113

Setting foreground color when editing should take color-filter into account, and report the correct foreground color for collapsed selections
https://bugs.webkit.org/show_bug.cgi?id=187778

Reviewed by Ryosuke Niwa.
Source/WebCore:

Fix two aspects of editing with color-filter:

When setting foreground color, inverse-transform the color through -apple-color-filter so that the user gets the color they chose when in Dark Mode. Tested by editing/style/exec-command-foreColor-with-color-filter.html.

When retrieving the style of the collapsed selection, take color filter into account so that color picker reflects the color the users sees, instead of the content color. Tested by editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html

Add two additional tests that ensure that -apple-color-filter does not impact the NSAttributedString code
path, since -apple-color-filter should not affect the behavior of Copy.

Tests: editing/mac/attributed-string/attrib-string-colors-with-color-filter.html

editing/mac/attributed-string/attrib-string-range-with-color-filter.html
editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html
editing/style/exec-command-foreColor-with-color-filter.html

editing/EditingStyle.cpp: (WebCore::StyleChange::StyleChange): (WebCore::StyleChange::extractTextStyles):
editing/EditingStyle.h:
editing/cocoa/EditorCocoa.mm: (WebCore::Editor::fontAttributesForSelectionStart const):
platform/graphics/filters/FilterOperation.cpp: (WebCore::InvertLightnessFilterOperation::inverseTransformColor const):
platform/graphics/filters/FilterOperation.h: (WebCore::FilterOperation::inverseTransformColor const):
platform/graphics/filters/FilterOperations.cpp: (WebCore::FilterOperations::transformColor const): (WebCore::FilterOperations::inverseTransformColor const):
platform/graphics/filters/FilterOperations.h:

LayoutTests:

editing/mac/attributed-string/attrib-string-colors-with-color-filter-expected.txt: Added.
editing/mac/attributed-string/attrib-string-colors-with-color-filter.html: Added.
editing/mac/attributed-string/attrib-string-range-with-color-filter-expected.txt: Added.
editing/mac/attributed-string/attrib-string-range-with-color-filter.html: Added.
editing/mac/attributed-string/attributed-string-for-typing-with-color-filter-expected.txt: Added.
editing/mac/attributed-string/attributed-string-for-typing-with-color-filter.html: Added.
editing/style/exec-command-foreColor-with-color-filter-expected.txt: Added.
editing/style/exec-command-foreColor-with-color-filter.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234005 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234030] by bshafiei@apple.com

4 edits in branches/safari-606-branch/Source

Cherry-pick r233992. rdar://problem/42417109

Update iOS fullscreen alert text again
https://bugs.webkit.org/show_bug.cgi?id=187797
rdar://problem/42373783

Reviewed by Jer Noble.

Source/WebCore:

English.lproj/Localizable.strings:

Source/WebKit:

UIProcess/ios/fullscreen/WKFullScreenViewController.mm: (-[WKFullScreenViewController _showPhishingAlert]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233992 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:05 AM Changeset in webkit [234029] by bshafiei@apple.com

3 edits in branches/safari-606-branch/Source/WebCore

Cherry-pick r233982. rdar://problem/42389208

Hitting RELEASE_ASSERT(!m_activeDOMObjectAdditionForbidden) under HTMLMediaElement::resume()
https://bugs.webkit.org/show_bug.cgi?id=187793
<rdar://problem/42308469>

Patch by Antoine Quint <Antoine Quint> on 2018-07-19
Reviewed by Chris Dumez.

Ensure we do not call JS under resume(), which would happen as a result of calling configureMediaControls() in prepareForLoad().

html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::~HTMLMediaElement): (WebCore::HTMLMediaElement::contextDestroyed): (WebCore::HTMLMediaElement::stop): (WebCore::HTMLMediaElement::suspend): (WebCore::HTMLMediaElement::resume):
html/HTMLMediaElement.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233982 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:00 AM Changeset in webkit [234028] by Carlos Garcia Campos

1 copy in releases/WebKitGTK/webkit-2.21.5

WebKitGTK+ 2.21.5

12:47 AM Changeset in webkit [234027] by Carlos Garcia Campos

5 edits in trunk

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.21.5 release.

Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

gtk/NEWS: Add release notes for 2.21.5.
webkitglib-symbols.map: Remove symbols.

12:22 AM Changeset in webkit [234026] by bshafiei@apple.com

7 edits in branches/safari-606-branch/Source

Versioning.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed