Context Navigation

← Previous Period
Next Period →

Timeline

Jun 22, 2013:

11:24 PM Changeset in webkit [151887] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Remove redundant helper from RenderRegion.
https://bugs.webkit.org/show_bug.cgi?id=117915

Patch by Zalan Bujtas <Alan Bujtas> on 2013-06-22
Reviewed by Andreas Kling.

Minor code cleanup.

rendering/RenderRegion.cpp:

(WebCore::RenderRegion::regionOversetState):
(WebCore::RenderRegion::setRegionOversetState):

rendering/RenderRegion.h:

11:14 PM Changeset in webkit [151886] by commit-queue@webkit.org

3 edits in trunk/Tools

[EFL] Add support for MHTML save/load feature to MiniBrowser
https://bugs.webkit.org/show_bug.cgi?id=106620

Patch by Santosh Mahto <santosh.ma@samsung.com> on 2013-06-22
Reviewed by Christophe Dumez.

Enable CTRL + S as save page in mhtml and CTRL + L to load any page
from filesystem.

MiniBrowser/efl/CMakeLists.txt:
MiniBrowser/efl/main.c:

(page_contents_callback):
(on_key_down):
(show_file_entry_dialog): generic function to show file enrty
selector dialogue

9:57 PM Changeset in webkit [151885] by fpizlo@apple.com

10 edits
6 adds in branches/dfgFourthTier

fourthTier: DFG shouldn't exit just because a String GetByVal went out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=117906

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

This does the obvious thing, but also makes sure that out-of-bounds accesses
don't fall off into a C call, but try to do the fast thing if the prototype
chain is sane. We ought to probably do this for other array accesses in the
future, as well, since it's so darn easy.

dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::executeEffects):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::objectPrototypeIsSane):
(JSC):
(JSC::JSGlobalObject::arrayPrototypeChainIsSane):
(JSC::JSGlobalObject::stringPrototypeChainIsSane):

runtime/JSGlobalObject.h:

(JSGlobalObject):

LayoutTests:

Reviewed by Mark Hahnenberg.

The out-of-bounds benchmark that isn't insane speeds up by 22x in this
patch.

fast/js/regress/script-tests/string-get-by-val-out-of-bounds-insane.js: Added.

(foo):

fast/js/regress/script-tests/string-get-by-val-out-of-bounds.js: Added.

(foo):

fast/js/regress/string-get-by-val-out-of-bounds-expected.txt: Added.
fast/js/regress/string-get-by-val-out-of-bounds-insane-expected.txt: Added.
fast/js/regress/string-get-by-val-out-of-bounds-insane.html: Added.
fast/js/regress/string-get-by-val-out-of-bounds.html: Added.

8:31 PM Changeset in webkit [151884] by jberlin@webkit.org

5 edits in tags/Safari-537.46.5/Source

“Versioning.”

8:28 PM Changeset in webkit [151883] by jberlin@webkit.org

1 copy in tags/Safari-537.46.5

New tag.

6:42 PM Changeset in webkit [151882] by fpizlo@apple.com

2 edits in branches/dfgFourthTier/Source/JavaScriptCore

fourthTier: GC's put_by_id transition fixpoint should converge more quickly
https://bugs.webkit.org/show_bug.cgi?id=117912

Reviewed by Mark Hahnenberg.

This was a rookie mistake. The GC does a classic forward data flow fixpoint. These work well so long as you
iterate the program in program order, or at least something close to program order. Because I enjoy reverse
loops ("while (n--) blah"), I ended up iterating in *reverse* of program order which ensured worst-case
pathologies every single time. And unsurprisingly, this slowed down a program, namely pdfjs.

Flipping the loops to iterate forward fixes a 90% regression in Octane/pdfjs and is otherwise neutral.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):

4:33 PM Changeset in webkit [151881] by dino@apple.com

2 edits in trunk/Source/WebKit2

Slightly reduce width threshold on detection of primary snapshotted Plug-In
https://bugs.webkit.org/show_bug.cgi?id=117914
<rdar://problem/14136687>

Reviewed by Simon Fraser.

We've noticed some content that should be detected as the primary snapshotted plug-in,
but is just a bit smaller than our 450x300 minimum threshold. Reduce the width to 400.

WebProcess/WebPage/WebPage.cpp: Change primarySnapshottedPlugInMinimumWidth from 450 to 400.

4:16 PM Changeset in webkit [151880] by mrowe@apple.com

2 edits in trunk/Source/WebCore

Build fix after r151878.

platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:

(WebCore::WebCoreAVFResourceLoader::startLoading): Pass the new UseDefaultOriginRestrictionsForType
argument to the ResourceLoaderOptions constructor.

1:29 PM Changeset in webkit [151879] by Simon Fraser

2 edits in trunk/Source/WebCore

Followup from r151877 .
Fix crash in fast/frames/iframe-access-screen-of-deleted.html by null-checking the widget.

platform/mac/PlatformScreenMac.mm:

(WebCore::screenForWidget):

12:56 PM Changeset in webkit [151878] by hmuller@adobe.com

14 edits
3 adds in trunk

[CSS Shapes] limit shape image values to same origin
https://bugs.webkit.org/show_bug.cgi?id=117610

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Restrict the image URL values for shape-inside and shape-outside to
the same origin as the document. The alpha channel of image shape values
will be thresholded to produce the shape's boundaries (see bug 116643)
so normal image access rules aren't secure enough.

Added a RequestOriginPolicy ResourceLoaderOption which is used by
StyleResolver::loadPendingShapeImage() to request the additional restriction.
The change should have no other effect although it does enable one to apply
the same restriction to other resources which can currently be loaded from
any origin - see CachedResourceLoader::canRequest().

Test: http/tests/security/shape-inside-image-origin.html

css/CSSImageValue.cpp:

(WebCore::CSSImageValue::cachedImage): Add an effectively optional ResourceLoaderOptions parameter.

css/CSSImageValue.h:

(WebCore::CSSImageValue::cachedImage): Ditto.

css/StyleResolver.cpp:

(WebCore::StyleResolver::loadPendingShapeImage): Load the image with the default CachedResourceLoader options plus RestrictToSameOrigin.
(WebCore::StyleResolver::loadPendingImages): Call loadPendingShapeImage().

css/StyleResolver.h:
loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::startLoadingMainResource): Update the ResourceLoaderOptions static variable.

loader/NetscapePlugInStreamLoader.cpp:

(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.

loader/ResourceLoader.h:

(WebCore::ResourceLoader::options):

loader/ResourceLoaderOptions.h: Add RequestOriginPolicy enum.

(WebCore::ResourceLoaderOptions::ResourceLoaderOptions):

loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequest): Pass ResourceLoaderOptions along to revised CachedResourceLoader::canRequest().

loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestImage):
(WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Update load() ResourceLoaderOptions.
(WebCore::CachedResourceLoader::canRequest): Replaced ContentSecurityPolicyCheck parameter with ResourceLoaderOptions.
(WebCore::CachedResourceLoader::requestResource): Pass ResourceLoaderOptions along to revised CachedResourceLoader::canRequest().
(WebCore::CachedResourceLoader::defaultCachedResourceOptions): Added UseDefaultOriginRestrictionsForType initializer.

loader/cache/CachedResourceLoader.h:
loader/icon/IconLoader.cpp:

(WebCore::IconLoader::startLoading): Added UseDefaultOriginRestrictionsForType intializer.

LayoutTests:

Verify that a non same-origin image URL specified for shape-inside or
shape-outside will not load and the shape property will be reset to "none".

http/tests/resources/square100.png: Added.
http/tests/security/shape-inside-image-origin-expected.txt: Added.
http/tests/security/shape-inside-image-origin.html: Added.

12:41 PM Changeset in webkit [151877] by Simon Fraser

11 edits
1 add in trunk/Source

screen.availWidth always returns width of primary display
https://bugs.webkit.org/show_bug.cgi?id=117863

Source/WebCore:

Reviewed by Geoffrey Garen.

In WebKit2, Widgets have no platformWidget, so trying to get to the
NSScreen via the platform widget's window never succeeded, and we always
fell back on getting info for the main display.

However, we were already pushing the WKView's displayID down to the
WebProcess for the requestAnimationFrame infrastructure, so use that.

Add a virtual function on Widget windowDisplayID(), that is overridden
in FrameView to return the PlatformDisplayID which Page has.

Fix PlatformScreenMac to fall back to Widget::windowDisplayID() when it fails
to get an NSWindow from the Widget.

Add a utility category on NSScreen to get an NSScreen's displayID, and to
find an NSScreen given a displayID.

WebCore.exp.in:
WebCore.xcodeproj/project.pbxproj:
page/FrameView.cpp:

(WebCore::FrameView::windowDisplayID):

page/FrameView.h:
platform/Widget.cpp:

(WebCore::Widget::windowDisplayID):

platform/Widget.h:
platform/mac/PlatformScreenMac.h: Added.
platform/mac/PlatformScreenMac.mm:

(+[NSScreen screenForDislayID:]):
(-[NSScreen displayID]):
(WebCore::screenRect):
(WebCore::screenAvailableRect):

platform/mac/WidgetMac.mm:

(WebCore::Widget::windowDisplayID):

Source/WebKit2:

Reviewed by Geoffrey Garen.

In WebKit2, Widgets have no platformWidget, so trying to get to the
NSScreen via the platform widget's window never succeeded, and we always
fell back on getting info for the main display.

However, we were already pushing the WKView's displayID down to the
WebProcess for the requestAnimationFrame infrastructure, so use that.

The WebProcess would not receive a displayID for a WKView until the window
was activated; fix by calling -doWindowDidChangeScreen when the view
moves to a window, rather than doing it from -_windowDidBecomeKey:.

UIProcess/API/mac/WKView.mm:

(-[WKView viewDidMoveToWindow]):
(-[WKView _windowDidBecomeKey:]):

Jun 21, 2013:

10:56 PM Changeset in webkit [151876] by fpizlo@apple.com

4 edits
3 adds in branches/dfgFourthTier

fourthTier: DFG should CSE MakeRope
https://bugs.webkit.org/show_bug.cgi?id=117905

Source/JavaScriptCore:

Reviewed by Geoffrey Garen.

Adds MakeRope to the CSE phase and removes the comment that says that
we could do it but aren't doing it.

Also fixed SpeculatedType dumping so that if you have a Cell type then
it just prints "Cell" and if you just have Object then it just prints
"Object", instead of printing the long list of types.

bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):

dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::performNodeCSE):

LayoutTests:

Reviewed by Geoffrey Garen.

This benchmark speeds up by 50%.

fast/js/regress/make-rope-cse-expected.txt: Added.
fast/js/regress/make-rope-cse.html: Added.
fast/js/regress/script-tests/make-rope-cse.js: Added.

(foo):

7:36 PM Changeset in webkit [151875] by ggaren@apple.com

2 edits in trunk/Source/WebCore

Crashes due to NULL dereference beneath WebCore::StyleResolver::loadPendingSVGDocuments and related functions
https://bugs.webkit.org/show_bug.cgi?id=117903

Reviewed by Darin Adler.

css/StyleResolver.cpp:

(WebCore::StyleResolver::loadPendingSVGDocuments): Add a NULL check for
RenderStyle here...
(WebCore::StyleResolver::loadPendingResources): ...and here.

7:27 PM Changeset in webkit [151874] by fpizlo@apple.com

7 edits
3 adds in branches/dfgFourthTier

fourthTier: DFG should't exit just because it GetByVal'd a big character
https://bugs.webkit.org/show_bug.cgi?id=117899

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Add a slow path. Also clarify handling of GetByVal in PutStructure elimination.
Previously it would fail due to canExit() but now we can also fail because
GetByVal(String) can allocate. Just make it so GetByVal is totally poisoned, in
a very explicit way.

dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::putStructureStoreElimination):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):
(SpeculativeJIT):

LayoutTests:

Reviewed by Mark Hahnenberg.

This benchmark speeds up by 3x.

fast/js/regress/script-tests/string-get-by-val-big-char.js: Added.

(foo):

fast/js/regress/string-get-by-val-big-char-expected.txt: Added.
fast/js/regress/string-get-by-val-big-char.html: Added.

6:10 PM Changeset in webkit [151873] by Simon Fraser

2 edits in trunk/Source/WebCore

Occasional crash swiping between pages
https://bugs.webkit.org/show_bug.cgi?id=117902

Reviewed by Beth Dakin.

m_scrollingStateTree->rootStateNode() can be null when quickly swiping between pages,
so check this in ScrollingCoordinatorMac::commitTreeState().

page/scrolling/mac/ScrollingCoordinatorMac.mm:

(WebCore::ScrollingCoordinatorMac::commitTreeState):

5:25 PM Changeset in webkit [151872] by Brent Fulgham

2 edits in trunk/Tools

[Windows] Unreviewed crash protection for DRT

DumpRenderTree/win/AccessibilityUIElementWin.cpp: Check for null elements in routines

to avoid crashing during test runs.

5:13 PM Changeset in webkit [151871] by mark.lam@apple.com

2 edits in branches/dfgFourthTier/Source/WebCore

Fixed broken build: updated to match SmallStrings changes in r151864.

Not reviewed.

No new tests.

bindings/js/JSDOMBinding.h:

(WebCore::jsStringWithCache):

5:08 PM Changeset in webkit [151870] by Brent Fulgham

1 edit
1 add in trunk/LayoutTests

[Windows] Unreviewed gardening.

platform/win/accessibility/aria-menubar-menuitems-expected.txt: Added.

4:58 PM Changeset in webkit [151869] by mark.lam@apple.com

11 edits
1 add in trunk

Source/JavaScriptCore: Introducing the VMStackBounds class.
https://bugs.webkit.org/show_bug.cgi?id=117862.

Reviewed by Geoffrey Garen.

Removed Interpreter::StackPolicy.
The new VMStackBounds will take over choosing the appropriate stack size requirements, and invoking the underlying WTF::StackBounds to to the real bounds check.
VMStackBounds will now be used universally throughout JSC instead of WTF::StackBounds.

JavaScriptCore.xcodeproj/project.pbxproj:
bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):

bytecompiler/BytecodeGenerator.h:
interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
(JSC::Interpreter::prepareForRepeatCall):

interpreter/Interpreter.h:

(JSC::Interpreter::isInErrorHandlingMode):

parser/Parser.cpp:

(JSC::::Parser):

parser/Parser.h:
runtime/StringRecursionChecker.h:

(JSC::StringRecursionChecker::performCheck):

runtime/VMStackBounds.h: Added.

(JSC::VMStackBounds::VMStackBounds):
(JSC::VMStackBounds::isSafeToRecurse):
(JSC::VMStackBounds::requiredCapacity):

LayoutTests: Reverting failure expectation for fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html.
https://bugs.webkit.org/show_bug.cgi?id=117862.

Reviewed by Geoffrey Garen.

platform/mac/TestExpectations:

4:39 PM Changeset in webkit [151868] by Brent Fulgham

3 edits
3 adds in trunk

AX: Title for ListItemRole should consist of concatenated child text elements.
https://bugs.webkit.org/show_bug.cgi?id=117892

Reviewed by Chris Fleizach.

Source/WebCore:

accessibility/listitem-title.html

accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::visibleText): Add ListItemRole to set of
elements that concatenate their children for display purposes.
(WebCore::AccessibilityNodeObject::title): Ditto.

LayoutTests:

accessibility/listitem-title.html: Added.
platform/mac/accessibility/listitem-title-expected.txt: Added.
platform/win/accessibility/listitem-title-expected.txt: Added.

4:28 PM Changeset in webkit [151867] by Lucas Forschler

2 edits in branches/safari-537-branch/Source/WebKit

Merged r151847. <rdar://problem/14231905>

4:27 PM Changeset in webkit [151866] by Lucas Forschler

8 edits in branches/safari-537-branch/Source

Merged r151787. <rdar://problem/14219184>

4:23 PM Changeset in webkit [151865] by Lucas Forschler

6 edits
3 deletes in branches/safari-537-branch/LayoutTests

Merged r151801.

4:05 PM Changeset in webkit [151864] by fpizlo@apple.com

8 edits
3 adds in branches/dfgFourthTier

fourthTier: Small strings shouldn't get GC'd
https://bugs.webkit.org/show_bug.cgi?id=117897

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Kill off the code needed to allocate them lazily and finalize them.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

heap/Heap.cpp:

(JSC::Heap::collect):

runtime/JSString.h:

(JSC::jsSingleCharacterString):
(JSC::jsSingleCharacterSubstring):
(JSC::jsString):
(JSC::jsSubstring8):
(JSC::jsSubstring):
(JSC::jsOwnedString):

runtime/NumberPrototype.cpp:

(JSC::integerValueToString):

runtime/SmallStrings.cpp:

(JSC):
(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):

runtime/SmallStrings.h:

(JSC::SmallStrings::singleCharacterString):
(SmallStrings):

LayoutTests:

Reviewed by Mark Hahnenberg.

This test speeds up by 5%.

fast/js/regress/script-tests/string-get-by-val.js: Added.

(foo):

fast/js/regress/string-get-by-val-expected.txt: Added.
fast/js/regress/string-get-by-val.html: Added.

3:50 PM Changeset in webkit [151863] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

[MediaStream]: Remove >= 0 assertion from a size_t variable
https://bugs.webkit.org/show_bug.cgi?id=117890

Patch by Sergio Correia <Sergio Correia> on 2013-06-21
Reviewed by Adam Barth.

This patch fixes a strict build by removing the >= 0 assertion from
a size_t (unsigned type) variable in RTCStatsResponse.cpp.

No new tests; build fix.

Modules/mediastream/RTCStatsResponse.cpp:

(WebCore::RTCStatsResponse::addStatistic): Remove >=0assertion,
since the variable is unsigned and is always >= 0.

3:20 PM Changeset in webkit [151862] by Lucas Forschler

5 edits in tags/Safari-537.46.4/Source

Versioning.

3:13 PM Changeset in webkit [151861] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Uncaught exception when pretty printing WebInspector.Script
https://bugs.webkit.org/show_bug.cgi?id=117893

This was an issue with an earlier refactoring. The sourceCode is a Script,
so replace the non-existent local variable "script" with "this._sourceCode".

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2013-06-21
Reviewed by Timothy Hatcher.

UserInterface/SourceCodeTextEditor.js:

(WebInspector.SourceCodeTextEditor.prototype.textEditorUpdatedFormatting):

3:13 PM Changeset in webkit [151860] by Lucas Forschler

2 edits in tags/Safari-537.46.4/Source/WebKit

Merged r151847. <rdar://problem/14231905>

3:07 PM Changeset in webkit [151859] by Lucas Forschler

8 edits in tags/Safari-537.46.4/Source

Merged r151787. <rdar://problem/14219184>

2:55 PM Changeset in webkit [151858] by achristensen@apple.com

2 edits in trunk/Source/WebCore

GraphicsContext3DNEON.h cannot be found on Windows and does not need to be found.
https://bugs.webkit.org/show_bug.cgi?id=117894

Reviewed by Brent Fulgham.

platform/graphics/GraphicsContext3D.cpp:

Added #if HAVE(ARM_NEON_INTRINSICS) around #include "GraphicsContext3DNEON.h"

2:33 PM Changeset in webkit [151857] by Lucas Forschler

1 copy in tags/Safari-537.46.4

New Tag.

2:27 PM Changeset in webkit [151856] by fpizlo@apple.com

15 edits
1 add in branches/dfgFourthTier/Source

fourthTier: Merge r146932 and 146933 so that we can profile from DumpRenderTree
https://bugs.webkit.org/show_bug.cgi?id=117891

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Merging the JSC part of these changes required creating a fresh VM to JSONify
the profiler database, because that's the only truly safe way to do it. This
is because we don't really know when the profiler would be asked to dump JSON,
and we might be in the middle of VM shutdown. That's a bug in the ToT version
of this, but we didn't catch it because we didn't have enough assertions to
that effect.

jsc.cpp:

(jscmain):

profiler/ProfilerDatabase.cpp:

(Profiler):
(JSC::Profiler::Database::Database):
(JSC::Profiler::Database::~Database):
(JSC::Profiler::Database::toJSON):
(JSC::Profiler::Database::registerToSaveAtExit):
(JSC::Profiler::Database::addDatabaseToAtExit):
(JSC::Profiler::Database::removeDatabaseFromAtExit):
(JSC::Profiler::Database::performAtExitSave):
(JSC::Profiler::Database::removeFirstAtExitDatabase):
(JSC::Profiler::Database::atExitCallback):

profiler/ProfilerDatabase.h:

(Database):
(JSC::Profiler::Database::databaseID):

runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::createContextGroup):
(JSC::VM::create):
(JSC::VM::createLeaked):
(JSC::VM::sharedInstance):

runtime/VM.h:

(VM):

Source/WTF:

Reviewed by Mark Hahnenberg.

The WTF part of this change is a straight-up merge with nothing interesting.

GNUmakefile.list.am:
WTF.gypi:
WTF.pro:
WTF.vcproj/WTF.vcproj:
WTF.xcodeproj/project.pbxproj:
wtf/CMakeLists.txt:
wtf/MetaAllocator.cpp:

(WTF::MetaAllocator::dumpProfile):

wtf/ProcessID.h: Added.

(WTF):
(WTF::getCurrentProcessID):

wtf/text/StringImpl.cpp:

(WTF::StringStats::printStats):

2:04 PM Changeset in webkit [151855] by robert@webkit.org

3 edits
2 adds in trunk

Ignoring padding-right of inline elements in containers with undefined width
https://bugs.webkit.org/show_bug.cgi?id=76451

Reviewed by David Hyatt.

Source/WebCore:

Collapsed trailing space on a normal wrap line should not cause a line-break
if it is the difference between fitting on the line and breaking. Likewise, on a line that
has a mix of auto-wrap and no-wrap inlines we don't want a trailing space at the end of a no-wrap inline
to be the difference between that no-wrap inline fitting or breaking the line. This latter
scenario is covered already by inline-whitespace-wrapping-8.html.

Test: fast/text/whitespace/inline-whitespace-wrapping-9.html

rendering/RenderBlockLineLayout.cpp:

(WebCore::LineWidth::fitsOnLine):
(WebCore::LineWidth::fitsOnLineIncludingExtraWidth):
(WebCore::LineWidth::fitsOnLineExcludingTrailingWhitespace):
(WebCore::LineWidth::currentWidth):
(WebCore::LineWidth::fitsOnLineExcludingTrailingCollapsedWhitespace):
(WebCore::RenderBlock::LineBreaker::nextSegmentBreak):

LayoutTests:

fast/text/whitespace/inline-whitespace-wrapping-9-expected.html: Added.
fast/text/whitespace/inline-whitespace-wrapping-9.html: Added.

1:57 PM Changeset in webkit [151854] by achristensen@apple.com

8 edits in trunk/Source/WebCore

Added WebGL source files to Windows build and made Windows build successfully with them.
https://bugs.webkit.org/show_bug.cgi?id=117853

Reviewed by Brent Fulgham.

WebCore.vcxproj/WebCore.vcxproj: Added WebGL source files.
WebCore.vcxproj/WebCore.vcxproj.filters: Added platform\graphics\opengl and platform\graphics\gpu filters.
WebCore.vcxproj/WebCorePreBuild.cmd: Copy ANGLE headers and glext.h before building WebCore (which now uses them).
platform/graphics/ANGLEWebKitBridge.h: Look in newly copied directory for ShaderLang.h.
platform/graphics/OpenGLShims.h: Include GL/glext.h.
platform/graphics/gpu/LoopBlinnShader.cpp:

(WebCore::LoopBlinnShader::use): Fixed parameter ordering in call to uniformMatrix4fv.

platform/graphics/opengl/GLPlatformSurface.cpp:

(WebCore::GLPlatformSurface::createOffScreenSurface): Added notImplemented for non-EGL builds for now.

1:37 PM Changeset in webkit [151853] by eric.carlson@apple.com

4 edits in trunk/Source/WebCore

Update platform text track menu
https://bugs.webkit.org/show_bug.cgi?id=117884

Reviewed by Jer Noble.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setSelectedTextTrack):

html/track/TextTrack.cpp:

(WebCore::TextTrack::platformTextTrack):

platform/graphics/PlatformTextTrack.h:

(WebCore::PlatformTextTrack::create):
(WebCore::PlatformTextTrack::uniqueId):
(WebCore::PlatformTextTrack::captionMenuOffItem):
(WebCore::PlatformTextTrack::captionMenuAutomaticItem):
(WebCore::PlatformTextTrack::PlatformTextTrack):

1:21 PM Changeset in webkit [151852] by commit-queue@webkit.org

5 edits in trunk

AX: audio/video playback control timers (elapsed and remaining) should be exposed as ApplicationTimerRole
https://bugs.webkit.org/show_bug.cgi?id=117883

Patch by James Craig <james@cookiecrook.com> on 2013-06-21
Reviewed by Chris Fleizach.

Some of the media controls were returning the wrong role. Updated existing test coverage.

Source/WebCore:

accessibility/AccessibilityMediaControls.h:

(WebCore::AccessibilityMediaTimeDisplay::roleValue):

LayoutTests:

accessibility/media-element.html:
platform/mac/accessibility/media-element-expected.txt:

12:59 PM Changeset in webkit [151851] by achristensen@apple.com

1 edit
2 adds in trunk/Source/WebCore

Added glext.h from http://www.opengl.org/registry/oldspecs/glext.h for Windows
This file does not meet WebKit style guidelines.
Part of https://bugs.webkit.org/show_bug.cgi?id=117853

Reviewed by Brent Fulgham.

platform/graphics/win/GL: Added.
platform/graphics/win/GL/glext.h: Added.

12:53 PM WebKitGTK/2.0.x edited by zandobersek@gmail.com

Add three more merge proposals for the 2.0.4 release. (diff)

12:46 PM Changeset in webkit [151850] by Lucas Forschler

5 edits in tags/Safari-537.46.3/Source

Versioning.

12:38 PM Changeset in webkit [151849] by Lucas Forschler

1 copy in tags/Safari-537.46.3

New Tag.

12:25 PM Changeset in webkit [151848] by fpizlo@apple.com

7 edits in branches/dfgFourthTier

Merge trunk r146548.

Source/JavaScriptCore:

2013-03-21 Filip Pizlo <fpizlo@apple.com>

JSC profiler should have an at-a-glance report of the success of DFG optimization
https://bugs.webkit.org/show_bug.cgi?id=112988

Reviewed by Geoffrey Garen.

dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleCall): (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::parseBlock):
profiler/ProfilerCompilation.cpp: (JSC::Profiler::Compilation::Compilation): (JSC::Profiler::Compilation::toJS):
profiler/ProfilerCompilation.h: (JSC::Profiler::Compilation::noticeInlinedGetById): (JSC::Profiler::Compilation::noticeInlinedPutById): (JSC::Profiler::Compilation::noticeInlinedCall): (Compilation):
runtime/CommonIdentifiers.h:

Tools:

2013-03-21 Filip Pizlo <fpizlo@apple.com>

JSC profiler should have an at-a-glance report of the success of DFG optimization
https://bugs.webkit.org/show_bug.cgi?id=112988

Reviewed by Geoffrey Garen.

Scripts/display-profiler-output:

11:47 AM Changeset in webkit [151847] by roger_fong@apple.com

2 edits in trunk/Source/WebKit

Unreviewed. Fix a missing parenthesis in include directory path.

WebKit.vcxproj/WebKitExportGenerator/WebKitExportGeneratorCommon.props:

11:16 AM Changeset in webkit [151846] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Stop removing and re-adding breakpoints from the backend on reload.

On reload the sourceCode for breakpoints are nulled out, which fires DisplayLocationDidChange.
Then the sourceCode is reassociated, firing DisplayLocationDidChange again. In these cases we
don't need to update the backend, since nothing really changed.

https://bugs.webkit.org/show_bug.cgi?id=117877

Reviewed by Joseph Pecoraro.

UserInterface/DebuggerManager.js:

(WebInspector.DebuggerManager.prototype._breakpointDisplayLocationDidChange): Return early when
_ignoreBreakpointDisplayLocationDidChangeEvent is true.
(WebInspector.DebuggerManager.prototype.reset): Set _ignoreBreakpointDisplayLocationDidChangeEvent.
(WebInspector.DebuggerManager.prototype._associateBreakpointsWithSourceCode): Ditto.

11:08 AM Changeset in webkit [151845] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Fix TextTrackCue::cueIndex() to handle the null case of TextTrack::cues(() properly
https://bugs.webkit.org/show_bug.cgi?id=117815
<rdar://problem/14211041>

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-06-21
Reviewed by Ryosuke Niwa.

This patch adds assert statements to try to catch when
track()->cues() returns a null pointer.

html/track/TextTrackCue.cpp:

(WebCore::TextTrackCue::cueIndex):

10:52 AM Changeset in webkit [151844] by jer.noble@apple.com

5 edits in trunk/Source/WebCore

[iOS] Hang drawing captions after pressing the home button while playing a video
https://bugs.webkit.org/show_bug.cgi?id=117882

Reviewed by Eric Carlson.

Instead of rendering in a callback on the main thread, pre-render the captions and pass to the main
thread as a CGImage. As such, rename paintTextTrackRepresentation() to createTextTrackRepresentationImage().

html/shadow/MediaControlElements.cpp:

(WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage): Renamed from

paintTextTrackRepresentation. Now returns an Image object.

html/shadow/MediaControlElements.h:
platform/graphics/MediaPlayer.h:
platform/graphics/TextTrackRepresentation.h:

10:42 AM Changeset in webkit [151843] by commit-queue@webkit.org

8 edits in trunk/Source/WebCore

[CSS Regions] Move overset compute code from flow thread to named flow thread
https://bugs.webkit.org/show_bug.cgi?id=117835

Patch by Radu Stavila <stavila@adobe.com> on 2013-06-21
Reviewed by Andreas Kling.

Moved computeOversetStateForRegions() and overset() methods from RenderFlowThread to RenderNamedFlowThread.
Added ASSERTS in RenderRegion::regionOversetState and RenderRegion::setRegionOversetState to ensure
the region was created from an element.

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computeOverflow):

rendering/RenderFlowThread.cpp:

(WebCore::RenderFlowThread::RenderFlowThread):

rendering/RenderFlowThread.h:
rendering/RenderNamedFlowThread.cpp:

(WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
(WebCore::RenderNamedFlowThread::computeOversetStateForRegions):

rendering/RenderNamedFlowThread.h:

(WebCore::RenderNamedFlowThread::overset):

rendering/RenderRegion.cpp:

(WebCore::RenderRegion::regionOversetState):
(WebCore::RenderRegion::setRegionOversetState):

9:48 AM Changeset in webkit [151842] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Unreviewed, rolling out r151838.
http://trac.webkit.org/changeset/151838
https://bugs.webkit.org/show_bug.cgi?id=117880

Breaks MediaPlayerPrivateQt on Mac (Requested by carewolf on
#webkit).

html/HTMLMediaElement.h:

9:35 AM Changeset in webkit [151841] by Brent Fulgham

6 edits
3 adds in trunk

Source/WebCore: [Windows] AX: Radio buttons with "tab" role should describe themselves as tabs
https://bugs.webkit.org/show_bug.cgi?id=117837

Reviewed by Chris Fleizach.

accessibility/aria-tab-role-on-buttons.html

accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::canSetSelectedAttribute): Indicate that certain accessibility
types (such as Tabs) can be selected.

accessibility/AccessibilityNodeObject.h: Signature for canSelectAttribute override.

Source/WebKit/win: [Windows] AX: Radio buttons with "tab" role should describe themselves as tabs.
https://bugs.webkit.org/show_bug.cgi?id=117837

Reviewed by Chris Fleizach.

AccessibleBase.cpp:

(MSAARole): Don't expose TabRole as a radio button to satisfy buggy screen readers.

LayoutTests: [Windows] AX: Radio buttons with "tab" role should describe themselves as tabs.
https://bugs.webkit.org/show_bug.cgi?id=117837

Reviewed by Chris Fleizach.

accessibility/aria-tab-role-on-buttons.html: Added.
accessibility/aria-tab-role-on-buttons-expected.txt: Added.
platform/win/aria-tab-role-on-buttons-expected.txt: Added.

9:12 AM Changeset in webkit [151840] by allan.jensen@digia.com

4 edits in trunk/Source/WebCore

Remove unused GesturePinch events
https://bugs.webkit.org/show_bug.cgi?id=117875

Reviewed by Andreas Kling.

The gesturePinch events have not been used for some time, even Chromium
had stop using them before moving out of webkit.

dom/GestureEvent.cpp:

(WebCore::GestureEvent::create):

page/EventHandler.cpp:

(WebCore::EventHandler::handleGestureEvent):

platform/PlatformEvent.h:

9:03 AM Changeset in webkit [151839] by commit-queue@webkit.org

13 edits
3 moves
1 add
1 delete in trunk

Improve the reattaching process while applying the :hover style
https://bugs.webkit.org/show_bug.cgi?id=117590

Patch by Radu Stavila <stavila@adobe.com> on 2013-06-21
Reviewed by Andreas Kling.

Source/WebCore:

Changes made:

context is properly propagated to the element's children and to Shadow DOM elements.
context is properly set on the lazyReattach method.
another hit-testing is triggered when needed.
when a hovered element is detached, it's ancestors are also removed from the hovered state.

Tests: fast/css/hover-display-block-inline.html

fast/css/hover-display-block-none.html

dom/ContainerNode.cpp:

(WebCore::ContainerNode::attach):
(WebCore::ContainerNode::detach):

dom/ContainerNode.h:

(WebCore::ContainerNode::attachChildren):
(WebCore::ContainerNode::detachChildrenIfNeeded):
(WebCore::ContainerNode::detachChildren):

dom/Document.cpp:

(WebCore::Document::recalcStyle):
(WebCore::Document::updateHoverActiveState):

dom/Element.cpp:

(WebCore::Element::attach):
(WebCore::Element::detach):

dom/ElementShadow.cpp:

(WebCore::ElementShadow::attach):
(WebCore::ElementShadow::detach):

dom/ElementShadow.h:
dom/Node.h:

(WebCore::Node::lazyReattach):

LayoutTests:

Moved hover-display-block-inline.html and hover-display-block-none.html from fast/regions to fast/css.
Updated hover-display-block-none.html and hover-single-flow-into-other.html to ensure the outcome won't be affected by the machine's speed.
Updated input-file-re-render.html to stop it from failing on windows and linux machines (a more detailed description can be found inside the test itself).

fast/css/hover-display-block-inline-expected.txt: Renamed from LayoutTests/fast/regions/hover-display-block-inline-expected.txt.
fast/css/hover-display-block-inline.html: Renamed from LayoutTests/fast/regions/hover-display-block-inline.html.
fast/css/hover-display-block-none-expected.txt: Renamed from LayoutTests/fast/regions/hover-display-block-none-expected.txt.
fast/css/hover-display-block-none.html: Added.
fast/css/hover-update-expected.txt:
fast/css/hover-update.html:
fast/forms/file/input-file-re-render.html:
fast/regions/hover-display-block-none.html: Removed.
fast/regions/hover-single-flow-into-other.html:

9:01 AM Changeset in webkit [151838] by allan.jensen@digia.com

2 edits in trunk/Source/WebCore

HTMLMediaElement should inherit from MediaPlayerClient privately
https://bugs.webkit.org/show_bug.cgi?id=117874

Reviewed by Andreas Kling.

Fixing FIXME: HTMLMediaElement was stuck with public inheritance from
MediaPlayerClient due to the Chromium port.
This can now be fixed to a private inheritance.

html/HTMLMediaElement.h:

8:58 AM Changeset in webkit [151837] by allan.jensen@digia.com

1 edit
2 deletes in trunk/Source/WebCore

Remove Chromium-only TouchDisambiguation
https://bugs.webkit.org/show_bug.cgi?id=117873

Reviewed by Andreas Kling.

page/TouchDisambiguation.cpp: Removed.
page/TouchDisambiguation.h: Removed.

8:45 AM Changeset in webkit [151836] by commit-queue@webkit.org

7 edits in trunk

Rollout r150602: Restoring text-overflow vs. floating rendering behaviour.
https://bugs.webkit.org/show_bug.cgi?id=117871

Unreviewed. Rolling out r150602.
Undesirable rendering behaviour.

Patch by Zalan Bujtas <Alan Bujtas> on 2013-06-21

Source/WebCore:

rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::checkLinesForTextOverflow):

LayoutTests:

fast/css/text-overflow-ellipsis-behind-floats-expected.html:
fast/css/text-overflow-ellipsis-behind-floats.html:
fast/css/text-overflow-ellipsis-full-truncate-rtl-expected.html:
fast/css/text-overflow-ellipsis-full-truncate-rtl.html:

7:31 AM Changeset in webkit [151835] by commit-queue@webkit.org

12 edits in trunk

Web Inspector: Integrate new regionOversetChange event into inspector
https://bugs.webkit.org/show_bug.cgi?id=117833

Source/WebCore:

Added the new regionOversetChange event to the WebInspector.

Patch by Radu Stavila <stavila@adobe.com> on 2013-06-21
Reviewed by Joseph Pecoraro.

Tests: inspector/styles/protocol-css-regions-commands.html:

inspector/Inspector.json:
inspector/InspectorCSSAgent.cpp:

(WebCore::ChangeRegionOversetTask::ChangeRegionOversetTask):
(WebCore::ChangeRegionOversetTask::scheduleFor):
(WebCore::ChangeRegionOversetTask::unschedule):
(WebCore::ChangeRegionOversetTask::reset):
(WebCore::ChangeRegionOversetTask::onTimer):
(WebCore::InspectorCSSAgent::resetNonPersistentData):
(WebCore::InspectorCSSAgent::willRemoveNamedFlow):
(WebCore::InspectorCSSAgent::didChangeRegionOverset):
(WebCore::InspectorCSSAgent::regionOversetChanged):

inspector/InspectorCSSAgent.h:
inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::didChangeRegionOversetImpl):

inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::didChangeRegionOverset):

inspector/front-end/CSSNamedFlowCollectionsView.js:

(WebInspector.CSSNamedFlowCollectionsView.prototype._regionOversetChanged):
(WebInspector.CSSNamedFlowCollectionsView.prototype.wasShown):
(WebInspector.CSSNamedFlowCollectionsView.prototype.willHide):

inspector/front-end/CSSStyleModel.js:

(WebInspector.CSSStyleModel.prototype._regionOversetChanged):
(WebInspector.CSSDispatcher.prototype.regionLayoutUpdated):
(WebInspector.CSSDispatcher.prototype.regionOversetChanged):

rendering/RenderNamedFlowThread.cpp:

(WebCore::RenderNamedFlowThread::dispatchRegionOversetChangeEvent):

LayoutTests:

Tests for the new regionOversetChange event.

Patch by Radu Stavila <stavila@adobe.com> on 2013-06-21
Reviewed by Joseph Pecoraro.

inspector/styles/protocol-css-regions-commands-expected.txt:
inspector/styles/protocol-css-regions-commands.html:

6:59 AM Changeset in webkit [151834] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

[EFL] NetworkStateNotifierEfl: Use closeWithRetry instead of looping for EINTR on close
https://bugs.webkit.org/show_bug.cgi?id=117872

Patch by Sergio Correia <Sergio Correia> on 2013-06-21
Reviewed by Christophe Dumez.

closeWithRetry works around the Linux behavior of closing the file descriptor
unconditionally even if the close() call is interrupted.

No new tests, no behavior change.

platform/network/efl/NetworkStateNotifierEfl.cpp:

(WebCore::NetworkStateNotifier::~NetworkStateNotifier): Use closeWithRetry instead of
looping for EINTR on close.

4:41 AM Changeset in webkit [151833] by Carlos Garcia Campos

3 edits in trunk/Source/WebKit2

[GTK] Do not try to load videos in unit tests
https://bugs.webkit.org/show_bug.cgi?id=117866

Reviewed by Philippe Normand.

It makes the tests slower, and generates and error because we use
a fake src.

UIProcess/API/gtk/tests/TestContextMenu.cpp:

(testContextMenuDefaultMenu): Use preload='none' in video tag.

UIProcess/API/gtk/tests/TestWebKitWebView.cpp:

(testWebViewMouseTarget): Ditto.

3:34 AM Changeset in webkit [151832] by Christophe Dumez

33 edits in trunk

REGRESSION (r150663): Using webkitAudioContext in Inspector makes it undefined everywhere
https://bugs.webkit.org/show_bug.cgi?id=117825

Reviewed by Kentaro Hara.

Source/WebCore:

Partially revert r150663 so that we use Settings to enable WebAudio instead of
RuntimeEnabledFeatures.

Introduce a new [EnabledBySetting] IDL extended attribute which behaves similarly to
the existing [EnabledAtRuntime] but relies on Settings instead of RuntimeEnabledFeatures
to determine if the feature should be enabled. Make use of this new IDL attribute for
webkitAudioContext interface.

No new tests, no behavior change.

Modules/webaudio/AudioContext.idl:
WebCore.exp.in:
WebCore.order:
bindings/generic/RuntimeEnabledFeatures.cpp:
bindings/generic/RuntimeEnabledFeatures.h:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

bindings/scripts/IDLAttributes.txt:
bindings/scripts/preprocess-idls.pl:

(GenerateConstructorAttribute):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):

bindings/scripts/test/JS/JSTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj TestSubObjEnabledBySetting]):
(-[DOMTestObj setTestSubObjEnabledBySetting:]):

bindings/scripts/test/TestObj.idl:
page/Settings.in:

Source/WebKit/efl: