Ignore:
Location:
releases/WebKitGTK/webkit-2.16
Files:
58 added
154 edited

Legend:

Unmodified
Added
Removed

  • TabularUnified releases/WebKitGTK/webkit-2.16/ChangeLog

    r217367 r219817  
     12017-07-24  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.6 release.
     4
     5        * Source/cmake/OptionsGTK.cmake:
     6
     72017-06-26  Carlos Garcia Campos  <cgarcia@igalia.com>
     8
     9        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.5 release.
     10
     11        * Source/cmake/OptionsGTK.cmake:
     12
     132017-06-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     14
     15        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.4 release.
     16
     17        * Source/cmake/OptionsGTK.cmake:
     18
    1192017-05-24  Carlos Garcia Campos  <cgarcia@igalia.com>
    220

  • TabularUnified releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog

    r217367 r219817  
     12017-06-26  Saam Barati  <sbarati@apple.com>
     2
     3        Crash in JSC::Lexer<unsigned char>::setCode
     4        https://bugs.webkit.org/show_bug.cgi?id=172754
     5
     6        Reviewed by Mark Lam.
     7
     8        * stress/dont-reserve-huge-capacity-lexer.js: Added.
     9        (catch):
     10
     112017-04-13  Mark Lam  <mark.lam@apple.com>
     12
     13        Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
     14        https://bugs.webkit.org/show_bug.cgi?id=170661
     15        <rdar://problem/31579046>
     16
     17        Reviewed by Filip Pizlo.
     18
     19        * stress/regress-170661.js: Added.
     20
     212017-04-20  Mark Lam  <mark.lam@apple.com>
     22
     23        virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
     24        https://bugs.webkit.org/show_bug.cgi?id=171079
     25        <rdar://problem/31684756>
     26
     27        Reviewed by Saam Barati.
     28
     29        * stress/regress-171079.js: Added.
     30
     312017-05-05  Saam Barati  <sbarati@apple.com>
     32
     33        putDirectIndex does not properly do defineOwnProperty
     34        https://bugs.webkit.org/show_bug.cgi?id=171591
     35        <rdar://problem/31735695>
     36
     37        Reviewed by Geoffrey Garen.
     38
     39        * stress/array-prototype-splice-making-typed-array.js:
     40        (test):
     41        * stress/array-species-config-array-constructor.js:
     42        (shouldThrow):
     43        (test):
     44        * stress/put-direct-index-broken-2.js: Added.
     45        (assert):
     46        (test):
     47        (makeLengthWritable):
     48        (set get restoreOldDesc):
     49        * stress/put-direct-index-broken.js: Added.
     50        (whatToTest):
     51        (tryRunning):
     52        (tryItOut):
     53        * stress/put-indexed-getter-setter.js: Added.
     54        (foo.X.prototype.set 7):
     55        (foo.X.prototype.get 7):
     56        (foo.X):
     57        (foo):
     58
     592017-05-17  Filip Pizlo  <fpizlo@apple.com>
     60
     61        Unreviewed, address mlam's review feedback.
     62
     63        * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
     64
     652017-05-17  Filip Pizlo  <fpizlo@apple.com>
     66
     67        JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
     68        https://bugs.webkit.org/show_bug.cgi?id=172208
     69
     70        Reviewed by Saam Barati.
     71
     72        * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
     73        (foo):
     74        (bar):
     75        (baz):
     76
     772017-04-17  Mark Lam  <mark.lam@apple.com>
     78
     79        JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
     80        https://bugs.webkit.org/show_bug.cgi?id=170896
     81        <rdar://problem/31651319>
     82
     83        Reviewed by JF Bastien and Keith Miller.
     84
     85        * stress/regress-170896.js: Added.
     86
     872017-05-25  Saam Barati  <sbarati@apple.com>
     88
     89        Our for-in optimization in the bytecode generator does its static analysis incorrectly
     90        https://bugs.webkit.org/show_bug.cgi?id=172532
     91        <rdar://problem/32369452>
     92
     93        Reviewed by Mark Lam.
     94
     95        * stress/for-in-invalidation-for-any-write.js: Added.
     96        (assert):
     97        (test):
     98        (test.i):
     99
     1002017-04-14  Saam Barati  <sbarati@apple.com>
     101
     102        ParseInt intrinsic in DFG backend doesn't properly flush its operands
     103        https://bugs.webkit.org/show_bug.cgi?id=170865
     104
     105        Reviewed by Mark Lam and Geoffrey Garen.
     106
     107        * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
     108        (assert):
     109        (foo):
     110
    11112017-05-10  Filip Pizlo  <fpizlo@apple.com>
    2112

  • TabularUnified releases/WebKitGTK/webkit-2.16/JSTests/stress/array-prototype-splice-making-typed-array.js

    r217367 r219817  
    1111test(function() {
    1212    // This should not crash.
    13 
    14     // FIXME: this might need to be updated as we make our splice implementation
    15     // more ES6 compliant: https://bugs.webkit.org/show_bug.cgi?id=159645
    1613    let x = [1,2,3,4,5];
    1714    x.constructor = Uint8Array;
    1815    delete x[2];
    1916    assert(!(2 in x));
    20     let removed = x.splice(1,3);
    21     assert(removed instanceof Uint8Array);
    22     assert(removed.length === 3);
    23     assert(removed[0] === 2);
    24     assert(removed[1] === 0);
    25     assert(removed[2] === 4);
     17    let err = null;
     18    try {
     19        let removed = x.splice(1,3);
     20        assert(removed instanceof Uint8Array);
     21        assert(removed.length === 3);
     22        assert(removed[0] === 2);
     23        assert(removed[1] === 0);
     24        assert(removed[2] === 4);
     25    } catch(e) {
     26        err = e;
     27    }
     28    assert(err.toString() === "TypeError: Attempting to configure non-configurable property on a typed array at index: 0");
    2629
    2730    assert(x instanceof Array);
    28     assert(x.length === 2);
     31    assert(x.length === 5);
    2932    assert(x[0] === 1);
    30     assert(x[1] === 5);
     33    assert(x[1] === 2);
     34    assert(x[2] === undefined);
     35    assert(x[3] === 4);
     36    assert(x[4] === 5);
    3137});
    3238

  • TabularUnified releases/WebKitGTK/webkit-2.16/JSTests/stress/array-species-config-array-constructor.js

    r217367 r219817  
    2020Object.defineProperty(Int32Array.prototype, "length", { value: 0, writable: true });
    2121
    22 result = foo.concat([1]);
    23 if (!(result instanceof Int32Array))
    24     throw "concat failed";
     22function shouldThrow(f, m) {
     23    let err;
     24    try {
     25        f();
     26    } catch(e) {
     27        err = e;
     28    }
     29    if (err.toString() !== m)
     30        throw new Error("Wrong error: " + err);
     31}
    2532
    26 result = foo.splice();
    27 if (!(result instanceof Int32Array))
    28     throw "splice failed";
    29 
    30 result = foo.slice();
    31 if (!(result instanceof Int32Array))
    32     throw "slice failed";
     33function test() {
     34    const message = "TypeError: Attempting to configure non-configurable property on a typed array at index: 0";
     35    shouldThrow(() => foo.concat([1]), message);
     36    foo = [1,2,3,4];
     37    shouldThrow(() => foo.slice(0), message);
     38    foo = [1,2,3,4];
     39    let r = foo.splice();
     40    if (!(r instanceof Int32Array))
     41        throw "Bad";
     42    if (r.length !== 0)
     43        throw "Bad";
     44    foo = [1,2,3,4];
     45    shouldThrow(() => foo.splice(0), message);
     46}
     47noInline(test);
     48for (let i = 0; i < 3000; ++i)
     49    test();

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog

    r217367 r219817  
     12017-05-12  Jiewen Tan  <jiewen_tan@apple.com>
     2
     3        Elements should be inserted into a template element as its content's last child
     4        https://bugs.webkit.org/show_bug.cgi?id=171373
     5        <rdar://problem/31862949>
     6
     7        Reviewed by Ryosuke Niwa.
     8
     9        * fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt: Added.
     10        * fast/dom/HTMLTemplateElement/insert-fostering-child.html: Added.
     11
     122017-05-15  Jiewen Tan  <jiewen_tan@apple.com>
     13
     14        Replace CryptoOperationData with BufferSource for WebKitSubtleCrypto
     15        https://bugs.webkit.org/show_bug.cgi?id=172146
     16        <rdar://problem/32122256>
     17
     18        Reviewed by Brent Fulgham.
     19
     20        * crypto/webkitSubtle/argument-conversion-expected.txt:
     21        * crypto/webkitSubtle/import-export-raw-key-leak-expected.txt: Added.
     22        * crypto/webkitSubtle/import-export-raw-key-leak.html: Added.
     23
     242017-05-11  Zalan Bujtas  <zalan@apple.com>
     25
     26        AX: Defer text changes until after the tree is clean if needed.
     27        https://bugs.webkit.org/show_bug.cgi?id=171546
     28        <rdar://problem/31934942>
     29
     30        Reviewed by Simon Fraser.
     31
     32        * accessibility/crash-when-render-tree-is-not-clean-expected.txt: Added.
     33        * accessibility/crash-when-render-tree-is-not-clean.html: Added.
     34
     352017-05-02  Zalan Bujtas  <zalan@apple.com>
     36
     37        Defer AX cache update when text content changes until after layout is finished.
     38        https://bugs.webkit.org/show_bug.cgi?id=171429
     39        <rdar://problem/31885984>
     40
     41        Reviewed by Simon Fraser.
     42
     43        * accessibility/crash-while-adding-text-child-with-transform-expected.txt: Added.
     44        * accessibility/crash-while-adding-text-child-with-transform.html: Added.
     45
     462017-06-17  Antti Koivisto  <antti@apple.com>
     47
     48        Crash due to infinite recursion via FrameSelection::updateAppearanceAfterLayout
     49        https://bugs.webkit.org/show_bug.cgi?id=173468
     50
     51        Reviewed by Ryosuke Niwa.
     52
     53        * editing/selection/updateAppearanceAfterLayout-recursion-expected.txt: Added.
     54        * editing/selection/updateAppearanceAfterLayout-recursion.html: Added.
     55
     562017-06-17  Ryosuke Niwa  <rniwa@webkit.org>
     57
     58        REGRESSION(r209495): materiauxlaverdure.com fails to load
     59        https://bugs.webkit.org/show_bug.cgi?id=173301
     60        <rdar://problem/32624850>
     61
     62        Reviewed by Antti Koivisto.
     63
     64        Rebaselined the existing tests and added a new regression test for serializing CSS properties and values.
     65
     66        * accessibility/mac/alt-for-css-content-expected.txt:
     67        * accessibility/mac/webkit-alt-for-css-content-expected.txt:
     68        * editing/pasteboard/cjk-line-height-expected.txt:
     69        * fast/css/alt-inherit-initial-expected.txt:
     70        * fast/css/alt-inherit-initial.html:
     71        * fast/css/content-language-comma-separated-list-expected.txt:
     72        * fast/css/content-language-empty-expected.txt:
     73        * fast/css/content-language-only-whitespace-expected.txt:
     74        * fast/css/content-language-with-whitespace-expected.txt:
     75        * fast/css/counters/counter-cssText-expected.txt:
     76        * fast/css/counters/counter-cssText.html:
     77        * fast/css/font-family-trailing-bracket-gunk-expected.txt:
     78        * fast/css/font-family-trailing-bracket-gunk.html:
     79        * fast/css/getComputedStyle/computed-style-font-family-expected.txt:
     80        * fast/css/getComputedStyle/computed-style-properties-expected.txt:
     81        * fast/css/getComputedStyle/computed-style-properties.html:
     82        * fast/css/getComputedStyle/font-family-fallback-reset-expected.txt:
     83        * fast/css/getComputedStyle/font-family-fallback-reset.html:
     84        * fast/css/lang-mapped-to-webkit-locale-expected.txt:
     85        * fast/css/lang-mapped-to-webkit-locale.xhtml:
     86        * fast/css/serialization-with-double-quotes-expected.txt: Added.
     87        * fast/css/serialization-with-double-quotes.html: Added.
     88        * fast/css/uri-token-parsing-expected.txt:
     89        * fast/css/uri-token-parsing.html:
     90        * fast/inspector-support/cssURLQuotes-expected.txt:
     91        * fast/inspector-support/style-expected.txt:
     92        * fast/text/font-stretch-parse-expected.txt:
     93        * fast/text/font-stretch-parse.html:
     94        * fast/text/font-style-parse-expected.txt:
     95        * fast/text/font-style-parse.html:
     96        * fast/text/font-weight-parse-expected.txt:
     97        * fast/text/font-weight-parse.html:
     98        * media/controls/track-menu.html:
     99        * platform/mac-elcapitan/fast/css/getComputedStyle/computed-style-font-family-expected.txt:
     100        * platform/mac-elcapitan/fast/text/font-stretch-parse-expected.txt:
     101        * platform/mac-elcapitan/fast/text/font-style-parse-expected.txt:
     102        * platform/mac-elcapitan/fast/text/font-weight-parse-expected.txt:
     103
     1042017-06-09  Brady Eidson  <beidson@apple.com>
     105
     106        Crash when IndexedDB's getAll is used inside a Web Worker.
     107        https://bugs.webkit.org/show_bug.cgi?id=172434
     108
     109        Reviewed by Andy Estes.
     110
     111        * storage/indexeddb/modern/resources/worker-getall.js: Added.
     112        * storage/indexeddb/modern/worker-getall-expected.txt: Added.
     113        * storage/indexeddb/modern/worker-getall.html: Added.
     114
     1152017-06-08  Ryosuke Niwa  <rniwa@webkit.org>
     116
     117        Crash inside InsertNodeBeforeCommand via InsertParagraphSeparatorCommand
     118        https://bugs.webkit.org/show_bug.cgi?id=173085
     119
     120        Reviewed by Wenson Hsieh.
     121
     122        Added a regresion test.
     123
     124        * editing/inserting/insert-horizontal-rule-in-empty-document-crash-expected.txt: Added.
     125        * editing/inserting/insert-horizontal-rule-in-empty-document-crash.html: Added.
     126
     1272017-06-08  Xabier Rodriguez Calvar  <calvaris@igalia.com>
     128
     129        MediaTime class has rounding issues in different platforms
     130        https://bugs.webkit.org/show_bug.cgi?id=172640
     131
     132        Reviewed by Jer Noble.
     133
     134        Update expectations because the MediaTime printing changed, but
     135        results are the same.
     136
     137        * media/media-source/media-source-overlapping-append-expected.txt:
     138        * media/media-source/media-source-overlapping-decodetime-expected.txt:
     139        * media/media-source/media-source-seek-back-expected.txt:
     140        * media/media-source/media-source-sequence-timestamps-expected.txt:
     141        * media/media-source/media-source-timeoffset-expected.txt:
     142
     1432017-06-06  Zalan Bujtas  <zalan@apple.com>
     144
     145        Safari doesn't load newest The Order of the Stick comic.
     146        https://bugs.webkit.org/show_bug.cgi?id=172949
     147        <rdar://problem/32389730>
     148
     149        Reviewed by Antti Koivisto.
     150
     151        * fast/table/floating-table-sibling-is-invisible-expected.html: Added.
     152        * fast/table/floating-table-sibling-is-invisible.html: Added.
     153
     1542017-06-05  Chris Dumez  <cdumez@apple.com>
     155
     156        ASSERTION FAILED: RunLoop::isMain() in com.apple.WebKit: IPC::Connection::sendSyncMessage + 128
     157        https://bugs.webkit.org/show_bug.cgi?id=172943
     158        <rdar://problem/31288058>
     159
     160        Reviewed by Alexey Proskuryakov.
     161
     162        Make test clean a little bit more robust.
     163
     164        * storage/domstorage/sessionstorage/set-item-synchronous-keydown.html:
     165
     1662017-06-05  Chris Dumez  <cdumez@apple.com>
     167
     168        ASSERTION FAILED: RunLoop::isMain() in com.apple.WebKit: IPC::Connection::sendSyncMessage + 128
     169        https://bugs.webkit.org/show_bug.cgi?id=172943
     170        <rdar://problem/31288058>
     171
     172        Reviewed by Alexey Proskuryakov.
     173
     174        Add better test coverage.
     175
     176        * storage/domstorage/sessionstorage/set-item-synchronous-keydown-expected.txt: Added.
     177        * storage/domstorage/sessionstorage/set-item-synchronous-keydown.html: Added.
     178
     1792017-06-12  Carlos Garcia Campos  <cgarcia@igalia.com>
     180
     181        [GTK] Stop dismissing menus attached to the web view for every injected event
     182        https://bugs.webkit.org/show_bug.cgi?id=172708
     183
     184        Reviewed by Alex Christensen.
     185
     186        * editing/selection/5354455-1.html: No need to click on editable area to focus it, contextClick already focuses
     187        it, we even have another test to ensure it. Those fast clicks were causing a double click in GTK+ port which
     188        selected the whole line. We don't need to dismiss the context menu either, because contextClick() doesn't really
     189        show the menu.
     190        * fast/events/context-activated-by-key-event.html: Dismiss the context menu every time we show it.
     191        * fast/events/mouse-click-events.html: Dimiss the context menu when testing right click events.
     192
     1932017-05-30  Adrian Perez de Castro  <aperez@igalia.com>
     194
     195        [GTK] Test cases for typehead in form menu lists should start from known state
     196        https://bugs.webkit.org/show_bug.cgi?id=171792
     197
     198        Reviewed by Carlos Garcia Campos.
     199
     200        Since r215188 opening a popup menu in a form pre-selects the active
     201        element to mimic GtkComboxBox behavior, but the layout test implicitly
     202        assumed that type ahead search always started the beginning of the
     203        list, which is no longer true now that GTK+ is informed of which one
     204        is the active element.
     205
     206        * platform/gtk/fast/forms/menulist-typeahead-find.html: Reset menu
     207        list to the initial state (no element selected, unfocused) at the
     208        beginning of testTypeAheadFunction().
     209
     2102017-05-25  Chris Dumez  <cdumez@apple.com>
     211
     212        imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_owner_and_table_2.html is crashing
     213        https://bugs.webkit.org/show_bug.cgi?id=172628
     214        <rdar://problem/32418707>
     215
     216        Reviewed by Sam Weinig.
     217
     218        Add reduced test case.
     219
     220        * TestExpectations:
     221        Unskip test that is no longer crashing in debug builds.
     222
     223        * fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt: Added.
     224        * fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html: Added.
     225
     2262017-05-25  Zalan Bujtas  <zalan@apple.com>
     227
     228        Frame's composited content is visible when the frame has visibility: hidden.
     229        https://bugs.webkit.org/show_bug.cgi?id=125565
     230        <rdar://problem/32196849>
     231
     232        Reviewed by Simon Fraser.
     233
     234        * compositing/resources/visibility.html: Added.
     235        * compositing/visibility/frameset-visibility-hidden-expected.html: Added.
     236        * compositing/visibility/frameset-visibility-hidden.html: Added.
     237        * compositing/visibility/iframe-visibility-hidden-expected.html: Added.
     238        * compositing/visibility/iframe-visibility-hidden.html: Added.
     239        * compositing/visibility/object-visibility-hidden-expected.html: Added.
     240        * compositing/visibility/object-visibility-hidden.html: Added.
     241
     2422017-05-25  Chris Dumez  <cdumez@apple.com>
     243
     244        DocumentThreadableLoader::redirectReceived() should not rely on the resource's loader
     245        https://bugs.webkit.org/show_bug.cgi?id=172578
     246        <rdar://problem/30754582>
     247
     248        Reviewed by Youenn Fablet.
     249
     250        Add layout test coverage.
     251
     252        * http/tests/xmlhttprequest/cacheable-cross-origin-redirect-crash-expected.txt: Added.
     253        * http/tests/xmlhttprequest/cacheable-cross-origin-redirect-crash.html: Added.
     254
     2552017-05-24  Jiewen Tan  <jiewen_tan@apple.com>
     256
     257        Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
     258        https://bugs.webkit.org/show_bug.cgi?id=172555
     259        <rdar://problem/32004724>
     260
     261        Reviewed by Ryosuke Niwa.
     262
     263        * editing/selection/resources/select-iframe-focusin-document-crash-frame.html: Added.
     264        * editing/selection/select-iframe-focusin-document-crash-expected.txt: Added.
     265        * editing/selection/select-iframe-focusin-document-crash.html: Added.
     266
     2672017-03-24  Brent Fulgham  <bfulgham@apple.com>
     268
     269        Handle recursive calls to ProcessingInstruction::checkStyleSheet
     270        https://bugs.webkit.org/show_bug.cgi?id=169982
     271        <rdar://problem/31083051>
     272
     273        Reviewed by Antti Koivisto.
     274
     275        * fast/dom/beforeload/image-removed-during-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load-expected.txt.
     276        * fast/dom/beforeload/image-removed-during-before-load.html: Copied from LayoutTests/fast/dom/beforeload/image-removed-during-before-load.html.
     277        * fast/dom/beforeload/recursive-css-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load-expected.txt.
     278        * fast/dom/beforeload/recursive-css-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-css-pi-before-load.html.
     279        * fast/dom/beforeload/recursive-link-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load-expected.txt.
     280        * fast/dom/beforeload/recursive-link-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-link-before-load.html.
     281        * fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load-expected.txt.
     282        * fast/dom/beforeload/recursive-xsl-pi-before-load.html: Copied from LayoutTests/fast/dom/beforeload/recursive-xsl-pi-before-load.html.
     283        * fast/dom/beforeload/resources/content.xhtml: Copied from LayoutTests/fast/dom/beforeload/resources/content.xhtml.
     284        * fast/dom/beforeload/resources/pass.css: Copied from LayoutTests/fast/dom/beforeload/resources/pass.css.
     285        * fast/dom/beforeload/resources/test.xsl: Copied from LayoutTests/fast/dom/beforeload/resources/test.xsl.
     286
    12872017-03-22  Jiewen Tan  <jiewen_tan@apple.com>
    2288

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/accessibility/mac/alt-for-css-content-expected.txt

    r217367 r219817  
    4040AXValue: ALTERNATIVE CONTENT TEST6
    4141
    42 alt accessed through Javascript: 'ALTERNATIVE CONTENT TEST2'
     42alt accessed through Javascript: "ALTERNATIVE CONTENT TEST2"
    4343Test7 - alt does not apply to DOM nodes.
    4444AXRole: AXImage

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/accessibility/mac/webkit-alt-for-css-content-expected.txt

    r217367 r219817  
    4040AXValue: ALTERNATIVE CONTENT TEST6
    4141
    42 WebKitAlt accessed through Javascript: 'ALTERNATIVE CONTENT TEST2'
     42WebKitAlt accessed through Javascript: "ALTERNATIVE CONTENT TEST2"
    4343Test7 - webkit-alt does not apply to DOM nodes.
    4444AXRole: AXImage

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/crypto/webkitSubtle/argument-conversion-expected.txt

    r217367 r219817  
    1717Passing invalid data to digest()
    1818PASS crypto.webkitSubtle.digest({name: 'sha-1'}) threw exception TypeError: Not enough arguments.
    19 PASS crypto.webkitSubtle.digest({name: 'sha-1'}, null) threw exception TypeError: Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData.
    20 PASS crypto.webkitSubtle.digest({name: 'sha-1'}, 10) threw exception TypeError: Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData.
    21 PASS crypto.webkitSubtle.digest({name: 'sha-1'}, [10]) threw exception TypeError: Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData.
    22 PASS crypto.webkitSubtle.digest({name: 'sha-1'}, [new Uint8Array([0])]) threw exception TypeError: Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData.
     19PASS crypto.webkitSubtle.digest({name: 'sha-1'}, null) threw exception TypeError: Type error.
     20PASS crypto.webkitSubtle.digest({name: 'sha-1'}, 10) threw exception TypeError: Type error.
     21PASS crypto.webkitSubtle.digest({name: 'sha-1'}, [10]) threw exception TypeError: Type error.
     22PASS crypto.webkitSubtle.digest({name: 'sha-1'}, [new Uint8Array([0])]) threw exception TypeError: Type error.
    2323
    2424Passing invalid algorithmIdentifiers to digest()

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/editing/pasteboard/cjk-line-height-expected.txt

    r217367 r219817  
    22To manually test, copy and paste the selected content below. WebKit should not generate line-height property in the pasted content.
    33| <span>
    4 |   style="font-family: 'Hiragino Kaku Gothic ProN';"
     4|   style="font-family: "Hiragino Kaku Gothic ProN";"
    55|   "hello<#selection-caret>"
    66| <br>

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/editing/selection/5354455-1.html

    r217367 r219817  
    1717    y = paragraph.offsetParent.offsetTop + paragraph.offsetTop + paragraph.offsetHeight / 2;
    1818    eventSender.mouseMoveTo(x, y);
    19     // Give the editable region focus.
    20     eventSender.mouseDown();
    21     eventSender.mouseUp();
    2219    // Right click on the paragraph break to select it.
    2320    eventSender.contextClick();
    24     // esc key to kill the context menu.
    25     eventSender.keyDown(String.fromCharCode(0x001B), null);
    26    
     21
    2722    document.getElementById(result).innerHTML = window.getSelection().type;
    2823}

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/alt-inherit-initial-expected.txt

    r217367 r219817  
    1212testDiv.style['alt'] = 'initial'
    1313PASS testDiv.style['alt'] is "initial"
    14 PASS window.getComputedStyle(testDiv).getPropertyValue('alt') is "''"
     14PASS window.getComputedStyle(testDiv).getPropertyValue('alt') is "\"\""
    1515PASS successfullyParsed is true
    1616

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/alt-inherit-initial.html

    r217367 r219817  
    3131evalAndLog("testDiv.style['alt'] = 'initial'");
    3232shouldBeEqualToString("testDiv.style['alt']", "initial");
    33 shouldBeEqualToString("window.getComputedStyle(testDiv).getPropertyValue('alt')", "''");
     33shouldBeEqualToString("window.getComputedStyle(testDiv).getPropertyValue('alt')", `""`);
    3434
    3535</script>

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/content-language-comma-separated-list-expected.txt

    r217367 r219817  
    11Test for bug 76701: map HTTP-EQUIV content-language to -webkit-locale. This particular test tests that a comma-separated list of languages is ignored. This expectation may change, see bug. The HTML5 spec says that content-language should not have multiple languages, and decrees that a content-language containing a comma be ignored; this position has been upheld following significant debate. Firefox accepts a comma-separated list and a CSS :lang selector for any language in the list is matched. It's unclear what IE does.
    22
    3 FAIL languageOfNode('x') should be auto. Was 'ja, zh_CN'.
     3FAIL languageOfNode('x') should be auto. Was "ja, zh_CN".
    44PASS languageOfNode('y') is "ar"
    55PASS successfullyParsed is true

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/content-language-empty-expected.txt

    r217367 r219817  
    11Test for bug 76701: map HTTP-EQUIV content-language to -webkit-locale. This particular test tests that a content-language of empty string is ignored. This expectation may change, see bug. HTML5 decrees that the meta element be ignored in case of the empty string. It's unclear what other browsers do.
    22
    3 FAIL languageOfNode('x') should be auto. Was ''.
     3FAIL languageOfNode('x') should be auto. Was "".
    44PASS languageOfNode('y') is "ar"
    55PASS successfullyParsed is true

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/content-language-only-whitespace-expected.txt

    r217367 r219817  
    11Test for bug 76701: map HTTP-EQUIV content-language to -webkit-locale. This particular test tests that a content-language with whitespace-only content is ignored. This expectation may change, see bug. HTML5 decrees that the meta element be ignored in case of whitespace only content. It's unclear what other browsers do.
    22
    3 FAIL languageOfNode('x') should be auto. Was '  \9 \a  '.
     3FAIL languageOfNode('x') should be auto. Was "  \9 \a  ".
    44PASS languageOfNode('y') is "ar"
    55PASS successfullyParsed is true

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/content-language-with-whitespace-expected.txt

    r217367 r219817  
    11Test for bug 76701: map HTTP-EQUIV content-language to -webkit-locale. This particular test tests that the the pragma-set default language is set to the first sequence of non-whitespace characters of the content-language content. This expectation may change, see bug. This expectation is as per the HTML 5 spec. It appears that Firefox does not exactly do this, but trims the leading and trailing whitespace. It's unclear what IE does.
    22
    3 FAIL languageOfNode('x') should be ja_JP. Was '  \a \9 \9 ja-JP   \9  zh_CN \9 \a \a \9 \9 '.
     3FAIL languageOfNode('x') should be ja_JP. Was "  \a \9 \9 ja-JP   \9  zh_CN \9 \a \a \9 \9 ".
    44PASS languageOfNode('y') is "ar"
    55PASS successfullyParsed is true

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/counters/counter-cssText-expected.txt

    r217367 r219817  
    55
    66PASS rules[2].style.cssText is "content: counter(section, decimal);"
    7 PASS rules[3].style.cssText is "content: counters(section, ':', decimal);"
     7PASS rules[3].style.cssText is "content: counters(section, \":\", decimal);"
    88PASS rules[4].style.cssText is "content: counter(section, lower-roman);"
    9 PASS rules[5].style.cssText is "content: counters(section, ',', upper-roman);"
     9PASS rules[5].style.cssText is "content: counters(section, \",\", upper-roman);"
    1010PASS rules[6].style.cssText is "content: counter(section, none);"
    1111PASS successfullyParsed is true

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/counters/counter-cssText.html

    r217367 r219817  
    3030description("Test the cssText output of counter-valued CSSPrimitiveValues");
    3131var rules = document.styleSheets[0].cssRules;
    32 shouldBeEqualToString("rules[2].style.cssText", "content: counter(section, decimal);");
    33 shouldBeEqualToString("rules[3].style.cssText", "content: counters(section, ':', decimal);");
    34 shouldBeEqualToString("rules[4].style.cssText", "content: counter(section, lower-roman);");
    35 shouldBeEqualToString("rules[5].style.cssText", "content: counters(section, ',', upper-roman);");
    36 shouldBeEqualToString("rules[6].style.cssText", "content: counter(section, none);");
     32shouldBeEqualToString("rules[2].style.cssText", `content: counter(section, decimal);`);
     33shouldBeEqualToString("rules[3].style.cssText", `content: counters(section, ":", decimal);`);
     34shouldBeEqualToString("rules[4].style.cssText", `content: counter(section, lower-roman);`);
     35shouldBeEqualToString("rules[5].style.cssText", `content: counters(section, ",", upper-roman);`);
     36shouldBeEqualToString("rules[6].style.cssText", `content: counter(section, none);`);
    3737</script>
    3838<script src="../../../resources/js-test-post.js"></script>

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/font-family-trailing-bracket-gunk-expected.txt

    r217367 r219817  
    44
    55
    6 PASS spanElement.innerHTML is 'foo'
    7 PASS computedStyle.getPropertyValue('font-family') is "'Arial [ding dong]', 'Helvetica [Xft]', Courier"
     6PASS spanElement.innerHTML is "foo"
     7PASS computedStyle.getPropertyValue('font-family') is "\"Arial [ding dong]\", \"Helvetica [Xft]\", Courier"
    88PASS successfullyParsed is true
    99

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/font-family-trailing-bracket-gunk.html

    r217367 r219817  
    1414
    1515var computedStyle = window.getComputedStyle(spanElement);
    16 shouldBe("spanElement.innerHTML", "'foo'");
    17 shouldBe("computedStyle.getPropertyValue('font-family')", "\"'Arial [ding dong]', 'Helvetica [Xft]', Courier\"");
     16shouldBeEqualToString("spanElement.innerHTML", "foo");
     17shouldBeEqualToString("computedStyle.getPropertyValue('font-family')", `"Arial [ding dong]", "Helvetica [Xft]", Courier`);
    1818
    1919document.body.removeChild(spanElement);

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/getComputedStyle/computed-style-font-family-expected.txt

    r217367 r219817  
    11Font attributes. The font-family should list three families:
    22
    3 font-family: monospace, 'Lucida Grande', sans-serif;
     3font-family: monospace, "Lucida Grande", sans-serif;
    44font-size: 16px;
    55font-style: normal;

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/getComputedStyle/computed-style-properties-expected.txt

    r217367 r219817  
    1111
    1212PASS computedStyleFor('outline', null, 'outline-offset') is '5px'
    13 PASS computedStyleFor('content', 'before', 'content') is 'text'
    14 PASS computedStyleFor('content', 'after', 'content') is "'test ' url(data:image/gif;base64,R0lGODlhAQABAJAAAP8AAAAAACwAAAAAAQABAAACAgQBADs=)"
    15 PASS computedStyleFor('counter', null, 'counter-reset') is 'section 0'
     13PASS computedStyleFor('content', 'before', 'content') is "text"
     14PASS computedStyleFor('content', 'after', 'content') is "\"test \" url(data:image/gif;base64,R0lGODlhAQABAJAAAP8AAAAAACwAAAAAAQABAAACAgQBADs=)"
     15PASS computedStyleFor('counter', null, 'counter-reset') is "section 0"
    1616PASS str.indexOf('subsection 0') != -1 is true
    1717PASS str.indexOf('anothercounter 5') != -1 is true
    18 PASS computedStyleFor('counter1', 'before', 'counter-increment') is 'section 1'
    19 PASS computedStyleFor('subcounter2', 'before', 'counter-increment') is 'subsection 1'
    20 PASS computedStyleFor('subcounter2', 'before', 'content') is "counter(section) '.' counter(subsection) '. '"
     18PASS computedStyleFor('counter1', 'before', 'counter-increment') is "section 1"
     19PASS computedStyleFor('subcounter2', 'before', 'counter-increment') is "subsection 1"
     20PASS computedStyleFor('subcounter2', 'before', 'content') is "counter(section) \".\" counter(subsection) \". \""
    2121PASS successfullyParsed is true
    2222

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/getComputedStyle/computed-style-properties.html

    r217367 r219817  
    6666shouldBe("computedStyleFor('outline', null, 'outline-offset')", "'5px'");
    6767
    68 shouldBe("computedStyleFor('content', 'before', 'content')", "'text'");
    69 shouldBe("computedStyleFor('content', 'after', 'content')", '"\'test \' url(data:image/gif;base64,R0lGODlhAQABAJAAAP8AAAAAACwAAAAAAQABAAACAgQBADs=)"');
    70 shouldBe("computedStyleFor('counter', null, 'counter-reset')", "'section 0'");
     68shouldBeEqualToString("computedStyleFor('content', 'before', 'content')", "text");
     69shouldBeEqualToString("computedStyleFor('content', 'after', 'content')", `"test " url(data:image/gif;base64,R0lGODlhAQABAJAAAP8AAAAAACwAAAAAAQABAAACAgQBADs=)`);
     70shouldBeEqualToString("computedStyleFor('counter', null, 'counter-reset')", "section 0");
    7171var str = computedStyleFor('subcounter', null, 'counter-reset');
    7272shouldBe("str.indexOf('subsection 0') != -1", "true");
    7373shouldBe("str.indexOf('anothercounter 5') != -1", "true");
    74 shouldBe("computedStyleFor('counter1', 'before', 'counter-increment')", "'section 1'");
    75 shouldBe("computedStyleFor('subcounter2', 'before', 'counter-increment')", "'subsection 1'");
    76 shouldBe("computedStyleFor('subcounter2', 'before', 'content')", '"counter(section) \'.\' counter(subsection) \'. \'"');
     74shouldBeEqualToString("computedStyleFor('counter1', 'before', 'counter-increment')", "section 1");
     75shouldBeEqualToString("computedStyleFor('subcounter2', 'before', 'counter-increment')", "subsection 1");
     76shouldBeEqualToString("computedStyleFor('subcounter2', 'before', 'content')", `counter(section) "." counter(subsection) ". "`);
    7777</script>
    7878<script src="../../../resources/js-test-post.js"></script>

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/getComputedStyle/font-family-fallback-reset-expected.txt

    r217367 r219817  
    44
    55
    6 PASS window.getComputedStyle(outerDiv, null).fontFamily is "'courier new', cursive"
     6PASS window.getComputedStyle(outerDiv, null).fontFamily is "\"courier new\", cursive"
    77PASS window.getComputedStyle(timesDiv, null).fontFamily is "foo"
    88PASS window.getComputedStyle(cursiveDiv, null).fontFamily is "cursive"

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/getComputedStyle/script-tests/font-family-fallback-reset.js

    r217367 r219817  
    1111'</div>';
    1212
    13 shouldBeEqualToString("window.getComputedStyle(outerDiv, null).fontFamily", "'courier new', cursive");
     13shouldBeEqualToString("window.getComputedStyle(outerDiv, null).fontFamily", `"courier new", cursive`);
    1414shouldBeEqualToString("window.getComputedStyle(timesDiv, null).fontFamily", "foo");
    1515shouldBeEqualToString("window.getComputedStyle(cursiveDiv, null).fontFamily", "cursive");

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/lang-mapped-to-webkit-locale-expected.txt

    r217367 r219817  
    2020PASS languageOfNode('q4') is "ar"
    2121PASS languageOfNode('q5') is "auto"
    22 PASS languageOfNode('q6') is "'  '"
     22PASS languageOfNode('q6') is "\"  \""
    2323PASS languageOfNode('q7') is "auto"
    2424PASS languageOfNode('q8') is "xyzzy"
    25 PASS languageOfNode('q9') is "'][;][['"
     25PASS languageOfNode('q9') is "\"][;][[\""
    2626PASS successfullyParsed is true
    2727

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/lang-mapped-to-webkit-locale.xhtml

    r217367 r219817  
    4747shouldBeEqualToString("languageOfNode('q4')", "ar");
    4848shouldBeEqualToString("languageOfNode('q5')", "auto");
    49 shouldBeEqualToString("languageOfNode('q6')", "'  '");
     49shouldBeEqualToString("languageOfNode('q6')", `"  "`);
    5050shouldBeEqualToString("languageOfNode('q7')", "auto");
    5151shouldBeEqualToString("languageOfNode('q8')", "xyzzy");
    52 shouldBeEqualToString("languageOfNode('q9')", "'][;][['");
     52shouldBeEqualToString("languageOfNode('q9')", `"][;][["`);
    5353
    5454var successfullyParsed = true;

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/uri-token-parsing-expected.txt

    r217367 r219817  
    1313#h { content: url(e); }
    1414#i { content: url(f); }
    15 #j { content: url('url(g)'); }
     15#j { content: url("url(g)"); }
    1616#l { content: url(c); }
    1717#m { content: url(d); }
    1818#n { content: url(e); }
    1919#o { content: url(f); }
    20 #p { content: url('url(g)'); }
    21 #q { cursor: url('url(q)'), default; }
    22 #r { list-style-image: url('url(r)'); }
    23 #s { background-image: url('url(s)'); }
    24 #t { -webkit-mask-image: url('url(t)'); }
    25 #u { -webkit-border-image: url('url(u)') 1 2 3 4 fill stretch round; }
    26 #v { -webkit-mask-box-image: url('url(v)') 1 2 3 4 fill stretch round; }
     20#p { content: url("url(g)"); }
     21#q { cursor: url("url(q)"), default; }
     22#r { list-style-image: url("url(r)"); }
     23#s { background-image: url("url(s)"); }
     24#t { -webkit-mask-image: url("url(t)"); }
     25#u { -webkit-border-image: url("url(u)") 1 2 3 4 fill stretch round; }
     26#v { -webkit-mask-box-image: url("url(v)") 1 2 3 4 fill stretch round; }
    2727#w { content: url(ww); }
    2828#x { content: url(x%20xx); }
    … …  
    3838#h { content: url(e); }
    3939#i { content: url(f); }
    40 #j { content: url('url(g)'); }
     40#j { content: url("url(g)"); }
    4141#l { content: url(c); }
    4242#m { content: url(d); }
    4343#n { content: url(e); }
    4444#o { content: url(f); }
    45 #p { content: url('url(g)'); }
    46 #q { cursor: url('url(q)'), default; }
    47 #r { list-style-image: url('url(r)'); }
    48 #s { background-image: url('url(s)'); }
    49 #t { -webkit-mask-image: url('url(t)'); }
    50 #u { -webkit-border-image: url('url(u)') 1 2 3 4 fill stretch round; }
    51 #v { -webkit-mask-box-image: url('url(v)') 1 2 3 4 fill stretch round; }
     45#p { content: url("url(g)"); }
     46#q { cursor: url("url(q)"), default; }
     47#r { list-style-image: url("url(r)"); }
     48#s { background-image: url("url(s)"); }
     49#t { -webkit-mask-image: url("url(t)"); }
     50#u { -webkit-border-image: url("url(u)") 1 2 3 4 fill stretch round; }
     51#v { -webkit-mask-box-image: url("url(v)") 1 2 3 4 fill stretch round; }
    5252#w { content: url(ww); }
    5353#x { content: url(x%20xx); }

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/css/uri-token-parsing.html

    r217367 r219817  
    8787#h { content: url(e); }
    8888#i { content: url(f); }
    89 #j { content: url('url(g)'); }
     89#j { content: url("url(g)"); }
    9090#l { content: url(c); }
    9191#m { content: url(d); }
    9292#n { content: url(e); }
    9393#o { content: url(f); }
    94 #p { content: url('url(g)'); }
    95 #q { cursor: url('url(q)'), default; }
    96 #r { list-style-image: url('url(r)'); }
    97 #s { background-image: url('url(s)'); }
    98 #t { -webkit-mask-image: url('url(t)'); }
    99 #u { -webkit-border-image: url('url(u)') 1 2 3 4 fill stretch round; }
    100 #v { -webkit-mask-box-image: url('url(v)') 1 2 3 4 fill stretch round; }
     94#p { content: url("url(g)"); }
     95#q { cursor: url("url(q)"), default; }
     96#r { list-style-image: url("url(r)"); }
     97#s { background-image: url("url(s)"); }
     98#t { -webkit-mask-image: url("url(t)"); }
     99#u { -webkit-border-image: url("url(u)") 1 2 3 4 fill stretch round; }
     100#v { -webkit-mask-box-image: url("url(v)") 1 2 3 4 fill stretch round; }
    101101#w { content: url(ww); }
    102102#x { content: url(x%20xx); }

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/events/context-activated-by-key-event.html

    r217367 r219817  
    1212  document.getElementById('result').appendChild(document.createTextNode(text));
    1313  document.getElementById('result').appendChild(document.createElement("br"));
     14}
     15
     16function dismissContextMenu() {
     17  if (window.eventSender) {
     18    // esc key to kill the context menu.
     19    eventSender.keyDown(String.fromCharCode(0x001B), null);
     20  }
    1421}
    1522
    … …  
    3643if (window.testRunner) {
    3744  eventSender.keyDown('menu');
     45  dismissContextMenu();
    3846
    3947  var rect = document.getElementById('contenteditable').getBoundingClientRect();
    … …  
    4452  eventSender.mouseUp();
    4553  eventSender.keyDown('menu');
     54  dismissContextMenu();
    4655
    4756  document.getElementById('link').focus();
    4857  eventSender.keyDown('menu');
     58  dismissContextMenu();
    4959
    5060  window.getSelection().selectAllChildren(document.getElementById('contenteditable'));
    5161  eventSender.keyDown('menu');
     62  dismissContextMenu();
    5263
    5364  testRunner.dumpAsText();

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/events/script-tests/mouse-click-events.js

    r217367 r219817  
    2020}
    2121
     22function dismissContextMenu() {
     23    if (window.eventSender) {
     24        // esc key to kill the context menu.
     25        eventSender.keyDown(String.fromCharCode(0x001B), null);
     26    }
     27}
     28
    2229div.addEventListener("click", appendEventLog, false);
    2330div.addEventListener("dblclick", appendEventLog, false);
    … …  
    3542    }
    3643    eventSender.mouseDown(button);
     44    if (button == 2)
     45        dismissContextMenu();
    3746    eventSender.mouseUp(button);
    3847    eventSender.mouseDown(button);
     48    if (button == 2)
     49        dismissContextMenu();
    3950    eventSender.mouseUp(button);
    4051    // could test dragging here too

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/inspector-support/cssURLQuotes-expected.txt

    r217367 r219817  
    11ALERT: url(file:///unquoted) (URL should not be quoted)
    22ALERT: url(file:///noQuotesNeeded) (URL should not be quoted)
    3 ALERT: url('file:///should(Quote)') (URL should be quoted)
     3ALERT: url("file:///should(Quote)") (URL should be quoted)
    44

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/fast/inspector-support/style-expected.txt

    r217367 r219817  
    2121font-size: 24px (original property was font)
    2222line-height: normal (original property was font and property was implicitly set.)
    23 font-family: 'Lucida Grande' (original property was font)
     23font-family: "Lucida Grande" (original property was font)
    2424

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/ChangeLog

    r217367 r219817  
     12017-06-17  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        REGRESSION(r209495): materiauxlaverdure.com fails to load
     4        https://bugs.webkit.org/show_bug.cgi?id=173301
     5        <rdar://problem/32624850>
     6
     7        Reviewed by Antti Koivisto.
     8
     9        Rebaselined the tests that are now passing.
     10
     11        * web-platform-tests/cssom/CSSNamespaceRule-expected.txt:
     12        * web-platform-tests/cssom/serialize-values-expected.txt:
     13
    1142017-05-18  Daniel Bates  <dabates@apple.com>
    215

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/controls/track-menu.html

    r217367 r219817  
    7878                tester.test("First menu item checkmark image is visible")
    7979                    .value(getComputedStyle(checkImage).content)
    80                     .contains("url('data:image/svg+xml,<svg xmlns=");
     80                    .contains('url("data:image/svg+xml,<svg xmlns=');
    8181
    8282                var menuItem = menuList.children[1];

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/media-source/media-source-overlapping-append-expected.txt

    r217367 r219817  
    88EVENT(updateend)
    99EXPECTED (bufferedSamples.length == '6') OK
    10 {PTS({0/1000, 0.000000}), DTS({0/1000, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    11 {PTS({1000/1000, 1.000000}), DTS({1000/1000, 1.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    12 {PTS({2000/1000, 2.000000}), DTS({2000/1000, 2.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    13 {PTS({3000/1000, 3.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    14 {PTS({4000/1000, 4.000000}), DTS({4000/1000, 4.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    15 {PTS({5000/1000, 5.000000}), DTS({5000/1000, 5.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
     10{PTS({0/1000 = 0.000000}), DTS({0/1000 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     11{PTS({1000/1000 = 1.000000}), DTS({1000/1000 = 1.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     12{PTS({2000/1000 = 2.000000}), DTS({2000/1000 = 2.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     13{PTS({3000/1000 = 3.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     14{PTS({4000/1000 = 4.000000}), DTS({4000/1000 = 4.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     15{PTS({5000/1000 = 5.000000}), DTS({5000/1000 = 5.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
    1616RUN(sourceBuffer.appendBuffer(samples))
    1717EVENT(updateend)
    1818EXPECTED (bufferedSamples.length == '6') OK
    19 {PTS({0/1000, 0.000000}), DTS({0/1000, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(1)}
    20 {PTS({1000/1000, 1.000000}), DTS({1000/1000, 1.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
    21 {PTS({2000/1000, 2.000000}), DTS({2000/1000, 2.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
    22 {PTS({3000/1000, 3.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(1)}
    23 {PTS({4000/1000, 4.000000}), DTS({4000/1000, 4.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
    24 {PTS({5000/1000, 5.000000}), DTS({5000/1000, 5.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
     19{PTS({0/1000 = 0.000000}), DTS({0/1000 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(1)}
     20{PTS({1000/1000 = 1.000000}), DTS({1000/1000 = 1.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
     21{PTS({2000/1000 = 2.000000}), DTS({2000/1000 = 2.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
     22{PTS({3000/1000 = 3.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(1)}
     23{PTS({4000/1000 = 4.000000}), DTS({4000/1000 = 4.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
     24{PTS({5000/1000 = 5.000000}), DTS({5000/1000 = 5.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
    2525RUN(sourceBuffer.appendBuffer(samples))
    2626EVENT(updateend)
    2727EXPECTED (bufferedSamples.length == '6') OK
    28 {PTS({0/1000, 0.000000}), DTS({0/1000, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(2)}
    29 {PTS({2000/1000, 2.000000}), DTS({1000/1000, 1.000000}), duration({1000/1000, 1.000000}), flags(0), generation(2)}
    30 {PTS({1000/1000, 1.000000}), DTS({2000/1000, 2.000000}), duration({1000/1000, 1.000000}), flags(0), generation(2)}
    31 {PTS({3000/1000, 3.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(2)}
    32 {PTS({5000/1000, 5.000000}), DTS({4000/1000, 4.000000}), duration({1000/1000, 1.000000}), flags(0), generation(2)}
    33 {PTS({4000/1000, 4.000000}), DTS({5000/1000, 5.000000}), duration({1000/1000, 1.000000}), flags(0), generation(2)}
     28{PTS({0/1000 = 0.000000}), DTS({0/1000 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(2)}
     29{PTS({2000/1000 = 2.000000}), DTS({1000/1000 = 1.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(2)}
     30{PTS({1000/1000 = 1.000000}), DTS({2000/1000 = 2.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(2)}
     31{PTS({3000/1000 = 3.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(2)}
     32{PTS({5000/1000 = 5.000000}), DTS({4000/1000 = 4.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(2)}
     33{PTS({4000/1000 = 4.000000}), DTS({5000/1000 = 5.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(2)}
    3434END OF TEST
    3535

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/media-source/media-source-overlapping-decodetime-expected.txt

    r217367 r219817  
    1010EVENT(updateend)
    1111EXPECTED (bufferedSamples.length == '7') OK
    12 {PTS({0/1000, 0.000000}), DTS({0/1000, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    13 {PTS({1000/1000, 1.000000}), DTS({1000/1000, 1.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    14 {PTS({2000/1000, 2.000000}), DTS({2000/1000, 2.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    15 {PTS({3000/1000, 3.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    16 {PTS({4000/1000, 4.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(1)}
    17 {PTS({5000/1000, 5.000000}), DTS({4000/1000, 4.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
    18 {PTS({6000/1000, 6.000000}), DTS({5000/1000, 5.000000}), duration({1000/1000, 1.000000}), flags(0), generation(1)}
     12{PTS({0/1000 = 0.000000}), DTS({0/1000 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     13{PTS({1000/1000 = 1.000000}), DTS({1000/1000 = 1.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     14{PTS({2000/1000 = 2.000000}), DTS({2000/1000 = 2.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     15{PTS({3000/1000 = 3.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     16{PTS({4000/1000 = 4.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(1)}
     17{PTS({5000/1000 = 5.000000}), DTS({4000/1000 = 4.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
     18{PTS({6000/1000 = 6.000000}), DTS({5000/1000 = 5.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(1)}
    1919END OF TEST
    2020

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/media-source/media-source-seek-back-expected.txt

    r217367 r219817  
    1313EVENT(seeked)
    1414EXPECTED (enqueuedSamples.length == '1') OK
    15 {PTS({0/1000, 0.000000}), DTS({0/1000, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
     15{PTS({0/1000 = 0.000000}), DTS({0/1000 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
    1616END OF TEST
    1717

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/media-source/media-source-sequence-timestamps-expected.txt

    r217367 r219817  
    88EVENT(updateend)
    99EXPECTED (bufferedSamples.length == '6') OK
    10 {PTS({0/1, 0.000000}), DTS({0/1, 0.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    11 {PTS({1000/1000, 1.000000}), DTS({1000/1000, 1.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    12 {PTS({2000/1000, 2.000000}), DTS({2000/1000, 2.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    13 {PTS({3000/1000, 3.000000}), DTS({3000/1000, 3.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    14 {PTS({4000/1000, 4.000000}), DTS({4000/1000, 4.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    15 {PTS({5000/1000, 5.000000}), DTS({5000/1000, 5.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
     10{PTS({0/1 = 0.000000}), DTS({0/1 = 0.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     11{PTS({1000/1000 = 1.000000}), DTS({1000/1000 = 1.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     12{PTS({2000/1000 = 2.000000}), DTS({2000/1000 = 2.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     13{PTS({3000/1000 = 3.000000}), DTS({3000/1000 = 3.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     14{PTS({4000/1000 = 4.000000}), DTS({4000/1000 = 4.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     15{PTS({5000/1000 = 5.000000}), DTS({5000/1000 = 5.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
    1616END OF TEST
    1717

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/media/media-source/media-source-timeoffset-expected.txt

    r217367 r219817  
    99EVENT(updateend)
    1010EXPECTED (bufferedSamples.length == '6') OK
    11 {PTS({100000000/10000000, 10.000000}), DTS({100000000/10000000, 10.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    12 {PTS({110000000/10000000, 11.000000}), DTS({110000000/10000000, 11.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    13 {PTS({120000000/10000000, 12.000000}), DTS({120000000/10000000, 12.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    14 {PTS({130000000/10000000, 13.000000}), DTS({130000000/10000000, 13.000000}), duration({1000/1000, 1.000000}), flags(1), generation(0)}
    15 {PTS({140000000/10000000, 14.000000}), DTS({140000000/10000000, 14.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
    16 {PTS({150000000/10000000, 15.000000}), DTS({150000000/10000000, 15.000000}), duration({1000/1000, 1.000000}), flags(0), generation(0)}
     11{PTS({100000000/10000000 = 10.000000}), DTS({100000000/10000000 = 10.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     12{PTS({110000000/10000000 = 11.000000}), DTS({110000000/10000000 = 11.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     13{PTS({120000000/10000000 = 12.000000}), DTS({120000000/10000000 = 12.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     14{PTS({130000000/10000000 = 13.000000}), DTS({130000000/10000000 = 13.000000}), duration({1000/1000 = 1.000000}), flags(1), generation(0)}
     15{PTS({140000000/10000000 = 14.000000}), DTS({140000000/10000000 = 14.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
     16{PTS({150000000/10000000 = 15.000000}), DTS({150000000/10000000 = 15.000000}), duration({1000/1000 = 1.000000}), flags(0), generation(0)}
    1717END OF TEST
    1818

  • TabularUnified releases/WebKitGTK/webkit-2.16/LayoutTests/platform/gtk/fast/forms/menulist-typeahead-find.html

    r217367 r219817  
    2020    if (!window.eventSender)
    2121        return;
     22
     23    // Reset menu list to initial state.
     24    menulist.selectedIndex = 0;
     25    menulist.blur();
    2226
    2327    eventSender.mouseMoveTo(menulist.offsetLeft + (menulist.offsetWidth / 2), menulist.offsetTop + (menulist.offsetHeight / 2));

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/ChangeLog

    r217367 r219817  
     12017-07-24  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Unreviewed. Fix the build with GCC 4.9 after merge r217438.
     4
     5        * bytecompiler/BytecodeGenerator.h:
     6        (JSC::StructureForInContext::addGetInst):
     7
     82017-06-26  Saam Barati  <sbarati@apple.com>
     9
     10        Crash in JSC::Lexer<unsigned char>::setCode
     11        https://bugs.webkit.org/show_bug.cgi?id=172754
     12
     13        Reviewed by Mark Lam.
     14
     15        The lexer was asking one of its buffers to reserve initial space that
     16        was O(text size in bytes). For large sources, this would end up causing
     17        the vector to overflow and crash. This patch changes this code be like
     18        the Lexer's other buffers and to only reserve a small starting buffer.
     19
     20        * parser/Lexer.cpp:
     21        (JSC::Lexer<T>::setCode):
     22
     232017-04-13  Mark Lam  <mark.lam@apple.com>
     24
     25        Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
     26        https://bugs.webkit.org/show_bug.cgi?id=170661
     27        <rdar://problem/31579046>
     28
     29        Reviewed by Filip Pizlo.
     30
     31        Previously, we were using flush() to flush the outermost frame's scopeRegister.
     32        This is incorrect because flush() expects the VirtualRegister value passed to
     33        it to be that of the top most inlined frame.  In the event that we reach a
     34        terminal condition while inside an inlined frame, flush() will end up flushing
     35        the wrong register.  The fix is simply to use flushDirect() instead.
     36
     37        * dfg/DFGByteCodeParser.cpp:
     38        (JSC::DFG::ByteCodeParser::flush):
     39
     402017-04-20  Mark Lam  <mark.lam@apple.com>
     41
     42        virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
     43        https://bugs.webkit.org/show_bug.cgi?id=171079
     44        <rdar://problem/31684756>
     45
     46        Reviewed by Saam Barati.
     47
     48        This is needed because tail calls would restore callee saved registers (and
     49        therefore, potentially clobber the tag registers) before jumping to the thunk.
     50
     51        * jit/ThunkGenerators.cpp:
     52        (JSC::virtualThunkFor):
     53
     542017-05-05  Keith Miller  <keith_miller@apple.com>
     55
     56        Put does not properly consult the prototype chain
     57        https://bugs.webkit.org/show_bug.cgi?id=171754
     58
     59        Reviewed by Saam Barati.
     60
     61        We should do a follow up that cleans up the rest of put. See:
     62        https://bugs.webkit.org/show_bug.cgi?id=171759
     63
     64        * runtime/JSCJSValue.cpp:
     65        (JSC::JSValue::putToPrimitive):
     66        * runtime/JSObject.cpp:
     67        (JSC::JSObject::putInlineSlow):
     68        * runtime/JSObjectInlines.h:
     69        (JSC::JSObject::canPerformFastPutInline):
     70
     712017-07-24  Carlos Garcia Campos  <cgarcia@igalia.com>
     72
     73        Unreviewed. Fix merge r217438.
     74
     75        See bug #174781.
     76
     77        * bytecompiler/BytecodeGenerator.cpp:
     78        (JSC::StructureForInContext::finalize): Use operand instead of unsignedValue.
     79
     802017-05-05  Saam Barati  <sbarati@apple.com>
     81
     82        putDirectIndex does not properly do defineOwnProperty
     83        https://bugs.webkit.org/show_bug.cgi?id=171591
     84        <rdar://problem/31735695>
     85
     86        Reviewed by Geoffrey Garen.
     87
     88        This patch fixes putDirectIndex and its JIT implementations to be
     89        compatible with the ES6 spec. I think our code became out of date
     90        when we implemented ArraySpeciesCreate since ArraySpeciesCreate may
     91        return arbitrary objects. We perform putDirectIndex on that arbitrary
     92        object. The behavior we want is as if we performed defineProperty({configurable:true, enumerable:true, writable:true}).
     93        However, we weren't doing this. putDirectIndex assumed it could just splat
     94        data into any descendent of JSObject's butterfly. For example, this means
     95        we'd just splat into the butterfly of a typed array, even though a typed
     96        array doesn't use its butterfly to store its indexed properties in the usual
     97        way. Also, typed array properties are non-configurable, so this operation
     98        should throw. This also means if we saw a ProxyObject, we'd just splat
     99        into its butterfly, but this is obviously wrong because ProxyObject should
     100        intercept the defineProperty operation.
     101       
     102        This patch fixes this issue by adding a whitelist of cell types that can
     103        go down putDirectIndex's fast path. Anything not in that whitelist will
     104        simply call into defineOwnProperty.
     105
     106        * bytecode/ByValInfo.h:
     107        (JSC::jitArrayModePermitsPutDirect):
     108        * dfg/DFGArrayMode.cpp:
     109        (JSC::DFG::ArrayMode::refine):
     110        * jit/JITOperations.cpp:
     111        * runtime/ArrayPrototype.cpp:
     112        (JSC::arrayProtoFuncSplice):
     113        * runtime/ClonedArguments.cpp:
     114        (JSC::ClonedArguments::createStructure):
     115        * runtime/JSGenericTypedArrayViewInlines.h:
     116        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
     117        * runtime/JSObject.cpp:
     118        (JSC::canDoFastPutDirectIndex):
     119        (JSC::JSObject::defineOwnIndexedProperty):
     120        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
     121        (JSC::JSObject::putDirectIndexBeyondVectorLength): Deleted.
     122        * runtime/JSObject.h:
     123        (JSC::JSObject::putDirectIndex):
     124        (JSC::JSObject::canSetIndexQuicklyForPutDirect): Deleted.
     125        * runtime/JSType.h:
     126
     1272017-05-17  Filip Pizlo  <fpizlo@apple.com>
     128
     129        JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
     130        https://bugs.webkit.org/show_bug.cgi?id=172208
     131
     132        Reviewed by Saam Barati.
     133
     134        * dfg/DFGArgumentsEliminationPhase.cpp:
     135
     1362017-04-17  Mark Lam  <mark.lam@apple.com>
     137
     138        JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
     139        https://bugs.webkit.org/show_bug.cgi?id=170896
     140        <rdar://problem/31651319>
     141
     142        Reviewed by JF Bastien and Keith Miller.
     143
     144        * runtime/JSArray.cpp:
     145        (JSC::JSArray::appendMemcpy):
     146
     1472017-05-25  Saam Barati  <sbarati@apple.com>
     148
     149        Our for-in optimization in the bytecode generator does its static analysis incorrectly
     150        https://bugs.webkit.org/show_bug.cgi?id=172532
     151        <rdar://problem/32369452>
     152
     153        Reviewed by Mark Lam.
     154
     155        Our static analysis for when a for-in induction variable
     156        is written to tried to its analysis as we generate
     157        bytecode. This has issues, since it does not account for
     158        the dynamic execution path of the program. Let's consider
     159        a program where our old analysis worked:
     160       
     161        ```
     162        for (let p in o) {
     163            o[p]; // We can transform this into a fast get_direct_pname
     164            p = 20;
     165            o[p]; // We cannot transform this since p has been changed.
     166        }
     167        ```
     168       
     169        However, our static analysis did not account for loops, which exist
     170        in JavaScript. e.g, it would incorrectly compile this program as:
     171        ```
     172        for (let p in o) {
     173            for (let i = 0; i < 20; ++i) {
     174                o[p]; // It transforms this to use get_direct_pname even though p will be over-written if we get here from the inner loop back edge!
     175                p = 20;
     176                o[p]; // We correctly do not transform this.
     177            }
     178        }
     179        ```
     180       
     181        Because of this flaw, I've made the optimization more conservative.
     182        We now optimistically emit code for the optimized access. However,
     183        if a for-in context is *ever* invalidated, before we pop it off
     184        the stack, we rewrite the program's optimized accesses to no longer
     185        be optimized. To do this, each context keeps track of its optimized
     186        accesses.
     187       
     188        This patch also adds a new bytecode, op_nop, which is just a no-op.
     189        It was helpful to add this because reverting get_direct_pname to get_by_val
     190        will leave us with an extra instruction word because get_direct_pname is
     191        has a length of 7 where get_by_val has a length of 6. This leaves us with
     192        an extra slot that we fill with an op_nop.
     193
     194        * bytecode/BytecodeDumper.cpp:
     195        (JSC::BytecodeDumper<Block>::dumpBytecode):
     196        * bytecode/BytecodeList.json:
     197        * bytecode/BytecodeUseDef.h:
     198        (JSC::computeUsesForBytecodeOffset):
     199        (JSC::computeDefsForBytecodeOffset):
     200        * bytecompiler/BytecodeGenerator.cpp:
     201        (JSC::BytecodeGenerator::emitGetByVal):
     202        (JSC::BytecodeGenerator::popIndexedForInScope):
     203        (JSC::BytecodeGenerator::popStructureForInScope):
     204        (JSC::BytecodeGenerator::invalidateForInContextForLocal):
     205        (JSC::StructureForInContext::pop):
     206        (JSC::IndexedForInContext::pop):
     207        * bytecompiler/BytecodeGenerator.h:
     208        (JSC::StructureForInContext::addGetInst):
     209        (JSC::IndexedForInContext::addGetInst):
     210        * dfg/DFGByteCodeParser.cpp:
     211        (JSC::DFG::ByteCodeParser::parseBlock):
     212        * dfg/DFGCapabilities.cpp:
     213        (JSC::DFG::capabilityLevel):
     214        * jit/JIT.cpp:
     215        (JSC::JIT::privateCompileMainPass):
     216        * jit/JIT.h:
     217        * jit/JITOpcodes.cpp:
     218        (JSC::JIT::emit_op_nop):
     219        * llint/LowLevelInterpreter.asm:
     220
     2212017-04-14  Saam Barati  <sbarati@apple.com>
     222
     223        ParseInt intrinsic in DFG backend doesn't properly flush its operands
     224        https://bugs.webkit.org/show_bug.cgi?id=170865
     225
     226        Reviewed by Mark Lam and Geoffrey Garen.
     227
     228        The DFG backend code needed to first call .gpr()/.jsValueRegs()
     229        before calling flushRegisters(), or the input JSValueOperand would
     230        not be flushed.
     231
     232        * dfg/DFGSpeculativeJIT.cpp:
     233        (JSC::DFG::SpeculativeJIT::compileParseInt):
     234
     2352017-06-16  Konstantin Tokarev  <annulen@yandex.ru>
     236
     237        REGRESSION(r166799): LogsPageMessagesToSystemConsoleEnabled corrupts non-ASCII characters
     238        https://bugs.webkit.org/show_bug.cgi?id=173470
     239
     240        Reviewed by Joseph Pecoraro.
     241
     242        ConsoleClient::printConsoleMessageWithArguments() incorrectly uses
     243        const char* overload of StringBuilder::append() that assummes Latin1
     244        encoding, not UTF8.
     245
     246        * runtime/ConsoleClient.cpp:
     247        (JSC::ConsoleClient::printConsoleMessageWithArguments):
     248
     2492017-06-01  Tomas Popela  <tpopela@redhat.com>, Mark Lam  <mark.lam@apple.com>
     250
     251        RELEASE_ASSERT_NOT_REACHED() in InferredType::kindForFlags() on Big-Endians
     252        https://bugs.webkit.org/show_bug.cgi?id=170945
     253
     254        Reviewed by Mark Lam.
     255
     256        Re-define PutByIdFlags as a int32_t enum explicitly because it is
     257        stored as an int32_t value in UnlinkedInstruction.  This prevents
     258        a bug on 64-bit big endian architectures where the word order is
     259        inverted (when we convert the UnlinkedInstruction into a CodeBlock
     260        Instruction), resulting in the PutByIdFlags value not being stored in
     261        the 32-bit word that the rest of the code expects it to be in.
     262
     263        * bytecode/PutByIdFlags.h:
     264
    12652017-05-10  Mark Lam  <mark.lam@apple.com>
    2266

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecode/ByValInfo.h

    r217367 r219817  
    165165}
    166166
     167inline bool jitArrayModePermitsPutDirect(JITArrayMode mode)
     168{
     169    // We don't allow typed array putDirect here since putDirect has
     170    // defineOwnProperty({configurable: true, writable:true, enumerable:true})
     171    // semantics. Typed array indexed properties are non-configurable by
     172    // default, so we can't simply store to a typed array for putDirect.
     173    //
     174    // We could model putDirect on ScopedArguments and DirectArguments, but we
     175    // haven't found any performance incentive to do it yet.
     176    switch (mode) {
     177    case JITInt32:
     178    case JITDouble:
     179    case JITContiguous:
     180    case JITArrayStorage:
     181        return true;
     182    default:
     183        return false;
     184    }
     185}
     186
    167187inline TypedArrayType typedArrayTypeForJITArrayMode(JITArrayMode mode)
    168188{

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecode/BytecodeList.json

    r217367 r219817  
    153153            { "name" : "op_watchdog", "length" : 1 },
    154154            { "name" : "op_log_shadow_chicken_prologue", "length" : 2},
    155             { "name" : "op_log_shadow_chicken_tail", "length" : 3}
     155            { "name" : "op_log_shadow_chicken_tail", "length" : 3},
     156            { "name" : "op_nop", "length" : 1 }
    156157        ]
    157158    },

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecode/BytecodeUseDef.h

    r217367 r219817  
    5656    case op_watchdog:
    5757    case op_get_argument:
     58    case op_nop:
    5859        return;
    5960    case op_assert:
    … …  
    364365    case op_log_shadow_chicken_tail:
    365366    case op_yield:
     367    case op_nop:
    366368#define LLINT_HELPER_OPCODES(opcode, length) case opcode:
    367369        FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r217367 r219817  
    13881388        case op_watchdog: {
    13891389            printLocationAndOp(out, exec, location, it, "watchdog");
     1390            break;
     1391        }
     1392        case op_nop: {
     1393            printLocationAndOp(out, exec, location, it, "nop");
    13901394            break;
    13911395        }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecode/PutByIdFlags.h

    r217367 r219817  
    3030namespace JSC {
    3131
    32 enum PutByIdFlags : intptr_t {
     32enum PutByIdFlags : int32_t {
    3333    PutByIdNone = 0,
    3434

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r217367 r219817  
    27942794RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
    27952795{
    2796     for (size_t i = m_forInContextStack.size(); i > 0; i--) {
    2797         ForInContext& context = m_forInContextStack[i - 1].get();
     2796    for (size_t i = m_forInContextStack.size(); i--; ) {
     2797        ForInContext& context = m_forInContextStack[i].get();
    27982798        if (context.local() != property)
    27992799            continue;
    28002800
    2801         if (!context.isValid())
    2802             break;
     2801        unsigned instIndex = instructions().size();
    28032802
    28042803        if (context.type() == ForInContext::IndexedForInContextType) {
     2804            static_cast<IndexedForInContext&>(context).addGetInst(instIndex, property->index());
    28052805            property = static_cast<IndexedForInContext&>(context).index();
    28062806            break;
    … …  
    28162816        instructions().append(structureContext.enumerator()->index());
    28172817        instructions().append(profile);
     2818
     2819        structureContext.addGetInst(instIndex, property->index(), profile);
    28182820        return dst;
    28192821    }
    … …  
    44884490    if (!localRegister)
    44894491        return;
     4492
     4493    ASSERT(m_forInContextStack.last()->type() == ForInContext::IndexedForInContextType);
     4494    static_cast<IndexedForInContext&>(m_forInContextStack.last().get()).finalize(*this);
    44904495    m_forInContextStack.removeLast();
    44914496}
    … …  
    45964601    if (!localRegister)
    45974602        return;
     4603    ASSERT(m_forInContextStack.last()->type() == ForInContext::StructureForInContextType);
     4604    static_cast<StructureForInContext&>(m_forInContextStack.last().get()).finalize(*this);
    45984605    m_forInContextStack.removeLast();
    45994606}
    … …  
    46124619    // reassigned, or we'd have to resort to runtime checks to see if the variable had been
    46134620    // reassigned from its original value.
    4614     for (size_t i = m_forInContextStack.size(); i > 0; i--) {
    4615         ForInContext& context = m_forInContextStack[i - 1].get();
     4621    for (size_t i = m_forInContextStack.size(); i--; ) {
     4622        ForInContext& context = m_forInContextStack[i].get();
    46164623        if (context.local() != localRegister)
    46174624            continue;
    … …  
    49674974}
    49684975
     4976void StructureForInContext::finalize(BytecodeGenerator& generator)
     4977{
     4978    if (isValid())
     4979        return;
     4980
     4981    for (const auto& instTuple : m_getInsts) {
     4982        unsigned instIndex = std::get<0>(instTuple);
     4983        int propertyRegIndex = std::get<1>(instTuple);
     4984        UnlinkedValueProfile valueProfile = std::get<2>(instTuple);
     4985        OpcodeID op = generator.instructions()[instIndex].u.opcode;
     4986        RELEASE_ASSERT(op == op_get_direct_pname);
     4987        ASSERT(opcodeLength(op_get_direct_pname) == 7);
     4988        ASSERT(opcodeLength(op_get_by_val) == 6);
     4989
     4990        // 0. Change the opcode to get_by_val.
     4991        generator.instructions()[instIndex].u.opcode = op_get_by_val;
     4992        // 1. dst stays the same.
     4993        // 2. base stays the same.
     4994        // 3. property gets switched to the original property.
     4995        generator.instructions()[instIndex + 3].u.operand = propertyRegIndex;
     4996        // 4. add an array profile.
     4997        generator.instructions()[instIndex + 4].u.operand = generator.newArrayProfile();
     4998        // 5. set the result value profile.
     4999        generator.instructions()[instIndex + 5].u.operand = valueProfile;
     5000        // 6. nop out the last instruction word.
     5001        generator.instructions()[instIndex + 6].u.opcode = op_nop;
     5002    }
     5003}
     5004
     5005void IndexedForInContext::finalize(BytecodeGenerator& generator)
     5006{
     5007    if (isValid())
     5008        return;
     5009
     5010    for (const auto& instPair : m_getInsts) {
     5011        unsigned instIndex = instPair.first;
     5012        int propertyRegIndex = instPair.second;
     5013        OpcodeID op = generator.instructions()[instIndex].u.opcode;
     5014        RELEASE_ASSERT(op == op_get_by_val);
     5015        // We just need to perform the get_by_val with the original property here,
     5016        // not the indexed one.
     5017        generator.instructions()[instIndex + 3].u.operand = propertyRegIndex;
     5018    }
     5019}
     5020
    49695021} // namespace JSC
    49705022

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

    r217367 r219817  
    222222        RegisterID* enumerator() const { return m_enumeratorRegister.get(); }
    223223
     224        void addGetInst(unsigned instIndex, int propertyRegIndex, UnlinkedValueProfile valueProfile)
     225        {
     226            m_getInsts.append(std::tuple<unsigned, int, UnlinkedValueProfile>(instIndex, propertyRegIndex, valueProfile));
     227        }
     228
     229        void finalize(BytecodeGenerator&);
     230
    224231    private:
    225232        RefPtr<RegisterID> m_indexRegister;
    226233        RefPtr<RegisterID> m_propertyRegister;
    227234        RefPtr<RegisterID> m_enumeratorRegister;
     235        Vector<std::tuple<unsigned, int, UnlinkedValueProfile>> m_getInsts;
    228236    };
    229237
    … …  
    243251        RegisterID* index() const { return m_indexRegister.get(); }
    244252
     253        void finalize(BytecodeGenerator&);
     254        void addGetInst(unsigned instIndex, int propertyIndex) { m_getInsts.append({ instIndex, propertyIndex }); }
     255
    245256    private:
    246257        RefPtr<RegisterID> m_indexRegister;
     258        Vector<std::pair<unsigned, int>> m_getInsts;
    247259    };
    248260
    … …  
    915927        void prepareLexicalScopeForNextForLoopIteration(VariableEnvironmentNode*, RegisterID* loopSymbolTable);
    916928        int labelScopeDepth() const;
     929        UnlinkedArrayProfile newArrayProfile();
    917930
    918931    private:
    … …  
    924937        UnlinkedArrayAllocationProfile newArrayAllocationProfile();
    925938        UnlinkedObjectAllocationProfile newObjectAllocationProfile();
    926         UnlinkedArrayProfile newArrayProfile();
    927939        UnlinkedValueProfile emitProfiledOpcode(OpcodeID);
    928940        int kill(RegisterID* dst)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp

    r217367 r219817  
    846846                                    storeValue(undefined, storeIndex);
    847847                                }
     848                               
     849                                node->remove();
     850                                node->origin.exitOK = canExit;
     851                                break;
    848852                            }
    849 
    850                             node->remove();
    851                             node->origin.exitOK = canExit;
    852                             break;
    853853                        }
    854854                    } else {

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

    r217367 r219817  
    187187    // to value profiling, but the array profile tells us something else, then we
    188188    // should just trust the array profile.
     189
     190    auto typedArrayResult = [&] (ArrayMode result) -> ArrayMode {
     191        if (node->op() == PutByValDirect) {
     192            // This is semantically identical to defineOwnProperty({configurable: true, writable:true, enumerable:true}),
     193            // which we can't model as a simple store to the typed array since typed array indexed properties
     194            // are non-configurable.
     195            return ArrayMode(Array::Generic);
     196        }
     197        return result;
     198    };
    189199   
    190200    switch (type()) {
    … …  
    236246    case Array::Float32Array:
    237247    case Array::Float64Array:
    238         switch (node->op()) {
    239         case PutByVal:
     248        if (node->op() == PutByVal) {
    240249            if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
    241                 return withSpeculation(Array::OutOfBounds);
    242             return withSpeculation(Array::InBounds);
    243         default:
    244             return withSpeculation(Array::InBounds);
    245         }
    246         return *this;
     250                return typedArrayResult(withSpeculation(Array::OutOfBounds));
     251        }
     252        return typedArrayResult(withSpeculation(Array::InBounds));
    247253    case Array::Unprofiled:
    248254    case Array::SelectUsingPredictions: {
    … …  
    275281            break;
    276282        }
    277        
     283
    278284        if (isInt8ArraySpeculation(base))
    279             return result.withType(Array::Int8Array);
     285            return typedArrayResult(result.withType(Array::Int8Array));
    280286       
    281287        if (isInt16ArraySpeculation(base))
    282             return result.withType(Array::Int16Array);
     288            return typedArrayResult(result.withType(Array::Int16Array));
    283289       
    284290        if (isInt32ArraySpeculation(base))
    285             return result.withType(Array::Int32Array);
     291            return typedArrayResult(result.withType(Array::Int32Array));
    286292       
    287293        if (isUint8ArraySpeculation(base))
    288             return result.withType(Array::Uint8Array);
     294            return typedArrayResult(result.withType(Array::Uint8Array));
    289295       
    290296        if (isUint8ClampedArraySpeculation(base))
    291             return result.withType(Array::Uint8ClampedArray);
     297            return typedArrayResult(result.withType(Array::Uint8ClampedArray));
    292298       
    293299        if (isUint16ArraySpeculation(base))
    294             return result.withType(Array::Uint16Array);
     300            return typedArrayResult(result.withType(Array::Uint16Array));
    295301       
    296302        if (isUint32ArraySpeculation(base))
    297             return result.withType(Array::Uint32Array);
     303            return typedArrayResult(result.withType(Array::Uint32Array));
    298304       
    299305        if (isFloat32ArraySpeculation(base))
    300             return result.withType(Array::Float32Array);
     306            return typedArrayResult(result.withType(Array::Float32Array));
    301307       
    302308        if (isFloat64ArraySpeculation(base))
    303             return result.withType(Array::Float64Array);
     309            return typedArrayResult(result.withType(Array::Float64Array));
    304310
    305311        if (type() == Array::Unprofiled)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r217367 r219817  
    626626            flushDirect(virtualRegisterForArgument(0));
    627627        if (m_graph.needsScopeRegister())
    628             flush(m_codeBlock->scopeRegister());
     628            flushDirect(m_codeBlock->scopeRegister());
    629629    }
    630630
    … …  
    54095409            NEXT_OPCODE(op_watchdog);
    54105410        }
     5411
     5412        case op_nop: {
     5413            addToGraph(Check); // We add a nop here so that basic block linking doesn't break.
     5414            NEXT_OPCODE(op_nop);
     5415        }
    54115416           
    54125417        case op_create_lexical_environment: {

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r217367 r219817  
    189189    case op_loop_hint:
    190190    case op_watchdog:
     191    case op_nop:
    191192    case op_ret:
    192193    case op_end:

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r217367 r219817  
    31403140        if (node->child1().useKind() == UntypedUse) {
    31413141            JSValueOperand value(this, node->child1());
     3142#if USE(JSVALUE64)
     3143            auto result = resultRegs.gpr();
     3144            auto valueReg = value.gpr();
     3145#else
     3146            auto result = resultRegs;
     3147            auto valueReg = value.jsValueRegs();
     3148#endif
    31423149
    31433150            flushRegisters();
    3144 #if USE(JSVALUE64)
    3145             callOperation(operationParseIntGeneric, resultRegs.gpr(), value.gpr(), radixGPR);
    3146 #else
    3147             callOperation(operationParseIntGeneric, resultRegs, value.jsValueRegs(), radixGPR);
    3148 #endif
     3151            callOperation(operationParseIntGeneric, result, valueReg, radixGPR);
    31493152            m_jit.exceptionCheck();
    31503153        } else {
    … …  
    31533156            speculateString(node->child1(), valueGPR);
    31543157
     3158#if USE(JSVALUE64)
     3159            auto result = resultRegs.gpr();
     3160#else
     3161            auto result = resultRegs;
     3162#endif
     3163
    31553164            flushRegisters();
    3156 #if USE(JSVALUE64)
    3157             callOperation(operationParseIntString, resultRegs.gpr(), valueGPR, radixGPR);
    3158 #else
    3159             callOperation(operationParseIntString, resultRegs, valueGPR, radixGPR);
    3160 #endif
     3165            callOperation(operationParseIntString, result, valueGPR, radixGPR);
    31613166            m_jit.exceptionCheck();
    31623167        }
    … …  
    31643169        if (node->child1().useKind() == UntypedUse) {
    31653170            JSValueOperand value(this, node->child1());
     3171#if USE(JSVALUE64)
     3172            auto result = resultRegs.gpr();
     3173#else
     3174            auto result = resultRegs;
     3175#endif
     3176            JSValueRegs valueRegs = value.jsValueRegs();
    31663177
    31673178            flushRegisters();
    3168 #if USE(JSVALUE64)
    3169             callOperation(operationParseIntNoRadixGeneric, resultRegs.gpr(), value.jsValueRegs());
    3170 #else
    3171             callOperation(operationParseIntNoRadixGeneric, resultRegs, value.jsValueRegs());
    3172 #endif
     3179            callOperation(operationParseIntNoRadixGeneric, result, valueRegs);
    31733180            m_jit.exceptionCheck();
    31743181        } else {

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/jit/JIT.cpp

    r217367 r219817  
    330330        DEFINE_OP(op_loop_hint)
    331331        DEFINE_OP(op_watchdog)
     332        DEFINE_OP(op_nop)
    332333        DEFINE_OP(op_lshift)
    333334        DEFINE_OP(op_mod)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/jit/JIT.h

    r217367 r219817  
    532532        void emit_op_loop_hint(Instruction*);
    533533        void emit_op_watchdog(Instruction*);
     534        void emit_op_nop(Instruction*);
    534535        void emit_op_lshift(Instruction*);
    535536        void emit_op_mod(Instruction*);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r217367 r219817  
    957957}
    958958
     959void JIT::emit_op_nop(Instruction*)
     960{
     961}
     962
    959963void JIT::emit_op_new_regexp(Instruction* currentInstruction)
    960964{

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/jit/JITOperations.cpp

    r217367 r219817  
    548548        uint32_t index = subscript.asUInt32();
    549549        ASSERT(isIndex(index));
    550         if (baseObject->canSetIndexQuicklyForPutDirect(index)) {
    551             baseObject->setIndexQuickly(callFrame->vm(), index, value);
    552             return;
    553         }
    554 
    555         // FIXME: This will make us think that in-bounds typed array accesses are actually
    556         // out-of-bounds.
    557         // https://bugs.webkit.org/show_bug.cgi?id=149886
    558         byValInfo->arrayProfile->setOutOfBounds();
     550
     551        switch (baseObject->indexingType()) {
     552        case ALL_INT32_INDEXING_TYPES:
     553        case ALL_DOUBLE_INDEXING_TYPES:
     554        case ALL_CONTIGUOUS_INDEXING_TYPES:
     555        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
     556            if (index < baseObject->butterfly()->vectorLength())
     557                break;
     558            FALLTHROUGH;
     559        default:
     560            byValInfo->arrayProfile->setOutOfBounds();
     561            break;
     562        }
     563
    559564        baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
    560565        return;
    … …  
    696701            // Attempt to optimize.
    697702            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
    698             if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
     703            if (jitArrayModePermitsPutDirect(arrayMode) && arrayMode != byValInfo->arrayMode) {
    699704                CodeBlock* codeBlock = exec->codeBlock();
    700705                ConcurrentJSLocker locker(codeBlock->m_lock);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r217367 r219817  
    184184   
    185185#if USE(JSVALUE64)
     186    GPRReg tagMaskRegister = GPRInfo::tagMaskRegister;
     187    if (callLinkInfo.isTailCall()) {
     188        // Tail calls could have clobbered the GPRInfo::tagMaskRegister because they
     189        // restore callee saved registers before getthing here. So, let's materialize
     190        // the TagMask in a temp register and use the temp instead.
     191        tagMaskRegister = GPRInfo::regT4;
     192        jit.move(CCallHelpers::TrustedImm64(TagMask), tagMaskRegister);
     193    }
    186194    slowCase.append(
    187         jit.branchTest64(
    188             CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::tagMaskRegister));
     195        jit.branchTest64(CCallHelpers::NonZero, GPRInfo::regT0, tagMaskRegister));
    189196#else
    190197    slowCase.append(

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r217367 r219817  
    15741574
    15751575
     1576_llint_op_nop:
     1577    dispatch(1)
     1578
     1579
    15761580_llint_op_switch_string:
    15771581    traceExecution()

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/parser/Lexer.cpp

    r217367 r219817  
    565565   
    566566    m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
    567     m_buffer16.reserveInitialCapacity((m_codeEnd - m_code) / 2);
     567    m_buffer16.reserveInitialCapacity(initialReadBufferCapacity);
    568568    m_bufferForRawTemplateString16.reserveInitialCapacity(initialReadBufferCapacity);
    569569   

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

    r217367 r219817  
    10301030
    10311031    if (!result) {
    1032         if (speciesResult.first == SpeciesConstructResult::CreatedObject) {
     1032        if (speciesResult.first == SpeciesConstructResult::CreatedObject)
    10331033            result = speciesResult.second;
    1034            
    1035             for (unsigned k = 0; k < actualDeleteCount; ++k) {
    1036                 JSValue v = getProperty(exec, thisObj, k + actualStart);
    1037                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
    1038                 if (UNLIKELY(!v))
    1039                     continue;
    1040                 result->putByIndexInline(exec, k, v, true);
    1041                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
    1042             }
    1043         } else {
     1034        else {
    10441035            result = JSArray::tryCreate(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), actualDeleteCount);
    10451036            if (UNLIKELY(!result)) {
    … …  
    10471038                return encodedJSValue();
    10481039            }
    1049 
    1050             for (unsigned k = 0; k < actualDeleteCount; ++k) {
    1051                 JSValue v = getProperty(exec, thisObj, k + actualStart);
    1052                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
    1053                 if (UNLIKELY(!v))
    1054                     continue;
    1055                 result->putDirectIndex(exec, k, v);
    1056                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
    1057             }
     1040        }
     1041        for (unsigned k = 0; k < actualDeleteCount; ++k) {
     1042            JSValue v = getProperty(exec, thisObj, k + actualStart);
     1043            RETURN_IF_EXCEPTION(scope, encodedJSValue());
     1044            if (UNLIKELY(!v))
     1045                continue;
     1046            result->putDirectIndex(exec, k, v, 0, PutDirectIndexShouldThrow);
     1047            RETURN_IF_EXCEPTION(scope, encodedJSValue());
    10581048        }
    10591049    }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/ClonedArguments.cpp

    r217367 r219817  
    154154Structure* ClonedArguments::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)
    155155{
    156     Structure* structure = Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), indexingType);
     156    Structure* structure = Structure::create(vm, globalObject, prototype, TypeInfo(ClonedArgumentsType, StructureFlags), info(), indexingType);
    157157    PropertyOffset offset;
    158158    structure = structure->addPropertyTransition(vm, structure, vm.propertyNames->length, DontEnum, offset);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/ConsoleClient.cpp

    r217367 r219817  
    166166        String argAsString = arguments->argumentAt(i).toString(arguments->globalState());
    167167        builder.append(' ');
    168         builder.append(argAsString.utf8().data());
     168        builder.append(argAsString);
    169169    }
    170170

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSArray.cpp

    r217367 r219817  
    482482
    483483    IndexingType type = indexingType();
    484     IndexingType copyType = mergeIndexingTypeForCopying(otherArray->indexingType());
     484    IndexingType otherType = otherArray->indexingType();
     485    IndexingType copyType = mergeIndexingTypeForCopying(otherType);
    485486    if (type == ArrayWithUndecided && copyType != NonArray) {
    486487        if (copyType == ArrayWithInt32)
    … …  
    516517    ASSERT(copyType == indexingType());
    517518
    518     if (type == ArrayWithDouble)
     519    if (UNLIKELY(otherType == ArrayWithUndecided)) {
     520        auto* butterfly = this->butterfly();
     521        if (type == ArrayWithDouble) {
     522            for (unsigned i = startIndex; i < newLength; ++i)
     523                butterfly->contiguousDouble()[i] = PNaN;
     524        } else {
     525            for (unsigned i = startIndex; i < newLength; ++i)
     526                butterfly->contiguousInt32()[i].setWithoutWriteBarrier(JSValue());
     527        }
     528    } else if (type == ArrayWithDouble)
    519529        memcpy(butterfly()->contiguousDouble().data() + startIndex, otherArray->butterfly()->contiguousDouble().data(), sizeof(JSValue) * otherLength);
    520530    else

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSCJSValue.cpp

    r217367 r219817  
    161161    if (propertyName != vm.propertyNames->underscoreProto) {
    162162        for (; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
    163             prototype = obj->getPrototypeDirect();
     163            prototype = obj->getPrototype(vm, exec);
     164            RETURN_IF_EXCEPTION(scope, false);
     165
    164166            if (prototype.isNull())
    165167                return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

    r217367 r219817  
    395395    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
    396396
    397     if (parseIndex(propertyName)) {
     397    if (std::optional<uint32_t> index = parseIndex(propertyName)) {
     398        auto throwTypeErrorIfNeeded = [&] (const char* errorMessage) -> bool {
     399            if (shouldThrow)
     400                throwTypeError(exec, scope, makeString(errorMessage, String::number(*index)));
     401            return false;
     402        };
     403
    398404        if (descriptor.isAccessorDescriptor())
    399             return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to store accessor indexed property on a typed array."));
     405            return throwTypeErrorIfNeeded("Attempting to store accessor property on a typed array at index: ");
    400406
    401407        if (descriptor.configurable())
    402             return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to configure non-configurable property."));
     408            return throwTypeErrorIfNeeded("Attempting to configure non-configurable property on a typed array at index: ");
    403409
    404410        if (!descriptor.enumerable() || !descriptor.writable())
    405             return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to store non-enumerable or non-writable indexed property on a typed array."));
     411            return throwTypeErrorIfNeeded("Attempting to store non-enumerable or non-writable property on a typed array at index: ");
    406412
    407413        if (descriptor.value()) {

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSObject.cpp

    r217367 r219817  
    803803            return proxy->ProxyObject::put(proxy, exec, propertyName, value, slot);
    804804        }
    805         JSValue prototype = obj->getPrototypeDirect();
     805        JSValue prototype = obj->getPrototype(vm, exec);
     806        RETURN_IF_EXCEPTION(scope, false);
    806807        if (prototype.isNull())
    807808            break;
    … …  
    809810    }
    810811
    811     ASSERT(!structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this);
    812812    if (!putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot))
    813813        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
    … …  
    23452345}
    23462346
     2347ALWAYS_INLINE static bool canDoFastPutDirectIndex(JSObject* object)
     2348{
     2349    return isJSArray(object)
     2350        || isJSFinalObject(object)
     2351        || object->type() == DirectArgumentsType
     2352        || object->type() == ScopedArgumentsType
     2353        || object->type() == ClonedArgumentsType;
     2354}
     2355
    23472356// Defined in ES5.1 8.12.9
    23482357bool JSObject::defineOwnIndexedProperty(ExecState* exec, unsigned index, const PropertyDescriptor& descriptor, bool throwException)
    … …  
    23582367        // however if the property currently exists missing attributes will override from their current 'true'
    23592368        // state (i.e. defineOwnProperty could be used to set a value without needing to entering 'SparseMode').
    2360         if (!descriptor.attributes() && descriptor.value()) {
     2369        if (!descriptor.attributes() && descriptor.value() && canDoFastPutDirectIndex(this)) {
    23612370            ASSERT(!descriptor.isAccessorDescriptor());
    23622371            return putDirectIndex(exec, index, descriptor.value(), 0, throwException ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
    … …  
    27972806}
    27982807
    2799 bool JSObject::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, unsigned attributes, PutDirectIndexMode mode)
     2808bool JSObject::putDirectIndexSlowOrBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, unsigned attributes, PutDirectIndexMode mode)
    28002809{
    28012810    VM& vm = exec->vm();
     2811   
     2812    if (!canDoFastPutDirectIndex(this)) {
     2813        PropertyDescriptor descriptor;
     2814        descriptor.setDescriptor(value, attributes);
     2815        return methodTable(vm)->defineOwnProperty(this, exec, Identifier::from(exec, i), descriptor, mode == PutDirectIndexShouldThrow);
     2816    }
    28022817
    28032818    // i should be a valid array index that is outside of the current vector.
    … …  
    28432858        if (!value.isInt32()) {
    28442859            convertInt32ForValue(vm, value);
    2845             return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
     2860            return putDirectIndexSlowOrBeyondVectorLength(exec, i, value, attributes, mode);
    28462861        }
    28472862        putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, i, value);
    … …  
    28572872        if (!value.isNumber()) {
    28582873            convertDoubleToContiguous(vm);
    2859             return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
     2874            return putDirectIndexSlowOrBeyondVectorLength(exec, i, value, attributes, mode);
    28602875        }
    28612876        double valueAsDouble = value.asNumber();
    28622877        if (valueAsDouble != valueAsDouble) {
    28632878            convertDoubleToContiguous(vm);
    2864             return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
     2879            return putDirectIndexSlowOrBeyondVectorLength(exec, i, value, attributes, mode);
    28652880        }
    28662881        putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, i, value);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSObject.h

    r217367 r219817  
    196196    JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
    197197       
     198    // This performs the ECMAScript Set() operation.
    198199    ALWAYS_INLINE bool putByIndexInline(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
    199200    {
    … …  
    209210    //  - accessors are not called.
    210211    //  - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).
    211     // This method creates a property with attributes writable, enumerable and configurable all set to true.
     212    // This method creates a property with attributes writable, enumerable and configurable all set to true if attributes is zero,
     213    // otherwise, it creates a property with the provided attributes. Semantically, this is performing defineOwnProperty.
    212214    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)
    213215    {
    214         if (!attributes && canSetIndexQuicklyForPutDirect(propertyName)) {
     216        auto canSetIndexQuicklyForPutDirect = [&] () -> bool {
     217            switch (indexingType()) {
     218            case ALL_BLANK_INDEXING_TYPES:
     219            case ALL_UNDECIDED_INDEXING_TYPES:
     220                return false;
     221            case ALL_INT32_INDEXING_TYPES:
     222            case ALL_DOUBLE_INDEXING_TYPES:
     223            case ALL_CONTIGUOUS_INDEXING_TYPES:
     224            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
     225                return propertyName < m_butterfly.get()->vectorLength();
     226            default:
     227                RELEASE_ASSERT_NOT_REACHED();
     228                return false;
     229            }
     230        };
     231       
     232        if (!attributes && canSetIndexQuicklyForPutDirect()) {
    215233            setIndexQuickly(exec->vm(), propertyName, value);
    216234            return true;
    217235        }
    218         return putDirectIndexBeyondVectorLength(exec, propertyName, value, attributes, mode);
    219     }
     236        return putDirectIndexSlowOrBeyondVectorLength(exec, propertyName, value, attributes, mode);
     237    }
     238    // This is semantically equivalent to performing defineOwnProperty(propertyName, {configurable:true, writable:true, enumerable:true, value:value}).
    220239    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value)
    221240    {
    … …  
    223242    }
    224243
    225     // A non-throwing version of putDirect and putDirectIndex.
     244    // A generally non-throwing version of putDirect and putDirectIndex.
     245    // However, it's only guaranteed to not throw based on what the receiver is.
     246    // For example, if the receiver is a ProxyObject, this is not guaranteed, since
     247    // it may call into arbitrary JS code. It's the responsibility of the user of
     248    // this API to ensure that the receiver object is a well known type if they
     249    // want to ensure that this won't throw an exception.
    226250    JS_EXPORT_PRIVATE bool putDirectMayBeIndex(ExecState*, PropertyName, JSValue);
    227251       
    … …  
    346370            return i < butterfly->arrayStorage()->vectorLength()
    347371                && !!butterfly->arrayStorage()->m_vector[i];
    348         default:
    349             RELEASE_ASSERT_NOT_REACHED();
    350             return false;
    351         }
    352     }
    353        
    354     bool canSetIndexQuicklyForPutDirect(unsigned i)
    355     {
    356         switch (indexingType()) {
    357         case ALL_BLANK_INDEXING_TYPES:
    358         case ALL_UNDECIDED_INDEXING_TYPES:
    359             return false;
    360         case ALL_INT32_INDEXING_TYPES:
    361         case ALL_DOUBLE_INDEXING_TYPES:
    362         case ALL_CONTIGUOUS_INDEXING_TYPES:
    363         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
    364             return i < m_butterfly.get()->vectorLength();
    365372        default:
    366373            RELEASE_ASSERT_NOT_REACHED();
    … …  
    10141021    bool putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
    10151022    bool putDirectIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode, ArrayStorage*);
    1016     JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode);
     1023    JS_EXPORT_PRIVATE bool putDirectIndexSlowOrBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode);
    10171024       
    10181025    unsigned getNewVectorLength(unsigned indexBias, unsigned currentVectorLength, unsigned currentLength, unsigned desiredLength);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSObjectInlines.h

    r217367 r219817  
    7070    JSObject* obj = this;
    7171    while (true) {
    72         if (obj->structure(vm)->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj->type() == ProxyObjectType)
     72        MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
     73        if (obj->structure(vm)->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj->methodTable(vm)->getPrototype != defaultGetPrototype)
    7374            return false;
    7475

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/JavaScriptCore/runtime/JSType.h

    r217367 r219817  
    9898    WebAssemblyFunctionType,
    9999
    100     LastJSCObjectType = JSSetType,
     100    ClonedArgumentsType,
     101
     102    LastJSCObjectType = ClonedArgumentsType,
    101103    MaxJSType = 0b11111111,
    102104};

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/ThirdParty/ANGLE/ChangeLog

    r217367 r219817  
     12017-07-13  Adrian Perez de Castro  <aperez@igalia.com>
     2
     3        eglplatform.h does not support Wayland
     4        https://bugs.webkit.org/show_bug.cgi?id=163482
     5
     6        This makes it possible to build WebKitGTK+ when the target system has only Wayland support,
     7        but no X11 (and therefore the X11 headers are not present).
     8
     9        Reviewed by Alex Christensen.
     10
     11        * include/EGL/eglplatform.h: Add Wayland typedefs when WL_EGL_PLATFORM is defined (for example
     12        by including wayland-egl.h before including EGL/egl.h). Also, include the X11 headers only
     13        when ANGLE_USE_X11 is defined and, for consistency with Mesa's version of the header, when
     14        MESA_EGL_NO_X11_HEADERS is not defined.
     15
    1162016-12-20  Tim Horton  <timothy_horton@apple.com>
    217

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/ThirdParty/ANGLE/changes.diff

    r217367 r219817  
    559559                                           framebufferFormatInfo.format)) != conversionSet.end())
    560560     {
     561diff --git a/include/EGL/eglplatform.h b/include/EGL/eglplatform.h
     562index 9bb75910ac0..ccaf7e6f343 100644
     563--- a/include/EGL/eglplatform.h
     564+++ b/include/EGL/eglplatform.h
     565@@ -89,6 +89,12 @@ typedef int   EGLNativeDisplayType;
     566 typedef void *EGLNativeWindowType;
     567 typedef void *EGLNativePixmapType;
     568 
     569+#elif defined(WL_EGL_PLATFORM)
     570+
     571+typedef struct wl_display    *EGLNativeDisplayType;
     572+typedef struct wl_egl_pixmap *EGLNativePixmapType;
     573+typedef struct wl_egl_window *EGLNativeWindowType;
     574+
     575 #elif defined(__ANDROID__) || defined(ANDROID)
     576 
     577 #include <android/native_window.h>
     578@@ -107,6 +113,8 @@ typedef intptr_t EGLNativePixmapType;
     579 
     580 #elif defined(__unix__)
     581 
     582+#if defined(ANGLE_USE_X11) && !defined(MESA_EGL_NO_X11_HEADERS)
     583+
     584 /* X11 (tentative)  */
     585 #include <X11/Xlib.h>
     586 #include <X11/Xutil.h>
     587@@ -116,6 +124,14 @@ typedef Pixmap   EGLNativePixmapType;
     588 typedef Window   EGLNativeWindowType;
     589 
     590 #else
     591+
     592+typedef void             *EGLNativeDisplayType;
     593+typedef khronos_uintptr_t EGLNativePixmapType;
     594+typedef khronos_uintptr_t EGLNativeWindowType;
     595+
     596+#endif /* ANGLE_USE_X11 && !MESA_EGL_NO_X11_HEADERS */
     597+
     598+#else
     599 #error "Platform not recognized"
     600 #endif
     601 

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/ThirdParty/ANGLE/include/EGL/eglplatform.h

    r217367 r219817  
    9090typedef void *EGLNativePixmapType;
    9191
     92#elif defined(WL_EGL_PLATFORM)
     93
     94typedef struct wl_display    *EGLNativeDisplayType;
     95typedef struct wl_egl_pixmap *EGLNativePixmapType;
     96typedef struct wl_egl_window *EGLNativeWindowType;
     97
    9298#elif defined(__ANDROID__) || defined(ANDROID)
    9399
    … …  
    107113
    108114#elif defined(__unix__)
     115
     116#if defined(ANGLE_USE_X11) && !defined(MESA_EGL_NO_X11_HEADERS)
    109117
    110118/* X11 (tentative)  */
    … …  
    129137
    130138#else
     139
     140typedef void             *EGLNativeDisplayType;
     141typedef khronos_uintptr_t EGLNativePixmapType;
     142typedef khronos_uintptr_t EGLNativeWindowType;
     143
     144#endif /* ANGLE_USE_X11 && !MESA_EGL_NO_X11_HEADERS */
     145
     146#else
    131147#error "Platform not recognized"
    132148#endif

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WTF/ChangeLog

    r217367 r219817  
     12017-06-08  Xabier Rodriguez Calvar  <calvaris@igalia.com>
     2
     3        MediaTime class has rounding issues in different platforms
     4        https://bugs.webkit.org/show_bug.cgi?id=172640
     5
     6        Reviewed by Jer Noble.
     7
     8        The way a timescale is set when creating a MediaTime from a double
     9        can create rounding issues in different platforms because in some
     10        rounding is made and in others, it truncates. This way we ensure a
     11        common behavior.
     12
     13        Dumping MediaTimes is also confusing and by the output you don't
     14        know if it's containing a double or a fraction. Now, if it
     15        contains a double, it only prints the double because printing the
     16        fraction is misleading (it currently prints the double read as an
     17        integer) and if it contains a fraction it shows the fraction and
     18        its double representation separated by an = instead of a ,.
     19
     20        * wtf/MediaTime.cpp:
     21        (WTF::MediaTime::createWithDouble): When creating MediaTime from
     22        double, we round instead of leaving it to the cast operation.
     23        (WTF::MediaTime::dump):
     24
    1252017-04-21  Konstantin Tokarev  <annulen@yandex.ru>
    226

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WTF/wtf/MediaTime.cpp

    r217367 r219817  
    146146    while (doubleTime * timeScale > std::numeric_limits<int64_t>::max())
    147147        timeScale /= 2;
    148     return MediaTime(static_cast<int64_t>(doubleTime * timeScale), timeScale, Valid);
     148    return MediaTime(static_cast<int64_t>(std::round(doubleTime * timeScale)), timeScale, Valid);
    149149}
    150150
    … …  
    495495}
    496496
    497 void MediaTime::dump(PrintStream &out) const
    498 {
    499     out.print("{", m_timeValue, "/", m_timeScale, ", ", toDouble(), "}");
     497void MediaTime::dump(PrintStream& out) const
     498{
     499    out.print("{");
     500    if (!hasDoubleValue())
     501        out.print(m_timeValue, "/", m_timeScale, " = ");
     502    out.print(toDouble(), "}");
    500503}
    501504

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog

    r217367 r219817  
     12017-07-12  Carlos Alberto Lopez Perez  <clopez@igalia.com>
     2
     3        REGRESSION(r219332): [GTK] 9 new failures on fast/forms spinbutton related tests
     4        https://bugs.webkit.org/show_bug.cgi?id=174395
     5
     6        Reviewed by Carlos Garcia Campos.
     7
     8        Covered by existing tests.
     9
     10        Before r219332 the height of the spin button widget was
     11        calculated as the maximum value between the individual button
     12        ( the [+] or [-] ) width (33 pixels) and height (16 pixels).
     13        And r219332 caused the height of the widget to be calculated as
     14        the height of the button (16 pixels), which was incorrect as
     15        each button should be first expanded vertically to fit the
     16        preferred size of the widget.
     17
     18        Fix this by making the calculations about the spin button widget
     19        on a new function spinButtonSize() that takes this into account,
     20        and use this values both for adjusting the style of the input
     21        field and the spin button widget itself.
     22
     23        * rendering/RenderThemeGtk.cpp:
     24        (WebCore::spinButtonSize):
     25        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
     26        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
     27
     282017-07-11  Carlos Alberto Lopez Perez  <clopez@igalia.com>
     29
     30        [GTK] Spin buttons on input type number appear over the value itself for small widths
     31        https://bugs.webkit.org/show_bug.cgi?id=173572
     32
     33        Reviewed by Carlos Garcia Campos.
     34
     35        When drawing the spin buttons, override the width of the input
     36        element to increment it with the width of the spin button.
     37        This ensures that we don't end up covering the input values with
     38        the spin buttons.
     39
     40        Do this also for user controlled styles, because most web authors
     41        won't test how their site renders on WebKitGTK+, and they will
     42        assume spin buttons in the order of 13 pixels wide (that is what
     43        most browsers use), but the GTK+ spin button is much wider (66 pixels).
     44
     45        Test: platform/gtk/fast/forms/number/number-size-spinbutton-nocover.html
     46
     47        * rendering/RenderTheme.cpp:
     48        (WebCore::RenderTheme::adjustStyle):
     49        * rendering/RenderThemeGtk.cpp:
     50        (WebCore::RenderThemeGtk::adjustTextFieldStyle): Call the theme's adjustTextFieldStyle() also for user controlled styles.
     51        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
     52
     532017-05-12  Jiewen Tan  <jiewen_tan@apple.com>
     54
     55        Elements should be inserted into a template element as its content's last child
     56        https://bugs.webkit.org/show_bug.cgi?id=171373
     57        <rdar://problem/31862949>
     58
     59        Reviewed by Ryosuke Niwa.
     60
     61        Before this change, our HTML parser obeys the following premises:
     62        1) A fostering child whose parent is a table should be inserted before its parent and under its grandparent.
     63        2) When inserting into a template element, an element should be inserted into its content.
     64
     65        Let's walk through the example:
     66        a) Before eventhandler takes place
     67        template
     68        table
     69            svg <- parser
     70        b) After eventhandler takes place
     71        template
     72            table
     73                svg <- parser
     74        c) after parsing svg
     75        template
     76            content
     77                svg
     78                (table)
     79            table
     80
     81        Finally, in the example, the svg element will be inserted into the content of the template element while
     82        having its next sibling point to the table element. However, the table element is actually under the
     83        template element not its content.
     84
     85        This messy tree is constructed because the second premise is incompleted. It should be: When inserting into
     86        a template element, an element should be inserted into its content as its last child.
     87        Quoted from Step 3 of https://html.spec.whatwg.org/multipage/syntax.html#appropriate-place-for-inserting-a-node
     88        A correct tree will then looks like:
     89        template
     90            content
     91                svg
     92            table
     93
     94        Tests: fast/dom/HTMLTemplateElement/insert-fostering-child-crash.html
     95               fast/dom/HTMLTemplateElement/insert-fostering-child.html
     96
     97        * html/parser/HTMLConstructionSite.cpp:
     98        (WebCore::insert):
     99        By nullifying task.nextChild, it will force the parser to append the element as task.parent's last child.
     100
     1012017-05-15  Jiewen Tan  <jiewen_tan@apple.com>
     102
     103        Replace CryptoOperationData with BufferSource for WebKitSubtleCrypto
     104        https://bugs.webkit.org/show_bug.cgi?id=172146
     105        <rdar://problem/32122256>
     106
     107        Reviewed by Brent Fulgham.
     108
     109        In this patch, we replaces CryptoOperationData with BufferSource for WebKitSubtleCrypto in
     110        the custom binding codes.
     111
     112        Test: crypto/webkitSubtle/import-export-raw-key-leak.html
     113
     114        * bindings/js/JSWebKitSubtleCryptoCustom.cpp:
     115        (WebCore::JSWebKitSubtleCrypto::encrypt):
     116        (WebCore::JSWebKitSubtleCrypto::decrypt):
     117        (WebCore::JSWebKitSubtleCrypto::sign):
     118        (WebCore::JSWebKitSubtleCrypto::verify):
     119        (WebCore::JSWebKitSubtleCrypto::digest):
     120        (WebCore::JSWebKitSubtleCrypto::importKey):
     121        (WebCore::JSWebKitSubtleCrypto::unwrapKey):
     122        * crypto/WebKitSubtleCrypto.idl:
     123
     1242017-05-13  Zalan Bujtas  <zalan@apple.com>
     125
     126        AccessibilityRenderObject::textUnderElement needs to assert on unclean tree.
     127        https://bugs.webkit.org/show_bug.cgi?id=172065
     128
     129        Reviewed by Simon Fraser.
     130
     131        r192103 changed the assert logic incorrectly. If the tree is dirty, regardless of the renderer's type,
     132        TextIterator will end up forcing style update/layout on the render tree.
     133        The original assert would have hit with bug 171546 prior to r216726.
     134
     135        * accessibility/AccessibilityRenderObject.cpp:
     136        (WebCore::AccessibilityRenderObject::textUnderElement):
     137
     1382017-05-11  Zalan Bujtas  <zalan@apple.com>
     139
     140        AX: Defer text changes until after the tree is clean if needed.
     141        https://bugs.webkit.org/show_bug.cgi?id=171546
     142        <rdar://problem/31934942>
     143
     144        Reviewed by Simon Fraser.
     145
     146        While updating an accessibility object state, we might
     147        trigger unintentional style updates. This style update could
     148        end up destroying renderes that are still referenced by functions
     149        on the callstack.
     150        To avoid that, defer such changes and let AXObjectCache operate on a clean tree.         
     151
     152        Test: accessibility/crash-when-render-tree-is-not-clean.html
     153
     154        * accessibility/AXObjectCache.cpp:
     155        (WebCore::AXObjectCache::remove):
     156        (WebCore::AXObjectCache::handleAttributeChanged):
     157        (WebCore::AXObjectCache::labelChanged):
     158        (WebCore::AXObjectCache::performDeferredCacheUpdate):
     159        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
     160        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
     161        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
     162        (WebCore::AXObjectCache::deferTextChanged): Deleted.
     163        * accessibility/AXObjectCache.h: Decouple different type of changes.
     164        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
     165        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
     166        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
     167        (WebCore::AXObjectCache::deferTextChanged): Deleted.
     168        * rendering/RenderBlock.cpp:
     169        (WebCore::RenderBlock::deleteLines):
     170        * rendering/RenderBlockLineLayout.cpp:
     171        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):
     172        * rendering/RenderText.cpp:
     173        (WebCore::RenderText::setText):
     174
     1752017-05-02  Zalan Bujtas  <zalan@apple.com>
     176
     177        Defer AX cache update when text content changes until after layout is finished.
     178        https://bugs.webkit.org/show_bug.cgi?id=171429
     179        <rdar://problem/31885984>
     180
     181        Reviewed by Simon Fraser.
     182
     183        When the content of the RenderText changes (even as the result of a text-transform change)
     184        instead of updating the AX cache eagerly (and trigger layout on a half-backed render tree)
     185        we should just defer it until after the subsequent layout is done.
     186
     187        Test: accessibility/crash-while-adding-text-child-with-transform.html
     188
     189        * accessibility/AXObjectCache.cpp:
     190        (WebCore::AXObjectCache::remove):
     191        (WebCore::AXObjectCache::performDeferredCacheUpdate):
     192        (WebCore::AXObjectCache::recomputeDeferredIsIgnored):
     193        (WebCore::AXObjectCache::deferTextChanged):
     194        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
     195        * accessibility/AXObjectCache.h:
     196        (WebCore::AXObjectCache::deferTextChanged):
     197        (WebCore::AXObjectCache::performDeferredCacheUpdate):
     198        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
     199        * page/FrameView.cpp:
     200        (WebCore::FrameView::performPostLayoutTasks):
     201        * rendering/RenderText.cpp:
     202        (WebCore::RenderText::setText):
     203
     2042017-06-19  Brady Eidson  <beidson@apple.com>
     205
     206        Various IndexedDB crashes as an after effect of previous test.
     207        <rdar://problem/31418761> and https://bugs.webkit.org/show_bug.cgi?id=170436
     208
     209        Reviewed by Chris Dumez.
     210
     211        No new test (No consistent test possible, in practice covered by all existing IDB tests)
     212
     213        This is timing related, where a UniqueIDBDatabase can be destroyed on the main thread while
     214        it still has one task left to try to execute on the IDBServer thread.
     215       
     216        The background thread tasks don't Ref<> the UniqueIDBDatabase, so even though task execution
     217        took a Ref<> protector, there was still a small window for a race.
     218       
     219        Should be closed up by making the background thread tasks themselves protect this.
     220       
     221        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
     222        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTask):
     223        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTaskReply):
     224        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask):
     225        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply):
     226        * Modules/indexeddb/server/UniqueIDBDatabase.h:
     227
     2282017-06-18  Carlos Garcia Campos  <cgarcia@igalia.com>
     229
     230        [GStreamer] MainThreadNotifier ASSERTION FAILED: m_boundThread == currentThread() in _WebKitWebSrcPrivate::~_WebKitWebSrcPrivate
     231        https://bugs.webkit.org/show_bug.cgi?id=152043
     232
     233        Reviewed by Xabier Rodriguez-Calvar.
     234
     235        Stop using a WeakPtr in MainThreadNotifier, because it's not thread safe, which causes a crash in debug builds when
     236        the notifier is destroyed in a different thread. Make MainThreadNotifier thread safe refcounted instead, and add
     237        an invalidate() method to mark it as invalid.
     238
     239        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
     240        (WebCore::InbandTextTrackPrivateGStreamer::handleSample):
     241        (WebCore::InbandTextTrackPrivateGStreamer::streamChanged):
     242        * platform/graphics/gstreamer/MainThreadNotifier.h:
     243        (WebCore::MainThreadNotifier::MainThreadNotifier): Deleted.
     244        (WebCore::MainThreadNotifier::notify): Deleted.
     245        (WebCore::MainThreadNotifier::cancelPendingNotifications): Deleted.
     246        (WebCore::MainThreadNotifier::addPendingNotification): Deleted.
     247        (WebCore::MainThreadNotifier::removePendingNotification): Deleted.
     248        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
     249        (WebCore::MediaPlayerPrivateGStreamer::videoChangedCallback):
     250        (WebCore::MediaPlayerPrivateGStreamer::videoSinkCapsChangedCallback):
     251        (WebCore::MediaPlayerPrivateGStreamer::audioChangedCallback):
     252        (WebCore::MediaPlayerPrivateGStreamer::textChangedCallback):
     253        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
     254        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
     255        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
     256        (WebCore::MediaPlayerPrivateGStreamerBase::volumeChangedCallback):
     257        (WebCore::MediaPlayerPrivateGStreamerBase::muteChangedCallback):
     258        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
     259        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
     260        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
     261        (WebCore::TrackPrivateBaseGStreamer::TrackPrivateBaseGStreamer):
     262        (WebCore::TrackPrivateBaseGStreamer::~TrackPrivateBaseGStreamer):
     263        (WebCore::TrackPrivateBaseGStreamer::disconnect):
     264        (WebCore::TrackPrivateBaseGStreamer::activeChangedCallback):
     265        (WebCore::TrackPrivateBaseGStreamer::tagsChanged):
     266        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h:
     267        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
     268        (webkit_web_src_init):
     269        (webKitWebSrcDispose):
     270        (webKitWebSrcStop):
     271        (webKitWebSrcStart):
     272        (webKitWebSrcNeedData):
     273        (webKitWebSrcEnoughData):
     274        (webKitWebSrcSeek):
     275
     2762017-06-17  Antti Koivisto  <antti@apple.com>
     277
     278        Crash due to infinite recursion via FrameSelection::updateAppearanceAfterLayout
     279        https://bugs.webkit.org/show_bug.cgi?id=173468
     280
     281        Reviewed by Ryosuke Niwa.
     282
     283        Test: editing/selection/updateAppearanceAfterLayout-recursion.html
     284
     285        Calling FrameSelection::updateAppearanceAfterLayout() from Document::resolveStyle is unsafe
     286        because it may cause another call to resolveStyle. We have some cases where the style
     287        is still unclean when updateAppearanceAfterLayout() is called. This can lead to infinite
     288        recursion.
     289
     290        The test case is not the common stack seen in CrashTracer (couldn't quit replicate it) but
     291        the updateAppearanceAfterLayout/resolveStyle recursion is the same.
     292
     293        * dom/Document.cpp:
     294        (WebCore::Document::resolveStyle):
     295
     296            Normally selection appearance update is done in post-layout but not all style resolutions schedule a layout.
     297            Invoke it asynchronously in that case instead of the previous synchronous call.
     298
     299        * editing/FrameSelection.cpp:
     300        (WebCore::FrameSelection::FrameSelection):
     301        (WebCore::FrameSelection::updateAppearanceAfterLayout):
     302        (WebCore::FrameSelection::scheduleAppearanceUpdateAfterStyleChange):
     303        (WebCore::FrameSelection::appearanceUpdateTimerFired):
     304        (WebCore::FrameSelection::updateAppearanceAfterLayoutOrStyleChange):
     305        * editing/FrameSelection.h:
     306
     3072017-06-17  Ryosuke Niwa  <rniwa@webkit.org>
     308
     309        REGRESSION(r209495): materiauxlaverdure.com fails to load
     310        https://bugs.webkit.org/show_bug.cgi?id=173301
     311        <rdar://problem/32624850>
     312
     313        Reviewed by Antti Koivisto.
     314
     315        The bug was caused by WebKit wrapping CSS string values with single quotation marks instead of
     316        double quotation marks as spec'ed in https://drafts.csswg.org/cssom/#serialize-a-string and
     317        implemented in Firefox and Chrome.
     318
     319        The website eval's the computed value of the `content` CSS property with the value `'{name: "flat"}'`
     320        after stripping single quotation marks from both ends. Prior to r209495, WebKit serialized this CSS value
     321        in single quotations without escaping double quotations. After r209495, double quotations are escaped
     322        with backslashes as `'{name: \"flat\"}'`. As a result, `eval` is invoked with `{name: \"flat\"}`
     323        after stripping single quotations from both ends, which resulted in an exception.
     324
     325        Chrome and Firefox don't encounter this exception despite of the fact they escape double quotations
     326        as well because serialize with double quotations as `"{name: \"flat\"}"`. Because there is no code
     327        to strip double quotations, eval is invoked with the same string, resulting in the entire value as
     328        being parsed as string, instead of an object with a single key "name" with the value of "flat" as
     329        was the case in WebKit prior to r209495. While this behavior was most certainly not the intent of
     330        the website author, Chrome and Firefox don't encounter an exception and the website continues to work.
     331
     332        This patch aligns WebKit's behavior to that of the CSS OM specification, Firefox, and Chrome by
     333        serializing CSS string values using double quotation marks instead of single quotation marks.
     334
     335        Note: inline change log comments are added below for every call site of serializeString for clarity.
     336
     337        Test: fast/css/getPropertyValue-serialization-with-double-quotes.html
     338
     339        * css/CSSBasicShapes.cpp:
     340        (WebCore::buildPathString): Use double quotation marks in path(~) of shapes.
     341        * css/CSSMarkup.cpp:
     342        (WebCore::serializeString):
     343        (WebCore::serializeURL): Use double quotation marks to serialize URLs.
     344        (WebCore::serializeAsStringOrCustomIdent): Use double quotation marks to serialize strings. We still avoid
     345        using wrapping the value with double quotations when the value can be an identifier. See r209495.
     346        (WebCore::serializeFontFamily): Ditto for font-family names such as "San Francisco".
     347        * css/CSSMarkup.h:
     348        * css/CSSNamespaceRule.cpp:
     349        (WebCore::CSSNamespaceRule::cssText): Use double quotation marks to serialize namespace URIs.
     350        * css/CSSPrimitiveValue.cpp:
     351        (WebCore::CSSPrimitiveValue::formatNumberForCustomCSSText): Use double quotation marks to serialize
     352        the separators; e.g. counter(sectionNumber, ".") to produce "1.".
     353        * css/CSSSelector.cpp:
     354        (WebCore::CSSSelector::selectorText): Use double quotation marks to serialize attribute values.
     355        * css/parser/CSSParserToken.cpp:
     356        (WebCore::CSSParserToken::serialize): Use double quotation marks to serialize strings in @support.
     357        * editing/EditingStyle.cpp:
     358        (WebCore::StyleChange::extractTextStyles): Updated to strip double quotation marks in font family names to
     359        maintain the compatibility with old versions of Microsoft Outlook.
     360        * html/HTMLElement.cpp:
     361        (WebCore::HTMLElement::mapLanguageAttributeToLocale): Use double quotations marks to serialize the value
     362        of the lang content attribute. It doesn't matter which one is used here because it's only a temporary value
     363        only fed into the CSS parser to set the equivalent CSS value from the content attribute.
     364
     3652017-06-14  Miguel Gomez  <magomez@igalia.com>
     366
     367        REGRESSION(r216901): ImageDecoders: rendering of large images is broken since r216901
     368        https://bugs.webkit.org/show_bug.cgi?id=172502
     369
     370        Reviewed by Carlos Garcia Campos.
     371
     372        When using GTK and WPE image decoders, the decoded frames are stored inside a Vector of
     373        ImageFrames inside the decoders. These ImageFrames have and ImageBackingStore with the
     374        pixels. When a NativeImagePtr is requested, a cairo surface is created from the data
     375        in those ImageBackingStores, but the data keeps being owned by the backing stores. Due
     376        to this, if the decoder that created the image gets destroyed, the backing stores for
     377        the decoded frames get destroyed as well, causing the cairo surfaces that were using
     378        that data to contain garbage (and potentially cause a crash).
     379
     380        To fix this, we change ImageBackingStore so the pixels are stored in a SharedBuffer. The
     381        buffer will be reffed everytime a cairo surface is created with it, and the cairo surfaces
     382        will unref the buffer when they are destroyed. This way, the pixel data won't be freed
     383        while there are cairo surfaces using it.
     384
     385        No new tests, no behaviour change.
     386
     387        * platform/graphics/ImageBackingStore.h:
     388        (WebCore::ImageBackingStore::setSize):
     389        (WebCore::ImageBackingStore::ImageBackingStore):
     390        * platform/image-decoders/cairo/ImageBackingStoreCairo.cpp:
     391        (WebCore::ImageBackingStore::image):
     392
     3932017-06-13  Jer Noble  <jer.noble@apple.com>
     394
     395        Protect lifetime of media element during HTMLMediaElement::notifyAboutPlaying()
     396        https://bugs.webkit.org/show_bug.cgi?id=173320
     397        <rdar://problem/32590276>
     398
     399        Reviewed by Brent Fulgham.
     400
     401        * html/HTMLMediaElement.cpp:
     402        (WebCore::HTMLMediaElement::notifyAboutPlaying):
     403
     4042017-06-09  Brady Eidson  <beidson@apple.com>
     405
     406        Crash when IndexedDB's getAll is used inside a Web Worker.
     407        https://bugs.webkit.org/show_bug.cgi?id=172434
     408
     409        Reviewed by Andy Estes.
     410
     411        Test: storage/indexeddb/modern/worker-getall.html
     412
     413        * Modules/indexeddb/IDBGetAllResult.cpp:
     414        (WebCore::IDBGetAllResult::IDBGetAllResult): Add an isolated-copying constructor.
     415        (WebCore::IDBGetAllResult::isolatedCopy):
     416        * Modules/indexeddb/IDBGetAllResult.h:
     417       
     418        * Modules/indexeddb/shared/IDBResultData.cpp:
     419        (WebCore::IDBResultData::isolatedCopy): Actually copy the IDBGetAllResult.
     420
     4212017-06-08  Ryosuke Niwa  <rniwa@webkit.org>
     422
     423        Crash inside InsertNodeBeforeCommand via InsertParagraphSeparatorCommand
     424        https://bugs.webkit.org/show_bug.cgi?id=173085
     425        <rdar://problem/32575059>
     426
     427        Reviewed by Wenson Hsieh.
     428
     429        The crash was caused by the condition to check for special cases failing when visiblePos is null.
     430        Exit early in these extreme cases.
     431
     432        Also replaced the use of deprecatedNode and deprecatedEditingOffset to modern idioms.
     433
     434        Test: editing/inserting/insert-horizontal-rule-in-empty-document-crash.html
     435
     436        * editing/InsertParagraphSeparatorCommand.cpp:
     437        (WebCore::InsertParagraphSeparatorCommand::doApply):
     438
     4392017-06-06  Zalan Bujtas  <zalan@apple.com>
     440
     441        Safari doesn't load newest The Order of the Stick comic.
     442        https://bugs.webkit.org/show_bug.cgi?id=172949
     443        <rdar://problem/32389730>
     444
     445        Reviewed by Antti Koivisto.
     446
     447        As part of the table layout, RenderTableSection::layoutRows calls the RenderTableCell's layout() directly
     448        (skipping the RenderTableRow parent). If during this call the RenderTableCell (or any of its descendant) marks the ancestor
     449        chain dirty, this dirty flag on the RenderTableRows will never be cleared and we'll end up early returning from RenderTableSection::paint.
     450        For certain type of float objects, we need to invalidate the line layout path during layout (and we mark the ancestors dirty).
     451        This patch takes a conservative approach and marks the ancestors dirty only when the renderer is not dirty yet, but
     452        as part of webkit.org/b/172947 we should revisit and validate whether the setNeedsLayout() is required at all.
     453
     454        Test: fast/table/floating-table-sibling-is-invisible.html
     455
     456        * rendering/RenderBlockFlow.cpp:
     457        (WebCore::RenderBlockFlow::invalidateLineLayoutPath):
     458
     4592017-06-05  Zalan Bujtas  <zalan@apple.com>
     460
     461        Destroy the associated renderer subtree when display: contents node is deleted.
     462        https://bugs.webkit.org/show_bug.cgi?id=172920
     463        <rdar://problem/32446045>
     464
     465        Reviewed by Antti Koivisto.
     466
     467        Since display: contents node does not create a renderer, we need to explicitly check
     468        and distinguish it from the display: none case.
     469
     470        Covered by existing tests.
     471
     472        * dom/ContainerNode.cpp:
     473        (WebCore::destroyRenderTreeIfNeeded):
     474        * dom/Node.cpp:
     475        (WebCore::Node::~Node): Promote ASSERT(!renderer()) to ASSERT_WITH_SECURITY_IMPLICATION.
     476        * dom/Text.cpp:
     477        (WebCore::Text::~Text): Redundant assert. Text is a Node.
     478
     4792017-06-05  Carlos Garcia Campos  <cgarcia@igalia.com>
     480
     481        [GStreamer] Deadlock in MediaPlayerPrivateGStreamer::changePipelineState, web process often locks up on seeking in a youtube video that has already fully buffered
     482        https://bugs.webkit.org/show_bug.cgi?id=170003
     483
     484        Reviewed by Michael Catanzaro.
     485
     486        When video sink is requested to render a frame, the GstBaseSink preroll mutex is taken. Then WebKit media player
     487        schedules a repaint in the main thread, taking the draw mutex and waiting on draw condition. It can happen that
     488        before the repaint is done in the main thread, a pause is requested in the main thread, causing a change state
     489        from PLAYING to PAUSE. When the change state reaches the video sink gst_base_sink_change_state() tries to get
     490        the preroll mutex. This causes a deadlock because the main thread is waiting to get the preroll mutex, but the
     491        other thread is waiting for the main thread to do the repaint. GStreamer handles this case by calling unlock()
     492        on the video sink before trying to get the preroll mutex, but the media player doesn't cancel the pending
     493        repaint when using coordinated graphics. This patch adds a new signal to WebKitVideoSink "repaint-cancelled" to
     494        notify the media player to cancel the pending prepaint.
     495
     496        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
     497        (WebCore::MediaPlayerPrivateGStreamerBase::cancelRepaint): Release the draw mutex and notify the condition.
     498        (WebCore::MediaPlayerPrivateGStreamerBase::repaintCancelledCallback): Call cancelRepaint().
     499        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSink): Connect to WebKitVideoSink::repaint-cancelled.
     500        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
     501        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
     502        (webkitVideoSinkRepaintCancelled): Emit WebKitVideoSink::repaint-cancelled.
     503        (webkitVideoSinkUnlock): Call webkitVideoSinkRepaintCancelled().
     504        (webkitVideoSinkStop): Ditto.
     505        (webkit_video_sink_class_init): Add WebKitVideoSink::repaint-cancelled signal.
     506
     5072017-06-01  Carlos Garcia Campos  <cgarcia@igalia.com>
     508
     509        [GTK] Cache RenderThemeGadget hierarchies for rendering themed elements with GTK+ 3.20+
     510        https://bugs.webkit.org/show_bug.cgi?id=162673
     511
     512        Reviewed by Michael Catanzaro.
     513
     514        Because of the way the new theming system works in GTK+ >= 3.20 we are currently creating a gadget hierarchy
     515        every time we need to render a styled element or get layout information about it. That's happening on every
     516        repaint, and it's specially problematic for overlay scrollbar indicators that fade in/out when shown/hidden. We
     517        need to cache the gadgets and simply apply the state before every paint or layout query. When using GtkWidgetPath,
     518        calling gtk_style_context_save() breaks the gadget hierarchy, and style classes need to be set when building the
     519        GtkWidgetPath. That means we can't cache RenderThemeGadgets, call save, apply style classes and state, and then
     520        call restore. We need to cache gadget hierarchies with fixed style classes. Fortunately, setting the state does
     521        work, so we don't need to also cache a different hierarchy for every possible state. For example, for the
     522        particular case of scrollbars we would cache VerticalScrollbarRight, VerticalScrollbarLeft, HorizontalScrollbar,
     523        VerticalScrollIndicatorRight, VerticalScrollIndicatorLeft and HorizontalScrollIndicator. In practice, we will
     524        only have 4 of those at the same time in the cache.
     525        This patch adds RenderThemeWidget to represent a hierarchy of gadgets with fixed style classes that can be
     526        cached and reused to render or query style of those "widgets". It also simplifies the RenderThemeGtk and
     527        ScrollbarThemeGtk code by removing a lot of duplicated code to build the gadget hierarchies.
     528
     529        * PlatformGTK.cmake:
     530        * platform/gtk/RenderThemeGadget.cpp:
     531        (WebCore::createStyleContext):
     532        (WebCore::appendElementToPath):
     533        (WebCore::RenderThemeGadget::state):
     534        (WebCore::RenderThemeGadget::setState):
     535        * platform/gtk/RenderThemeGadget.h:
     536        * platform/gtk/RenderThemeWidget.cpp: Added.
     537        (WebCore::widgetMap):
     538        (WebCore::RenderThemeWidget::getOrCreate):
     539        (WebCore::RenderThemeWidget::clearCache):
     540        (WebCore::RenderThemeWidget::~RenderThemeWidget):
     541        (WebCore::RenderThemeScrollbar::RenderThemeScrollbar):
     542        (WebCore::RenderThemeScrollbar::stepper):
     543        (WebCore::RenderThemeToggleButton::RenderThemeToggleButton):
     544        (WebCore::RenderThemeButton::RenderThemeButton):
     545        (WebCore::RenderThemeComboBox::RenderThemeComboBox):
     546        (WebCore::RenderThemeEntry::RenderThemeEntry):
     547        (WebCore::RenderThemeSearchEntry::RenderThemeSearchEntry):
     548        (WebCore::RenderThemeSpinButton::RenderThemeSpinButton):
     549        (WebCore::RenderThemeSlider::RenderThemeSlider):
     550        (WebCore::RenderThemeProgressBar::RenderThemeProgressBar):
     551        (WebCore::RenderThemeListView::RenderThemeListView):
     552        (WebCore::RenderThemeIcon::RenderThemeIcon):
     553        * platform/gtk/RenderThemeWidget.h: Added.
     554        (WebCore::RenderThemeEntry::entry):
     555        (WebCore::RenderThemeEntry::selection):
     556        * platform/gtk/ScrollbarThemeGtk.cpp:
     557        (WebCore::ScrollbarThemeGtk::themeChanged):
     558        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
     559        (WebCore::widgetTypeForScrollbar):
     560        (WebCore::contentsRectangle):
     561        (WebCore::ScrollbarThemeGtk::trackRect):
     562        (WebCore::ScrollbarThemeGtk::backButtonRect):
     563        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
     564        (WebCore::ScrollbarThemeGtk::paint):
     565        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
     566        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
     567        * rendering/RenderThemeGtk.cpp:
     568        (WebCore::createStyleContext):
     569        (WebCore::setToggleSize):
     570        (WebCore::paintToggle):
     571        (WebCore::RenderThemeGtk::paintButton):
     572        (WebCore::menuListColor):
     573        (WebCore::RenderThemeGtk::popupInternalPaddingBox):
     574        (WebCore::RenderThemeGtk::paintMenuList):
     575        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
     576        (WebCore::RenderThemeGtk::paintTextField):
     577        (WebCore::adjustSearchFieldIconStyle):
     578        (WebCore::paintSearchFieldIcon):
     579        (WebCore::RenderThemeGtk::paintSliderTrack):
     580        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
     581        (WebCore::RenderThemeGtk::paintSliderThumb):
     582        (WebCore::RenderThemeGtk::progressBarRectForBounds):
     583        (WebCore::RenderThemeGtk::paintProgressBar):
     584        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
     585        (WebCore::RenderThemeGtk::paintInnerSpinButton):
     586        (WebCore::styleColor):
     587        (WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor):
     588        (WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor):
     589        (WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor):
     590        (WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor):
     591        (WebCore::RenderThemeGtk::paintMediaButton):
     592
     5932017-06-01  Chris Dumez  <cdumez@apple.com>
     594
     595        Make WebCore::defaultPortForProtocol() thread-safe
     596        https://bugs.webkit.org/show_bug.cgi?id=172797
     597
     598        Reviewed by Brent Fulgham.
     599
     600        Make WebCore::defaultPortForProtocol() thread-safe since it is called from the SecurityOrigin
     601        constructor and SecurityOrigin objects are constructed from various threads.
     602
     603        This should not regress the non-testing code paths since we only pay locking costs if
     604        a default port override has been set by the tests.
     605
     606        * platform/URL.cpp:
     607        (WebCore::defaultPortForProtocolMapLock):
     608        (WebCore::defaultPortForProtocolMapForTesting):
     609        (WebCore::ensureDefaultPortForProtocolMapForTesting):
     610        (WebCore::registerDefaultPortForProtocolForTesting):
     611        (WebCore::clearDefaultPortForProtocolMapForTesting):
     612        (WebCore::defaultPortForProtocol):
     613
     6142017-05-30  Dan Bernstein  <mitz@apple.com>
     615
     616        Fixed the build after r217588.
     617
     618        * page/FrameView.h: Stopped exporting a function defined inline.
     619
     6202017-05-30  Zalan Bujtas  <zalan@apple.com>
     621
     622        ASSERTION FAILED: m_layoutPhase == InPostLayerPositionsUpdatedAfterLayout || m_layoutPhase == OutsideLayout
     623        https://bugs.webkit.org/show_bug.cgi?id=171501
     624        <rdar://problem/31977453>
     625
     626        Reviewed by Simon Fraser.
     627
     628        We should be able to paint as long as the tree is clean and we are in paintable state.
     629
     630        * page/FrameView.cpp:
     631        (WebCore::FrameView::paintContents):
     632
     6332017-05-30  Jeremy Jones  <jeremyj@apple.com>
     634
     635        m_resourceSelectionTaskQueue tasks should be cleared when player is destroyed to prevent invalid state.
     636        https://bugs.webkit.org/show_bug.cgi?id=172726
     637        rdar://problem/30867764
     638
     639        Reviewed by Eric Carlson.
     640
     641        I haven't found a reproducible way to make a test case for this race condition.
     642
     643        If m_player is cleared while there is an outstanding task in m_resourceSelectionTaskQueue,
     644        that task may assume m_player is not null and crash. It is better to cancel that task than
     645        to perform it part way with null checks.
     646
     647        * html/HTMLMediaElement.cpp:
     648        (WebCore::HTMLMediaElement::~HTMLMediaElement):
     649        (WebCore::HTMLMediaElement::clearMediaPlayer):
     650
     6512017-05-27  Zalan Bujtas  <zalan@apple.com>
     652
     653        enclosingIntRect returns a rect with -1 width/height when the input FloatRect overflows integer.
     654        https://bugs.webkit.org/show_bug.cgi?id=172676
     655
     656        Reviewed by Simon Fraser.
     657
     658        Clamp integer values soon after the enclosing rectangle is resolved.
     659
     660        * platform/graphics/FloatRect.cpp:
     661        (WebCore::enclosingIntRect):
     662
     6632017-05-26  Youenn Fablet  <youenn@apple.com>
     664
     665        Minor clean-up related to DocumentThreadableLoader redirections
     666        https://bugs.webkit.org/show_bug.cgi?id=172647
     667
     668        Reviewed by Chris Dumez.
     669
     670        No change of behavior.
     671
     672        Decrementing m_options redirect count directly instead of using an
     673        additional counter.
     674
     675        To compare whether two URLs are same-origin, use scheme+host+port check
     676        as per the spec.
     677        This is fine as only the initial origin may have specific rules and we
     678        are using the scheme+host+port checks when already being gone to
     679        another origin.
     680
     681        * loader/DocumentThreadableLoader.cpp:
     682        (WebCore::DocumentThreadableLoader::redirectReceived):
     683        * loader/DocumentThreadableLoader.h:
     684        * loader/SubresourceLoader.cpp:
     685        (WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl):
     686
     6872017-05-25  Chris Dumez  <cdumez@apple.com>
     688
     689        imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_owner_and_table_2.html is crashing
     690        https://bugs.webkit.org/show_bug.cgi?id=172628
     691        <rdar://problem/32418707>
     692
     693        Reviewed by Sam Weinig.
     694
     695        In the event where a form is removed synchronously by a script during parsing,
     696        FormAssociatedElement::m_formSetByParser may end up referring to a form that
     697        is no longer in the document. As a result, we should make sure m_formSetByParser
     698        is still connected in FormAssociatedElement::insertedInto() before we call
     699        FormAssociatedElement::setForm(m_formSetByParser).
     700
     701        Test: fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html
     702
     703        * html/FormAssociatedElement.cpp:
     704        (WebCore::FormAssociatedElement::insertedInto):
     705
     7062017-05-25  Zalan Bujtas  <zalan@apple.com>
     707
     708        Frame's composited content is visible when the frame has visibility: hidden.
     709        https://bugs.webkit.org/show_bug.cgi?id=125565
     710        <rdar://problem/32196849>
     711
     712        Reviewed by Simon Fraser.
     713
     714        Do not construct composited layers for hidden RenderWidgets (frameset, iframe, object).
     715        Note that we still construct layers for the associated renderers as usual.
     716
     717        Tests: compositing/visibility/frameset-visibility-hidden.html
     718               compositing/visibility/iframe-visibility-hidden.html
     719               compositing/visibility/object-visibility-hidden.html
     720
     721        * rendering/RenderLayerCompositor.cpp:
     722        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin):
     723        (WebCore::RenderLayerCompositor::requiresCompositingForFrame):
     724
     7252017-05-25  Chris Dumez  <cdumez@apple.com>
     726
     727        DocumentThreadableLoader::redirectReceived() should not rely on the resource's loader
     728        https://bugs.webkit.org/show_bug.cgi?id=172578
     729        <rdar://problem/30754582>
     730
     731        Reviewed by Youenn Fablet.
     732
     733        DocumentThreadableLoader::redirectReceived() should not rely on the resource's loader. The rest of the methods do not.
     734        It is unsafe for it to rely on the resource's loader because it gets cleared when the load completes. A CachedRawresource
     735        may be reused from the memory cache once its load has completed.
     736
     737        This would cause crashes in CachedRawResource::didAddClient() when replaying the redirects because it would call
     738        DocumentThreadableLoader::redirectReceived() and potentially not have a loader anymore. To hit this exact code path,
     739        you would need to make repeated XHR to a cacheable simple cross-origin resource that has cacheable redirect.
     740
     741        Test: http/tests/xmlhttprequest/cacheable-cross-origin-redirect-crash.html
     742
     743        * loader/DocumentThreadableLoader.cpp:
     744        (WebCore::DocumentThreadableLoader::redirectReceived):
     745        * loader/DocumentThreadableLoader.h:
     746
     7472017-05-25  Zalan Bujtas  <zalan@apple.com>
     748
     749        ASSERTION FAILED: !needsStyleRecalc() || !document().childNeedsStyleRecalc()
     750        https://bugs.webkit.org/show_bug.cgi?id=172576
     751        <rdar://problem/32181979>
     752
     753        Reviewed by Brent Fulgham.
     754
     755        Ensure that we clean the subframe's document before start searching for a focusable element.
     756
     757        Covered by existing test.
     758
     759        * page/FocusController.cpp:
     760        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
     761
     7622017-05-24  Jiewen Tan  <jiewen_tan@apple.com>
     763
     764        Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
     765        https://bugs.webkit.org/show_bug.cgi?id=172555
     766        <rdar://problem/32004724>
     767
     768        Reviewed by Ryosuke Niwa.
     769
     770        setSelectionWithoutUpdatingAppearance could dispatch a synchronous focusin event,
     771        which could invoke an event handler that deteles the frame. Therefore, add a
     772        protector before the call.
     773
     774        Test: editing/selection/select-iframe-focusin-document-crash.html
     775
     776        * editing/FrameSelection.cpp:
     777        (WebCore::FrameSelection::setSelection):
     778
     7792017-05-23  Zalan Bujtas  <zalan@apple.com>
     780
     781        ASSERTION FAILED: !renderer().view().needsLayout() while running media/video-main-content-autoplay.html
     782        https://bugs.webkit.org/show_bug.cgi?id=172476
     783
     784        Reviewed by Simon Fraser.
     785
     786        This patch decouples the layout call logic from the post layout task timer setup.
     787        Just because we are switching over to asynchronous performPostLayoutTasks() it should not stop us from
     788        running layout on a dirty tree (we could encounter a forced layout (which sets m_postLayoutTasksTimer active)
     789        and a subsequent tree mutation during performPostLayoutTasks()).
     790
     791        There are a few different ways to end up here:
     792        root layout is done -> call performPostLayoutTasks() synchronously ->
     793        1. tree stays clean -> no action needed.
     794        2. tree gets dirty -> setup performPostLayoutTasks timer -> run nested layout -> since m_postLayoutTasksTimer is active()
     795        we don't try to run performPostLayoutTasks() while in the nested layout and we return with a clean tree.         
     796
     797        * page/FrameView.cpp:
     798        (WebCore::FrameView::layout):
     799
     8002017-03-24  Brent Fulgham  <bfulgham@apple.com>
     801
     802        Handle recursive calls to ProcessingInstruction::checkStyleSheet
     803        https://bugs.webkit.org/show_bug.cgi?id=169982
     804        <rdar://problem/31083051>
     805
     806        Reviewed by Antti Koivisto.
     807
     808       See if we triggered a recursive load of the stylesheet during the 'beforeload'
     809       event handler. If so, reset to a valid state before completing the load.
     810
     811       We should also check after 'beforeload' that we were not disconnected from (or
     812       moved to a new) document.
     813
     814       I also looked for other cases of this pattern and fixed them, too.
     815
     816       Tests: fast/dom/beforeload/image-removed-during-before-load.html
     817               fast/dom/beforeload/recursive-css-pi-before-load.html
     818               fast/dom/beforeload/recursive-link-before-load.html
     819               fast/dom/beforeload/recursive-xsl-pi-before-load.html
     820
     821        * dom/ProcessingInstruction.cpp:
     822        (WebCore::ProcessingInstruction::clearExistingCachedSheet): Added.
     823        (WebCore::ProcessingInstruction::checkStyleSheet): Prevent recursive calls into
     824        this function during 'beforeload' handling. Also, safely handle the case where
     825        the element was disconnected in the 'beforeload' handler (similar to what
     826        we do in HTMLLinkElement).
     827        (WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
     828        current document to match what we do in setXSLStyleSheet.
     829        * dom/ProcessingInstruction.h:
     830        * html/HTMLLinkElement.cpp:
     831        (WebCore::HTMLLinkElement::process): Prevent recursive calls into
     832        this function during 'beforeload' handling.
     833        * html/HTMLLinkElement.h:
     834        * loader/ImageLoader.cpp:
     835        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): safely handle the case where
     836        the element was disconnected in the 'beforeload' handler (similar to what
     837        we do in HTMLLinkElement).
     838        * style/StyleScope.cpp:
     839        (WebCore::Style::Scope::hasPendingSheet): Added.
     840        * style/StyleScope.h:
     841
    18422017-04-09  Fujii Hironori  <Hironori.Fujii@sony.com>
    2843

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/IDBGetAllResult.cpp

    r217367 r219817  
    4343}
    4444
     45IDBGetAllResult::IDBGetAllResult(const IDBGetAllResult& that, IsolatedCopyTag)
     46{
     47    isolatedCopy(that, *this);
     48}
     49
    4550IDBGetAllResult IDBGetAllResult::isolatedCopy() const
    4651{
    47     IDBGetAllResult result;
    48     result.m_type = m_type;
     52    return { *this, IsolatedCopy };
     53}
    4954
    50     if (WTF::holds_alternative<std::nullptr_t>(m_results))
    51         return result;
     55void IDBGetAllResult::isolatedCopy(const IDBGetAllResult& source, IDBGetAllResult& destination)
     56{
     57    destination.m_type = source.m_type;
    5258
    53     switch (m_type) {
     59    if (WTF::holds_alternative<std::nullptr_t>(source.m_results))
     60        return;
     61
     62    switch (source.m_type) {
    5463    case IndexedDB::GetAllType::Keys:
    55         isolatedCopyOfVariant<IDBKeyData>(m_results, result.m_results);
     64        isolatedCopyOfVariant<IDBKeyData>(source.m_results, destination.m_results);
    5665        break;
    5766    case IndexedDB::GetAllType::Values:
    58         isolatedCopyOfVariant<IDBValue>(m_results, result.m_results);
     67        isolatedCopyOfVariant<IDBValue>(source.m_results, destination.m_results);
    5968        break;
    6069    }
    61 
    62     return result;
    6370}
    6471

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/IDBGetAllResult.h

    r217367 r219817  
    5555    }
    5656
     57    enum IsolatedCopyTag { IsolatedCopy };
     58    IDBGetAllResult(const IDBGetAllResult&, IsolatedCopyTag);
    5759    IDBGetAllResult isolatedCopy() const;
    5860
    … …  
    7072
    7173private:
     74    static void isolatedCopy(const IDBGetAllResult& source, IDBGetAllResult& destination);
     75
    7276    IndexedDB::GetAllType m_type { IndexedDB::GetAllType::Keys };
    7377    WTF::Variant<Vector<IDBKeyData>, Vector<IDBValue>, std::nullptr_t> m_results { nullptr };

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp

    r217367 r219817  
    17071707void UniqueIDBDatabase::postDatabaseTask(CrossThreadTask&& task)
    17081708{
    1709     m_databaseQueue.append(WTFMove(task));
     1709    m_databaseQueue.append([protectedThis = makeRef(*this), task = WTFMove(task)]() mutable {
     1710        task.performTask();
     1711    });
    17101712    ++m_queuedTaskCount;
    17111713
    … …  
    17161718{
    17171719    ASSERT(!isMainThread());
    1718     m_databaseReplyQueue.append(WTFMove(task));
     1720
     1721    m_databaseReplyQueue.append([protectedThis = makeRef(*this), task = WTFMove(task)]() mutable {
     1722        task.performTask();
     1723    });
    17191724    ++m_queuedTaskCount;
    17201725
    … …  
    17301735    ASSERT(task);
    17311736
    1732     // Performing the task might end up removing the last reference to this.
    1733     Ref<UniqueIDBDatabase> protectedThis(*this);
    1734 
    1735     task->performTask();
     1737    (*task)();
    17361738    --m_queuedTaskCount;
    17371739
    1738     // Release the ref in the main thread to ensure it's deleted there as expected in case of being the last reference.
    1739     callOnMainThread([protectedThis = WTFMove(protectedThis)] {
     1740    // Release the task on the main thread in case it holds the last reference to this,
     1741    // as UniqueIDBDatabase objects must be deleted on the main thread.
     1742    callOnMainThread([task = WTFMove(task)] {
    17401743    });
    17411744}
    … …  
    17491752    ASSERT(task);
    17501753
    1751     // Performing the task might end up removing the last reference to this.
    1752     Ref<UniqueIDBDatabase> protectedThis(*this);
    1753 
    1754     task->performTask();
     1754    (*task)();
    17551755    --m_queuedTaskCount;
    17561756

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h

    r217367 r219817  
    266266    bool m_deleteBackingStoreInProgress { false };
    267267
    268     CrossThreadQueue<CrossThreadTask> m_databaseQueue;
    269     CrossThreadQueue<CrossThreadTask> m_databaseReplyQueue;
     268    CrossThreadQueue<Function<void ()>> m_databaseQueue;
     269    CrossThreadQueue<Function<void ()>> m_databaseReplyQueue;
    270270    std::atomic<uint64_t> m_queuedTaskCount { 0 };
    271271

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/Modules/indexeddb/shared/IDBResultData.cpp

    r217367 r219817  
    9595    if (source.m_getResult)
    9696        destination.m_getResult = std::make_unique<IDBGetResult>(*source.m_getResult, IDBGetResult::IsolatedCopy);
     97    if (source.m_getAllResult)
     98        destination.m_getAllResult = std::make_unique<IDBGetAllResult>(*source.m_getAllResult, IDBGetAllResult::IsolatedCopy);
    9799}
    98100

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/PlatformGTK.cmake

    r217367 r219817  
    208208    platform/gtk/PlatformWheelEventGtk.cpp
    209209    platform/gtk/RenderThemeGadget.cpp
     210    platform/gtk/RenderThemeWidget.cpp
    210211    platform/gtk/ScrollbarThemeGtk.cpp
    211212    platform/gtk/SoundGtk.cpp

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/accessibility/AXObjectCache.cpp

    r217367 r219817  
    712712    remove(axID);
    713713    m_renderObjectMapping.remove(renderer);
    714     if (is<RenderBlock>(*renderer))
    715         m_deferredIsIgnoredChangeList.remove(downcast<RenderBlock>(renderer));
    716714}
    717715
    … …  
    721719        return;
    722720
     721    if (is<Element>(*node))
     722        m_deferredRecomputeIsIgnoredList.remove(downcast<Element>(node));
     723    m_deferredTextChangedList.remove(node);
    723724    removeNodeForUse(node);
    724725
    … …  
    14311432        handleAriaRoleChanged(element);
    14321433    else if (attrName == altAttr || attrName == titleAttr)
    1433         textChanged(element);
     1434        deferTextChangedIfNeeded(element);
    14341435    else if (attrName == forAttr && is<HTMLLabelElement>(*element))
    14351436        labelChanged(element);
    … …  
    14451446        postNotification(element, AXObjectCache::AXValueChanged);
    14461447    else if (attrName == aria_labelAttr || attrName == aria_labeledbyAttr || attrName == aria_labelledbyAttr)
    1447         textChanged(element);
     1448        deferTextChangedIfNeeded(element);
    14481449    else if (attrName == aria_checkedAttr)
    14491450        checkedStateChanged(element);
    … …  
    14911492    ASSERT(is<HTMLLabelElement>(*element));
    14921493    HTMLElement* correspondingControl = downcast<HTMLLabelElement>(*element).control();
    1493     textChanged(correspondingControl);
     1494    deferTextChangedIfNeeded(correspondingControl);
    14941495}
    14951496
    … …  
    26762677}
    26772678   
    2678 void AXObjectCache::performDeferredIsIgnoredChange()
    2679 {
    2680     for (auto* renderer : m_deferredIsIgnoredChangeList)
    2681         recomputeIsIgnored(renderer);
    2682     m_deferredIsIgnoredChangeList.clear();
    2683 }
    2684 
    2685 void AXObjectCache::recomputeDeferredIsIgnored(RenderBlock& renderer)
    2686 {
    2687     if (renderer.beingDestroyed())
    2688         return;
    2689     m_deferredIsIgnoredChangeList.add(&renderer);
     2679void AXObjectCache::performDeferredCacheUpdate()
     2680{
     2681    for (auto* node : m_deferredTextChangedList)
     2682        textChanged(node);
     2683    m_deferredTextChangedList.clear();
     2684
     2685    for (auto* element : m_deferredRecomputeIsIgnoredList) {
     2686        if (auto* renderer = element->renderer())
     2687            recomputeIsIgnored(renderer);
     2688    }
     2689    m_deferredRecomputeIsIgnoredList.clear();
     2690}
     2691
     2692void AXObjectCache::deferRecomputeIsIgnored(Element* element)
     2693{
     2694    if (!element)
     2695        return;
     2696
     2697    if (element->renderer() && element->renderer()->beingDestroyed())
     2698        return;
     2699
     2700    m_deferredRecomputeIsIgnoredList.add(element);
     2701}
     2702
     2703void AXObjectCache::deferTextChangedIfNeeded(Node* node)
     2704{
     2705    if (!node)
     2706        return;
     2707
     2708    if (node->renderer() && node->renderer()->beingDestroyed())
     2709        return;
     2710
     2711    auto& document = node->document();
     2712    // FIXME: We should just defer all text changes.
     2713    if (document.needsStyleRecalc() || document.inRenderTreeUpdate() || (document.view() && document.view()->isInRenderTreeLayout())) {
     2714        m_deferredTextChangedList.add(node);
     2715        return;
     2716    }
     2717    textChanged(node);
    26902718}
    26912719

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/accessibility/AXObjectCache.h

    r217367 r219817  
    4646class RenderBlock;
    4747class RenderObject;
     48class RenderText;
    4849class ScrollView;
    4950class VisiblePosition;
    … …  
    326327    static void setShouldRepostNotificationsForTests(bool value);
    327328#endif
    328     void recomputeDeferredIsIgnored(RenderBlock& renderer);
    329     void performDeferredIsIgnoredChange();
     329    void deferRecomputeIsIgnored(Element*);
     330    void deferTextChangedIfNeeded(Node*);
     331    void performDeferredCacheUpdate();
    330332
    331333protected:
    … …  
    429431    AXTextStateChangeIntent m_textSelectionIntent;
    430432    bool m_isSynchronizingSelection { false };
    431     ListHashSet<RenderBlock*> m_deferredIsIgnoredChangeList;
     433    ListHashSet<Element*> m_deferredRecomputeIsIgnoredList;
     434    ListHashSet<Node*> m_deferredTextChangedList;
    432435};
    433436
    … …  
    491494inline void AXObjectCache::handleAttributeChanged(const QualifiedName&, Element*) { }
    492495inline void AXObjectCache::recomputeIsIgnored(RenderObject*) { }
    493 inline void AXObjectCache::recomputeDeferredIsIgnored(RenderBlock&) { }
    494 inline void AXObjectCache::performDeferredIsIgnoredChange() { }
     496inline void AXObjectCache::deferRecomputeIsIgnored(Element*) { }
     497inline void AXObjectCache::deferTextChangedIfNeeded(Node*) { }
     498inline void AXObjectCache::performDeferredCacheUpdate() { }
    495499inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
    496500inline void AXObjectCache::postTextStateChangeNotification(Node*, const AXTextStateChangeIntent&, const VisibleSelection&) { }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/accessibility/AccessibilityRenderObject.cpp

    r217367 r219817  
    628628        return ASCIILiteral("\n");
    629629
    630     bool isRenderText = is<RenderText>(*m_renderer);
    631 
    632630    if (shouldGetTextFromNode(mode))
    633631        return AccessibilityNodeObject::textUnderElement(mode);
    … …  
    635633    // We use a text iterator for text objects AND for those cases where we are
    636634    // explicitly asking for the full text under a given element.
    637     bool shouldIncludeAllChildren = mode.childrenInclusion == AccessibilityTextUnderElementMode::TextUnderElementModeIncludeAllChildren;
    638     if (isRenderText || shouldIncludeAllChildren) {
     635    if (is<RenderText>(*m_renderer) || mode.childrenInclusion == AccessibilityTextUnderElementMode::TextUnderElementModeIncludeAllChildren) {
    639636        // If possible, use a text iterator to get the text, so that whitespace
    640637        // is handled consistently.
    … …  
    670667                    return String();
    671668
    672                 // The tree should be stable before looking through the children of a non-Render Text object.
    673                 // Otherwise, further uses of TextIterator will force a layout update, potentially altering
    674                 // the accessibility tree and causing crashes in the loop that computes the result text.
    675                 ASSERT((isRenderText || !shouldIncludeAllChildren) || (!nodeDocument->renderView()->layoutState() && !nodeDocument->childNeedsStyleRecalc()));
    676 
     669                // Renders referenced by accessibility objects could get destroyed, if TextIterator ends up triggering
     670                // style update/layout here. See also AXObjectCache::deferTextChangedIfNeeded().
     671                ASSERT_WITH_SECURITY_IMPLICATION(!nodeDocument->childNeedsStyleRecalc());
     672                ASSERT_WITH_SECURITY_IMPLICATION(!nodeDocument->view()->isInRenderTreeLayout());
    677673                return plainText(textRange.get(), textIteratorBehaviorForTextRange());
    678674            }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp

    r217367 r219817  
    2929#if ENABLE(SUBTLE_CRYPTO)
    3030
     31#include "BufferSource.h"
    3132#include "CryptoAlgorithm.h"
    3233#include "CryptoAlgorithmParametersDeprecated.h"
    … …  
    4041#include "JSCryptoKeyPair.h"
    4142#include "JSCryptoKeySerializationJWK.h"
    42 #include "JSCryptoOperationData.h"
    4343#include "JSDOMPromise.h"
    4444#include "ScriptState.h"
    … …  
    149149    }
    150150
    151     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(2));
     151    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(2)));
    152152    RETURN_IF_EXCEPTION(scope, { });
    153153
    … …  
    161161    };
    162162
    163     auto result = algorithm->encrypt(*parameters, *key, data, WTFMove(successCallback), WTFMove(failureCallback));
     163    auto result = algorithm->encrypt(*parameters, *key, { data.data(), data.length() }, WTFMove(successCallback), WTFMove(failureCallback));
    164164    if (result.hasException()) {
    165165        propagateException(state, scope, result.releaseException());
    … …  
    194194    }
    195195
    196     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(2));
     196    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(2)));
    197197    RETURN_IF_EXCEPTION(scope, { });
    198198
    … …  
    206206    };
    207207
    208     auto result = algorithm->decrypt(*parameters, *key, data, WTFMove(successCallback), WTFMove(failureCallback));
     208    auto result = algorithm->decrypt(*parameters, *key, { data.data(), data.length() }, WTFMove(successCallback), WTFMove(failureCallback));
    209209    if (result.hasException()) {
    210210        propagateException(state, scope, result.releaseException());
    … …  
    239239    }
    240240
    241     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(2));
     241    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(2)));
    242242    RETURN_IF_EXCEPTION(scope, { });
    243243
    … …  
    251251    };
    252252
    253     auto result = algorithm->sign(*parameters, *key, data, WTFMove(successCallback), WTFMove(failureCallback));
     253    auto result = algorithm->sign(*parameters, *key, { data.data(), data.length() }, WTFMove(successCallback), WTFMove(failureCallback));
    254254    if (result.hasException()) {
    255255        propagateException(state, scope, result.releaseException());
    … …  
    284284    }
    285285
    286     auto signature = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(2));
    287     RETURN_IF_EXCEPTION(scope, { });
    288 
    289     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(3));
     286    auto signature = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(2)));
     287    RETURN_IF_EXCEPTION(scope, { });
     288
     289    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(3)));
    290290    RETURN_IF_EXCEPTION(scope, { });
    291291
    … …  
    299299    };
    300300
    301     auto result = algorithm->verify(*parameters, *key, signature, data, WTFMove(successCallback), WTFMove(failureCallback));
     301    auto result = algorithm->verify(*parameters, *key, { signature.data(), signature.length() }, { data.data(), data.length() }, WTFMove(successCallback), WTFMove(failureCallback));
    302302    if (result.hasException()) {
    303303        propagateException(state, scope, result.releaseException());
    … …  
    322322    RETURN_IF_EXCEPTION(scope, { });
    323323
    324     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(1));
     324    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(1)));
    325325    RETURN_IF_EXCEPTION(scope, { });
    326326
    … …  
    334334    };
    335335
    336     auto result = algorithm->digest(*parameters, data, WTFMove(successCallback), WTFMove(failureCallback));
     336    auto result = algorithm->digest(*parameters, { data.data(), data.length() }, WTFMove(successCallback), WTFMove(failureCallback));
    337337    if (result.hasException()) {
    338338        propagateException(state, scope, result.releaseException());
    … …  
    457457    RETURN_IF_EXCEPTION(scope, { });
    458458
    459     auto data = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(1));
     459    auto data = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(1)));
    460460    RETURN_IF_EXCEPTION(scope, { });
    461461
    … …  
    488488    };
    489489
    490     WebCore::importKey(state, keyFormat, data, WTFMove(algorithm), WTFMove(parameters), extractable, keyUsages, WTFMove(successCallback), WTFMove(failureCallback));
     490    WebCore::importKey(state, keyFormat, { data.data(), data.length() }, WTFMove(algorithm), WTFMove(parameters), extractable, keyUsages, WTFMove(successCallback), WTFMove(failureCallback));
    491491    RETURN_IF_EXCEPTION(scope, JSValue());
    492492
    … …  
    626626    RETURN_IF_EXCEPTION(scope, { });
    627627
    628     auto wrappedKeyData = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(1));
     628    auto wrappedKeyData = BufferSource(convert<IDLBufferSource>(state, state.uncheckedArgument(1)));
    629629    RETURN_IF_EXCEPTION(scope, { });
    630630
    … …  
    692692    };
    693693
    694     auto result = unwrapAlgorithm->decryptForUnwrapKey(*unwrapAlgorithmParameters, *unwrappingKey, wrappedKeyData, WTFMove(decryptSuccessCallback), WTFMove(decryptFailureCallback));
     694    auto result = unwrapAlgorithm->decryptForUnwrapKey(*unwrapAlgorithmParameters, *unwrappingKey, { wrappedKeyData.data(), wrappedKeyData.length() }, WTFMove(decryptSuccessCallback), WTFMove(decryptFailureCallback));
    695695    if (result.hasException()) {
    696696        propagateException(state, scope, result.releaseException());

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/crypto/WebKitSubtleCrypto.idl

    r217367 r219817  
    2929    NoInterfaceObject,
    3030] interface WebKitSubtleCrypto {
    31     [Custom] Promise<ArrayBuffer> encrypt(AlgorithmIdentifier algorithm, Key key, sequence<CryptoOperationData> data);
    32     [Custom] Promise<ArrayBuffer> decrypt(AlgorithmIdentifier algorithm, Key key, sequence<CryptoOperationData> data);
    33     [Custom] Promise<ArrayBuffer> sign(AlgorithmIdentifier algorithm, Key key, sequence<CryptoOperationData> data);
    34     [Custom] Promise<boolean> verify(AlgorithmIdentifier algorithm, Key key, CryptoOperationData signature, sequence<CryptoOperationData> data);
    35     [Custom] Promise<ArrayBuffer> digest(AlgorithmIdentifier algorithm, sequence<CryptoOperationData> data);
     31    [Custom] Promise<ArrayBuffer> encrypt(AlgorithmIdentifier algorithm, Key key, sequence<BufferSource> data);
     32    [Custom] Promise<ArrayBuffer> decrypt(AlgorithmIdentifier algorithm, Key key, sequence<BufferSource> data);
     33    [Custom] Promise<ArrayBuffer> sign(AlgorithmIdentifier algorithm, Key key, sequence<BufferSource> data);
     34    [Custom] Promise<boolean> verify(AlgorithmIdentifier algorithm, Key key, BufferSource signature, sequence<BufferSource> data);
     35    [Custom] Promise<ArrayBuffer> digest(AlgorithmIdentifier algorithm, sequence<BufferSource> data);
    3636    [Custom] Promise<(CryptoKey or CryptoKeyPair)> generateKey(AlgorithmIdentifier algorithm, optional boolean extractable, optional sequence<KeyUsage> keyUsages);
    37     [Custom] Promise<CryptoKey> importKey(KeyFormat format, CryptoOperationData keyData, AlgorithmIdentifier? algorithm, optional boolean extractable, optional sequence<KeyUsage> keyUsages);
     37    [Custom] Promise<CryptoKey> importKey(KeyFormat format, BufferSource keyData, AlgorithmIdentifier? algorithm, optional boolean extractable, optional sequence<KeyUsage> keyUsages);
    3838    [Custom] Promise<ArrayBuffer> exportKey(KeyFormat format, Key key);
    3939    [Custom] Promise<ArrayBuffer> wrapKey(KeyFormat format, Key key, Key wrappingKey, AlgorithmIdentifier wrapAlgorithm);
    40     [Custom] Promise<CryptoKey> unwrapKey(KeyFormat format, CryptoOperationData wrappedKey, Key unwrappingKey, AlgorithmIdentifier unwrapAlgorithm, AlgorithmIdentifier? unwrappedKeyAlgorithm, optional boolean extractable, optional sequence<KeyUsage> keyUsages);
     40    [Custom] Promise<CryptoKey> unwrapKey(KeyFormat format, BufferSource wrappedKey, Key unwrappingKey, AlgorithmIdentifier unwrapAlgorithm, AlgorithmIdentifier? unwrappedKeyAlgorithm, optional boolean extractable, optional sequence<KeyUsage> keyUsages);
    4141};

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/css/CSSMarkup.cpp

    r217367 r219817  
    159159}
    160160
    161 void serializeString(const String& string, StringBuilder& appendTo, bool useDoubleQuotes)
     161void serializeString(const String& string, StringBuilder& appendTo)
    162162{
    163163    // FIXME: From the CSS OM draft:
    … …  
    165165    // We need to switch to using " instead of ', but this involves patching a large
    166166    // number of tests and changing editing code to not get confused by double quotes.
    167     appendTo.append(useDoubleQuotes ? '\"' : '\'');
     167    appendTo.append('"');
    168168
    169169    unsigned index = 0;
    … …  
    180180    }
    181181
    182     appendTo.append(useDoubleQuotes ? '\"' : '\'');
    183 }
    184 
    185 String serializeString(const String& string, bool useDoubleQuotes)
     182    appendTo.append('"');
     183}
     184
     185String serializeString(const String& string)
    186186{
    187187    StringBuilder builder;
    188     serializeString(string, builder, useDoubleQuotes);
     188    serializeString(string, builder);
    189189    return builder.toString();
    190190}

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/css/CSSMarkup.h

    r217367 r219817  
    3131// Common serializing methods. See: http://dev.w3.org/csswg/cssom/#common-serializing-idioms
    3232void serializeIdentifier(const String& identifier, StringBuilder& appendTo, bool skipStartChecks = false);
    33 void serializeString(const String&, StringBuilder& appendTo, bool useDoubleQuotes = false);
    34 String serializeString(const String&, bool useDoubleQuotes = false);
     33void serializeString(const String&, StringBuilder& appendTo);
     34String serializeString(const String&);
    3535String serializeURL(const String&);
    3636String serializeFontFamily(const String&);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/css/CSSSelector.cpp

    r217367 r219817  
    698698            }
    699699            if (cs->match() != CSSSelector::Set) {
    700                 serializeString(cs->serializingValue(), str, true);
     700                serializeString(cs->serializingValue(), str);
    701701                if (cs->attributeValueMatchingIsCaseInsensitive())
    702702                    str.appendLiteral(" i]");

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/ContainerNode.cpp

    r217367 r219817  
    5454#include "RenderWidget.h"
    5555#include "RootInlineBox.h"
     56#include "RuntimeEnabledFeatures.h"
    5657#include "SVGDocumentExtensions.h"
    5758#include "SVGElement.h"
    … …  
    106107static inline void destroyRenderTreeIfNeeded(Node& child)
    107108{
    108     bool childIsHTMLSlotElement = false;
    109     childIsHTMLSlotElement = is<HTMLSlotElement>(child);
     109    bool isElement = is<Element>(child);
     110    auto hasDisplayContents = isElement && downcast<Element>(child).hasDisplayContents();
     111    auto isNamedFlowElement = isElement && downcast<Element>(child).isNamedFlowContentElement();
    110112    // FIXME: Get rid of the named flow test.
    111     bool isElement = is<Element>(child);
    112     if (!child.renderer() && !childIsHTMLSlotElement
    113         && !(isElement && downcast<Element>(child).isNamedFlowContentElement()))
     113    if (!child.renderer() && !hasDisplayContents && !isNamedFlowElement)
    114114        return;
    115115    if (isElement)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Document.cpp

    r217367 r219817  
    18351835        frameView.viewportContentsChanged();
    18361836
     1837    // Usually this is handled by post-layout.
    18371838    if (!frameView.needsLayout())
    1838         frameView.frame().selection().updateAppearanceAfterLayout();
     1839        frameView.frame().selection().scheduleAppearanceUpdateAfterStyleChange();
    18391840
    18401841    // As a result of the style recalculation, the currently hovered element might have been
    … …  
    18461847    if (m_gotoAnchorNeededAfterStylesheetsLoad && !styleScope().hasPendingSheets())
    18471848        frameView.scrollToFragment(m_url);
     1849
     1850    // FIXME: Ideally we would ASSERT(!needsStyleRecalc()) here but we have some cases where it is not true.
    18481851}
    18491852

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Node.cpp

    r217367 r219817  
    287287#endif
    288288
    289     ASSERT(!renderer());
     289    ASSERT_WITH_SECURITY_IMPLICATION(!renderer());
    290290    ASSERT(!parentNode());
    291291    ASSERT(!m_previous);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/ProcessingInstruction.cpp

    r217367 r219817  
    11/*
    22 * Copyright (C) 2000 Peter Kelly (pmk@post.com)
    3  * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
     3 * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
    44 * Copyright (C) 2013 Samsung Electronics. All rights reserved.
    55 *
    … …  
    3636#include "XMLDocumentParser.h"
    3737#include "XSLStyleSheet.h"
     38#include <wtf/SetForScope.h>
    3839
    3940namespace WebCore {
    … …  
    8182void ProcessingInstruction::checkStyleSheet()
    8283{
     84    // Prevent recursive loading of stylesheet.
     85    if (m_isHandlingBeforeLoad)
     86        return;
     87
    8388    if (m_target == "xml-stylesheet" && document().frame() && parentNode() == &document()) {
    8489        // see http://www.w3.org/TR/xml-stylesheet/
    … …  
    131136
    132137            String url = document().completeURL(href).string();
     138
     139            Ref<Document> originalDocument = document();
     140
     141            {
     142            SetForScope<bool> change(m_isHandlingBeforeLoad, true);
    133143            if (!dispatchBeforeLoadEvent(url))
    134144                return;
     145            }
     146
     147            bool didEventListenerDisconnectThisElement = !isConnected() || &document() != originalDocument.ptr();
     148            if (didEventListenerDisconnectThisElement)
     149                return;
    135150
    136151            m_loading = true;
    137152            document().styleScope().addPendingSheet();
     153
     154            ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
    138155
    139156#if ENABLE(XSLT)
    … …  
    207224    // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
    208225    // type.
     226    Ref<Document> protect(document());
    209227    parseStyleSheet(sheet->sheetText());
    210228}

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/ProcessingInstruction.h

    r217367 r219817  
    11/*
    22 * Copyright (C) 2000 Peter Kelly (pmk@post.com)
    3  * Copyright (C) 2006 Apple Inc. All rights reserved.
     3 * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
    44 * Copyright (C) 2013 Samsung Electronics. All rights reserved.
    55 *
    … …  
    8888    bool m_isXSL { false };
    8989#endif
     90    bool m_isHandlingBeforeLoad { false };
    9091};
    9192

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Text.cpp

    r217367 r219817  
    5555Text::~Text()
    5656{
    57     ASSERT(!renderer());
    5857}
    5958

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/EditingStyle.cpp

    r217367 r219817  
    17051705
    17061706    m_applyFontFace = style.getPropertyValue(CSSPropertyFontFamily);
    1707     // Remove single quotes for Outlook 2007 compatibility. See https://bugs.webkit.org/show_bug.cgi?id=79448
    1708     m_applyFontFace.replaceWithLiteral('\'', "");
     1707    // Remove quotes for Outlook 2007 compatibility. See https://bugs.webkit.org/show_bug.cgi?id=79448
     1708    m_applyFontFace.replaceWithLiteral('\"', "");
    17091709    style.removeProperty(CSSPropertyFontFamily);
    17101710

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/FrameSelection.cpp

    r217367 r219817  
    112112    , m_granularity(CharacterGranularity)
    113113    , m_caretBlinkTimer(*this, &FrameSelection::caretBlinkTimerFired)
     114    , m_appearanceUpdateTimer(*this, &FrameSelection::appearanceUpdateTimerFired)
    114115    , m_caretInsidePositionFixed(false)
    115116    , m_absCaretBoundsDirty(true)
    … …  
    333334void FrameSelection::setSelection(const VisibleSelection& selection, SetSelectionOptions options, AXTextStateChangeIntent intent, CursorAlignOnScroll align, TextGranularity granularity)
    334335{
     336    RefPtr<Frame> protectedFrame(m_frame);
    335337    if (!setSelectionWithoutUpdatingAppearance(selection, options, align, granularity))
    336338        return;
    … …  
    23972399void FrameSelection::updateAppearanceAfterLayout()
    23982400{
     2401    m_appearanceUpdateTimer.stop();
     2402    updateAppearanceAfterLayoutOrStyleChange();
     2403}
     2404
     2405void FrameSelection::scheduleAppearanceUpdateAfterStyleChange()
     2406{
     2407    m_appearanceUpdateTimer.startOneShot(0_s);
     2408}
     2409
     2410void FrameSelection::appearanceUpdateTimerFired()
     2411{
     2412    updateAppearanceAfterLayoutOrStyleChange();
     2413}
     2414
     2415void FrameSelection::updateAppearanceAfterLayoutOrStyleChange()
     2416{
    23992417    if (auto* client = m_frame->editor().client())
    24002418        client->updateEditorStateAfterLayoutIfEditabilityChanged();

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/FrameSelection.h

    r217367 r219817  
    152152
    153153    void updateAppearanceAfterLayout();
     154    void scheduleAppearanceUpdateAfterStyleChange();
    154155    void setNeedsSelectionUpdate();
    155156
    … …  
    316317    void caretBlinkTimerFired();
    317318
     319    void updateAppearanceAfterLayoutOrStyleChange();
     320    void appearanceUpdateTimerFired();
     321
    318322    void setCaretVisibility(CaretVisibility);
    319323    bool recomputeCaretRect();
    … …  
    335339
    336340    Timer m_caretBlinkTimer;
     341    Timer m_appearanceUpdateTimer;
    337342    // The painted bounds of the caret in absolute coordinates
    338343    IntRect m_absCaretBounds;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp

    r217367 r219817  
    186186    insertionPosition = positionAvoidingSpecialElementBoundary(insertionPosition);
    187187    VisiblePosition visiblePos(insertionPosition, affinity);
     188    if (visiblePos.isNull())
     189        return;
     190
    188191    calculateStyleBeforeInsertion(insertionPosition);
    189192
    … …  
    266269            ASSERT(startBlock->firstChild());
    267270            refNode = startBlock->firstChild();
    268         }
    269         else if (insertionPosition.deprecatedNode() == startBlock && nestNewBlock) {
    270             refNode = startBlock->traverseToChildAt(insertionPosition.deprecatedEditingOffset());
     271        } else if (insertionPosition.containerNode() == startBlock && nestNewBlock) {
     272            refNode = startBlock->traverseToChildAt(insertionPosition.computeOffsetInContainerNode());
    271273            ASSERT(refNode); // must be true or we'd be in the end of block case
    272274        } else

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/html/FormAssociatedElement.cpp

    r217367 r219817  
    7272    HTMLElement& element = asHTMLElement();
    7373    if (m_formSetByParser) {
    74         setForm(m_formSetByParser);
     74        // The form could have been removed by a script during parsing.
     75        if (m_formSetByParser->isConnected())
     76            setForm(m_formSetByParser);
    7577        m_formSetByParser = nullptr;
    7678    }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/html/HTMLLinkElement.cpp

    r217367 r219817  
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    5  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2014 Apple Inc. All rights reserved.
     5 * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    66 * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
    77 * Copyright (C) 2011 Google Inc. All rights reserved.
    … …  
    5656#include "StyleSheetContents.h"
    5757#include <wtf/Ref.h>
     58#include <wtf/SetForScope.h>
    5859#include <wtf/StdLibExtras.h>
    5960
    … …  
    225226    }
    226227
     228    // Prevent recursive loading of link.
     229    if (m_isHandlingBeforeLoad)
     230        return;
     231
    227232    URL url = getNonEmptyURLAttribute(hrefAttr);
    228233
    … …  
    244249        }
    245250
     251        {
     252        SetForScope<bool> change(m_isHandlingBeforeLoad, true);
    246253        if (!shouldLoadLink())
    247254            return;
     255        }
    248256
    249257        m_loading = true;
    … …  
    278286        request.setAsPotentiallyCrossOrigin(crossOrigin(), document());
    279287
     288        ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
    280289        m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
    281290

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/html/HTMLLinkElement.h

    r217367 r219817  
    22 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    4  * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
     4 * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    55 * Copyright (C) 2011 Google Inc. All rights reserved.
    66 *
    … …  
    134134    bool m_firedLoad;
    135135    bool m_loadedResource;
     136    bool m_isHandlingBeforeLoad { false };
    136137
    137138    PendingSheetType m_pendingSheetType;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/html/HTMLMediaElement.cpp

    r217367 r219817  
    569569    m_updatePlaybackControlsManagerQueue.close();
    570570    m_playbackControlsManagerBehaviorRestrictionsQueue.close();
     571    m_resourceSelectionTaskQueue.close();
    571572
    572573    m_completelyLoaded = true;
    … …  
    10111012void HTMLMediaElement::notifyAboutPlaying()
    10121013{
     1014    Ref<HTMLMediaElement> protectedThis(*this); // The 'playing' event can make arbitrary DOM mutations.
    10131015    m_playbackStartedTime = currentMediaTime().toDouble();
    10141016    dispatchEvent(Event::create(eventNames().playingEvent, false, true));
    … …  
    51165118    m_mediaSession->canProduceAudioChanged();
    51175119
     5120    m_resourceSelectionTaskQueue.cancelAllTasks();
     5121
    51185122    updateSleepDisabling();
    51195123}

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp

    r217367 r219817  
    103103static inline void insert(HTMLConstructionSiteTask& task)
    104104{
    105     if (is<HTMLTemplateElement>(*task.parent))
     105    if (is<HTMLTemplateElement>(*task.parent)) {
    106106        task.parent = &downcast<HTMLTemplateElement>(*task.parent).content();
     107        task.nextChild = nullptr;
     108    }
    107109
    108110    ASSERT(!task.child->parentNode());

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/loader/DocumentThreadableLoader.cpp

    r217367 r219817  
    227227
    228228    Ref<DocumentThreadableLoader> protectedThis(*this);
     229    --m_options.maxRedirectCount;
    229230
    230231    // FIXME: We restrict this check to Fetch API for the moment, as this might disrupt WorkerScriptLoader.
    … …  
    251252
    252253    ASSERT(m_resource);
    253     ASSERT(m_resource->loader());
     254    ASSERT(m_originalHeaders);
     255
     256    // Use a unique for subsequent loads if needed.
     257    // https://fetch.spec.whatwg.org/#concept-http-redirect-fetch (Step 10).
    254258    ASSERT(m_options.mode == FetchOptions::Mode::Cors);
    255     ASSERT(m_originalHeaders);
    256 
    257     // Loader might have modified the origin to a unique one, let's reuse it for subsequent loads.
    258     m_origin = m_resource->loader()->origin();
     259    if (!securityOrigin().canRequest(redirectResponse.url()) && !protocolHostAndPortAreEqual(redirectResponse.url(), request.url()))
     260        m_origin = SecurityOrigin::createUnique();
    259261
    260262    // Except in case where preflight is needed, loading should be able to continue on its own.
    … …  
    264266
    265267    m_options.allowCredentials = DoNotAllowStoredCredentials;
    266     m_options.maxRedirectCount -= m_resource->loader()->redirectCount();
    267268
    268269    clearResource();

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/loader/ImageLoader.cpp

    r217367 r219817  
    395395        return;
    396396    m_hasPendingBeforeLoadEvent = false;
     397    Ref<Document> originalDocument = element().document();
    397398    if (element().dispatchBeforeLoadEvent(m_image->url())) {
     399        bool didEventListenerDisconnectThisElement = !element().isConnected() || &element().document() != originalDocument.ptr();
     400        if (didEventListenerDisconnectThisElement)
     401            return;
     402       
    398403        updateRenderer();
    399404        return;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/loader/SubresourceLoader.cpp

    r217367 r219817  
    496496            redirectingToNewOrigin = true;
    497497        else
    498             redirectingToNewOrigin = !SecurityOrigin::create(previousRequest.url())->canRequest(newRequest.url());
     498            redirectingToNewOrigin = !protocolHostAndPortAreEqual(previousRequest.url(), newRequest.url());
    499499    }
    500500

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/page/FocusController.cpp

    r217367 r219817  
    379379    while (is<HTMLFrameOwnerElement>(element)) {
    380380        HTMLFrameOwnerElement& owner = downcast<HTMLFrameOwnerElement>(*element);
    381         if (!owner.contentFrame())
     381        if (!owner.contentFrame() || !owner.contentFrame()->document())
    382382            break;
     383        owner.contentFrame()->document()->updateLayoutIgnorePendingStylesheets();
    383384        Element* foundElement = findFocusableElementWithinScope(direction, FocusNavigationScope::scopeOwnedByIFrame(owner), nullptr, event);
    384385        if (!foundElement)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/page/FrameView.cpp

    r217367 r219817  
    15761576            // we call it through the timer here.
    15771577            m_postLayoutTasksTimer.startOneShot(0);
    1578             if (needsLayout())
    1579                 layout();
    15801578        }
     1579        if (needsLayout())
     1580            layout();
    15811581    }
    15821582
    … …  
    35413541
    35423542    if (AXObjectCache* cache = frame().document()->existingAXObjectCache())
    3543         cache->performDeferredIsIgnoredChange();
     3543        cache->performDeferredCacheUpdate();
    35443544}
    35453545
    … …  
    44294429#endif
    44304430
    4431     if (m_layoutPhase == InViewSizeAdjust)
    4432         return;
    4433 
    4434     TraceScope tracingScope(PaintViewStart, PaintViewEnd);
    4435 
    4436     ASSERT(m_layoutPhase == InPostLayerPositionsUpdatedAfterLayout || m_layoutPhase == OutsideLayout);
    4437    
    44384431    RenderView* renderView = this->renderView();
    44394432    if (!renderView) {
    … …  
    44414434        return;
    44424435    }
     4436
     4437    if (!inPaintableState())
     4438        return;
     4439
     4440    TraceScope tracingScope(PaintViewStart, PaintViewEnd);
    44434441
    44444442    ASSERT(!needsLayout());

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/page/FrameView.h

    r217367 r219817  
    115115    bool isInLayout() const { return m_layoutPhase != OutsideLayout; }
    116116    bool isInRenderTreeLayout() const { return m_layoutPhase == InRenderTreeLayout; }
    117     WEBCORE_EXPORT bool inPaintableState() { return m_layoutPhase != InRenderTreeLayout && m_layoutPhase != InViewSizeAdjust && m_layoutPhase != InPostLayout; }
     117    bool inPaintableState() { return m_layoutPhase != InRenderTreeLayout && m_layoutPhase != InViewSizeAdjust && m_layoutPhase != InPostLayout; }
    118118
    119119    RenderElement* layoutRoot() const { return m_layoutRoot; }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/URL.cpp

    r217367 r219817  
    550550#endif
    551551
     552static Lock& defaultPortForProtocolMapForTestingLock()
     553{
     554    static NeverDestroyed<Lock> lock;
     555    return lock;
     556}
     557
    552558using DefaultPortForProtocolMapForTesting = HashMap<String, uint16_t>;
    553 static DefaultPortForProtocolMapForTesting& defaultPortForProtocolMapForTesting()
    554 {
    555     static NeverDestroyed<DefaultPortForProtocolMapForTesting> defaultPortForProtocolMap;
     559static DefaultPortForProtocolMapForTesting*& defaultPortForProtocolMapForTesting()
     560{
     561    static DefaultPortForProtocolMapForTesting* defaultPortForProtocolMap;
    556562    return defaultPortForProtocolMap;
    557563}
    558564
     565static DefaultPortForProtocolMapForTesting& ensureDefaultPortForProtocolMapForTesting()
     566{
     567    DefaultPortForProtocolMapForTesting*& defaultPortForProtocolMap = defaultPortForProtocolMapForTesting();
     568    if (!defaultPortForProtocolMap)
     569        defaultPortForProtocolMap = new DefaultPortForProtocolMapForTesting;
     570    return *defaultPortForProtocolMap;
     571}
     572
    559573void registerDefaultPortForProtocolForTesting(uint16_t port, const String& protocol)
    560574{
    561     defaultPortForProtocolMapForTesting().add(protocol, port);
     575    LockHolder locker(defaultPortForProtocolMapForTestingLock());
     576    ensureDefaultPortForProtocolMapForTesting().add(protocol, port);
    562577}
    563578
    564579void clearDefaultPortForProtocolMapForTesting()
    565580{
    566     defaultPortForProtocolMapForTesting().clear();
     581    LockHolder locker(defaultPortForProtocolMapForTestingLock());
     582    if (auto* map = defaultPortForProtocolMapForTesting())
     583        map->clear();
    567584}
    568585
    569586std::optional<uint16_t> defaultPortForProtocol(StringView protocol)
    570587{
    571     const auto& defaultPortForProtocolMap = defaultPortForProtocolMapForTesting();
    572     auto iterator = defaultPortForProtocolMap.find(protocol.toStringWithoutCopying());
    573     if (iterator != defaultPortForProtocolMap.end())
    574         return iterator->value;
     588    if (auto* overrideMap = defaultPortForProtocolMapForTesting()) {
     589        LockHolder locker(defaultPortForProtocolMapForTestingLock());
     590        ASSERT(overrideMap); // No need to null check again here since overrideMap cannot become null after being non-null.
     591        auto iterator = overrideMap->find(protocol.toStringWithoutCopying());
     592        if (iterator != overrideMap->end())
     593            return iterator->value;
     594    }
    575595    return URLParser::defaultPortForProtocol(protocol);
    576596}

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/FloatRect.cpp

    r217367 r219817  
    216216IntRect enclosingIntRect(const FloatRect& rect)
    217217{
    218     IntPoint location = flooredIntPoint(rect.minXMinYCorner());
    219     IntPoint maxPoint = ceiledIntPoint(rect.maxXMaxYCorner());
    220 
    221     return IntRect(location, maxPoint - location);
     218    FloatPoint location = flooredIntPoint(rect.minXMinYCorner());
     219    FloatPoint maxPoint = ceiledIntPoint(rect.maxXMaxYCorner());
     220    return IntRect(IntPoint(location), IntSize(maxPoint - location));
    222221}
    223222

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/ImageBackingStore.h

    r217367 r219817  
    3030#include "IntSize.h"
    3131#include "NativeImage.h"
    32 
    33 #include <wtf/Vector.h>
     32#include "SharedBuffer.h"
    3433
    3534namespace WebCore {
    … …  
    5554            return false;
    5655
    57         unsigned area = size.area().unsafeGet();
    58         if (!m_pixels.tryReserveCapacity(area))
     56        Vector<char> buffer;
     57        size_t bufferSize = size.area().unsafeGet() * sizeof(RGBA32);
     58
     59        if (!buffer.tryReserveCapacity(bufferSize))
    5960            return false;
    6061
    61         m_pixels.resize(area);
    62         m_pixelsPtr = m_pixels.data();
     62        buffer.resize(bufferSize);
     63        m_pixels = SharedBuffer::adoptVector(buffer);
     64        m_pixelsPtr = reinterpret_cast<RGBA32*>(const_cast<char*>(m_pixels->data()));
    6365        m_size = size;
    6466        m_frameRect = IntRect(IntPoint(), m_size);
    … …  
    184186
    185187    ImageBackingStore(const ImageBackingStore& other)
    186         : m_pixels(other.m_pixels)
    187         , m_size(other.m_size)
     188        : m_size(other.m_size)
    188189        , m_premultiplyAlpha(other.m_premultiplyAlpha)
    189190    {
    190191        ASSERT(!m_size.isEmpty() && !isOverSize(m_size));
    191         m_pixelsPtr = m_pixels.data();
     192        m_pixels = other.m_pixels->copy();
     193        m_pixelsPtr = reinterpret_cast<RGBA32*>(const_cast<char*>(m_pixels->data()));
    192194    }
    193195
    … …  
    213215    }
    214216
    215     Vector<RGBA32> m_pixels;
     217    RefPtr<SharedBuffer> m_pixels;
    216218    RGBA32* m_pixelsPtr { nullptr };
    217219    IntSize m_size;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp

    r217367 r219817  
    7676
    7777    RefPtr<InbandTextTrackPrivateGStreamer> protectedThis(this);
    78     m_notifier.notify(MainThreadNotification::NewSample, [protectedThis] {
     78    m_notifier->notify(MainThreadNotification::NewSample, [protectedThis] {
    7979        protectedThis->notifyTrackOfSample();
    8080    });
    … …  
    8484{
    8585    RefPtr<InbandTextTrackPrivateGStreamer> protectedThis(this);
    86     m_notifier.notify(MainThreadNotification::StreamChanged, [protectedThis] {
     86    m_notifier->notify(MainThreadNotification::StreamChanged, [protectedThis] {
    8787        protectedThis->notifyTrackOfStreamChanged();
    8888    });

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/MainThreadNotifier.h

    r217367 r219817  
    1717 */
    1818
    19 #ifndef MainThreadNotifier_h
    20 #define MainThreadNotifier_h
     19#pragma once
    2120
     21#include <wtf/Atomics.h>
    2222#include <wtf/Lock.h>
    2323#include <wtf/MainThread.h>
    2424#include <wtf/RunLoop.h>
    25 #include <wtf/WeakPtr.h>
     25#include <wtf/ThreadSafeRefCounted.h>
    2626
    2727namespace WebCore {
    2828
    2929template <typename T>
    30 class MainThreadNotifier {
     30class MainThreadNotifier final : public ThreadSafeRefCounted<MainThreadNotifier<T>> {
    3131public:
    32     MainThreadNotifier()
    33         : m_weakPtrFactory(this)
     32    static Ref<MainThreadNotifier> create()
    3433    {
     34        return adoptRef(*new MainThreadNotifier());
    3535    }
    3636
    … …  
    3838    void notify(T notificationType, const F& callbackFunctor)
    3939    {
     40        ASSERT(m_isValid.load());
    4041        if (isMainThread()) {
    4142            removePendingNotification(notificationType);
    … …  
    4748            return;
    4849
    49         auto weakThis = m_weakPtrFactory.createWeakPtr();
    50         std::function<void ()> callback(callbackFunctor);
    51         RunLoop::main().dispatch([weakThis, notificationType, callback] {
    52             if (weakThis && weakThis->removePendingNotification(notificationType))
     50        RunLoop::main().dispatch([this, protectedThis = makeRef(*this), notificationType, callback = std::function<void()>(callbackFunctor)] {
     51            if (!m_isValid.load())
     52                return;
     53            if (removePendingNotification(notificationType))
    5354                callback();
    5455        });
    … …  
    5758    void cancelPendingNotifications(unsigned mask = 0)
    5859    {
     60        ASSERT(m_isValid.load());
    5961        LockHolder locker(m_pendingNotificationsLock);
    6062        if (mask)
    … …  
    6466    }
    6567
     68    void invalidate()
     69    {
     70        ASSERT(m_isValid.load());
     71        m_isValid.store(false);
     72    }
     73
    6674private:
     75    MainThreadNotifier()
     76    {
     77        m_isValid.store(true);
     78    }
    6779
    6880    bool addPendingNotification(T notificationType)
    … …  
    8597    }
    8698
    87     WeakPtrFactory<MainThreadNotifier> m_weakPtrFactory;
    8899    Lock m_pendingNotificationsLock;
    89100    unsigned m_pendingNotifications { 0 };
     101    Atomic<bool> m_isValid;
    90102};
    91 
    92103
    93104} // namespace WebCore
    94105
    95 #endif // MainThreadNotifier_h

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

    r217367 r219817  
    621621void MediaPlayerPrivateGStreamer::videoChangedCallback(MediaPlayerPrivateGStreamer* player)
    622622{
    623     player->m_notifier.notify(MainThreadNotification::VideoChanged, [player] { player->notifyPlayerOfVideo(); });
     623    player->m_notifier->notify(MainThreadNotification::VideoChanged, [player] { player->notifyPlayerOfVideo(); });
    624624}
    625625
    … …  
    675675void MediaPlayerPrivateGStreamer::videoSinkCapsChangedCallback(MediaPlayerPrivateGStreamer* player)
    676676{
    677     player->m_notifier.notify(MainThreadNotification::VideoCapsChanged, [player] { player->notifyPlayerOfVideoCaps(); });
     677    player->m_notifier->notify(MainThreadNotification::VideoCapsChanged, [player] { player->notifyPlayerOfVideoCaps(); });
    678678}
    679679
    … …  
    686686void MediaPlayerPrivateGStreamer::audioChangedCallback(MediaPlayerPrivateGStreamer* player)
    687687{
    688     player->m_notifier.notify(MainThreadNotification::AudioChanged, [player] { player->notifyPlayerOfAudio(); });
     688    player->m_notifier->notify(MainThreadNotification::AudioChanged, [player] { player->notifyPlayerOfAudio(); });
    689689}
    690690
    … …  
    739739void MediaPlayerPrivateGStreamer::textChangedCallback(MediaPlayerPrivateGStreamer* player)
    740740{
    741     player->m_notifier.notify(MainThreadNotification::TextChanged, [player] { player->notifyPlayerOfText(); });
     741    player->m_notifier->notify(MainThreadNotification::TextChanged, [player] { player->notifyPlayerOfText(); });
    742742}
    743743

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

    r217367 r219817  
    201201
    202202MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase(MediaPlayer* player)
    203     : m_player(player)
     203    : m_notifier(MainThreadNotifier<MainThreadNotification>::create())
     204    , m_player(player)
    204205    , m_fpsSink(nullptr)
    205206    , m_readyState(MediaPlayer::HaveNothing)
    … …  
    224225    m_protectionCondition.notifyOne();
    225226#endif
    226     m_notifier.cancelPendingNotifications();
    227 
    228 #if USE(GSTREAMER_GL) || USE(COORDINATED_GRAPHICS_THREADED)
    229     m_drawTimer.stop();
    230     {
    231         LockHolder locker(m_drawMutex);
    232         m_drawCondition.notifyOne();
    233     }
    234 #endif
     227
     228    m_notifier->invalidate();
     229
     230    cancelRepaint();
    235231
    236232    if (m_videoSink) {
    … …  
    573569    GST_DEBUG("Volume changed to: %f", player->volume());
    574570
    575     player->m_notifier.notify(MainThreadNotification::VolumeChanged, [player] { player->notifyPlayerOfVolumeChange(); });
     571    player->m_notifier->notify(MainThreadNotification::VolumeChanged, [player] { player->notifyPlayerOfVolumeChange(); });
    576572}
    577573
    … …  
    622618{
    623619    // This is called when m_volumeElement receives the notify::mute signal.
    624     player->m_notifier.notify(MainThreadNotification::MuteChanged, [player] { player->notifyPlayerOfMute(); });
     620    player->m_notifier->notify(MainThreadNotification::MuteChanged, [player] { player->notifyPlayerOfMute(); });
    625621}
    626622
    … …  
    762758    if (triggerResize) {
    763759        GST_DEBUG("First sample reached the sink, triggering video dimensions update");
    764         m_notifier.notify(MainThreadNotification::SizeChanged, [this] { m_player->sizeChanged(); });
     760        m_notifier->notify(MainThreadNotification::SizeChanged, [this] { m_player->sizeChanged(); });
    765761    }
    766762
    … …  
    802798{
    803799    player->triggerRepaint(sample);
     800}
     801
     802void MediaPlayerPrivateGStreamerBase::cancelRepaint()
     803{
     804#if USE(TEXTURE_MAPPER_GL) || USE(COORDINATED_GRAPHICS_THREADED)
     805    m_drawTimer.stop();
     806    LockHolder locker(m_drawMutex);
     807    m_drawCondition.notifyOne();
     808#endif
     809}
     810
     811void MediaPlayerPrivateGStreamerBase::repaintCancelledCallback(MediaPlayerPrivateGStreamerBase* player)
     812{
     813    player->cancelRepaint();
    804814}
    805815
    … …  
    11411151        m_videoSink = webkitVideoSinkNew();
    11421152        g_signal_connect_swapped(m_videoSink.get(), "repaint-requested", G_CALLBACK(repaintCallback), this);
     1153        g_signal_connect_swapped(m_videoSink.get(), "repaint-cancelled", G_CALLBACK(repaintCancelledCallback), this);
    11431154    }
    11441155

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h

    r217367 r219817  
    173173    void triggerRepaint(GstSample*);
    174174    void repaint();
     175    void cancelRepaint();
    175176
    176177    static void repaintCallback(MediaPlayerPrivateGStreamerBase*, GstSample*);
     178    static void repaintCancelledCallback(MediaPlayerPrivateGStreamerBase*);
    177179
    178180    void notifyPlayerOfVolumeChange();
    … …  
    194196    };
    195197
    196     MainThreadNotifier<MainThreadNotification> m_notifier;
     198    Ref<MainThreadNotifier<MainThreadNotification>> m_notifier;
    197199    MediaPlayer* m_player;
    198200    GRefPtr<GstElement> m_pipeline;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp

    r217367 r219817  
    4545
    4646TrackPrivateBaseGStreamer::TrackPrivateBaseGStreamer(TrackPrivateBase* owner, gint index, GRefPtr<GstPad> pad)
    47     : m_index(index)
     47    : m_notifier(MainThreadNotifier<MainThreadNotification>::create())
     48    , m_index(index)
    4849    , m_pad(pad)
    4950    , m_owner(owner)
    … …  
    6263{
    6364    disconnect();
     65    m_notifier->invalidate();
    6466}
    6567
    … …  
    6971        return;
    7072
    71     m_notifier.cancelPendingNotifications();
     73    m_notifier->cancelPendingNotifications();
    7274    g_signal_handlers_disconnect_matched(m_pad.get(), G_SIGNAL_MATCH_DATA, 0, 0, nullptr, nullptr, this);
    7375
    … …  
    7880void TrackPrivateBaseGStreamer::activeChangedCallback(TrackPrivateBaseGStreamer* track)
    7981{
    80     track->m_notifier.notify(MainThreadNotification::ActiveChanged, [track] { track->notifyTrackOfActiveChanged(); });
     82    track->m_notifier->notify(MainThreadNotification::ActiveChanged, [track] { track->notifyTrackOfActiveChanged(); });
    8183}
    8284
    … …  
    99101    }
    100102
    101     m_notifier.notify(MainThreadNotification::TagsChanged, [this] { notifyTrackOfTagsChanged(); });
     103    m_notifier->notify(MainThreadNotification::TagsChanged, [this] { notifyTrackOfTagsChanged(); });
    102104}
    103105

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h

    r217367 r219817  
    6464    };
    6565
    66     MainThreadNotifier<MainThreadNotification> m_notifier;
     66    Ref<MainThreadNotifier<MainThreadNotification>> m_notifier;
    6767    gint m_index;
    6868    AtomicString m_label;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp

    r217367 r219817  
    5959enum {
    6060    REPAINT_REQUESTED,
     61    REPAINT_CANCELLED,
    6162    LAST_SIGNAL
    6263};
    … …  
    191192{
    192193    g_signal_emit(sink, webkitVideoSinkSignals[REPAINT_REQUESTED], 0, sample);
     194}
     195
     196static void webkitVideoSinkRepaintCancelled(WebKitVideoSink* sink)
     197{
     198    g_signal_emit(sink, webkitVideoSinkSignals[REPAINT_CANCELLED], 0);
    193199}
    194200
    … …  
    285291
    286292    priv->scheduler.stop();
     293    webkitVideoSinkRepaintCancelled(WEBKIT_VIDEO_SINK(baseSink));
    287294
    288295    return GST_CALL_PARENT_WITH_DEFAULT(GST_BASE_SINK_CLASS, unlock, (baseSink), TRUE);
    … …  
    303310
    304311    priv->scheduler.stop();
     312    webkitVideoSinkRepaintCancelled(WEBKIT_VIDEO_SINK(baseSink));
    305313    if (priv->currentCaps) {
    306314        gst_caps_unref(priv->currentCaps);
    … …  
    404412            1, // Only one parameter
    405413            GST_TYPE_SAMPLE);
     414    webkitVideoSinkSignals[REPAINT_CANCELLED] = g_signal_new("repaint-cancelled",
     415        G_TYPE_FROM_CLASS(klass),
     416        G_SIGNAL_RUN_LAST,
     417        0, // Class offset
     418        nullptr, // Accumulator
     419        nullptr, // Accumulator data
     420        g_cclosure_marshal_generic,
     421        G_TYPE_NONE, // Return type
     422        0, // No parameters
     423        G_TYPE_NONE);
    406424}
    407425

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

    r217367 r219817  
    165165
    166166    bool createdInMainThread;
    167     MainThreadNotifier<MainThreadSourceNotification> notifier;
     167    RefPtr<MainThreadNotifier<MainThreadSourceNotification>> notifier;
    168168    GRefPtr<GstBuffer> buffer;
    169169};
    … …  
    278278
    279279    priv->createdInMainThread = isMainThread();
     280    priv->notifier = MainThreadNotifier<MainThreadSourceNotification>::create();
    280281
    281282    priv->appsrc = GST_APP_SRC(gst_element_factory_make("appsrc", nullptr));
    … …  
    327328static void webKitWebSrcDispose(GObject* object)
    328329{
    329     WebKitWebSrc* src = WEBKIT_WEB_SRC(object);
    330     WebKitWebSrcPrivate* priv = src->priv;
     330    WebKitWebSrcPrivate* priv = WEBKIT_WEB_SRC(object)->priv;
     331    if (priv->notifier) {
     332        priv->notifier->invalidate();
     333        priv->notifier = nullptr;
     334    }
    331335
    332336    priv->player = nullptr;
    … …  
    409413    if (priv->resource || (priv->loader && !priv->keepAlive)) {
    410414        GRefPtr<WebKitWebSrc> protector = WTF::ensureGRef(src);
    411         priv->notifier.cancelPendingNotifications(MainThreadSourceNotification::NeedData | MainThreadSourceNotification::EnoughData | MainThreadSourceNotification::Seek);
    412         priv->notifier.notify(MainThreadSourceNotification::Stop, [protector, keepAlive = priv->keepAlive] {
     415        priv->notifier->cancelPendingNotifications(MainThreadSourceNotification::NeedData | MainThreadSourceNotification::EnoughData | MainThreadSourceNotification::Seek);
     416        priv->notifier->notify(MainThreadSourceNotification::Stop, [protector, keepAlive = priv->keepAlive] {
    413417            WebKitWebSrcPrivate* priv = protector->priv;
    414418
    … …  
    593597    locker.unlock();
    594598    GRefPtr<WebKitWebSrc> protector = WTF::ensureGRef(src);
    595     priv->notifier.notify(MainThreadSourceNotification::Start, [protector, request = WTFMove(request)] {
     599    priv->notifier->notify(MainThreadSourceNotification::Start, [protector, request = WTFMove(request)] {
    596600        WebKitWebSrcPrivate* priv = protector->priv;
    597601
    … …  
    793797
    794798    GRefPtr<WebKitWebSrc> protector = WTF::ensureGRef(src);
    795     priv->notifier.notify(MainThreadSourceNotification::NeedData, [protector] {
     799    priv->notifier->notify(MainThreadSourceNotification::NeedData, [protector] {
    796800        WebKitWebSrcPrivate* priv = protector->priv;
    797801        if (priv->resource)
    … …  
    818822
    819823    GRefPtr<WebKitWebSrc> protector = WTF::ensureGRef(src);
    820     priv->notifier.notify(MainThreadSourceNotification::EnoughData, [protector] {
     824    priv->notifier->notify(MainThreadSourceNotification::EnoughData, [protector] {
    821825        WebKitWebSrcPrivate* priv = protector->priv;
    822826        if (priv->resource)
    … …  
    849853
    850854    GRefPtr<WebKitWebSrc> protector = WTF::ensureGRef(src);
    851     priv->notifier.notify(MainThreadSourceNotification::Seek, [protector] {
     855    priv->notifier->notify(MainThreadSourceNotification::Seek, [protector] {
    852856        webKitWebSrcStop(protector.get());
    853857        webKitWebSrcStart(protector.get());

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/gtk/RenderThemeGadget.cpp

    r217367 r219817  
    6161    gtk_style_context_set_path(context.get(), path);
    6262    gtk_style_context_set_parent(context.get(), parent);
    63     // Unfortunately, we have to explicitly set the state again here for it to take effect.
    64     gtk_style_context_set_state(context.get(), gtk_widget_path_iter_get_state(path, -1));
    6563    return context;
    6664}
    … …  
    7371    for (const auto* className : info.classList)
    7472        gtk_widget_path_iter_add_class(path, -1, className);
    75     gtk_widget_path_iter_set_state(path, -1, static_cast<GtkStateFlags>(gtk_widget_path_iter_get_state(path, -1) | info.state));
    7673}
    7774
    … …  
    145142    gtk_style_context_get(m_context.get(), gtk_style_context_get_state(m_context.get()), "opacity", &returnValue, nullptr);
    146143    return returnValue;
     144}
     145
     146GtkStateFlags RenderThemeGadget::state() const
     147{
     148    return gtk_style_context_get_state(m_context.get());
     149}
     150
     151void RenderThemeGadget::setState(GtkStateFlags state)
     152{
     153    gtk_style_context_set_state(m_context.get(), state);
    147154}
    148155

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/gtk/RenderThemeGadget.h

    r217367 r219817  
    5757        Type type;
    5858        const char* name;
    59         GtkStateFlags state;
    6059        Vector<const char*> classList;
    6160    };
    … …  
    7776
    7877    GtkStyleContext* context() const { return m_context.get(); }
     78
     79    GtkStateFlags state() const;
     80    void setState(GtkStateFlags);
    7981
    8082protected:

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp

    r217367 r219817  
    3131#include "PlatformContextCairo.h"
    3232#include "PlatformMouseEvent.h"
    33 #include "RenderThemeGadget.h"
     33#include "RenderThemeWidget.h"
    3434#include "ScrollView.h"
    3535#include "Scrollbar.h"
    … …  
    9797void ScrollbarThemeGtk::themeChanged()
    9898{
     99#if GTK_CHECK_VERSION(3, 20, 0)
     100    RenderThemeWidget::clearCache();
     101#endif
    99102    updateThemeProperties();
    100103}
    … …  
    103106void ScrollbarThemeGtk::updateThemeProperties()
    104107{
    105     auto steppers = static_cast<RenderThemeScrollbarGadget*>(RenderThemeGadget::create({ RenderThemeGadget::Type::Scrollbar, "scrollbar", GTK_STATE_FLAG_NORMAL, { } }).get())->steppers();
    106     m_hasBackButtonStartPart = steppers.contains(RenderThemeScrollbarGadget::Steppers::Backward);
    107     m_hasForwardButtonEndPart = steppers.contains(RenderThemeScrollbarGadget::Steppers::Forward);
    108     m_hasBackButtonEndPart = steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryBackward);
    109     m_hasForwardButtonStartPart = steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryForward);
     108    auto& scrollbar = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::VerticalScrollbarRight));
     109    m_hasBackButtonStartPart = scrollbar.stepper(RenderThemeScrollbarGadget::Steppers::Backward);
     110    m_hasForwardButtonEndPart = scrollbar.stepper(RenderThemeScrollbarGadget::Steppers::Forward);
     111    m_hasBackButtonEndPart = scrollbar.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryBackward);
     112    m_hasForwardButtonStartPart = scrollbar.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryForward);
    110113}
    111114#else
    … …  
    169172}
    170173
    171 static std::unique_ptr<RenderThemeGadget> scrollbarGadgetForLayout(Scrollbar& scrollbar)
    172 {
    173     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Scrollbar, "scrollbar", scrollbarPartStateFlags(scrollbar, AllParts), { } };
     174static RenderThemeWidget::Type widgetTypeForScrollbar(Scrollbar& scrollbar, GtkStateFlags scrollbarState)
     175{
    174176    if (scrollbar.orientation() == VerticalScrollbar) {
    175         info.classList.append("vertical");
    176         info.classList.append("right");
    177     } else {
    178         info.classList.append("horizontal");
    179         info.classList.append("bottom");
    180     }
    181     if (scrollbar.isOverlayScrollbar())
    182         info.classList.append("overlay-indicator");
    183     if (info.state & GTK_STATE_FLAG_PRELIGHT)
    184         info.classList.append("hovering");
    185 
    186     return RenderThemeGadget::create(info);
    187 }
    188 
    189 static std::unique_ptr<RenderThemeBoxGadget> contentsGadgetForLayout(Scrollbar& scrollbar, RenderThemeGadget* parent, IntRect& contentsRect, Vector<int, 4>& steppersPosition)
    190 {
    191     Vector<RenderThemeGadget::Info> children;
    192     auto steppers = static_cast<RenderThemeScrollbarGadget*>(parent)->steppers();
    193     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Backward)) {
    194         steppersPosition[0] = 0;
    195         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, BackButtonStartPart), { "up" } });
    196     }
    197     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
    198         steppersPosition[1] = children.size();
    199         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart), { "down" } });
    200     }
    201     children.append({ RenderThemeGadget::Type::Generic, "trough", scrollbarPartStateFlags(scrollbar, BackTrackPart), { } });
    202     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryBackward)) {
    203         steppersPosition[2] = children.size();
    204         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, BackButtonEndPart), { "up" } });
    205     }
    206     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Forward)) {
    207         steppersPosition[3] = children.size();
    208         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart), { "down" } });
    209     }
    210     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "contents", GTK_STATE_FLAG_NORMAL, { } };
    211     auto contentsGadget = std::make_unique<RenderThemeBoxGadget>(info, scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL,
    212         children, parent);
    213 
    214     GtkBorder scrollbarContentsBox = parent->contentsBox();
    215     GtkBorder contentsContentsBox = contentsGadget->contentsBox();
     177        if (scrollbar.scrollableArea().shouldPlaceBlockDirectionScrollbarOnLeft())
     178            return scrollbarState & GTK_STATE_FLAG_PRELIGHT ? RenderThemeWidget::Type::VerticalScrollbarLeft : RenderThemeWidget::Type::VerticalScrollIndicatorLeft;
     179        return scrollbarState & GTK_STATE_FLAG_PRELIGHT ? RenderThemeWidget::Type::VerticalScrollbarRight : RenderThemeWidget::Type::VerticalScrollIndicatorRight;
     180    }
     181    return scrollbarState & GTK_STATE_FLAG_PRELIGHT ? RenderThemeWidget::Type::HorizontalScrollbar : RenderThemeWidget::Type::HorizontalScrollIndicator;
     182}
     183
     184static IntRect contentsRectangle(Scrollbar& scrollbar, RenderThemeScrollbar& scrollbarWidget)
     185{
     186    GtkBorder scrollbarContentsBox = scrollbarWidget.scrollbar().contentsBox();
     187    GtkBorder contentsContentsBox = scrollbarWidget.contents().contentsBox();
    216188    GtkBorder padding;
    217189    padding.left = scrollbarContentsBox.left + contentsContentsBox.left;
    … …  
    219191    padding.top = scrollbarContentsBox.top + contentsContentsBox.top;
    220192    padding.bottom = scrollbarContentsBox.bottom + contentsContentsBox.bottom;
    221     contentsRect = scrollbar.frameRect();
     193    IntRect contentsRect = scrollbar.frameRect();
    222194    contentsRect.move(padding.left, padding.top);
    223195    contentsRect.contract(padding.left + padding.right, padding.top + padding.bottom);
    224     return contentsGadget;
     196    return contentsRect;
    225197}
    226198
    227199IntRect ScrollbarThemeGtk::trackRect(Scrollbar& scrollbar, bool /*painting*/)
    228200{
    229     auto scrollbarGadget = scrollbarGadgetForLayout(scrollbar);
    230     IntRect rect;
    231     Vector<int, 4> steppersPosition(4, -1);
    232     auto contentsGadget = contentsGadgetForLayout(scrollbar, scrollbarGadget.get(), rect, steppersPosition);
    233 
    234     if (steppersPosition[0] != -1) {
    235         IntSize stepperSize = contentsGadget->child(steppersPosition[0])->preferredSize();
     201    auto scrollbarState = scrollbarPartStateFlags(scrollbar, AllParts);
     202    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(widgetTypeForScrollbar(scrollbar, scrollbarState)));
     203    scrollbarWidget.scrollbar().setState(scrollbarState);
     204
     205    IntRect rect = contentsRectangle(scrollbar, scrollbarWidget);
     206    if (auto* backwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Backward)) {
     207        backwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonStartPart));
     208        IntSize stepperSize = backwardStepper->preferredSize();
    236209        if (scrollbar.orientation() == VerticalScrollbar) {
    237210            rect.move(0, stepperSize.height());
    … …  
    242215        }
    243216    }
    244     if (steppersPosition[1] != -1) {
    245         IntSize stepperSize = contentsGadget->child(steppersPosition[1])->preferredSize();
     217    if (auto* secondaryForwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
     218        secondaryForwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart));
     219        IntSize stepperSize = secondaryForwardStepper->preferredSize();
    246220        if (scrollbar.orientation() == VerticalScrollbar) {
    247221            rect.move(0, stepperSize.height());
    … …  
    252226        }
    253227    }
    254     if (steppersPosition[2] != -1) {
     228    if (auto* secondaryBackwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryBackward)) {
     229        secondaryBackwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonEndPart));
    255230        if (scrollbar.orientation() == VerticalScrollbar)
    256             rect.contract(0, contentsGadget->child(steppersPosition[2])->preferredSize().height());
     231            rect.contract(0, secondaryBackwardStepper->preferredSize().height());
    257232        else
    258             rect.contract(contentsGadget->child(steppersPosition[2])->preferredSize().width(), 0);
    259     }
    260     if (steppersPosition[3] != -1) {
     233            rect.contract(secondaryBackwardStepper->preferredSize().width(), 0);
     234    }
     235    if (auto* forwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Forward)) {
     236        forwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart));
    261237        if (scrollbar.orientation() == VerticalScrollbar)
    262             rect.contract(0, contentsGadget->child(steppersPosition[3])->preferredSize().height());
     238            rect.contract(0, forwardStepper->preferredSize().height());
    263239        else
    264             rect.contract(contentsGadget->child(steppersPosition[3])->preferredSize().width(), 0);
     240            rect.contract(forwardStepper->preferredSize().width(), 0);
    265241    }
    266242
    … …  
    328304        return IntRect();
    329305
    330     auto scrollbarGadget = scrollbarGadgetForLayout(scrollbar);
    331     IntRect rect;
    332     Vector<int, 4> steppersPosition(4, -1);
    333     auto contentsGadget = contentsGadgetForLayout(scrollbar, scrollbarGadget.get(), rect, steppersPosition);
    334 
    335     if (part == BackButtonStartPart)
    336         return IntRect(rect.location(), contentsGadget->child(0)->preferredSize());
    337 
    338     // Secondary back.
    339     if (steppersPosition[1] != -1) {
    340         IntSize preferredSize = contentsGadget->child(steppersPosition[1])->preferredSize();
     306    auto scrollbarState = scrollbarPartStateFlags(scrollbar, AllParts);
     307    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(widgetTypeForScrollbar(scrollbar, scrollbarState)));
     308    scrollbarWidget.scrollbar().setState(scrollbarState);
     309
     310    IntRect rect = contentsRectangle(scrollbar, scrollbarWidget);
     311    if (part == BackButtonStartPart) {
     312        auto* backwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Backward);
     313        ASSERT(backwardStepper);
     314        backwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonStartPart));
     315        return IntRect(rect.location(), backwardStepper->preferredSize());
     316    }
     317
     318    if (auto* secondaryForwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
     319        secondaryForwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart));
     320        IntSize preferredSize = secondaryForwardStepper->preferredSize();
    341321        if (scrollbar.orientation() == VerticalScrollbar) {
    342322            rect.move(0, preferredSize.height());
    … …  
    348328    }
    349329
    350     if (steppersPosition[3] != -1) {
     330    if (auto* secondaryBackwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryBackward)) {
     331        secondaryBackwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonEndPart));
    351332        if (scrollbar.orientation() == VerticalScrollbar)
    352             rect.contract(0, contentsGadget->child(steppersPosition[3])->preferredSize().height());
     333            rect.contract(0, secondaryBackwardStepper->preferredSize().height());
    353334        else
    354             rect.contract(contentsGadget->child(steppersPosition[3])->preferredSize().width(), 0);
    355     }
    356 
    357     IntSize preferredSize = contentsGadget->child(steppersPosition[2])->preferredSize();
     335            rect.contract(secondaryBackwardStepper->preferredSize().width(), 0);
     336    }
     337
     338    auto* forwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Forward);
     339    ASSERT(forwardStepper);
     340    forwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart));
     341    IntSize preferredSize = forwardStepper->preferredSize();
    358342    if (scrollbar.orientation() == VerticalScrollbar)
    359343        rect.move(0, rect.height() - preferredSize.height());
    … …  
    370354        return IntRect();
    371355
    372     auto scrollbarGadget = scrollbarGadgetForLayout(scrollbar);
    373     IntRect rect;
    374     Vector<int, 4> steppersPosition(4, -1);
    375     auto contentsGadget = contentsGadgetForLayout(scrollbar, scrollbarGadget.get(), rect, steppersPosition);
    376 
    377     if (steppersPosition[0] != -1) {
    378         IntSize preferredSize = contentsGadget->child(steppersPosition[0])->preferredSize();
     356    auto scrollbarState = scrollbarPartStateFlags(scrollbar, AllParts);
     357    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(widgetTypeForScrollbar(scrollbar, scrollbarState)));
     358    scrollbarWidget.scrollbar().setState(scrollbarState);
     359
     360    IntRect rect = contentsRectangle(scrollbar, scrollbarWidget);
     361    if (auto* backwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Backward)) {
     362        backwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonStartPart));
     363        IntSize preferredSize = backwardStepper->preferredSize();
    379364        if (scrollbar.orientation() == VerticalScrollbar) {
    380365            rect.move(0, preferredSize.height());
    … …  
    386371    }
    387372
    388     if (steppersPosition[1] != -1) {
    389         IntSize preferredSize = contentsGadget->child(steppersPosition[1])->preferredSize();
     373    if (auto* secondaryForwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
     374        secondaryForwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart));
     375        IntSize preferredSize = secondaryForwardStepper->preferredSize();
    390376        if (part == ForwardButtonStartPart)
    391377            return IntRect(rect.location(), preferredSize);
    … …  
    400386    }
    401387
    402     // Forward button.
    403     IntSize preferredSize = contentsGadget->child(steppersPosition[3])->preferredSize();
     388    auto* forwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Forward);
     389    ASSERT(forwardStepper);
     390    forwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart));
     391    IntSize preferredSize = forwardStepper->preferredSize();
    404392    if (scrollbar.orientation() == VerticalScrollbar)
    405393        rect.move(0, rect.height() - preferredSize.height());
    … …  
    478466        return true;
    479467
    480     bool scrollbarOnLeft = scrollbar.scrollableArea().shouldPlaceBlockDirectionScrollbarOnLeft();
    481 
    482     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Scrollbar, "scrollbar", scrollbarPartStateFlags(scrollbar, AllParts, true), { } };
    483     if (scrollbar.orientation() == VerticalScrollbar) {
    484         info.classList.append("vertical");
    485         info.classList.append(scrollbarOnLeft ? "left" : "right");
    486     } else {
    487         info.classList.append("horizontal");
    488         info.classList.append("bottom");
    489     }
     468    auto scrollbarState = scrollbarPartStateFlags(scrollbar, AllParts, true);
     469    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(widgetTypeForScrollbar(scrollbar, scrollbarState)));
     470    auto& scrollbarGadget = scrollbarWidget.scrollbar();
     471    scrollbarGadget.setState(scrollbarState);
    490472    if (m_usesOverlayScrollbars)
    491         info.classList.append("overlay-indicator");
    492     if (info.state & GTK_STATE_FLAG_PRELIGHT)
    493         info.classList.append("hovering");
    494     if (scrollbar.pressedPart() != NoPart)
    495         info.classList.append("dragging");
    496     auto scrollbarGadget = RenderThemeGadget::create(info);
    497     if (m_usesOverlayScrollbars)
    498         opacity *= scrollbarGadget->opacity();
     473        opacity *= scrollbarGadget.opacity();
    499474    if (!opacity)
    500475        return true;
    501476
    502     info.type = RenderThemeGadget::Type::Generic;
    503     info.name = "contents";
    504     info.state = GTK_STATE_FLAG_NORMAL;
    505     info.classList.clear();
    506     Vector<RenderThemeGadget::Info> children;
    507     auto steppers = static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->steppers();
    508     unsigned steppersPosition[4] = { 0, 0, 0, 0 };
    509     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Backward)) {
    510         steppersPosition[0] = children.size();
    511         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, BackButtonStartPart), { "up" } });
    512     }
    513     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
    514         steppersPosition[1] = children.size();
    515         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart), { "down" } });
    516     }
    517     unsigned troughPosition = children.size();
    518     children.append({ RenderThemeGadget::Type::Generic, "trough", scrollbarPartStateFlags(scrollbar, BackTrackPart), { } });
    519     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryBackward)) {
    520         steppersPosition[2] = children.size();
    521         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, BackButtonEndPart), { "up" } });
    522     }
    523     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Forward)) {
    524         steppersPosition[3] = children.size();
    525         children.append({ RenderThemeGadget::Type::Generic, "button", scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart), { "down" } });
    526     }
    527     auto contentsGadget = std::make_unique<RenderThemeBoxGadget>(info, scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL,
    528         children, scrollbarGadget.get());
    529     RenderThemeGadget* troughGadget = contentsGadget->child(troughPosition);
    530 
    531     IntSize preferredSize = contentsGadget->preferredSize();
    532     std::unique_ptr<RenderThemeGadget> sliderGadget;
     477    auto& trough = scrollbarWidget.trough();
     478    trough.setState(scrollbarPartStateFlags(scrollbar, BackTrackPart));
     479
     480    auto* backwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Backward);
     481    if (backwardStepper)
     482        backwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonStartPart));
     483    auto* secondaryForwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryForward);
     484    if (secondaryForwardStepper)
     485        secondaryForwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonStartPart));
     486    auto* secondaryBackwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::SecondaryBackward);
     487    if (secondaryBackwardStepper)
     488        secondaryBackwardStepper->setState(scrollbarPartStateFlags(scrollbar, BackButtonEndPart));
     489    auto* forwardStepper = scrollbarWidget.stepper(RenderThemeScrollbarGadget::Steppers::Forward);
     490    if (forwardStepper)
     491        forwardStepper->setState(scrollbarPartStateFlags(scrollbar, ForwardButtonEndPart));
     492
     493    IntSize preferredSize = scrollbarWidget.contents().preferredSize();
    533494    int thumbSize = thumbLength(scrollbar);
    534495    if (thumbSize) {
    535         info.name = "slider";
    536         info.state = scrollbarPartStateFlags(scrollbar, ThumbPart);
    537         sliderGadget = RenderThemeGadget::create(info, troughGadget);
    538         preferredSize = preferredSize.expandedTo(sliderGadget->preferredSize());
    539     }
    540     preferredSize += scrollbarGadget->preferredSize() - scrollbarGadget->minimumSize();
     496        scrollbarWidget.slider().setState(scrollbarPartStateFlags(scrollbar, ThumbPart));
     497        preferredSize = preferredSize.expandedTo(scrollbarWidget.slider().preferredSize());
     498    }
     499    preferredSize += scrollbarGadget.preferredSize() - scrollbarGadget.minimumSize();
    541500
    542501    FloatRect contentsRect(rect);
    … …  
    545504    if (scrollbar.orientation() == VerticalScrollbar) {
    546505        if (rect.width() != preferredSize.width()) {
    547             if (!scrollbarOnLeft)
     506            if (!scrollbar.scrollableArea().shouldPlaceBlockDirectionScrollbarOnLeft())
    548507                contentsRect.move(std::abs(rect.width() - preferredSize.width()), 0);
    549508            contentsRect.setWidth(preferredSize.width());
    … …  
    562521    }
    563522
    564     scrollbarGadget->render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
    565     contentsGadget->render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
    566 
    567     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Backward)) {
    568         RenderThemeGadget* buttonGadget = contentsGadget->child(steppersPosition[0]);
     523    scrollbarGadget.render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
     524    scrollbarWidget.contents().render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
     525
     526    if (backwardStepper) {
    569527        FloatRect buttonRect = contentsRect;
    570528        if (scrollbar.orientation() == VerticalScrollbar)
    571             buttonRect.setHeight(buttonGadget->preferredSize().height());
     529            buttonRect.setHeight(backwardStepper->preferredSize().height());
    572530        else
    573             buttonRect.setWidth(buttonGadget->preferredSize().width());
    574         static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->renderStepper(graphicsContext.platformContext()->cr(), buttonRect, buttonGadget,
     531            buttonRect.setWidth(backwardStepper->preferredSize().width());
     532        static_cast<RenderThemeScrollbarGadget&>(scrollbarGadget).renderStepper(graphicsContext.platformContext()->cr(), buttonRect, backwardStepper,
    575533            scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL, RenderThemeScrollbarGadget::Steppers::Backward);
    576534        if (scrollbar.orientation() == VerticalScrollbar) {
    … …  
    582540        }
    583541    }
    584     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryForward)) {
    585         RenderThemeGadget* buttonGadget = contentsGadget->child(steppersPosition[1]);
     542    if (secondaryForwardStepper) {
    586543        FloatRect buttonRect = contentsRect;
    587544        if (scrollbar.orientation() == VerticalScrollbar)
    588             buttonRect.setHeight(buttonGadget->preferredSize().height());
     545            buttonRect.setHeight(secondaryForwardStepper->preferredSize().height());
    589546        else
    590             buttonRect.setWidth(buttonGadget->preferredSize().width());
    591         static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->renderStepper(graphicsContext.platformContext()->cr(), buttonRect, buttonGadget,
     547            buttonRect.setWidth(secondaryForwardStepper->preferredSize().width());
     548        static_cast<RenderThemeScrollbarGadget&>(scrollbarGadget).renderStepper(graphicsContext.platformContext()->cr(), buttonRect, secondaryForwardStepper,
    592549            scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL, RenderThemeScrollbarGadget::Steppers::SecondaryForward);
    593550        if (scrollbar.orientation() == VerticalScrollbar) {
    … …  
    599556        }
    600557    }
    601 
    602     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Forward)) {
    603         RenderThemeGadget* buttonGadget = contentsGadget->child(steppersPosition[3]);
     558    if (secondaryBackwardStepper) {
    604559        FloatRect buttonRect = contentsRect;
    605560        if (scrollbar.orientation() == VerticalScrollbar) {
    606             buttonRect.setHeight(buttonGadget->preferredSize().height());
     561            buttonRect.setHeight(secondaryBackwardStepper->preferredSize().height());
    607562            buttonRect.move(0, contentsRect.height() - buttonRect.height());
    608563        } else {
    609             buttonRect.setWidth(buttonGadget->preferredSize().width());
     564            buttonRect.setWidth(secondaryBackwardStepper->preferredSize().width());
    610565            buttonRect.move(contentsRect.width() - buttonRect.width(), 0);
    611566        }
    612         static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->renderStepper(graphicsContext.platformContext()->cr(), buttonRect, buttonGadget,
     567        static_cast<RenderThemeScrollbarGadget&>(scrollbarGadget).renderStepper(graphicsContext.platformContext()->cr(), buttonRect, secondaryBackwardStepper,
     568            scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL, RenderThemeScrollbarGadget::Steppers::SecondaryBackward);
     569        if (scrollbar.orientation() == VerticalScrollbar)
     570            contentsRect.contract(0, buttonRect.height());
     571        else
     572            contentsRect.contract(buttonRect.width(), 0);
     573    }
     574    if (forwardStepper) {
     575        FloatRect buttonRect = contentsRect;
     576        if (scrollbar.orientation() == VerticalScrollbar) {
     577            buttonRect.setHeight(forwardStepper->preferredSize().height());
     578            buttonRect.move(0, contentsRect.height() - buttonRect.height());
     579        } else {
     580            buttonRect.setWidth(forwardStepper->preferredSize().width());
     581            buttonRect.move(contentsRect.width() - buttonRect.width(), 0);
     582        }
     583        static_cast<RenderThemeScrollbarGadget&>(scrollbarGadget).renderStepper(graphicsContext.platformContext()->cr(), buttonRect, forwardStepper,
    613584            scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL, RenderThemeScrollbarGadget::Steppers::Forward);
    614585        if (scrollbar.orientation() == VerticalScrollbar)
    … …  
    617588            contentsRect.contract(buttonRect.width(), 0);
    618589    }
    619     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryBackward)) {
    620         RenderThemeGadget* buttonGadget = contentsGadget->child(steppersPosition[2]);
    621         FloatRect buttonRect = contentsRect;
    622         if (scrollbar.orientation() == VerticalScrollbar) {
    623             buttonRect.setHeight(buttonGadget->preferredSize().height());
    624             buttonRect.move(0, contentsRect.height() - buttonRect.height());
    625         } else {
    626             buttonRect.setWidth(buttonGadget->preferredSize().width());
    627             buttonRect.move(contentsRect.width() - buttonRect.width(), 0);
    628         }
    629         static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->renderStepper(graphicsContext.platformContext()->cr(), buttonRect, buttonGadget,
    630             scrollbar.orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL, RenderThemeScrollbarGadget::Steppers::SecondaryBackward);
    631         if (scrollbar.orientation() == VerticalScrollbar)
    632             contentsRect.contract(0, buttonRect.height());
    633         else
    634             contentsRect.contract(buttonRect.width(), 0);
    635     }
    636 
    637     troughGadget->render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
    638     if (sliderGadget) {
     590
     591    trough.render(graphicsContext.platformContext()->cr(), contentsRect, &contentsRect);
     592
     593    if (thumbSize) {
    639594        if (scrollbar.orientation() == VerticalScrollbar) {
    640595            contentsRect.move(0, thumbPosition(scrollbar));
    641             contentsRect.setWidth(sliderGadget->preferredSize().width());
     596            contentsRect.setWidth(scrollbarWidget.slider().preferredSize().width());
    642597            contentsRect.setHeight(thumbSize);
    643598        } else {
    644599            contentsRect.move(thumbPosition(scrollbar), 0);
    645600            contentsRect.setWidth(thumbSize);
    646             contentsRect.setHeight(sliderGadget->preferredSize().height());
     601            contentsRect.setHeight(scrollbarWidget.slider().preferredSize().height());
    647602        }
    648603        if (contentsRect.intersects(damageRect))
    649             sliderGadget->render(graphicsContext.platformContext()->cr(), contentsRect);
     604            scrollbarWidget.slider().render(graphicsContext.platformContext()->cr(), contentsRect);
    650605    }
    651606
    … …  
    847802int ScrollbarThemeGtk::scrollbarThickness(ScrollbarControlSize)
    848803{
    849     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Scrollbar, "scrollbar", GTK_STATE_FLAG_PRELIGHT, { "vertical", "right", "hovering" } };
    850     if (m_usesOverlayScrollbars)
    851         info.classList.append("overlay-indicator");
    852     auto scrollbarGadget = RenderThemeGadget::create(info);
    853     info.type = RenderThemeGadget::Type::Generic;
    854     info.name = "contents";
    855     info.state = GTK_STATE_FLAG_NORMAL;
    856     info.classList.clear();
    857     Vector<RenderThemeGadget::Info> children;
    858     auto steppers = static_cast<RenderThemeScrollbarGadget*>(scrollbarGadget.get())->steppers();
    859     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Backward))
    860         children.append({ RenderThemeGadget::Type::Generic, "button", GTK_STATE_FLAG_NORMAL, { "up" } });
    861     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryForward))
    862         children.append({ RenderThemeGadget::Type::Generic, "button", GTK_STATE_FLAG_NORMAL, { "down" } });
    863     unsigned troughPositon = children.size();
    864     children.append({ RenderThemeGadget::Type::Generic, "trough", GTK_STATE_FLAG_PRELIGHT, { } });
    865     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::SecondaryBackward))
    866         children.append({ RenderThemeGadget::Type::Generic, "button", GTK_STATE_FLAG_NORMAL, { "up" } });
    867     if (steppers.contains(RenderThemeScrollbarGadget::Steppers::Forward))
    868         children.append({ RenderThemeGadget::Type::Generic, "button", GTK_STATE_FLAG_NORMAL, { "down" } });
    869     auto contentsGadget = std::make_unique<RenderThemeBoxGadget>(info, GTK_ORIENTATION_VERTICAL, children, scrollbarGadget.get());
    870     info.name = "slider";
    871     auto sliderGadget = RenderThemeGadget::create(info, contentsGadget->child(troughPositon));
    872     IntSize contentsPreferredSize = contentsGadget->preferredSize();
    873     contentsPreferredSize = contentsPreferredSize.expandedTo(sliderGadget->preferredSize());
    874     IntSize preferredSize = contentsPreferredSize + scrollbarGadget->preferredSize() - scrollbarGadget->minimumSize();
    875 
     804    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::VerticalScrollbarRight));
     805    scrollbarWidget.scrollbar().setState(GTK_STATE_FLAG_PRELIGHT);
     806    IntSize contentsPreferredSize = scrollbarWidget.contents().preferredSize();
     807    contentsPreferredSize = contentsPreferredSize.expandedTo(scrollbarWidget.slider().preferredSize());
     808    IntSize preferredSize = contentsPreferredSize + scrollbarWidget.scrollbar().preferredSize() - scrollbarWidget.scrollbar().minimumSize();
    876809    return preferredSize.width();
    877810}
    … …  
    888821int ScrollbarThemeGtk::minimumThumbLength(Scrollbar& scrollbar)
    889822{
    890     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Scrollbar, "scrollbar", GTK_STATE_FLAG_PRELIGHT, { "vertical", "right", "hovering" } };
    891     if (m_usesOverlayScrollbars)
    892         info.classList.append("overlay-indicator");
    893     auto scrollbarGadget = RenderThemeGadget::create(info);
    894     info.type = RenderThemeGadget::Type::Generic;
    895     info.name = "contents";
    896     info.state = GTK_STATE_FLAG_NORMAL;
    897     info.classList.clear();
    898     Vector<RenderThemeGadget::Info> children = {{ RenderThemeGadget::Type::Generic, "trough", GTK_STATE_FLAG_PRELIGHT, { } } };
    899     auto contentsGadget = std::make_unique<RenderThemeBoxGadget>(info, GTK_ORIENTATION_VERTICAL, children, scrollbarGadget.get());
    900     info.name = "slider";
    901     IntSize minSize = RenderThemeGadget::create(info, contentsGadget->child(0))->minimumSize();
     823    auto& scrollbarWidget = static_cast<RenderThemeScrollbar&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::VerticalScrollbarRight));
     824    scrollbarWidget.scrollbar().setState(GTK_STATE_FLAG_PRELIGHT);
     825    IntSize minSize = scrollbarWidget.slider().minimumSize();
    902826    return scrollbar.orientation() == VerticalScrollbar ? minSize.height() : minSize.width();
    903827}

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/image-decoders/cairo/ImageBackingStoreCairo.cpp

    r217367 r219817  
    3333NativeImagePtr ImageBackingStore::image() const
    3434{
    35     return adoptRef(cairo_image_surface_create_for_data(
     35    m_pixels->ref();
     36    RefPtr<cairo_surface_t> surface = adoptRef(cairo_image_surface_create_for_data(
    3637        reinterpret_cast<unsigned char*>(const_cast<RGBA32*>(m_pixelsPtr)),
    3738        CAIRO_FORMAT_ARGB32, size().width(), size().height(), size().width() * sizeof(RGBA32)));
     39    static cairo_user_data_key_t s_surfaceDataKey;
     40    cairo_surface_set_user_data(surface.get(), &s_surfaceDataKey, m_pixels.get(), [](void* data) { static_cast<SharedBuffer*>(data)->deref(); });
     41
     42    return surface;
    3843}
    3944

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderBlock.cpp

    r217367 r219817  
    682682{
    683683    if (AXObjectCache* cache = document().existingAXObjectCache())
    684         cache->recomputeDeferredIsIgnored(*this);
     684        cache->deferRecomputeIsIgnored(element());
    685685}
    686686

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderBlockFlow.cpp

    r217367 r219817  
    36673667        // The simple line layout may have become invalid.
    36683668        m_simpleLineLayout = nullptr;
     3669        setLineLayoutPath(UndeterminedPath);
     3670        if (needsLayout())
     3671            return;
     3672        // FIXME: We should just kick off a subtree layout here (if needed at all) see webkit.org/b/172947.
    36693673        setNeedsLayout();
    3670         setLineLayoutPath(UndeterminedPath);
    36713674        return;
    36723675    }

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderBlockLineLayout.cpp

    r217367 r219817  
    131131    if (UNLIKELY(AXObjectCache::accessibilityEnabled()) && firstRootBox() == rootBox) {
    132132        if (AXObjectCache* cache = document().existingAXObjectCache())
    133             cache->recomputeDeferredIsIgnored(*this);
     133            cache->deferRecomputeIsIgnored(element());
    134134    }
    135135

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderLayerCompositor.cpp

    r217367 r219817  
    25372537   
    25382538    RenderWidget& pluginRenderer = downcast<RenderWidget>(renderer);
     2539    if (pluginRenderer.style().visibility() != VISIBLE)
     2540        return false;
     2541
    25392542    // If we can't reliably know the size of the plugin yet, don't change compositing state.
    25402543    if (pluginRenderer.needsLayout())
    … …  
    25522555
    25532556    auto& frameRenderer = downcast<RenderWidget>(renderer);
     2557    if (frameRenderer.style().visibility() != VISIBLE)
     2558        return false;
     2559
    25542560    if (!frameRenderer.requiresAcceleratedCompositing())
    25552561        return false;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderText.cpp

    r217367 r219817  
    12841284   
    12851285    if (AXObjectCache* cache = document().existingAXObjectCache())
    1286         cache->textChanged(this);
     1286        cache->deferTextChangedIfNeeded(textNode());
    12871287}
    12881288

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderTheme.cpp

    r217367 r219817  
    9292
    9393    if (UAHasAppearance && isControlStyled(style, border, background, backgroundColor)) {
    94         if (part == MenulistPart) {
     94        switch (part) {
     95        case MenulistPart:
    9596            style.setAppearance(MenulistButtonPart);
    9697            part = MenulistButtonPart;
    97         } else
     98            break;
     99        case TextFieldPart:
     100            adjustTextFieldStyle(styleResolver, style, element);
     101            FALLTHROUGH;
     102        default:
    98103            style.setAppearance(NoControlPart);
     104            break;
     105        }
    99106    }
    100107

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebCore/rendering/RenderThemeGtk.cpp

    r217367 r219817  
    4545#include "RenderObject.h"
    4646#include "RenderProgress.h"
    47 #include "RenderThemeGadget.h"
     47#include "RenderThemeWidget.h"
    4848#include "ScrollbarThemeGtk.h"
    4949#include "StringTruncator.h"
    … …  
    186186    switch (themePart) {
    187187    case Entry:
     188    case EntrySelection:
    188189        gtk_widget_path_append_type(path.get(), GTK_TYPE_ENTRY);
    189190        gtk_widget_path_iter_add_class(path.get(), -1, GTK_STYLE_CLASS_ENTRY);
    … …  
    528529        return;
    529530
    530     RenderThemeGadget::Info info = {
    531         .type = RenderThemeGadget::Type::Generic,
    532         .name = themePart == CheckButton ? "checkbutton" : "radiobutton",
    533         .state = GTK_STATE_FLAG_NORMAL,
    534         .classList = { }
    535     };
    536     auto parentGadget = RenderThemeGadget::create(info);
    537     if (themePart == CheckButton) {
    538         info.type = RenderThemeGadget::Type::Check;
    539         info.name = "check";
    540     } else {
    541         info.type = RenderThemeGadget::Type::Radio;
    542         info.name = "radio";
    543     }
    544     auto gadget = RenderThemeToggleGadget::create(info);
    545     IntSize preferredSize = parentGadget->preferredSize();
    546     preferredSize = preferredSize.expandedTo(gadget->preferredSize());
     531    auto& toggleWidget = static_cast<RenderThemeToggleButton&>(RenderThemeWidget::getOrCreate(themePart == CheckButton ? RenderThemeWidget::Type::CheckButton : RenderThemeWidget::Type::RadioButton));
     532    toggleWidget.button().setState(GTK_STATE_FLAG_NORMAL);
     533    toggleWidget.toggle().setState(GTK_STATE_FLAG_NORMAL);
     534    IntSize preferredSize = toggleWidget.button().preferredSize();
     535    preferredSize = preferredSize.expandedTo(toggleWidget.toggle().preferredSize());
    547536
    548537    if (style.width().isIntrinsicOrAuto())
    … …  
    557546    ASSERT(themePart == CheckButton || themePart == RadioButton);
    558547
    559     RenderThemeGadget::Info parentInfo = {
    560         .type = RenderThemeGadget::Type::Generic,
    561         .name = themePart == CheckButton ? "checkbutton" : "radiobutton",
    562         .state = themePartStateFlags(*theme, themePart, renderObject),
    563         .classList = { "text-button" }
    564     };
    565     auto parentGadget = RenderThemeGadget::create(parentInfo);
    566     RenderThemeGadget::Info info;
    567     info.state = parentInfo.state;
    568     if (themePart == CheckButton) {
    569         info.type = RenderThemeGadget::Type::Check;
    570         info.name = "check";
    571     } else {
    572         info.type = RenderThemeGadget::Type::Radio;
    573         info.name = "radio";
    574     }
    575     auto gadget = RenderThemeGadget::create(info, parentGadget.get());
     548    auto& toggleWidget = static_cast<RenderThemeToggleButton&>(RenderThemeWidget::getOrCreate(themePart == CheckButton ? RenderThemeWidget::Type::CheckButton : RenderThemeWidget::Type::RadioButton));
     549    auto toggleState = themePartStateFlags(*theme, themePart, renderObject);
     550    toggleWidget.button().setState(toggleState);
     551    toggleWidget.toggle().setState(toggleState);
    576552
    577553    FloatRect rect = fullRect;
    … …  
    580556    // in the full toggle button region. The reason for not simply forcing toggle
    581557    // buttons to be a smaller size is that we don't want to break site layouts.
    582     IntSize preferredSize = parentGadget->preferredSize();
    583     preferredSize = preferredSize.expandedTo(gadget->preferredSize());
     558    IntSize preferredSize = toggleWidget.button().preferredSize();
     559    preferredSize = preferredSize.expandedTo(toggleWidget.toggle().preferredSize());
    584560    shrinkToMinimumSizeAndCenterRectangle(rect, preferredSize);
    585     parentGadget->render(paintInfo.context().platformContext()->cr(), rect);
    586     gadget->render(paintInfo.context().platformContext()->cr(), rect);
     561    toggleWidget.button().render(paintInfo.context().platformContext()->cr(), rect);
     562    toggleWidget.toggle().render(paintInfo.context().platformContext()->cr(), rect);
    587563
    588564    if (theme->isFocused(renderObject))
    589         parentGadget->renderFocus(paintInfo.context().platformContext()->cr(), rect);
     565        toggleWidget.button().renderFocus(paintInfo.context().platformContext()->cr(), rect);
    590566}
    591567#else
    … …  
    684660bool RenderThemeGtk::paintButton(const RenderObject& renderObject, const PaintInfo& paintInfo, const IntRect& rect)
    685661{
    686     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "button", themePartStateFlags(*this, Button, renderObject), { "text-button" } };
    687     if (isDefault(renderObject))
    688         info.classList.append("default");
    689     auto gadget = RenderThemeGadget::create(info);
    690     gadget->render(paintInfo.context().platformContext()->cr(), rect);
     662    auto& buttonWidget = static_cast<RenderThemeButton&>(RenderThemeWidget::getOrCreate(isDefault(renderObject) ? RenderThemeWidget::Type::ButtonDefault : RenderThemeWidget::Type::Button));
     663    buttonWidget.button().setState(themePartStateFlags(*this, Button, renderObject));
     664    buttonWidget.button().render(paintInfo.context().platformContext()->cr(), rect);
    691665    if (isFocused(renderObject))
    692         gadget->renderFocus(paintInfo.context().platformContext()->cr(), rect);
     666        buttonWidget.button().renderFocus(paintInfo.context().platformContext()->cr(), rect);
    693667    return false;
    694668}
    … …  
    772746{
    773747#if GTK_CHECK_VERSION(3, 20, 0)
    774     RenderThemeGadget::Info info { RenderThemeGadget::Type::Generic, "combobox", element->isDisabledFormControl() ? GTK_STATE_FLAG_INSENSITIVE : GTK_STATE_FLAG_NORMAL, { } };
    775     auto comboGadget = RenderThemeGadget::create(info);
    776     Vector<RenderThemeGadget::Info> children {
    777         { RenderThemeGadget::Type::Generic, "button", info.state, { "combo" } }
    778     };
    779     info.name = "box";
    780     info.classList = { "horizontal", "linked" };
    781     return RenderThemeBoxGadget(info, GTK_ORIENTATION_HORIZONTAL, children, comboGadget.get()).child(0)->color();
     748    auto& comboWidget = static_cast<RenderThemeComboBox&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::ComboBox));
     749    GtkStateFlags state = element->isDisabledFormControl() ? GTK_STATE_FLAG_INSENSITIVE : GTK_STATE_FLAG_NORMAL;
     750    comboWidget.comboBox().setState(state);
     751    comboWidget.button().setState(state);
     752    return comboWidget.button().color();
    782753#else
    783754    GRefPtr<GtkStyleContext> parentStyleContext = createStyleContext(ComboBox);
    … …  
    825796        return LengthBox(0);
    826797
    827     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "combobox", GTK_STATE_FLAG_NORMAL, { } };
    828     auto comboGadget = RenderThemeGadget::create(info);
    829     Vector<RenderThemeGadget::Info> children = {
    830         { RenderThemeGadget::Type::Generic, "button", GTK_STATE_FLAG_NORMAL, { "combo" } }
    831     };
    832     info.name = "box";
    833     info.classList = { "horizontal", "linked" };
    834     auto boxGadget = std::make_unique<RenderThemeBoxGadget>(info, GTK_ORIENTATION_HORIZONTAL, children, comboGadget.get());
    835     RenderThemeGadget* buttonGadget = boxGadget->child(0);
    836     info.classList.removeLast();
    837     auto buttonBoxGadget = RenderThemeGadget::create(info, buttonGadget);
    838     info.name = "arrow";
    839     info.classList = { };
    840     auto arrowGadget = RenderThemeGadget::create(info, buttonBoxGadget.get());
    841     GtkBorder comboContentsBox = comboGadget->contentsBox();
    842     GtkBorder boxContentsBox = boxGadget->contentsBox();
    843     GtkBorder buttonContentsBox = buttonGadget->contentsBox();
    844     GtkBorder buttonBoxContentsBox = buttonBoxGadget->contentsBox();
     798    auto& comboWidget = static_cast<RenderThemeComboBox&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::ComboBox));
     799    comboWidget.comboBox().setState(GTK_STATE_FLAG_NORMAL);
     800    comboWidget.button().setState(GTK_STATE_FLAG_NORMAL);
     801    comboWidget.arrow().setState(GTK_STATE_FLAG_NORMAL);
     802    GtkBorder comboContentsBox = comboWidget.comboBox().contentsBox();
     803    GtkBorder boxContentsBox = comboWidget.box().contentsBox();
     804    GtkBorder buttonContentsBox = comboWidget.button().contentsBox();
     805    GtkBorder buttonBoxContentsBox = comboWidget.buttonBox().contentsBox();
    845806    GtkBorder padding;
    846807    padding.left = comboContentsBox.left + boxContentsBox.left + buttonContentsBox.left + buttonBoxContentsBox.left;
    … …  
    849810    padding.bottom = comboContentsBox.bottom + boxContentsBox.bottom + buttonContentsBox.bottom + buttonBoxContentsBox.bottom;
    850811
    851     auto arrowSize = arrowGadget->preferredSize();
     812    auto arrowSize = comboWidget.arrow().preferredSize();
    852813    return LengthBox(padding.top, padding.right + (style.direction() == LTR ? arrowSize.width() : 0),
    853814        padding.bottom, padding.left + (style.direction() == RTL ? arrowSize.width() : 0));
    … …  
    856817bool RenderThemeGtk::paintMenuList(const RenderObject& renderObject, const PaintInfo& paintInfo, const FloatRect& rect)
    857818{
    858     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "combobox", themePartStateFlags(*this, ComboBoxButton, renderObject), { } };
    859     auto comboGadget = RenderThemeGadget::create(info);
    860     Vector<RenderThemeGadget::Info> children = {
    861         { RenderThemeGadget::Type::Generic, "button", info.state, { "combo" } }
    862     };
    863     info.name = "box";
    864     info.classList = { "horizontal", "linked" };
    865     auto boxGadget = std::make_unique<RenderThemeBoxGadget>(info, GTK_ORIENTATION_HORIZONTAL, children, comboGadget.get());
    866     RenderThemeGadget* buttonGadget = boxGadget->child(0);
    867     info.classList.removeLast();
    868     auto buttonBoxGadget = RenderThemeGadget::create(info, buttonGadget);
    869     info.type = RenderThemeGadget::Type::Arrow;
    870     info.name = "arrow";
    871     info.classList = { };
    872     auto arrowGadget = RenderThemeGadget::create(info, buttonBoxGadget.get());
     819    auto& comboWidget = static_cast<RenderThemeComboBox&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::ComboBox));
     820    auto comboState = themePartStateFlags(*this, ComboBoxButton, renderObject);
     821    comboWidget.comboBox().setState(comboState);
     822    comboWidget.button().setState(comboState);
     823    comboWidget.arrow().setState(comboState);
    873824
    874825    cairo_t* cr = paintInfo.context().platformContext()->cr();
    875     comboGadget->render(cr, rect);
    876     boxGadget->render(cr, rect);
     826    comboWidget.comboBox().render(cr, rect);
     827    comboWidget.box().render(cr, rect);
    877828    FloatRect contentsRect;
    878     buttonGadget->render(cr, rect, &contentsRect);
    879     buttonBoxGadget->render(cr, contentsRect);
    880     arrowGadget->render(cr, contentsRect);
     829    comboWidget.button().render(cr, rect, &contentsRect);
     830    comboWidget.buttonBox().render(cr, contentsRect);
     831    comboWidget.arrow().render(cr, contentsRect);
    881832    if (isFocused(renderObject))
    882         buttonGadget->renderFocus(cr, rect);
     833        comboWidget.button().renderFocus(cr, rect);
    883834
    884835    return false;
    … …  
    981932
    982933#if GTK_CHECK_VERSION(3, 20, 0)
     934
     935static IntSize spinButtonSize()
     936{
     937    auto& spinButtonWidget = static_cast<RenderThemeSpinButton&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SpinButton));
     938    spinButtonWidget.spinButton().setState(GTK_STATE_FLAG_NORMAL);
     939    spinButtonWidget.entry().setState(GTK_STATE_FLAG_NORMAL);
     940    spinButtonWidget.up().setState(GTK_STATE_FLAG_NORMAL);
     941    spinButtonWidget.down().setState(GTK_STATE_FLAG_NORMAL);
     942
     943    IntSize preferredSize = spinButtonWidget.spinButton().preferredSize();
     944    preferredSize = preferredSize.expandedTo(spinButtonWidget.entry().preferredSize());
     945    IntSize upPreferredSize = preferredSize.expandedTo(spinButtonWidget.up().preferredSize());
     946    IntSize downPreferredSize = preferredSize.expandedTo(spinButtonWidget.down().preferredSize());
     947
     948    return IntSize(upPreferredSize.width() + downPreferredSize.width(), std::max(upPreferredSize.height(), downPreferredSize.height()));
     949}
     950
     951
    983952void RenderThemeGtk::adjustTextFieldStyle(StyleResolver&, RenderStyle& style, const Element* element) const
    984953{
    … …  
    986955        return;
    987956
    988     // Spinbuttons need a minimum height to be rendered correctly.
    989     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "spinbutton", GTK_STATE_FLAG_NORMAL, { "horizontal" } };
    990     auto spinbuttonGadget = RenderThemeGadget::create(info);
    991     info.type = RenderThemeGadget::Type::TextField;
    992     info.name = "entry";
    993     info.classList.clear();
    994     auto entryGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    995     info.type = RenderThemeGadget::Type::Icon;
    996     info.name = "button";
    997     info.classList.append("up");
    998     auto buttonUpGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    999     static_cast<RenderThemeIconGadget*>(buttonUpGadget.get())->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1000     info.classList[0] = "down";
    1001     auto buttonDownGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1002     static_cast<RenderThemeIconGadget*>(buttonDownGadget.get())->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1003     IntSize preferredSize = spinbuttonGadget->preferredSize();
    1004     preferredSize = preferredSize.expandedTo(entryGadget->preferredSize());
    1005     IntSize upPreferredSize = preferredSize.expandedTo(buttonUpGadget->preferredSize());
    1006     IntSize downPreferredSize = preferredSize.expandedTo(buttonDownGadget->preferredSize());
    1007     int height = std::max(upPreferredSize.height(), downPreferredSize.height());
    1008     style.setMinHeight(Length(height, Fixed));
     957    style.setMinHeight(Length(spinButtonSize().height(), Fixed));
     958
     959    // The default theme for the GTK+ port uses very wide spin buttons (66px) compared to what other
     960    // browsers use (~13 px). And unfortunately, most of the web developers won't test how their site
     961    // renders on WebKitGTK+. To ensure that spin buttons don't end up covering the values of the input
     962    // field, we override the width of the input element and always increment it with the width needed
     963    // for the spinbutton (when drawing the spinbutton).
     964    int minimumWidth = style.width().intValue() + spinButtonSize().width();
     965    style.setMinWidth(Length(minimumWidth, Fixed));
    1009966}
    1010967
    1011968bool RenderThemeGtk::paintTextField(const RenderObject& renderObject, const PaintInfo& paintInfo, const FloatRect& rect)
    1012969{
    1013     RenderThemeGadget::Info info = { RenderThemeGadget::Type::TextField, "entry", themePartStateFlags(*this, Entry, renderObject), { } };
    1014     std::unique_ptr<RenderThemeGadget> parentGadget;
    1015970    if (is<HTMLInputElement>(renderObject.node()) && shouldHaveSpinButton(downcast<HTMLInputElement>(*renderObject.node()))) {
    1016         info.name = "spinbutton";
    1017         info.classList.append("horizontal");
    1018         parentGadget = RenderThemeTextFieldGadget::create(info);
    1019         info.name = "entry";
    1020         info.classList.clear();
    1021     }
    1022 
    1023     auto entryGadget = RenderThemeTextFieldGadget::create(info, parentGadget.get());
    1024     if (parentGadget)
    1025         parentGadget->render(paintInfo.context().platformContext()->cr(), rect);
    1026     entryGadget->render(paintInfo.context().platformContext()->cr(), rect);
     971        auto& spinButtonWidget = static_cast<RenderThemeSpinButton&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SpinButton));
     972        auto spinButtonState = themePartStateFlags(*this, Entry, renderObject);
     973        spinButtonWidget.spinButton().setState(spinButtonState);
     974        spinButtonWidget.entry().setState(spinButtonState);
     975        spinButtonWidget.spinButton().render(paintInfo.context().platformContext()->cr(), rect);
     976        spinButtonWidget.entry().render(paintInfo.context().platformContext()->cr(), rect);
     977    } else {
     978        auto& entryWidget = static_cast<RenderThemeEntry&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::Entry));
     979        entryWidget.entry().setState(themePartStateFlags(*this, Entry, renderObject));
     980        entryWidget.entry().render(paintInfo.context().platformContext()->cr(), rect);
     981    }
    1027982    return false;
    1028983}
    … …  
    10661021{
    10671022    ASSERT(themePart == EntryIconLeft || themePart == EntryIconRight);
    1068     RenderThemeGadget::Info info = { RenderThemeGadget::Type::TextField, "entry", GTK_STATE_FLAG_NORMAL, { } };
    1069     auto parentGadget = RenderThemeGadget::create(info);
    1070     info.type = RenderThemeGadget::Type::Icon;
    1071     info.name = "image";
    1072     if (themePart == EntryIconLeft)
    1073         info.classList.append("left");
    1074     else
    1075         info.classList.append("right");
    1076     auto gadget = RenderThemeIconGadget::create(info, parentGadget.get());
     1023    auto& searchEntryWidget = static_cast<RenderThemeSearchEntry&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SearchEntry));
     1024    searchEntryWidget.entry().setState(GTK_STATE_FLAG_NORMAL);
     1025    searchEntryWidget.leftIcon().setState(GTK_STATE_FLAG_NORMAL);
     1026    searchEntryWidget.rightIcon().setState(GTK_STATE_FLAG_NORMAL);
    10771027
    10781028    // Get the icon size based on the font size.
    1079     static_cast<RenderThemeIconGadget*>(gadget.get())->setIconSize(style.fontSize());
    1080     IntSize preferredSize = gadget->preferredSize();
    1081     GtkBorder contentsBox = parentGadget->contentsBox();
     1029    auto& icon = static_cast<RenderThemeIconGadget&>(themePart == EntryIconLeft ? searchEntryWidget.leftIcon() : searchEntryWidget.rightIcon());
     1030    icon.setIconSize(style.fontSize());
     1031    IntSize preferredSize = icon.preferredSize();
     1032    GtkBorder contentsBox = searchEntryWidget.entry().contentsBox();
    10821033    if (themePart == EntryIconLeft)
    10831034        preferredSize.expand(contentsBox.left, contentsBox.top + contentsBox.bottom);
    … …  
    11661117{
    11671118    ASSERT(themePart == EntryIconLeft || themePart == EntryIconRight);
    1168     RenderThemeGadget::Info info = { RenderThemeGadget::Type::TextField, "entry", themePartStateFlags(*theme, Entry, renderObject), { } };
    1169     auto parentGadget = RenderThemeGadget::create(info);
    1170     info.type = RenderThemeGadget::Type::Icon;
    1171     info.state = themePartStateFlags(*theme, themePart, renderObject);
    1172     info.name = "image";
    1173     if (themePart == EntryIconLeft)
    1174         info.classList.append("left");
    1175     else
    1176         info.classList.append("right");
    1177     auto gadget = RenderThemeGadget::create(info, parentGadget.get());
    1178     auto* gadgetIcon = static_cast<RenderThemeIconGadget*>(gadget.get());
    1179     gadgetIcon->setIconSize(renderObject.style().fontSize());
    1180     if (themePart == EntryIconLeft)
    1181         gadgetIcon->setIconName("edit-find-symbolic");
    1182     else
    1183         gadgetIcon->setIconName("edit-clear-symbolic");
    1184     GtkBorder contentsBox = parentGadget->contentsBox();
     1119    auto& searchEntryWidget = static_cast<RenderThemeSearchEntry&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SearchEntry));
     1120    searchEntryWidget.entry().setState(themePartStateFlags(*theme, Entry, renderObject));
     1121    auto& icon = static_cast<RenderThemeIconGadget&>(themePart == EntryIconLeft ? searchEntryWidget.leftIcon() : searchEntryWidget.rightIcon());
     1122    icon.setState(themePartStateFlags(*theme, themePart, renderObject));
     1123    icon.setIconSize(renderObject.style().fontSize());
     1124    GtkBorder contentsBox = searchEntryWidget.entry().contentsBox();
    11851125    IntRect iconRect = rect;
    11861126    if (themePart == EntryIconLeft) {
    … …  
    11891129    } else
    11901130        iconRect.contract(contentsBox.right, contentsBox.top + contentsBox.bottom);
    1191     return !gadget->render(paintInfo.context().platformContext()->cr(), iconRect);
     1131    return !icon.render(paintInfo.context().platformContext()->cr(), iconRect);
    11921132}
    11931133bool RenderThemeGtk::paintSearchFieldResultsDecorationPart(const RenderBox& renderObject, const PaintInfo& paintInfo, const IntRect& rect)
    … …  
    13101250    ASSERT(part == SliderHorizontalPart || part == SliderVerticalPart);
    13111251
    1312     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "scale", themePartStateFlags(*this, Scale, renderObject), { } };
    1313     if (part == SliderHorizontalPart)
    1314         info.classList.append("horizontal");
    1315     else
    1316         info.classList.append("vertical");
    1317     auto scaleGadget = RenderThemeGadget::create(info);
    1318     info.name = "contents";
    1319     info.classList.clear();
    1320     auto contentsGadget = RenderThemeGadget::create(info, scaleGadget.get());
    1321     info.name = "trough";
    1322     auto troughGadget = RenderThemeGadget::create(info, contentsGadget.get());
    1323     info.name = "slider";
    1324     auto sliderGadget = RenderThemeGadget::create(info, troughGadget.get());
    1325     info.name = "highlight";
    1326     auto highlightGadget = RenderThemeGadget::create(info, troughGadget.get());
     1252    auto& sliderWidget = static_cast<RenderThemeSlider&>(RenderThemeWidget::getOrCreate(part == SliderHorizontalPart ? RenderThemeWidget::Type::HorizontalSlider : RenderThemeWidget::Type::VerticalSlider));
     1253    auto scaleState = themePartStateFlags(*this, Scale, renderObject);
     1254    auto& scale = sliderWidget.scale();
     1255    scale.setState(scaleState);
     1256    auto& contents = sliderWidget.contents();
     1257    auto& trough = sliderWidget.trough();
     1258    trough.setState(scaleState);
     1259    auto& slider = sliderWidget.slider();
     1260    auto& highlight = sliderWidget.highlight();
    13271261
    13281262    // The given rectangle is not calculated based on the scale size, but all the margins and paddings are based on it.
    1329     IntSize preferredSize = scaleGadget->preferredSize();
    1330     preferredSize = preferredSize.expandedTo(contentsGadget->preferredSize());
    1331     preferredSize = preferredSize.expandedTo(troughGadget->preferredSize());
     1263    IntSize preferredSize = scale.preferredSize();
     1264    preferredSize = preferredSize.expandedTo(contents.preferredSize());
     1265    preferredSize = preferredSize.expandedTo(trough.preferredSize());
    13321266    FloatRect trackRect = rect;
    13331267    if (part == SliderHorizontalPart) {
    … …  
    13401274
    13411275    FloatRect contentsRect;
    1342     scaleGadget->render(paintInfo.context().platformContext()->cr(), trackRect, &contentsRect);
    1343     contentsGadget->render(paintInfo.context().platformContext()->cr(), contentsRect, &contentsRect);
     1276    scale.render(paintInfo.context().platformContext()->cr(), trackRect, &contentsRect);
     1277    contents.render(paintInfo.context().platformContext()->cr(), contentsRect, &contentsRect);
    13441278    // Scale trough defines its size querying slider and highlight.
    13451279    if (part == SliderHorizontalPart)
    1346         contentsRect.setHeight(troughGadget->preferredSize().height() + std::max(sliderGadget->preferredSize().height(), highlightGadget->preferredSize().height()));
     1280        contentsRect.setHeight(trough.preferredSize().height() + std::max(slider.preferredSize().height(), highlight.preferredSize().height()));
    13471281    else
    1348         contentsRect.setWidth(troughGadget->preferredSize().width() + std::max(sliderGadget->preferredSize().width(), highlightGadget->preferredSize().width()));
     1282        contentsRect.setWidth(trough.preferredSize().width() + std::max(slider.preferredSize().width(), highlight.preferredSize().width()));
    13491283    FloatRect troughRect = contentsRect;
    1350     troughGadget->render(paintInfo.context().platformContext()->cr(), troughRect, &contentsRect);
     1284    trough.render(paintInfo.context().platformContext()->cr(), troughRect, &contentsRect);
    13511285    if (isFocused(renderObject))
    1352         troughGadget->renderFocus(paintInfo.context().platformContext()->cr(), troughRect);
     1286        trough.renderFocus(paintInfo.context().platformContext()->cr(), troughRect);
    13531287
    13541288    LayoutPoint thumbLocation;
    … …  
    13671301    } else
    13681302        contentsRect.setHeight(thumbLocation.y());
    1369     highlightGadget->render(paintInfo.context().platformContext()->cr(), contentsRect);
     1303    highlight.render(paintInfo.context().platformContext()->cr(), contentsRect);
    13701304
    13711305    return false;
    … …  
    13781312        return;
    13791313
    1380     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "scale", GTK_STATE_FLAG_NORMAL, { } };
    1381     if (part == SliderHorizontalPart)
    1382         info.classList.append("horizontal");
    1383     else
    1384         info.classList.append("vertical");
    1385     auto scaleGadget = RenderThemeGadget::create(info);
    1386     info.name = "contents";
    1387     info.classList.clear();
    1388     auto contentsGadget = RenderThemeGadget::create(info, scaleGadget.get());
    1389     info.name = "trough";
    1390     auto troughGadget = RenderThemeGadget::create(info, contentsGadget.get());
    1391     info.name = "slider";
    1392     auto sliderGadget = RenderThemeGadget::create(info, troughGadget.get());
    1393     info.name = "highlight";
    1394     auto highlightGadget = RenderThemeGadget::create(info, troughGadget.get());
    1395 
    1396     IntSize preferredSize = scaleGadget->preferredSize();
    1397     preferredSize = preferredSize.expandedTo(contentsGadget->preferredSize());
    1398     preferredSize = preferredSize.expandedTo(troughGadget->preferredSize());
    1399     preferredSize = preferredSize.expandedTo(sliderGadget->preferredSize());
     1314    auto& sliderWidget = static_cast<RenderThemeSlider&>(RenderThemeWidget::getOrCreate(part == SliderHorizontalPart ? RenderThemeWidget::Type::HorizontalSlider : RenderThemeWidget::Type::VerticalSlider));
     1315    sliderWidget.scale().setState(GTK_STATE_FLAG_NORMAL);
     1316    sliderWidget.trough().setState(GTK_STATE_FLAG_NORMAL);
     1317
     1318    IntSize preferredSize = sliderWidget.scale().preferredSize();
     1319    preferredSize = preferredSize.expandedTo(sliderWidget.contents().preferredSize());
     1320    preferredSize = preferredSize.expandedTo(sliderWidget.trough().preferredSize());
     1321    preferredSize = preferredSize.expandedTo(sliderWidget.slider().preferredSize());
    14001322    if (part == SliderThumbHorizontalPart) {
    14011323        style.setWidth(Length(preferredSize.width(), Fixed));
    … …  
    14131335    ASSERT(part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart);
    14141336
    1415     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "scale", themePartStateFlags(*this, Scale, renderObject), { } };
    1416     if (part == SliderHorizontalPart)
    1417         info.classList.append("horizontal");
    1418     else
    1419         info.classList.append("vertical");
    1420     auto scaleGadget = RenderThemeGadget::create(info);
    1421     info.name = "contents";
    1422     info.classList.clear();
    1423     auto contentsGadget = RenderThemeGadget::create(info, scaleGadget.get());
    1424     info.name = "trough";
    1425     auto troughGadget = RenderThemeGadget::create(info, contentsGadget.get());
    1426     info.name = "slider";
    1427     info.state = themePartStateFlags(*this, ScaleSlider, renderObject);
    1428     auto sliderGadget = RenderThemeGadget::create(info, troughGadget.get());
    1429     info.name = "highlight";
    1430     auto highlightGadget = RenderThemeGadget::create(info, troughGadget.get());
    1431 
    1432     GtkBorder scaleContentsBox = scaleGadget->contentsBox();
    1433     GtkBorder contentsContentsBox = contentsGadget->contentsBox();
    1434     GtkBorder troughContentsBox = troughGadget->contentsBox();
     1337    auto& sliderWidget = static_cast<RenderThemeSlider&>(RenderThemeWidget::getOrCreate(part == SliderThumbHorizontalPart ? RenderThemeWidget::Type::HorizontalSlider : RenderThemeWidget::Type::VerticalSlider));
     1338    auto scaleState = themePartStateFlags(*this, Scale, renderObject);
     1339    auto& scale = sliderWidget.scale();
     1340    scale.setState(scaleState);
     1341    auto& contents = sliderWidget.contents();
     1342    auto& trough = sliderWidget.trough();
     1343    trough.setState(scaleState);
     1344    auto& slider = sliderWidget.slider();
     1345    slider.setState(themePartStateFlags(*this, ScaleSlider, renderObject));
     1346    auto& highlight = sliderWidget.highlight();
     1347
     1348    GtkBorder scaleContentsBox = scale.contentsBox();
     1349    GtkBorder contentsContentsBox = contents.contentsBox();
     1350    GtkBorder troughContentsBox = trough.contentsBox();
    14351351    GtkBorder padding;
    14361352    padding.left = scaleContentsBox.left + contentsContentsBox.left + troughContentsBox.left;
    … …  
    14401356
    14411357    // Scale trough defines its size querying slider and highlight.
    1442     int troughHeight = troughGadget->preferredSize().height() + std::max(sliderGadget->preferredSize().height(), highlightGadget->preferredSize().height());
     1358    int troughHeight = trough.preferredSize().height() + std::max(slider.preferredSize().height(), highlight.preferredSize().height());
    14431359    IntRect sliderRect(rect.location(), IntSize(troughHeight, troughHeight));
    14441360    sliderRect.move(padding.left, padding.top);
    14451361    sliderRect.contract(padding.left + padding.right, padding.top + padding.bottom);
    1446     sliderGadget->render(paintInfo.context().platformContext()->cr(), sliderRect);
     1362    slider.render(paintInfo.context().platformContext()->cr(), sliderRect);
    14471363    return false;
    14481364}
    … …  
    15411457IntRect RenderThemeGtk::progressBarRectForBounds(const RenderObject& renderObject, const IntRect& bounds) const
    15421458{
    1543     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "progressbar", GTK_STATE_FLAG_NORMAL, { "horizontal" } };
    1544     auto progressBarGadget = RenderThemeGadget::create(info);
    1545     info.name = "trough";
    1546     info.classList.clear();
    1547     auto troughGadget = RenderThemeGadget::create(info, progressBarGadget.get());
    1548     info.name = "progress";
    1549     if (renderObject.style().direction() == RTL)
    1550         info.classList.append("right");
    1551     else
    1552         info.classList.append("left");
    15531459    const auto& renderProgress = downcast<RenderProgress>(renderObject);
    1554     if (renderProgress.isDeterminate())
    1555         info.classList.append("pulse");
    1556     auto progressGadget = RenderThemeGadget::create(info, troughGadget.get());
    1557     IntSize preferredSize = progressBarGadget->preferredSize();
    1558     preferredSize = preferredSize.expandedTo(troughGadget->preferredSize());
    1559     preferredSize = preferredSize.expandedTo(progressGadget->preferredSize());
     1460    auto& progressBarWidget = static_cast<RenderThemeProgressBar&>(RenderThemeWidget::getOrCreate(renderProgress.isDeterminate() ? RenderThemeProgressBar::Type::ProgressBar : RenderThemeProgressBar::Type::IndeterminateProgressBar));
     1461    IntSize preferredSize = progressBarWidget.progressBar().preferredSize();
     1462    preferredSize = preferredSize.expandedTo(progressBarWidget.trough().preferredSize());
     1463    preferredSize = preferredSize.expandedTo(progressBarWidget.progress().preferredSize());
    15601464    return IntRect(bounds.x(), bounds.y(), bounds.width(), preferredSize.height());
    15611465}
    … …  
    15661470        return true;
    15671471
    1568     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "progressbar", GTK_STATE_FLAG_NORMAL, { "horizontal" } };
    1569     auto progressBarGadget = RenderThemeGadget::create(info);
    1570     info.name = "trough";
    1571     info.classList.clear();
    1572     auto troughGadget = RenderThemeGadget::create(info, progressBarGadget.get());
    1573     info.name = "progress";
    1574     if (renderObject.style().direction() == RTL)
    1575         info.classList.append("right");
    1576     else
    1577         info.classList.append("left");
    15781472    const auto& renderProgress = downcast<RenderProgress>(renderObject);
    1579     if (renderProgress.isDeterminate())
    1580         info.classList.append("pulse");
    1581     auto progressGadget = RenderThemeGadget::create(info, troughGadget.get());
    1582 
    1583     progressBarGadget->render(paintInfo.context().platformContext()->cr(), rect);
    1584     troughGadget->render(paintInfo.context().platformContext()->cr(), rect);
    1585     progressGadget->render(paintInfo.context().platformContext()->cr(), calculateProgressRect(renderObject, rect));
     1473    auto& progressBarWidget = static_cast<RenderThemeProgressBar&>(RenderThemeWidget::getOrCreate(renderProgress.isDeterminate() ? RenderThemeProgressBar::Type::ProgressBar : RenderThemeProgressBar::Type::IndeterminateProgressBar));
     1474    progressBarWidget.progressBar().render(paintInfo.context().platformContext()->cr(), rect);
     1475    progressBarWidget.trough().render(paintInfo.context().platformContext()->cr(), rect);
     1476    progressBarWidget.progress().render(paintInfo.context().platformContext()->cr(), calculateProgressRect(renderObject, rect));
    15861477    return false;
    15871478}
    … …  
    16361527void RenderThemeGtk::adjustInnerSpinButtonStyle(StyleResolver&, RenderStyle& style, const Element*) const
    16371528{
    1638     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "spinbutton", GTK_STATE_FLAG_NORMAL, { "horizontal" } };
    1639     auto spinbuttonGadget = RenderThemeGadget::create(info);
    1640     info.type = RenderThemeGadget::Type::TextField;
    1641     info.name = "entry";
    1642     info.classList.clear();
    1643     auto entryGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1644     info.type = RenderThemeGadget::Type::Icon;
    1645     info.name = "button";
    1646     info.classList.append("up");
    1647     auto buttonUpGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1648     static_cast<RenderThemeIconGadget*>(buttonUpGadget.get())->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1649     info.classList[0] = "down";
    1650     auto buttonDownGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1651     static_cast<RenderThemeIconGadget*>(buttonDownGadget.get())->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1652     IntSize upPreferredSize = buttonUpGadget->preferredSize();
    1653     IntSize downPreferredSize = buttonDownGadget->preferredSize();
    1654     int buttonSize = std::max(std::max(upPreferredSize.width(), downPreferredSize.width()), std::max(upPreferredSize.height(), downPreferredSize.height()));
    1655     style.setWidth(Length(buttonSize * 2, Fixed));
    1656     style.setHeight(Length(buttonSize, Fixed));
     1529    style.setWidth(Length(spinButtonSize().width(), Fixed));
     1530    style.setHeight(Length(spinButtonSize().height(), Fixed));
    16571531}
    16581532
    16591533bool RenderThemeGtk::paintInnerSpinButton(const RenderObject& renderObject, const PaintInfo& paintInfo, const IntRect& rect)
    16601534{
    1661     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, "spinbutton", themePartStateFlags(*this, SpinButton, renderObject), { } };
    1662     auto spinbuttonGadget = RenderThemeGadget::create(info);
    1663     info.type = RenderThemeGadget::Type::TextField;
    1664     info.name = "entry";
    1665     info.classList.clear();
    1666     auto entryGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1667     info.type = RenderThemeGadget::Type::Icon;
    1668     info.name = "button";
    1669     info.classList.append("up");
    1670     info.state = themePartStateFlags(*this, SpinButtonUpButton, renderObject);
    1671     auto buttonUpGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1672     auto* gadgetIcon = static_cast<RenderThemeIconGadget*>(buttonUpGadget.get());
    1673     gadgetIcon->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1674     gadgetIcon->setIconName("list-add-symbolic");
    1675     info.classList[0] = "down";
    1676     info.state = themePartStateFlags(*this, SpinButtonDownButton, renderObject);
    1677     auto buttonDownGadget = RenderThemeGadget::create(info, spinbuttonGadget.get());
    1678     gadgetIcon = static_cast<RenderThemeIconGadget*>(buttonDownGadget.get());
    1679     gadgetIcon->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1680     gadgetIcon->setIconName("list-remove-symbolic");
     1535    auto& spinButtonWidget = static_cast<RenderThemeSpinButton&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SpinButton));
     1536    auto spinButtonState = themePartStateFlags(*this, SpinButton, renderObject);
     1537    spinButtonWidget.spinButton().setState(spinButtonState);
     1538    spinButtonWidget.entry().setState(spinButtonState);
     1539    auto& up = spinButtonWidget.up();
     1540    up.setState(themePartStateFlags(*this, SpinButtonUpButton, renderObject));
     1541    auto& down = spinButtonWidget.down();
     1542    down.setState(themePartStateFlags(*this, SpinButtonDownButton, renderObject));
    16811543
    16821544    IntRect iconRect = rect;
    16831545    iconRect.setWidth(iconRect.width() / 2);
    16841546    if (renderObject.style().direction() == RTL)
    1685         buttonUpGadget->render(paintInfo.context().platformContext()->cr(), iconRect);
     1547        up.render(paintInfo.context().platformContext()->cr(), iconRect);
    16861548    else
    1687         buttonDownGadget->render(paintInfo.context().platformContext()->cr(), iconRect);
     1549        down.render(paintInfo.context().platformContext()->cr(), iconRect);
    16881550    iconRect.move(iconRect.width(), 0);
    16891551    if (renderObject.style().direction() == RTL)
    1690         buttonDownGadget->render(paintInfo.context().platformContext()->cr(), iconRect);
     1552        down.render(paintInfo.context().platformContext()->cr(), iconRect);
    16911553    else
    1692         buttonUpGadget->render(paintInfo.context().platformContext()->cr(), iconRect);
     1554        up.render(paintInfo.context().platformContext()->cr(), iconRect);
    16931555
    16941556    return false;
    … …  
    18231685static Color styleColor(RenderThemePart themePart, GtkStateFlags state, StyleColorType colorType)
    18241686{
    1825     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Generic, nullptr, state, { } };
    1826     std::unique_ptr<RenderThemeGadget> parentGadget;
    1827     RenderThemePart part = themePart;
    1828     if (themePart == Entry && (state & GTK_STATE_FLAG_SELECTED)) {
    1829         info.name = "entry";
    1830         parentGadget = RenderThemeGadget::create(info);
    1831         part = EntrySelection;
    1832     }
    1833 
    1834     switch (part) {
    1835     case Entry:
    1836         info.name = "entry";
    1837         break;
    1838     case EntrySelection:
    1839         info.name = "selection";
    1840         break;
    1841     case ListBox:
    1842         info.name = "treeview";
    1843         info.classList.append("view");
    1844         break;
    1845     case Button:
    1846         info.name = "button";
    1847         break;
     1687    RenderThemeGadget* gadget = nullptr;
     1688    switch (themePart) {
    18481689    default:
    18491690        ASSERT_NOT_REACHED();
    1850         info.name = "entry";
    1851     }
    1852 
    1853     auto gadget = RenderThemeGadget::create(info, parentGadget.get());
     1691        FALLTHROUGH;
     1692    case Entry:
     1693        gadget = &static_cast<RenderThemeEntry&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::Entry)).entry();
     1694        break;
     1695    case EntrySelection:
     1696        gadget = static_cast<RenderThemeEntry&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::SelectedEntry)).selection();
     1697        break;
     1698    case ListBox:
     1699        gadget = &static_cast<RenderThemeListView&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::ListView)).treeview();
     1700        break;
     1701    case Button:
     1702        gadget = &static_cast<RenderThemeButton&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::Button)).button();
     1703        break;
     1704    }
     1705
     1706    ASSERT(gadget);
     1707    gadget->setState(state);
    18541708    return colorType == StyleColorBackground ? gadget->backgroundColor() : gadget->color();
    18551709}
    … …  
    18711725Color RenderThemeGtk::platformActiveSelectionBackgroundColor() const
    18721726{
    1873     return styleColor(Entry, static_cast<GtkStateFlags>(GTK_STATE_FLAG_SELECTED | GTK_STATE_FLAG_FOCUSED), StyleColorBackground);
     1727    return styleColor(EntrySelection, static_cast<GtkStateFlags>(GTK_STATE_FLAG_SELECTED | GTK_STATE_FLAG_FOCUSED), StyleColorBackground);
    18741728}
    18751729
    18761730Color RenderThemeGtk::platformInactiveSelectionBackgroundColor() const
    18771731{
    1878     return styleColor(Entry, GTK_STATE_FLAG_SELECTED, StyleColorBackground);
     1732    return styleColor(EntrySelection, GTK_STATE_FLAG_SELECTED, StyleColorBackground);
    18791733}
    18801734
    18811735Color RenderThemeGtk::platformActiveSelectionForegroundColor() const
    18821736{
    1883     return styleColor(Entry, static_cast<GtkStateFlags>(GTK_STATE_FLAG_SELECTED | GTK_STATE_FLAG_FOCUSED), StyleColorForeground);
     1737    return styleColor(EntrySelection, static_cast<GtkStateFlags>(GTK_STATE_FLAG_SELECTED | GTK_STATE_FLAG_FOCUSED), StyleColorForeground);
    18841738}
    18851739
    18861740Color RenderThemeGtk::platformInactiveSelectionForegroundColor() const
    18871741{
    1888     return styleColor(Entry, GTK_STATE_FLAG_SELECTED, StyleColorForeground);
     1742    return styleColor(EntrySelection, GTK_STATE_FLAG_SELECTED, StyleColorForeground);
    18891743}
    18901744
    … …  
    19421796bool RenderThemeGtk::paintMediaButton(const RenderObject& renderObject, GraphicsContext& graphicsContext, const IntRect& rect, const char* iconName)
    19431797{
    1944     RenderThemeGadget::Info info = { RenderThemeGadget::Type::Icon, "image", themePartStateFlags(*this, MediaButton, renderObject), { } };
    1945     auto gadget = RenderThemeGadget::create(info);
    1946     auto* gadgetIcon = static_cast<RenderThemeIconGadget*>(gadget.get());
    1947     gadgetIcon->setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
    1948     gadgetIcon->setIconName(iconName);
    1949     return !gadget->render(graphicsContext.platformContext()->cr(), rect);
     1798    auto& iconWidget = static_cast<RenderThemeIcon&>(RenderThemeWidget::getOrCreate(RenderThemeWidget::Type::Icon));
     1799    auto& icon = static_cast<RenderThemeIconGadget&>(iconWidget.icon());
     1800    icon.setState(themePartStateFlags(*this, MediaButton, renderObject));
     1801    icon.setIconSize(RenderThemeIconGadget::IconSizeGtk::Menu);
     1802    icon.setIconName(iconName);
     1803    return !icon.render(graphicsContext.platformContext()->cr(), rect);
    19501804}
    19511805#else

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/ChangeLog

    r217367 r219817  
     12017-07-24  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.6 release.
     4
     5        * gtk/NEWS: Add release notes for 2.16.6.
     6
     72017-06-26  Carlos Garcia Campos  <cgarcia@igalia.com>
     8
     9        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.5 release.
     10
     11        * gtk/NEWS: Add release notes for 2.16.5.
     12
     132017-06-25  Michael Catanzaro  <mcatanzaro@igalia.com>
     14
     15        Unreviewed, rolling out r215190.
     16
     17        Broke product select element on GNOME Bugzilla
     18
     19        Reverted changeset:
     20
     21        "[GTK] Misplaced right click menu on web page due to
     22        deprecated gtk_menu_popup()"
     23        https://bugs.webkit.org/show_bug.cgi?id=170553
     24        http://trac.webkit.org/changeset/215190
     25
     262017-06-20  Carlos Garcia Campos  <cgarcia@igalia.com>
     27
     28        Unreviewed. Update OptionsGTK.cmake and NEWS for 2.16.4 release.
     29
     30        * gtk/NEWS: Add release notes for 2.16.4.
     31
     322017-06-15  Carlos Garcia Campos  <cgarcia@igalia.com>
     33
     34        Unreviewed. Fix copy-paste error in GTK+ WEBKIT_JAVASCRIPT_ERROR definition.
     35
     36        The print one was copied there.
     37
     38        * UIProcess/API/gtk/WebKitError.h:
     39
     402017-06-16  Carlos Garcia Campos  <cgarcia@igalia.com>
     41
     42        Unreviewed. Remove wrong headers check from some GTK+ API files.
     43
     44        Remove the __WEBKIT_WEB_EXTENSION_H_INSIDE__ check since these are not actually shared.
     45
     46        * UIProcess/API/gtk/WebKitEditorState.h:
     47        * UIProcess/API/gtk/WebKitOptionMenu.h:
     48        * UIProcess/API/gtk/WebKitPrintCustomWidget.h:
     49
     502017-06-13  Carlos Garcia Campos  <cgarcia@igalia.com>
     51
     52        [GTK] Blob download doesn't work
     53        https://bugs.webkit.org/show_bug.cgi?id=172442
     54
     55        Reviewed by Carlos Alberto Lopez Perez.
     56
     57        GTK+ API uses URIs for download destination paths, and passes that URIs to the WebKit internals. But WebKit
     58        expects download destination location to be a local path. This is not a problem for normal downloads, because
     59        the soup backend handles the cases of download destination being a URI and a path. For blob downloads
     60        NetworkDataTaskBlob is used, and it always expects the download destination to be a local path, failing in
     61        FileSystem::openFile() when a URI is passed. We need to keep using local files internally and convert to URIs
     62        only when exposing those paths to the API.
     63
     64        * NetworkProcess/soup/NetworkDataTaskSoup.cpp:
     65        (WebKit::NetworkDataTaskSoup::download): Stop handling URIs here, we should always expect local files.
     66        * UIProcess/API/gtk/WebKitDownload.cpp:
     67        (webkitDownloadDecideDestinationWithSuggestedFilename): Convert destination URI to filanme before pasing it to DownloadClient.
     68        (webkitDownloadDestinationCreated): Convert the destination path to a URI before passing it to WebKitDownload::created-destionation signal.
     69        * UIProcess/API/gtk/WebKitDownloadClient.cpp:
     70        * UIProcess/API/gtk/WebKitDownloadPrivate.h:
     71
     722017-06-09  Ryosuke Niwa  <rniwa@webkit.org>
     73
     74        Crash inside WebKit::PluginView::getAuthenticationInfo
     75        https://bugs.webkit.org/show_bug.cgi?id=173083
     76        <rdar://problem/32513144>
     77
     78        Address Darin's review comment.
     79
     80        * WebProcess/Plugins/PluginView.cpp:
     81        (WebKit::PluginView::getAuthenticationInfo):
     82
     832017-06-07  Ryosuke Niwa  <rniwa@webkit.org>
     84
     85        Crash inside WebKit::PluginView::getAuthenticationInfo
     86        https://bugs.webkit.org/show_bug.cgi?id=173083
     87
     88        Reviewed by Chris Dumez.
     89
     90        Added a null pointer check. The content document may have went away by the time we get there from IPC.
     91
     92        * WebProcess/Plugins/PluginView.cpp:
     93        (WebKit::PluginView::getAuthenticationInfo):
     94
     952017-06-05  Chris Dumez  <cdumez@apple.com>
     96
     97        ASSERTION FAILED: RunLoop::isMain() in com.apple.WebKit: IPC::Connection::sendSyncMessage + 128
     98        https://bugs.webkit.org/show_bug.cgi?id=172943
     99        <rdar://problem/31288058>
     100
     101        Reviewed by Alexey Proskuryakov.
     102
     103        In Connection::sendMessage(), make sure we only ever transform asynchronous messages into synchronous
     104        ones if sendMessage() is called on the main thread. This is necessary because we no longer support
     105        sending synchronous messages from a background thread since r205125.
     106
     107        * Platform/IPC/Connection.cpp:
     108        (IPC::Connection::sendMessage):
     109        (IPC::Connection::sendSyncMessage):
     110
     1112017-06-02  Chris Dumez  <cdumez@apple.com>
     112
     113        REGRESSION (r206386): Xactimate Website Crashes @ com.apple.WebKit: WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant + 255
     114        https://bugs.webkit.org/show_bug.cgi?id=172846
     115        <rdar://problem/31093005>
     116
     117        Reviewed by Mark Lam.
     118
     119        Follow-up to r217695 to deal with exceptions potentially thrown by
     120        NPRuntimeObjectMap::convertJSValueToNPVariant() as well.
     121
     122        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
     123        (WebKit::NPJSObject::invoke):
     124
     1252017-06-01  Chris Dumez  <cdumez@apple.com>
     126
     127        REGRESSION (r206386): Xactimate Website Crashes @ com.apple.WebKit: WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant + 255
     128        https://bugs.webkit.org/show_bug.cgi?id=172846
     129        <rdar://problem/31093005>
     130
     131        Reviewed by Andreas Kling.
     132
     133        In NPJSObject::invoke(), return early if there was an exception when calling JSC::call().
     134        Using the value returned by JSC::call() when an exception occurred is unsafe.
     135
     136        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
     137        (WebKit::NPJSObject::invoke):
     138
     1392017-06-12  Carlos Garcia Campos  <cgarcia@igalia.com>
     140
     141        [GTK] Stop dismissing menus attached to the web view for every injected event
     142        https://bugs.webkit.org/show_bug.cgi?id=172708
     143
     144        Reviewed by Alex Christensen.
     145
     146        To actually simulate a right-click event we should also send the button release after the press, and let the page
     147        handle the events in addition to sending the event to the context menu controller, like we do with normal
     148        events. So, this is mostly the same as a real right-click event but without actually showing the menu.
     149
     150        * WebProcess/WebPage/WebPage.cpp:
     151        (WebKit::WebPage::contextMenuAtPointInWindow):
     152
     1532017-04-11  Adrian Perez de Castro  <aperez@igalia.com>
     154
     155        [GTK] Attach popup menu to web view widget
     156        https://bugs.webkit.org/show_bug.cgi?id=145866
     157
     158        Use gtk_menu_attach_to_widget() to let GTK+ know that popup menus belong to a certain web view.
     159        This improves the positioning choices that the toolkit can do, and solves a long-standing issue
     160        that caused long popup menus to hang outside of the available display area under Wayland.
     161
     162        Based on a patch by Jonas Ådahl <jadahl@gmail.com>.
     163
     164        Reviewed by Carlos Garcia Campos.
     165
     166        * UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
     167        (WebKit::WebPopupMenuProxyGtk::showPopupMenu):
     168
     1692017-04-10  Adrian Perez de Castro  <aperez@igalia.com>
     170
     171        [GTK] Misplaced right click menu on web page due to deprecated gtk_menu_popup()
     172        https://bugs.webkit.org/show_bug.cgi?id=170553
     173
     174        Reviewed by Michael Catanzaro.
     175
     176        Use gtk_menu_popup_at_pointer() and gtk_menu_popup_at_rect() when building with GTK+ 3.22 or
     177        newer. This allows the Wayland GTK+ backend to properly position popup menus, and also avoids
     178        using functions which were deprecated starting at that GTK+ release.
     179
     180        * UIProcess/gtk/WebContextMenuProxyGtk.cpp:
     181        (WebKit::WebContextMenuProxyGtk::show): Use gtk_menu_popup_at_pointer() as there is always a
     182        pointer event that can be passed to it.
     183        * UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
     184        (WebKit::WebPopupMenuProxyGtk::showPopupMenu): Use gtk_menu_popup_at_rect(), using the coordinates
     185        of the control passed as reference rectangle. Some conditional code is needed because with newer
     186        GTK+ versions a relative offset instead of an absolute position is needed.
     187
     1882017-04-10  Adrian Perez de Castro  <aperez@igalia.com>
     189
     190        [GTK] Opening a popup menu does not pre-select the active item
     191        https://bugs.webkit.org/show_bug.cgi?id=170680
     192
     193        Reviewed by Michael Catanzaro.
     194
     195        * UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
     196        (WebKit::WebPopupMenuProxyGtk::showPopupMenu): Use gtk_menu_shell_select_item() to
     197        ensure that the active item appears selected right after popping up the menu.
     198
    11992017-05-24  Carlos Garcia Campos  <cgarcia@igalia.com>
    2200

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/NetworkProcess/soup/NetworkDataTaskSoup.cpp

    r217367 r219817  
    849849    }
    850850
    851     if (g_path_is_absolute(m_pendingDownloadLocation.utf8().data()))
    852         m_downloadDestinationFile = adoptGRef(g_file_new_for_path(m_pendingDownloadLocation.utf8().data()));
    853     else
    854         m_downloadDestinationFile = adoptGRef(g_file_new_for_uri(m_pendingDownloadLocation.utf8().data()));
     851    CString downloadDestinationPath = m_pendingDownloadLocation.utf8();
     852    m_downloadDestinationFile = adoptGRef(g_file_new_for_path(downloadDestinationPath.data()));
    855853    GRefPtr<GFileOutputStream> outputStream;
    856854    GUniqueOutPtr<GError> error;
    … …  
    864862    }
    865863
    866     GUniquePtr<char> downloadDestinationURI(g_file_get_uri(m_downloadDestinationFile.get()));
    867     GUniquePtr<char> intermediateURI(g_strdup_printf("%s.wkdownload", downloadDestinationURI.get()));
    868     m_downloadIntermediateFile = adoptGRef(g_file_new_for_uri(intermediateURI.get()));
    869     outputStream = adoptGRef(g_file_replace(m_downloadIntermediateFile.get(), 0, TRUE, G_FILE_CREATE_NONE, 0, &error.outPtr()));
     864    GUniquePtr<char> intermediatePath(g_strdup_printf("%s.wkdownload", downloadDestinationPath.data()));
     865    m_downloadIntermediateFile = adoptGRef(g_file_new_for_path(intermediatePath.get()));
     866    outputStream = adoptGRef(g_file_replace(m_downloadIntermediateFile.get(), nullptr, TRUE, G_FILE_CREATE_NONE, nullptr, &error.outPtr()));
    870867    if (!outputStream) {
    871868        didFailDownload(platformDownloadDestinationError(m_response, error->message));
    … …  
    878875    auto* downloadPtr = download.get();
    879876    downloadManager.dataTaskBecameDownloadTask(m_pendingDownloadID, WTFMove(download));
    880     downloadPtr->didCreateDestination(String::fromUTF8(downloadDestinationURI.get()));
     877    downloadPtr->didCreateDestination(m_pendingDownloadLocation);
    881878
    882879    ASSERT(!m_client);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/Platform/IPC/Connection.cpp

    r217367 r219817  
    380380        return false;
    381381
    382     if (m_inDispatchMessageMarkedToUseFullySynchronousModeForTesting && !encoder->isSyncMessage() && !(encoder->messageReceiverName() == "IPC")) {
     382    if (RunLoop::isMain() && m_inDispatchMessageMarkedToUseFullySynchronousModeForTesting && !encoder->isSyncMessage() && !(encoder->messageReceiverName() == "IPC")) {
    383383        uint64_t syncRequestID;
    384384        auto wrappedMessage = createSyncMessageEncoder("IPC", "WrappedAsyncMessageForTesting", encoder->destinationID(), syncRequestID);

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp

    r217367 r219817  
    3232#include <wtf/glib/GRefPtr.h>
    3333#include <wtf/glib/GUniquePtr.h>
     34#include <wtf/text/CString.h>
    3435
    3536using namespace WebKit;
    … …  
    403404}
    404405
    405 CString webkitDownloadDecideDestinationWithSuggestedFilename(WebKitDownload* download, const CString& suggestedFilename, bool& allowOverwrite)
     406String webkitDownloadDecideDestinationWithSuggestedFilename(WebKitDownload* download, const CString& suggestedFilename, bool& allowOverwrite)
    406407{
    407408    if (download->priv->isCancelled)
    408         return "";
     409        return emptyString();
    409410    gboolean returnValue;
    410411    g_signal_emit(download, signals[DECIDE_DESTINATION], 0, suggestedFilename.data(), &returnValue);
    411412    allowOverwrite = download->priv->allowOverwrite;
    412     return download->priv->destinationURI;
    413 }
    414 
    415 void webkitDownloadDestinationCreated(WebKitDownload* download, const CString& destinationURI)
     413    GUniquePtr<char> destinationPath(g_filename_from_uri(download->priv->destinationURI.data(), nullptr, nullptr));
     414    if (!destinationPath)
     415        return emptyString();
     416    return String::fromUTF8(destinationPath.get());
     417}
     418
     419void webkitDownloadDestinationCreated(WebKitDownload* download, const String& destinationPath)
    416420{
    417421    if (download->priv->isCancelled)
    418422        return;
    419     g_signal_emit(download, signals[CREATED_DESTINATION], 0, destinationURI.data(), nullptr);
     423    GUniquePtr<char> destinationURI(g_filename_to_uri(destinationPath.utf8().data(), nullptr, nullptr));
     424    ASSERT(destinationURI);
     425    g_signal_emit(download, signals[CREATED_DESTINATION], 0, destinationURI.get());
    420426}
    421427

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadClient.cpp

    r217367 r219817  
    7878    {
    7979        GRefPtr<WebKitDownload> download = webkitWebContextGetOrCreateDownload(downloadProxy);
    80         return String::fromUTF8(webkitDownloadDecideDestinationWithSuggestedFilename(download.get(), filename.utf8(), allowOverwrite));
     80        return webkitDownloadDecideDestinationWithSuggestedFilename(download.get(), filename.utf8(), allowOverwrite);
    8181    }
    8282
    … …  
    8484    {
    8585        GRefPtr<WebKitDownload> download = webkitWebContextGetOrCreateDownload(downloadProxy);
    86         webkitDownloadDestinationCreated(download.get(), path.utf8());
     86        webkitDownloadDestinationCreated(download.get(), path);
    8787    }
    8888

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadPrivate.h

    r217367 r219817  
    2525#include <WebCore/ResourceError.h>
    2626#include <WebCore/ResourceRequest.h>
    27 #include <wtf/text/CString.h>
    2827
    2928WebKitDownload* webkitDownloadCreate(WebKit::DownloadProxy*);
    … …  
    3534void webkitDownloadCancelled(WebKitDownload*);
    3635void webkitDownloadFinished(WebKitDownload*);
    37 CString webkitDownloadDecideDestinationWithSuggestedFilename(WebKitDownload*, const CString& suggestedFilename, bool& allowOverwrite);
    38 void webkitDownloadDestinationCreated(WebKitDownload*, const CString& destinationURI);
     36String webkitDownloadDecideDestinationWithSuggestedFilename(WebKitDownload*, const CString& suggestedFilename, bool& allowOverwrite);
     37void webkitDownloadDestinationCreated(WebKitDownload*, const String& destinationPath);
    3938
    4039#endif // WebKitDownloadPrivate_h

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitEditorState.h

    r217367 r219817  
    1818 */
    1919
    20 #if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION) && !defined(__WEBKIT_WEB_EXTENSION_H_INSIDE__)
     20#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
    2121#error "Only <webkit2/webkit2.h> can be included directly."
    2222#endif

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitError.h

    r217367 r219817  
    3535#define WEBKIT_DOWNLOAD_ERROR   webkit_download_error_quark ()
    3636#define WEBKIT_PRINT_ERROR      webkit_print_error_quark ()
    37 #define WEBKIT_JAVASCRIPT_ERROR webkit_print_error_quark ()
     37#define WEBKIT_JAVASCRIPT_ERROR webkit_javascript_error_quark ()
    3838#define WEBKIT_SNAPSHOT_ERROR   webkit_snapshot_error_quark ()
    3939

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/API/gtk/WebKitPrintCustomWidget.h

    r217367 r219817  
    1818 */
    1919
    20 #if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION) && !defined(__WEBKIT_WEB_EXTENSION_H_INSIDE__)
     20#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
    2121#error "Only <webkit2/webkit2.h> can be included directly."
    2222#endif

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/UIProcess/gtk/WebPopupMenuProxyGtk.cpp

    r217367 r219817  
    123123    }
    124124
     125    gtk_menu_attach_to_widget(GTK_MENU(m_popup), GTK_WIDGET(m_webView), nullptr);
     126
    125127    const GdkEvent* event = m_client->currentlyProcessedMouseDownEvent() ? m_client->currentlyProcessedMouseDownEvent()->nativeEvent() : nullptr;
    126128    gtk_menu_popup_for_device(GTK_MENU(m_popup), event ? gdk_event_get_device(event) : nullptr, nullptr, nullptr,
    … …  
    143145       return;
    144146    }
     147
     148    // This ensures that the active item gets selected after popping up the menu, and
     149    // as it says in "gtkcombobox.c" (line ~1606): it's ugly, but gets the job done.
     150    GtkWidget* activeChild = gtk_menu_get_active(GTK_MENU(m_popup));
     151    if (activeChild && gtk_widget_get_visible(activeChild))
     152        gtk_menu_shell_select_item(GTK_MENU_SHELL(m_popup), activeChild);
    145153}
    146154

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp

    r217367 r219817  
    312312    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject.get(), argumentList);
    313313
     314    if (UNLIKELY(scope.exception())) {
     315        scope.clearException();
     316        return false;
     317    }
     318
    314319    // Convert and return the result of the function call.
    315320    m_objectMap->convertJSValueToNPVariant(exec, value, *result);
    316     scope.clearException();
     321
     322    if (UNLIKELY(scope.exception())) {
     323        scope.clearException();
     324        return false;
     325    }
    317326   
    318327    return true;

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/WebProcess/Plugins/PluginView.cpp

    r217367 r219817  
    15941594bool PluginView::getAuthenticationInfo(const ProtectionSpace& protectionSpace, String& username, String& password)
    15951595{
    1596     String partitionName = m_pluginElement->contentDocument()->topDocument().securityOrigin().domainForCachePartition();
     1596    auto* contentDocument = m_pluginElement->contentDocument();
     1597    if (!contentDocument)
     1598        return false;
     1599
     1600    String partitionName = contentDocument->topDocument().securityOrigin().domainForCachePartition();
    15971601    Credential credential = CredentialStorage::defaultCredentialStorage().get(partitionName, protectionSpace);
    15981602    if (credential.isEmpty())

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/WebProcess/WebPage/WebPage.cpp

    r217367 r219817  
    20592059{
    20602060    corePage()->contextMenuController().clearContextMenu();
    2061    
     2061
    20622062    // Simulate a mouse click to generate the correct menu.
    2063     PlatformMouseEvent mouseEvent(point, point, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime(), WebCore::ForceAtClick, WebCore::NoTap);
    2064     bool handled = corePage()->userInputBridge().handleContextMenuEvent(mouseEvent, &corePage()->mainFrame());
    2065     if (!handled)
    2066         return 0;
    2067 
    2068     return contextMenu();
     2063    PlatformMouseEvent mousePressEvent(point, point, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime(), WebCore::ForceAtClick, WebCore::NoTap);
     2064    corePage()->userInputBridge().handleMousePressEvent(mousePressEvent);
     2065    bool handled = corePage()->userInputBridge().handleContextMenuEvent(mousePressEvent, &corePage()->mainFrame());
     2066    auto* menu = handled ? contextMenu() : nullptr;
     2067    PlatformMouseEvent mouseReleaseEvent(point, point, RightButton, PlatformEvent::MouseReleased, 1, false, false, false, false, currentTime(), WebCore::ForceAtClick, WebCore::NoTap);
     2068    corePage()->userInputBridge().handleMouseReleaseEvent(mouseReleaseEvent);
     2069
     2070    return menu;
    20692071}
    20702072#endif

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/WebKit2/gtk/NEWS

    r217367 r219817  
     1==================
     2WebKitGTK+  2.16.6
     3==================
     4
     5  - Fix rendering of spin buttons with GTK+ >= 3.20 when the entry width is too short.
     6  - Fix the build when Wayland target is enabled and X11 disabled.
     7  - Fix several crashes and rendering issues.
     8  - Security fixes: CVE-2017-7039, CVE-2017-7018, CVE-2017-7030, CVE-2017-7037, CVE-2017-7034,
     9    CVE-2017-7055, CVE-2017-7056, CVE-2017-7064, CVE-2017-7061, CVE-2017-7048, CVE-2017-7046.
     10
     11==================
     12WebKitGTK+  2.16.5
     13==================
     14
     15  - Fix a web process crash when page finishes loading in several web sites.
     16  - Fix the menu of select elements not showing in some cases under Wayland.
     17
     18==================
     19WebKitGTK+  2.16.4
     20==================
     21
     22  - Fix web process deadlock when seeking youtube videos.
     23  - Fix blob downloads.
     24  - Improve theme rendering performance when using GTK+ >= 3.20.
     25  - Fix positioning of popup menus in Wayland.
     26  - Fix several crashes and rendering issues.
     27  - Security fixes: CVE-2017-2538.
     28
    129==================
    230WebKitGTK+  2.16.3

  • TabularUnified releases/WebKitGTK/webkit-2.16/Source/cmake/OptionsGTK.cmake

    r217367 r219817  
    33set(PROJECT_VERSION_MAJOR 2)
    44set(PROJECT_VERSION_MINOR 16)
    5 set(PROJECT_VERSION_MICRO 3)
     5set(PROJECT_VERSION_MICRO 6)
    66set(PROJECT_VERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_MICRO})
    77set(WEBKITGTK_API_VERSION 4.0)
    … …  
    1515# Libtool library version, not to be confused with API version.
    1616# See http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
    17 CALCULATE_LIBRARY_VERSIONS_FROM_LIBTOOL_TRIPLE(WEBKIT2 56 6 19)
    18 CALCULATE_LIBRARY_VERSIONS_FROM_LIBTOOL_TRIPLE(JAVASCRIPTCORE 23 10 5)
     17CALCULATE_LIBRARY_VERSIONS_FROM_LIBTOOL_TRIPLE(WEBKIT2 56 9 19)
     18CALCULATE_LIBRARY_VERSIONS_FROM_LIBTOOL_TRIPLE(JAVASCRIPTCORE 23 13 5)
    1919
    2020# These are shared variables, but we special case their definition so that we can use the

  • TabularUnified releases/WebKitGTK/webkit-2.16/Tools/ChangeLog

    r217367 r219817  
     12017-06-25  Michael Catanzaro  <mcatanzaro@igalia.com>
     2
     3        Unreviewed, rolling out r215190.
     4
     5        Broke product select element on GNOME Bugzilla
     6
     7        Reverted changeset:
     8
     9        "[GTK] Misplaced right click menu on web page due to
     10        deprecated gtk_menu_popup()"
     11        https://bugs.webkit.org/show_bug.cgi?id=170553
     12        http://trac.webkit.org/changeset/215190
     13
     142017-06-13  Carlos Garcia Campos  <cgarcia@igalia.com>
     15
     16        [GTK] Blob download doesn't work
     17        https://bugs.webkit.org/show_bug.cgi?id=172442
     18
     19        Reviewed by Carlos Alberto Lopez Perez.
     20
     21        Add a unit test to check blob downloads.
     22
     23        * TestWebKitAPI/Tests/WebKit2Gtk/TestDownloads.cpp:
     24        (testBlobDownload):
     25        (beforeAll):
     26
     272017-06-12  Carlos Garcia Campos  <cgarcia@igalia.com>
     28
     29        [GTK] Stop dismissing menus attached to the web view for every injected event
     30        https://bugs.webkit.org/show_bug.cgi?id=172708
     31
     32        Reviewed by Alex Christensen.
     33
     34        It's a workaround we added in r184015 that has worked so far for the context menu, but doesn't really work now
     35        that we also attach popup menus to the web view. We really need to be able to show a popup menu, and then send
     36        events while the menu is open.
     37
     38        * WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
     39        (WTR::EventSendingController::contextClick): Use WKBundlePageCopyContextMenuAtPointInWindow() also in GTK+ port.
     40        * WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:
     41        (WTR::EventSenderProxy::dispatchEvent): Stop calling PlatformWebView::dismissAllPopupMenus().
     42
     432017-04-10  Adrian Perez de Castro  <aperez@igalia.com>
     44
     45        [GTK] Misplaced right click menu on web page due to deprecated gtk_menu_popup()
     46        https://bugs.webkit.org/show_bug.cgi?id=170553
     47
     48        Reviewed by Michael Catanzaro.
     49
     50        Use gtk_menu_popup_at_pointer() and gtk_menu_popup_at_rect() when
     51        building with GTK+ 3.22 or newer. This allows the Wayland GTK+ backend
     52        to properly position popup menus, and also avoids using functions
     53        which were deprecated starting at that GTK+ release.
     54
     55        * MiniBrowser/gtk/BrowserSearchBar.c:
     56        (searchEntryMenuIconPressedCallback):
     57        Update MiniBrowser to use gtk_menu_popup_at_pointer().
     58
     592017-05-27  Zalan Bujtas  <zalan@apple.com>
     60
     61        enclosingIntRect returns a rect with -1 width/height when the input FloatRect overflows integer.
     62        https://bugs.webkit.org/show_bug.cgi?id=172676
     63
     64        Reviewed by Simon Fraser.
     65
     66        * TestWebKitAPI/Tests/WebCore/FloatRect.cpp:
     67        (TestWebKitAPI::TEST):
     68
    1692017-05-20  Ting-Wei Lan  <lantw44@gmail.com>
    270

  • TabularUnified releases/WebKitGTK/webkit-2.16/Tools/TestWebKitAPI/Tests/WebKit2Gtk/TestDownloads.cpp

    r217367 r219817  
    728728}
    729729
     730static void testBlobDownload(WebViewDownloadTest* test, gconstpointer)
     731{
     732    test->showInWindowAndWaitUntilMapped();
     733
     734    static const char* linkBlobHTML =
     735        "<html><body>"
     736        "<a id='downloadLink' style='position:absolute; left:1; top:1' download='foo.pdf'>Download Me</a>"
     737        "<script>"
     738        "  blob = new Blob(['Hello world'], {type: 'text/plain'});"
     739        "  document.getElementById('downloadLink').href = window.URL.createObjectURL(blob);"
     740        "</script>"
     741        "</body></html>";
     742    test->loadHtml(linkBlobHTML, kServer->getURIForPath("/").data());
     743    test->waitUntilLoadFinished();
     744
     745    g_idle_add([](gpointer userData) -> gboolean {
     746        auto* test = static_cast<WebViewDownloadTest*>(userData);
     747        test->clickMouseButton(1, 1, 1);
     748        return FALSE;
     749    }, test);
     750    test->waitUntilDownloadStarted();
     751
     752    g_assert(test->m_webView == webkit_download_get_web_view(test->m_download.get()));
     753    test->waitUntilDownloadFinished();
     754
     755    GRefPtr<GFile> downloadFile = adoptGRef(g_file_new_for_uri(webkit_download_get_destination(test->m_download.get())));
     756    GRefPtr<GFileInfo> downloadFileInfo = adoptGRef(g_file_query_info(downloadFile.get(), G_FILE_ATTRIBUTE_STANDARD_SIZE, static_cast<GFileQueryInfoFlags>(0), nullptr, nullptr));
     757    GUniquePtr<char> downloadPath(g_file_get_path(downloadFile.get()));
     758    GUniqueOutPtr<char> downloadContents;
     759    gsize downloadContentsLength;
     760    g_assert(g_file_get_contents(downloadPath.get(), &downloadContents.outPtr(), &downloadContentsLength, nullptr));
     761    g_assert_cmpint(g_file_info_get_size(downloadFileInfo.get()), ==, downloadContentsLength);
     762    g_assert_cmpstr(downloadContents.get(), ==, "Hello world");
     763    g_file_delete(downloadFile.get(), nullptr, nullptr);
     764}
     765
    730766void beforeAll()
    731767{
    … …  
    744780    DownloadTest::add("Downloads", "mime-type", testDownloadMIMEType);
    745781    WebViewDownloadTest::add("Downloads", "contex-menu-download-actions", testContextMenuDownloadActions);
     782    WebViewDownloadTest::add("Downloads", "blob-download", testBlobDownload);
    746783}
    747784

  • TabularUnified releases/WebKitGTK/webkit-2.16/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp

    r217367 r219817  
    548548    JSContextRef context = WKBundleFrameGetJavaScriptContext(mainFrame);
    549549#if ENABLE(CONTEXT_MENUS)
    550 #if PLATFORM(GTK) || PLATFORM(EFL)
    551     // Do mouse context click.
    552     mouseDown(2, 0);
    553     mouseUp(2, 0);
    554     WKRetainPtr<WKArrayRef> menuEntries = adoptWK(WKBundlePageCopyContextMenuItems(page));
    555 #else
    556550    WKRetainPtr<WKArrayRef> menuEntries = adoptWK(WKBundlePageCopyContextMenuAtPointInWindow(page, m_position));
    557 #endif
    558551    JSValueRef arrayResult = JSObjectMakeArray(context, 0, 0, 0);
    559552    if (!menuEntries)

  • TabularUnified releases/WebKitGTK/webkit-2.16/Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp

    r217367 r219817  
    168168{
    169169    ASSERT(m_testController->mainWebView());
    170 
    171     // If we are sending an escape key to the WebView, this has the side-effect of dismissing
    172     // any current popups anyway. Chances are that the test is doing this to dismiss the popup
    173     // anyway. Not all tests properly dismiss popup menus, so we still need to do it manually
    174     // if this isn't an escape key press.
    175     if (event->type != GDK_KEY_PRESS || event->key.keyval != GDK_KEY_Escape)
    176         m_testController->mainWebView()->dismissAllPopupMenus();
    177 
    178170    gtk_main_do_event(event);
    179171    gdk_event_free(event);
Note: See TracChangeset for help on using the changeset viewer.