Context Navigation

← Previous Period
Next Period →

Timeline

Jul 24, 2014:

11:58 PM Changeset in webkit [171588] by Yusuke Suzuki

8 edits
8 adds in trunk

CSS JIT: Implement Pseudo Element
https://bugs.webkit.org/show_bug.cgi?id=134835

Reviewed by Benjamin Poulain.

Implement Pseudo Element handling for CSS JIT SelectorCompiler.
At first, we start with the simple implementation. We handle limited number of pseudo element,
before, after, first-line, first-letter.

Source/WebCore:
Tests: fast/selectors/pseudo-element-inside-any.html

fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-any.html
fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-not.html
fast/selectors/querySelector-pseudo-element.html

css/ElementRuleCollector.cpp:

(WebCore::ElementRuleCollector::ruleMatches):

css/SelectorChecker.cpp:

(WebCore::SelectorChecker::matchRecursively):

cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
(WebCore::SelectorCompiler::constructFragments):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
(WebCore::SelectorCompiler::SelectorCodeGenerator::loadCheckingContext):
(WebCore::SelectorCompiler::SelectorCodeGenerator::branchOnResolvingModeWithCheckingContext):
(WebCore::SelectorCompiler::SelectorCodeGenerator::branchOnResolvingMode):
(WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNotResolvingStyle):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsActive):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasPseudoElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateRequestedPseudoElementEqualsToSelectorPseudoElement):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateMarkPseudoStyleForPseudoElement):

cssjit/SelectorCompiler.h:
rendering/style/RenderStyle.h:
rendering/style/RenderStyleConstants.h:

LayoutTests:

fast/selectors/pseudo-element-inside-any-expected.html: Added.
fast/selectors/pseudo-element-inside-any.html: Added.

Inside functional pseudo classes such as ":-webkit-any", when pseudo element comes (e.g. ":-webkit-any(::first-letter)"),
it produces a local failure. So if the other selectors are matched against the element, whole ":-webkit-any" succeeds.
For example, a selector ":-webkit-any(::first-letter, p)" matches against p elements.

fast/selectors/querySelector-pseudo-element-expected.txt: Added.
fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-any-expected.txt: Added.
fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-any.html: Added.
fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-not-expected.txt: Added.
fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-not.html: Added.
fast/selectors/querySelector-pseudo-element.html: Added.

11:24 PM Changeset in webkit [171587] by abucur@adobe.com

8 edits
2 adds in trunk

REGRESSION (r169105): Crash in selection
https://bugs.webkit.org/show_bug.cgi?id=134303

Patch by Radu Stavila <stavila@adobe.com> on 2014-07-24
Reviewed by David Hyatt.

Source/WebCore:

When splitting the selection between different subtrees, all subtrees must have their selection cleared before
starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
we get inconsistent data.

To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
method first iterates through all subtrees and performs the "clear" method and then starts all over again
and performs the "apply" method.

Test: fast/regions/selection/crash-deselect.html

WebCore.xcodeproj/project.pbxproj:
rendering/RenderSelectionInfo.h:
rendering/RenderView.cpp:

(WebCore::RenderView::setSelection):
(WebCore::RenderView::splitSelectionBetweenSubtrees):
(WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
(WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
(WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
(WebCore::RenderView::setSubtreeSelection): Deleted.

rendering/RenderView.h:
rendering/SelectionSubtreeRoot.cpp:

(WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):

rendering/SelectionSubtreeRoot.h:

(WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):

LayoutTests:

Added test for the crash that occurred in some cases when selecting.

fast/regions/selection/crash-deselect-expected.txt: Added.
fast/regions/selection/crash-deselect.html: Added.

11:13 PM Changeset in webkit [171586] by Lucas Forschler

7 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171471. <rdar://problem/17764847>

11:10 PM Changeset in webkit [171585] by Lucas Forschler

7 edits in branches/safari-600.1-branch/Source

Merged r171203. <rdar://problem/17617282>

11:06 PM Changeset in webkit [171584] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171580. <rdar://problem/17748416>

11:04 PM Changeset in webkit [171583] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171577. <rdar://problem/17803347>

11:02 PM Changeset in webkit [171582] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171576. <rdar://problem/17804891>

11:00 PM Changeset in webkit [171581] by Lucas Forschler

5 edits in branches/safari-600.1-branch/Source/WebKit/mac

Merged r171575. <rdar://problem/17784826>

9:51 PM Changeset in webkit [171580] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

REGRESSION(r164401): Placing a caret doesn't bring up autocorrection panel
https://bugs.webkit.org/show_bug.cgi?id=135278

Reviewed by Tim Horton.

The bug was caused by editorUIUpdateTimerFired calling respondToChangedSelection only if the selection was
triggered by dictation instead of only if it was NOT triggered by dictation.

Prior to r164401, AlternativeTextController::respondToMarkerAtEndOfWord exited early when SetSelectionOptions
had DictationTriggered set. r164401 intended to move this check to editorUIUpdateTimerFired to avoid passing
options around but the boolean condition was erroneously flipped.

Fixed the bug by negating the condition in editorUIUpdateTimerFired.

No new tests for now since autocorrection panel cannot be tested automatically. (We should really automate this!)

editing/Editor.cpp:

(WebCore::Editor::editorUIUpdateTimerFired):

9:27 PM Changeset in webkit [171579] by psolanki@apple.com

2 edits in trunk/Source/WebCore

REGRESSION(r171526): [GTK] Massive crashes.
https://bugs.webkit.org/show_bug.cgi?id=135283

Unreviewed. GTK build fix after r171526. Initialize m_buffer in SharedBuffer constructor.

platform/soup/SharedBufferSoup.cpp:

(WebCore::SharedBuffer::SharedBuffer):

8:12 PM Changeset in webkit [171578] by Brent Fulgham

2 edits in trunk/Source/JavaScriptCore

[Win] Correct build order in JavaScriptCore.submit.sln
https://bugs.webkit.org/show_bug.cgi?id=135282
<rdar://problem/17805592>

Unreviewed build fix.

JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Correct build order

such that LLIntDesiredOffset is built prior to the rest of JSC.

8:12 PM Changeset in webkit [171577] by timothy_horton@apple.com

2 edits in trunk/Source/WebCore

Crashes under scanSelectionForTelephoneNumbers in Range::text() on some sites
https://bugs.webkit.org/show_bug.cgi?id=135281
<rdar://problem/17803347>

Reviewed by Ryosuke Niwa.

editing/Editor.cpp:

(WebCore::Editor::scanSelectionForTelephoneNumbers):
toNormalizedRange is not guaranteed to return a non-null range.
If it returns null, pass the empty markedRanges down to the client as our new set.

8:00 PM Changeset in webkit [171576] by benjamin@webkit.org

2 edits in trunk/Source/WebKit2

[iOS][WK2] Do not try to hit test a null mainFrameRenderView on dynamicViewportSizeUpdate()
https://bugs.webkit.org/show_bug.cgi?id=135277
<rdar://problem/17804891>

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-07-24
Reviewed by Tim Horton.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::dynamicViewportSizeUpdate):
There is no guarantee that the main frame have its root view when performing a dynamicViewportSizeUpdate(),
we should not attempt to use the layer without null checking it first.

The odd part for me is <rdar://problem/17804891> is a little too frequent. In the vast majority of cases,
there is a RenderView, it seems actually pretty hard not to have one on dynamicViewportSizeUpdate().

Skipping hit testing is safe because it is a completely optional part of this algorithm.
When the hit test is not done, the new position is computed based on the relative position prior to
the size change.

7:26 PM Changeset in webkit [171575] by psolanki@apple.com

5 edits in trunk/Source/WebKit/mac

[iOS] Remove prefs to tweak cache values
https://bugs.webkit.org/show_bug.cgi?id=135274
<rdar://problem/17784826>

Reviewed by Alexey Proskuryakov.

Remove iOS specific code that used to look up user defaults to see if any cache values were
overridden. This was added for testing, is not used any more and is actually harmful now. It
can cause unnecessary memory churn when under memory pressure since we call [WebView _setCacheModel]
as a means to clear out memory cache.

WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences _setNSURLMemoryCacheSize:]): Deleted.
(-[WebPreferences _NSURLMemoryCacheSize]): Deleted.
(-[WebPreferences _setNSURLDiskCacheSize:]): Deleted.
(-[WebPreferences _NSURLDiskCacheSize]): Deleted.

WebView/WebPreferencesPrivate.h:
WebView/WebView.mm:

(+[WebView _setCacheModel:]):

6:31 PM Changeset in webkit [171574] by mitz@apple.com

6 edits in trunk/Source

Source/WebCore: WebCore part of <rdar://problem/17593701> Assertion failure in WebPage::reload (!m_pendingNavigationID) when reloading after a same-document back navigation
https://bugs.webkit.org/show_bug.cgi?id=135129

Reviewed by Darin Adler.

WebCore.exp.in: Exported equalIgnoringFragmentIdentifier(const URL&, const URL&).

Source/WebKit2: WebKit2 part of <rdar://problem/17593701> Assertion failure in WebPage::reload (!m_pendingNavigationID) when reloading after a same-document back navigation
https://bugs.webkit.org/show_bug.cgi?id=135129

Reviewed by Darin Adler.

Shared/WebBackForwardListItem.cpp:

(WebKit::childItemWithDocumentSequenceNumber): New helper function based on
WebCore::HistoryItem::childItemWithDocumentSequenceNumber.
(WebKit::documentTreesAreEqual): New helper function based on
WebCore::HistoryItem::hasSameDocumentTree.
(WebKit::WebBackForwardListItem::itemIsInSameDocument): Added. Based on
WebCore::HistoryItem::shouldDoSameDocumentNavigationTo.

Shared/WebBackForwardListItem.h:

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::goForward): Don’t assign a new navigation ID if the back-forward
navigation is a same-document navigation.
(WebKit::WebPageProxy::goBack): Ditto.
(WebKit::WebPageProxy::goToBackForwardItem): Ditto.

6:18 PM Changeset in webkit [171573] by Lucas Forschler

3 edits
2 copies in branches/safari-600.1-branch

Merged r171567. <rdar://problem/17781423>

6:16 PM Changeset in webkit [171572] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171570. <rdar://problem/17803170>

6:12 PM Changeset in webkit [171571] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171564. <rdar://problem/17757800>

6:11 PM Changeset in webkit [171570] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit2

Sometimes WKWebView is blank after resuming the app, until you scroll
https://bugs.webkit.org/show_bug.cgi?id=135275
<rdar://problem/17803170>

Reviewed by Benjamin Poulain.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::dispatchViewStateChange):
If the UI process is waiting for a didUpdateViewState, we need to *always*
get a reply from the Web Process, so dispatchViewStateChange should *always*
send SetViewState even if nothing changed (so that we get the reply).

6:08 PM Changeset in webkit [171569] by Lucas Forschler

4 edits
2 copies in branches/safari-600.1-branch

Merged r171561. <rdar://problem/16591706>

6:05 PM Changeset in webkit [171568] by Lucas Forschler

6 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171560. <rdar://problem/17542454>

6:05 PM Changeset in webkit [171567] by Simon Fraser

3 edits
2 adds in trunk

[iOS WK1] CSS viewport units use the wrong viewport size in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=135254
<rdar://problem/17781423>

Reviewed by Tim Horton.

Source/WebCore:

Test: fast/css/viewport-units-dynamic.html

In WebKit1 on iOS, we want to resolve viewport units against the visible
viewport, not the legacy WK1 notion of the "viewport" which is the entire document.

Fixes rendering of medium.com articles in WK1 views on iPad.

page/FrameView.cpp:

(WebCore::FrameView::viewportSizeForCSSViewportUnits):

LayoutTests:

New test that ensures that viewport units are resolved against the correct
viewport size after the first style recalc.

fast/css/viewport-units-dynamic.html: Added.
platform/mac/fast/css/viewport-units-dynamic-expected.txt: Added.

6:03 PM Changeset in webkit [171566] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171559. <rdar://problem/17598815>

5:59 PM Changeset in webkit [171565] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171558. <rdar://problem/17041912>

5:59 PM Changeset in webkit [171564] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

JSWrapperMap's jsWrapperForObject() needs to keep weak prototype and constructors from being GCed.
<https://webkit.org/b/135258>

Reviewed by Mark Hahnenberg.

Where needed, we cache the prototype object pointer in a stack local var.
This allows it to be scanned by the GC, and hence be kept alive until
we use it. The constructor object will in turn be kept alive by the
prototype object.

Also added some comments to warn against future code additions that could
regress this issue.

API/JSWrapperMap.mm:

(-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
(-[JSObjCClassInfo reallocateConstructorAndOrPrototype]):
(-[JSObjCClassInfo wrapperForObject:]):
(-[JSObjCClassInfo constructor]):

5:57 PM Changeset in webkit [171563] by Lucas Forschler

4 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171505. <rdar://problem/17713033>

5:53 PM Changeset in webkit [171562] by Lucas Forschler

7 edits
2 copies in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171543. <rdar://problem/17706699>

5:27 PM Changeset in webkit [171561] by mmaxfield@apple.com

4 edits
2 adds in trunk

Crash when measuring a glyphs from a fallback SVG font
https://bugs.webkit.org/show_bug.cgi?id=135264

Reviewed by Simon Fraser.

Source/WebCore:
We can't realize font data for all fallback fonts ahead
of time, but we don't have all the necessary context to
realize SVG fallback data when it's needed. For now, we
can just bail; however, a larger, more invasive fix is
in order.

Test: svg/text/svg-fallback-font-crash.html

platform/graphics/WidthIterator.cpp:

(WebCore::applyFontTransforms):

LayoutTests:
Render some text with a fallback SVG Font including a glyph which
only exists in that fallback font. Make sure there is no crash.

svg/text/resources/Litherum.svg:
svg/text/svg-fallback-font-crash-expected.txt: Added.
svg/text/svg-fallback-font-crash.html: Added.

5:24 PM Changeset in webkit [171560] by Simon Fraser

6 edits in trunk/Source/WebKit2

[iOS WK2] Header bar on nytimes articles lands in the wrong place after rubberbanding
https://bugs.webkit.org/show_bug.cgi?id=135221
<rdar://problem/17542454>

Reviewed by Benjamin Poulain.

The call to didCommitLayerTree() can cause one or two visible rect updates,
via changes to the UIScrollView contentSize and contentOffset. As a result, we
would notify the scrolling tree about a viewport change, but using the old
scrolling tree rather than the new one, so we could move layers around for
nodes which are about to be removed from the tree.

However, we also have to ensure that programmatic scrolls are applied after
didCommitLayerTree() has updated the view size, so have RemoteScrollingCoordinatorProxy
store data about programmatic scrolls and return them to the caller, which
can apply them after didCommitLayerTree().

UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.cpp: Store a pointer to a RequestedScrollInfo

for the duration of the tree update, so that we can store requested scroll info in it.
(WebKit::RemoteScrollingCoordinatorProxy::RemoteScrollingCoordinatorProxy):
(WebKit::RemoteScrollingCoordinatorProxy::updateScrollingTree):
(WebKit::RemoteScrollingCoordinatorProxy::scrollingTreeNodeRequestsScroll):

UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didCommitLayerTree): Give Mac a stub implementation.

UIProcess/WebPageProxy.h: Group some editing-related functions together.

(WebKit::WebPageProxy::editorState):
(WebKit::WebPageProxy::canDelete):
(WebKit::WebPageProxy::hasSelectedRange):
(WebKit::WebPageProxy::isContentEditable):
(WebKit::WebPageProxy::maintainsInactiveSelection):

UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree): Ordering change: update
the layer tree, then call didCommitLayerTree(), then do the viewport update, followed
by any programmatic scroll.

5:15 PM Changeset in webkit [171559] by dbates@webkit.org

2 edits in trunk/Source/WebCore

And Alexey Proskuryakov <ap@apple.com>

[iOS] REGRESSION (WebKit2): Can't login to Wordpress.com, facebook.com when always allowing cookies
https://bugs.webkit.org/show_bug.cgi?id=135273
<rdar://problem/17598815>

Reviewed by Alexey Proskuryakov.

Fixes an issue where cookies may be created in the wrong cookie store.

Currently, when we update the CFURLRequest object associated with a ResourceRequest object
we explicitly set a cookie storage, cookie accept policy, and SSL properties based on the
corresponding values in the old CFURLRequest object (if we have one). This ultimately leads
to CFNetwork associating the cookies for the request with a different cookie store when we
handle the request in the NetworkProcess. Instead, we shouldn't set these properties
explicitly as we already copy them implicitly earlier (via CFURLRequestCreateMutableCopy()).

platform/network/cf/ResourceRequestCFNet.cpp:

(WebCore::ResourceRequest::doUpdatePlatformRequest):

4:56 PM Changeset in webkit [171558] by Joseph Pecoraro

2 edits in trunk/Source/JavaScriptCore

JSLock release should only modify the AtomicStringTable if it modified in acquire
https://bugs.webkit.org/show_bug.cgi?id=135143

Reviewed by Darin Adler.

runtime/JSLock.cpp:

(JSC::JSLock::JSLock):
Initialize the member variable to nullptr.

(JSC::JSLock::willDestroyVM):
Update style to use nullptr instead of 0.

(JSC::JSLock::willReleaseLock):
We should only reset the thread data's atomic string table if
didAcquireLock changed it. m_entryAtomicStringTable will have
been set by didAcquireLock if it changed, or nullptr if it didn't.
This way we are sure we are balanced, regardless of m_vm changes.

4:50 PM Changeset in webkit [171557] by commit-queue@webkit.org

8 edits in trunk/Source

Rename feature flag for long-press gesture on Mac.

Source/JavaScriptCore:
https://bugs.webkit.org/show_bug.cgi?id=135259

Patch by Peyton Randolph <prandolph@apple.com> on 2014-07-24
Reviewed by Beth Dakin.

Configurations/FeatureDefines.xcconfig:

Rename LINK_LONG_PRESS to MAC_LONG_PRESS.

Source/WebCore:
https://bugs.webkit.org/show_bug.cgi?id=135259

Patch by Peyton Randolph <prandolph@apple.com> on 2014-07-24
Reviewed by Beth Dakin.

Configurations/FeatureDefines.xcconfig:

Rename LINK_LONG_PRESS to MAC_LONG_PRESS.

Source/WebKit/mac:
https://bugs.webkit.org/show_bug.cgi?id=135259

Patch by Peyton Randolph <prandolph@apple.com> on 2014-07-24
Reviewed by Beth Dakin.

Configurations/FeatureDefines.xcconfig:

Rename LINK_LONG_PRESS to MAC_LONG_PRESS.

Source/WebKit2:
https://bugs.webkit.org/show_bug.cgi?id=135259

Patch by Peyton Randolph <prandolph@apple.com> on 2014-07-24
Reviewed by Beth Dakin.

Configurations/FeatureDefines.xcconfig:

Rename LINK_LONG_PRESS to MAC_LONG_PRESS.

4:38 PM Changeset in webkit [171556] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171554. <rdar://problem/17766348>

4:35 PM Changeset in webkit [171555] by commit-queue@webkit.org

2 edits in trunk/Tools

GTK jhbuild modules needs to build xserver with --disable-local-transport
https://bugs.webkit.org/show_bug.cgi?id=135262

Patch by Michael Catanzaro <Michael Catanzaro> on 2014-07-24
Reviewed by Martin Robinson.

gtk/jhbuild.modules:

Build X server with --disable-local-transport, since local transport
is only supported on Solaris, SCO, and System V. Fixes build on
Fedora.

4:34 PM Changeset in webkit [171554] by mitz@apple.com

2 edits in trunk/Source/WebCore

Fixed Windows build fix.

platform/network/cf/AuthenticationCF.cpp:

4:30 PM Changeset in webkit [171553] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r171527.
https://bugs.webkit.org/show_bug.cgi?id=135265

Breaks JSC API tests (Requested by mlam on #webkit).

Reverted changeset:

"JSWrapperMap's jsWrapperForObject() needs to defer GC."
https://bugs.webkit.org/show_bug.cgi?id=135258
http://trac.webkit.org/changeset/171527

4:29 PM Changeset in webkit [171552] by commit-queue@webkit.org

2 edits in trunk/Tools

[GTK] build-webkit script fails under jhbuild if ACLOCAL_FLAGS is unset
https://bugs.webkit.org/show_bug.cgi?id=135065

Patch by Michael Catanzaro <Michael Catanzaro> on 2014-07-24
Reviewed by Martin Robinson.

jhbuild/jhbuild-wrapper:

(ensure_jhbuild): do not assume jhbuild sets ACLOCAL_FLAGS

4:28 PM Changeset in webkit [171551] by Lucas Forschler

4 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171545. <rdar://problem/17766348>

4:27 PM Changeset in webkit [171550] by Lucas Forschler

28 edits
6 copies
1 delete in branches/safari-600.1-branch/Source

Merged r171540. <rdar://problem/17766348>

4:21 PM Changeset in webkit [171549] by Lucas Forschler

10 edits in branches/safari-600.1-branch/Source

Merged r171532. <rdar://problem/17279500>

4:17 PM Changeset in webkit [171548] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171519. <rdar://problem/17798346>

4:16 PM Changeset in webkit [171547] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171518. <rdar://problem/17797103>

4:11 PM Changeset in webkit [171546] by Lucas Forschler

6 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171526. <rdar://problem/17470655>

4:01 PM Changeset in webkit [171545] by mitz@apple.com

4 edits in trunk/Source/WebCore

Attempted Windows build fix.

platform/network/cf/AuthenticationCF.cpp:

(WebCore::AuthenticationChallenge::AuthenticationChallenge):

platform/network/cf/CredentialStorageCFNet.cpp:

(WebCore::CredentialStorage::getFromPersistentStorage):

platform/network/cf/ProtectionSpaceCFNet.cpp:

(WebCore::ProtectionSpace::receivesCredentialSecurely):
(WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Deleted.

4:01 PM Changeset in webkit [171544] by Lucas Forschler

5 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171497. <rdar://problem/17470655>

3:56 PM Changeset in webkit [171543] by mhahnenberg@apple.com

7 edits
2 adds in trunk/Source/JavaScriptCore

Creating a JSGlobalObject with a custom JSClassRef results in a JSProxy with the wrong prototype
https://bugs.webkit.org/show_bug.cgi?id=135250

Reviewed by Geoffrey Garen.

JSGlobalObject::resetPrototype (which is called from JSGlobalContextCreateInGroup) doesn't change its
JSProxy's prototype as well. This results in a JSProxy where no properties in the original prototype
chain (as created from the JSClassRef hierarchy) are accessible. Changing resetPrototype to also change
the JSProxy's prototype fixes the issue.

API/JSValueRef.cpp:

(JSValueIsObjectOfClass): Also fixed a bug where a JSProxy for a JSGlobalObject with a custom JSClassRef
would claim it wasn't of the specified class, even if the target was of the specified class.

API/tests/CustomGlobalObjectClassTest.c: Added.

(jsDoSomething):
(customGlobalObjectClassTest):

API/tests/CustomGlobalObjectClassTest.h: Added.
API/tests/testapi.c:

(assertTrue):
(main):

JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
JavaScriptCore.xcodeproj/project.pbxproj:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::resetPrototype):

3:55 PM Changeset in webkit [171542] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171485. <rdar://problem/17782623>

3:54 PM Changeset in webkit [171541] by Lucas Forschler

3 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171201. <rdar://problem/17082607>

3:51 PM Changeset in webkit [171540] by mitz@apple.com

28 edits
2 copies
1 move
3 adds in trunk/Source

Source/WebCore: <rdar://problem/17766348> [Cocoa] WebCore::ProtectionSpace doesn’t preserve all NSURLProtectionSpace properties, such as the distinguishedNames array
https://bugs.webkit.org/show_bug.cgi?id=135229

Reviewed by Alexey Proskuryakov.

CMakeLists.txt: Updated for rename of a source file.

WebCore.exp.in: Updated.

WebCore.vcxproj/WebCore.vcxproj: Updated for rename of source files, added

ProtectionSpaceCFNet.{cpp,h}.

WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.

WebCore.xcodeproj/project.pbxproj: Updated for rename of source files, added

ProtectionSpaceCococa.{h.mm}.

platform/network/ProtectionSpace.cpp: Renamed to ProtectionSpaceBase.cpp.
platform/network/ProtectionSpace.h: This file was renamed to ProtectionSpaceBase.h, and

in its place added a generic ProtectionSpace class that just derives from
ProtectionSpaceBase. For Cocoa and CFNetwork, ProtectionSpace{Cocoa,CFNet}.h is included
instead of the generic class.

platform/network/ProtectionSpaceBase.cpp: Renamed ProtectionSpace.cpp to this.

(WebCore::ProtectionSpaceBase::ProtectionSpaceBase): Updated for rename.
(WebCore::ProtectionSpaceBase::host): Ditto.
(WebCore::ProtectionSpaceBase::port): Ditto.
(WebCore::ProtectionSpaceBase::serverType): Ditto.
(WebCore::ProtectionSpaceBase::isProxy): Ditto.
(WebCore::ProtectionSpaceBase::realm): Ditto.
(WebCore::ProtectionSpaceBase::authenticationScheme): Ditto.
(WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Removed CFNetwork-specific part,
which is now implemented in ProtectionSpaceCFNet.cpp.
(WebCore::ProtectionSpaceBase::compare): Replaced operator== with this, and made it call
ProtectionSpace::platformCompare at the end if needed.

platform/network/ProtectionSpaceBase.h: Renamed ProtectionSpace.h to this.

(WebCore::ProtectionSpaceBase::encodingRequiresPlatformData): Added with a default
implementation that returns false, for ProtectionSpace implementations to override.
(WebCore::ProtectionSpaceBase::platformCompare): Added with a default implementation that
returns true, for ProtectionSpace implementations to override.
(WebCore::operator==): Changed to call compare.

platform/network/cf/AuthenticationCF.cpp:

(WebCore::AuthenticationChallenge::AuthenticationChallenge): Changed to use the
ProtectionSpace constructor that takes a CFURLProtectionSpaceRef.
(WebCore::createCF): Changed to use ProtectionSpace::cfSpace.

platform/network/cf/AuthenticationCF.h: Guarded a couple of functiosn that aren’t used in

Cocoa with #if PLATFORM(WIN).

platform/network/cf/CredentialStorageCFNet.cpp:

(WebCore::CredentialStorage::getFromPersistentStorage): Changed to use
ProtectionSpace::cfSpace.
(WebCore::CredentialStorage::saveToPersistentStorage): Ditto.

platform/network/cf/ProtectionSpaceCFNet.cpp: Added.

(WebCore::ProtectionSpaceBase::receivesCredentialSecurely): Override with the
CFNetwork-specific test that was previously in ProtectionSpace.cpp.

platform/network/cf/ProtectionSpaceCFNet.h: Copied from Source/WebCore/platform/network/ProtectionSpace.h.

Declare ProtectionSpace and override receivesCredentialSecurely.

platform/network/mac/AuthenticationMac.h: Deleted the ProtectionSpace core() and mac().
platform/network/mac/AuthenticationMac.mm:

(WebCore::AuthenticationChallenge::AuthenticationChallenge): Changed to use the
ProtectionSpace constructor that takes an NSURLProtectionSpace.
(WebCore::mac): Changed to use ProtectionSpace::nsSpace.

platform/network/mac/CredentialStorageMac.mm:

(WebCore::CredentialStorage::getFromPersistentStorage): Ditto.

platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::receivedCredential): Changed to use the ProtectionSpace
constructor that takes an NSURLProtectionSpace.

platform/network/mac/WebCoreResourceHandleAsDelegate.mm:

(-[WebCoreResourceHandleAsDelegate connection:canAuthenticateAgainstProtectionSpace:]):
Ditto.

platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:

(-[WebCoreResourceHandleAsOperationQueueDelegate connection:canAuthenticateAgainstProtectionSpace:]):
Ditto.

Source/WebKit/mac: WebKit part of <rdar://problem/17766348> [Cocoa] WebCore::ProtectionSpace doesn’t preserve all NSURLProtectionSpace properties, such as the distinguishedNames array
https://bugs.webkit.org/show_bug.cgi?id=135229

Reviewed by Alexey Proskuryakov.

Misc/WebDownload.mm:

(-[WebDownloadInternal download:didReceiveAuthenticationChallenge:]): Chanegd to use the
ProtectionSpace constructor that takes an NSURLProtectionSpace.

Plugins/WebBaseNetscapePluginView.mm:

(WebKit::getAuthenticationInfo): Ditto.

WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::canAuthenticateAgainstProtectionSpace): Changed to use
ProtectionSpace::nsSpace.

Source/WebKit2: WebKit2 part of <rdar://problem/17766348> [Cocoa] WebCore::ProtectionSpace doesn’t preserve all NSURLProtectionSpace properties, such as the distinguishedNames array
https://bugs.webkit.org/show_bug.cgi?id=135229

Reviewed by Alexey Proskuryakov.

Shared/Cocoa/WKNSURLProtectionSpace.mm: Changed to use ProtectionSpace::nsSpace.

Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<ProtectionSpace>::encode): If encoding the space requires encoding the
platform data, do that.
(IPC::ArgumentCoder<ProtectionSpace>::decode): If platform data was encoded, decode it.

Shared/WebCoreArgumentCoders.h:

Shared/mac/WebCoreArgumentCodersMac.mm:

(IPC::ArgumentCoder<ProtectionSpace>::encodePlatformData): Archive the NSURLProtectionSpace.
(IPC::ArgumentCoder<ProtectionSpace>::decodePlatformData): Unarchive it.

Shared/soup/WebCoreArgumentCodersSoup.cpp:

(IPC::ArgumentCoder<ProtectionSpace>::encodePlatformData): Added.
(IPC::ArgumentCoder<ProtectionSpace>::decodePlatformData): Added.

3:42 PM Changeset in webkit [171539] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171509. <rdar://problem/17790792>

3:40 PM Changeset in webkit [171538] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171507. <rdar://problem/17738186>

3:39 PM Changeset in webkit [171537] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171506. <rdar://problem/17796052>

3:37 PM Changeset in webkit [171536] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171493. <rdar://problem/17785560>

3:34 PM Changeset in webkit [171535] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Tools

Merged r171487. <rdar://problem/17735912>

3:29 PM Changeset in webkit [171534] by Lucas Forschler

3 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171481. <rdar://problem/17713033>

3:27 PM Changeset in webkit [171533] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171478. <rdar://problem/17736503>

3:25 PM Changeset in webkit [171532] by benjamin@webkit.org

10 edits in trunk/Source

[WK2] Fixed/Sticky layers can get mispositioned when the layer tree commit change their position or size
https://bugs.webkit.org/show_bug.cgi?id=135227
<rdar://problem/17279500>

Reviewed by Simon Fraser.

Source/WebCore:
Keep track of the creation/destruction of Fixed and Sticky nodes in the ScrollingTree.

page/scrolling/ScrollingTree.cpp:

(WebCore::ScrollingTree::ScrollingTree):

page/scrolling/ScrollingTree.h:

(WebCore::ScrollingTree::hasFixedOrSticky):
(WebCore::ScrollingTree::fixedOrStickyNodeAdded):
(WebCore::ScrollingTree::fixedOrStickyNodeRemoved):

page/scrolling/mac/ScrollingTreeFixedNode.mm:

(WebCore::ScrollingTreeFixedNode::ScrollingTreeFixedNode):
(WebCore::ScrollingTreeFixedNode::~ScrollingTreeFixedNode):

page/scrolling/mac/ScrollingTreeStickyNode.mm:

(WebCore::ScrollingTreeStickyNode::ScrollingTreeStickyNode):
(WebCore::ScrollingTreeStickyNode::~ScrollingTreeStickyNode):

Source/WebKit2:
In some cases, a fixed or sticky positioned layer would end up at its position corresponding to the WebProcess
instead of sticking the to real viewport in the UIProcess.

The sequence of event is:
1) A layer becomes fixed in some ScrollingTree transaction.
2) Later, some change in the WebProcess causes a LayerTree update for that exact same layer, but no corresponding

ScrollingTree update is made.

3) In the UIProcess, the position of the fixed layer is changed due to the LayerTree update.

But! There is no ScrollingTree change, updateScrollingTree() never sets fixedOrStickyLayerChanged to true,
and the position is not corrected.

-> The layer is now at the wrong position until the next VisibleContentRectUpdate.

Ideally, we should have fixedOrStickyLayerChanged track if either the position or size of a fixed layer changed
in the layer tree. This is tricky since the layer tree does not keep track of the fixed nodes of the scrolling tree.

Since this complexity seems risky at this point, I went for something simpler but with more overhead:
any time the scrolling tree contains either a fixed or sticky layer, viewportChangedViaDelegatedScrolling()
is called to "fix" the position.

UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.cpp:

(WebKit::RemoteScrollingCoordinatorProxy::updateScrollingTree):
(WebKit::RemoteScrollingCoordinatorProxy::connectStateNodeLayers):

UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.h:

(WebKit::RemoteScrollingCoordinatorProxy::hasFixedOrSticky):

UIProcess/ios/RemoteScrollingCoordinatorProxyIOS.mm:

(WebKit::RemoteScrollingCoordinatorProxy::connectStateNodeLayers):

UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):

3:17 PM Changeset in webkit [171531] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Let WheelEvent wrap a PlatformWheelEvent
https://bugs.webkit.org/show_bug.cgi?id=135244

When WheelEvent is initialized with a PlatformWheelEvent, store that PlatformWheelEvent for future use.

Patch by Wenson Hsieh <Wenson Hsieh> on 2014-07-24
Reviewed by Beth Dakin.

No new tests because behavior should not have changed.

dom/WheelEvent.cpp: Added method to access the PlatformWheelEvent.

(WebCore::WheelEvent::WheelEvent):

dom/WheelEvent.h: Added field to store PlatformWheelEvent, if initialized via PlatformWheelEvent.

(WebCore::WheelEvent::wheelEvent):

3:15 PM Changeset in webkit [171530] by matthew_hanson@apple.com

1 copy in tags/Safari-537.78.1

New Tag.

3:11 PM Changeset in webkit [171529] by bshafiei@apple.com

3 edits in tags/Safari-600.1.2.1/Source/WebKit2

Merged r171201. <rdar://problem/17082607>

3:11 PM Changeset in webkit [171528] by Brian Burg

8 edits in trunk/Source

Web Replay: don't encode/decode primitive types that lack explicit sizes
https://bugs.webkit.org/show_bug.cgi?id=133430

Reviewed by Anders Carlsson.

Source/JavaScriptCore:
Don't support encode/decode of unsigned long, since its size is compiler-dependent.

replay/EncodedValue.cpp:

(JSC::EncodedValue::convertTo<unsigned long>):
(JSC::unsigned long>::encodeValue): Deleted.

replay/EncodedValue.h:

Source/WebCore:
Remove uses of unsigned long in encode/decode methods because the type lacks an
explicit size. Move frame index serialization away from using unsigned long.

replay/ReplayController.cpp:

(WebCore::logDispatchedDOMEvent): Fix the format string.

replay/SerializationMethods.cpp:

(WebCore::frameIndexFromDocument):
(WebCore::frameIndexFromFrame):
(WebCore::documentFromFrameIndex):
(WebCore::frameFromFrameIndex):
(JSC::EncodingTraits<PluginData>::encodeValue):
(JSC::EncodingTraits<PluginData>::decodeValue):

replay/SerializationMethods.h:
replay/WebInputs.json: Remove primitive types without explicit sizes.

3:01 PM Changeset in webkit [171527] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

JSWrapperMap's jsWrapperForObject() needs to defer GC.
<https://webkit.org/b/135258>

Reviewed by Oliver Hunt.

In the process of creating a JS wrapper, jsWrapperForObject() will create
the prototype and constructor of the corresponding ObjC class, as well as
for classes in its inheritance chain. These prototypes and constructors
are stored in Weak references in the JSObjCClassInfo objects. During all
the allocation that is being done to create all the prototypes and
constructors as well as the wrapper objects, a GC may occur thereby
collecting one or more of these newly created prototype and constructor
objects.

One example of where this problem can manifest is in wrapperForObject()
which is called from jsWrapperForObject(). In wrapperFoObject(), we do
the following steps:

reallocateConstructorAndOrPrototype() which creates the prototype object and store it in JSObjCClassInfo's m_prototype which is a Weak ref.
makeWrapper() to create the wrapper object, which may trigger a GC. GC will collect the prototype object and nullify the corresponding JSObjCClassInfo's m_prototype Weak ref.
call JSObjectSetPrototype() to set the JSObjCClassInfo's m_prototype in the newly created wrapper. This results in the wrapper getting a jsNull as a prototype instead of the expected prototype object.

To ensure that the prototype and constructor objects are retained until
they can be referenced properly from the wrapper object,
jsWrapperForObject() should defer GC until it's done with its work.

API/JSWrapperMap.mm:

(-[JSWrapperMap jsWrapperForObject:]):

2:37 PM Changeset in webkit [171526] by psolanki@apple.com

6 edits in trunk/Source/WebCore

Sharing SharedBuffer between WebCore and ImageIO is racy and crash prone
https://bugs.webkit.org/show_bug.cgi?id=135069
<rdar://problem/17470655>

Reviewed by Simon Fraser.

When passing image data to ImageIO for decoding, we pass an NSData subclass that is a wraper
around SharedBuffer. This can be a problem when ImageIO tries to access the data on the CA
thread. End result is data corruption on large image loads and potential crashes. The fix is
to have SharedBuffer create a copy of its data if the data has been passed to ImageIO and
might be accessed concurrently.

Since Vector is not refcounted, we do this by having a new refcounted object in SharedBuffer
that contains the buffer and we pass that in our NSData subclass WebCoreSharedBufferData.
Code that would result in the Vector memory moving e.g. append(), resize(), now checks to
see if the buffer was shared and if so, will create a new copy of the vector. This ensures
that the main thread does not end up invalidating the vector memory that we have passed it
to ImageIO.

No new tests because no functional changes.

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::makePurgeable):

Remove early return - createPurgeableMemory() has the correct check now.

platform/SharedBuffer.cpp:

(WebCore::SharedBuffer::SharedBuffer):
(WebCore::SharedBuffer::adoptVector):
(WebCore::SharedBuffer::createPurgeableBuffer):

Don't create purgeable buffer if we are sharing the buffer.

(WebCore::SharedBuffer::append):
(WebCore::SharedBuffer::clear):
(WebCore::SharedBuffer::copy):
(WebCore::SharedBuffer::duplicateDataBufferIfNecessary): Added.

Create a new copy of the data if we have shared the buffer and if appending to it would
exceed the capacity of the vector resulting in memmove.

(WebCore::SharedBuffer::appendToInternalBuffer): Added.
(WebCore::SharedBuffer::clearInternalBuffer): Added.
(WebCore::SharedBuffer::buffer):

Create a new copy of the buffer if we have shared it.

(WebCore::SharedBuffer::getSomeData):

platform/SharedBuffer.h:
platform/cf/SharedBufferCF.cpp:

(WebCore::SharedBuffer::SharedBuffer):
(WebCore::SharedBuffer::singleDataArrayBuffer):
(WebCore::SharedBuffer::maybeAppendDataArray):

platform/mac/SharedBufferMac.mm:

Pass the InternalBuffer object to WebCoreSharedBufferData

(-[WebCoreSharedBufferData dealloc]):
(-[WebCoreSharedBufferData initWithSharedBufferInternalBuffer:]):
(-[WebCoreSharedBufferData length]):
(-[WebCoreSharedBufferData bytes]):
(WebCore::SharedBuffer::createNSData):

Call createCFData() instead of duplicating code.

(WebCore::SharedBuffer::createCFData):

If the data is in purgeable memory, make a copy of it since m_buffer was cleared when
creating the purgeable buffer.

(-[WebCoreSharedBufferData initWithSharedBuffer:]): Deleted.

2:12 PM Changeset in webkit [171525] by Bem Jones-Bey

2 edits in trunk/Websites/webkit.org

Committers should mail webkit-committers not webkit-reviewers for reactivation
https://bugs.webkit.org/show_bug.cgi?id=135203

Reviewed by Ryosuke Niwa.

Only reviewers can send mail to webkit-reviewers. Amend the policy so that committers should
send mail to webkit-committers instead of webkit-reviewers.

coding/commit-review-policy.html:

2:00 PM Changeset in webkit [171524] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171395. <rdar://problem/17544620>

1:58 PM Changeset in webkit [171523] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171393. <rdar://problem/17544620>

1:56 PM Changeset in webkit [171522] by Lucas Forschler

3 edits
2 copies in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171390. <rdar://problem/17544620>

1:53 PM Changeset in webkit [171521] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171328. <rdar://problem/17544620>

1:47 PM Changeset in webkit [171520] by bshafiei@apple.com

2 edits in tags/Safari-600.1.2.1/Source/WebKit2

Merged r171518. <rdar://problem/17797103>

1:18 PM Changeset in webkit [171519] by oliver@apple.com

2 edits in trunk/Source/WebKit2

Need to explicitly support location services in webcontent profile
https://bugs.webkit.org/show_bug.cgi?id=135251
<rdar://17798346>

Reviewed by Dan Bernstein.

Switching to uikit-app means that we remove the implicit support
for location services. This makes us explicitly opt-in.

Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

1:13 PM Changeset in webkit [171518] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit2

Crash at [WKContentView _applicationWillEnterForeground:] + 28
<rdar://problem/17797103>

Reviewed by Sam Weinig.

UIProcess/ios/WKContentView.mm:

(-[WKContentView _applicationWillEnterForeground:]):
Drawing area can be null; null check it!
It's ok if we don't hide the content in this case, because if the drawing area is null,
it doesn't have any layers in the tree anyway.

1:00 PM Changeset in webkit [171517] by bshafiei@apple.com

2 edits in tags/Safari-600.1.2.1/Source/WebKit2

Merged r171509. <rdar://problem/17790792>

12:57 PM Changeset in webkit [171516] by bshafiei@apple.com

2 edits in tags/Safari-600.1.2.1/Tools

Merged r171487. <rdar://problem/17735912>

12:52 PM Changeset in webkit [171515] by bshafiei@apple.com

5 edits in tags/Safari-600.1.2.1/Source

Versioning.

12:49 PM Changeset in webkit [171514] by bshafiei@apple.com

1 copy in tags/Safari-600.1.2.1

New tag.

12:23 PM Changeset in webkit [171513] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

[Curl] Enable file logging.
https://bugs.webkit.org/show_bug.cgi?id=135202

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-07-24
Reviewed by Alex Christensen.

The Curl api offers the possibility to write log messages to file. Enable this for debugging purposes.

platform/network/curl/ResourceHandleManager.cpp:

(WebCore::ResourceHandleManager::ResourceHandleManager):
(WebCore::ResourceHandleManager::~ResourceHandleManager):
(WebCore::ResourceHandleManager::initializeHandle):

platform/network/curl/ResourceHandleManager.h:

9:20 AM Changeset in webkit [171512] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Sort WebCore.exp.in after r171252
https://bugs.webkit.org/show_bug.cgi?id=135239

Patch by Tibor Meszaros <tmeszaros.u-szeged@partner.samsung.com> on 2014-07-24
Reviewed by Csaba Osztrogonác.

WebCore.exp.in:

5:23 AM Changeset in webkit [171511] by mihnea@adobe.com

3 edits
2 adds in trunk

[New Multicolumn] Assertion failure when an input element has multicolumn style
https://bugs.webkit.org/show_bug.cgi?id=135234

Reviewed by Andrei Bucur.

Source/WebCore:
Restrict the assertion in RenderBlock::canComputeRegionRangeForBox
only to RenderNamedFlowThread objects since for RenderMultiColumnFlowThread
objects we can compute a range of regions during their parent block layout.

Test: fast/multicol/newmulticol/input-as-multicol.html

rendering/RenderBlock.cpp:

(WebCore::canComputeRegionRangeForBox):

LayoutTests:

fast/multicol/newmulticol/input-as-multicol-expected.txt: Added.
fast/multicol/newmulticol/input-as-multicol.html: Added.

Jul 23, 2014:

10:30 PM Changeset in webkit [171510] by fpizlo@apple.com

25 edits
4 adds in branches/ftlopt/Source/JavaScriptCore

Make improvements to Type Profiling
https://bugs.webkit.org/show_bug.cgi?id=134860

Patch by Saam Barati <sbarati@apple.com> on 2014-07-23
Reviewed by Filip Pizlo.

I improved the API between the inspector and JSC. We no longer send one huge
string to the inspector. We now send structured data that represents the type
information that JSC has collected. I've also created a beginning implementation
of a type lattice that allows us to resolve a display name for a type that
consists of a single word.

I created a data structure that knows which functions have executed. This
solves the bug where types inside an un-executed function will resolve
to the type of the enclosing expression of that function. This data
structure may also be useful later if the inspector chooses to create a UI
around showing which functions have executed.

Better type information is gathered for objects. StructureShape now
represents an object's prototype chain. StructureShape also collects
the constructor name for an object.

Expression ranges are now zero indexed.

Removed some extraneous methods.

JavaScriptCore.xcodeproj/project.pbxproj:
bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::scopeDependentProfile):

bytecode/CodeBlock.h:
bytecode/TypeLocation.h:

(JSC::TypeLocation::TypeLocation):

bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):

bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset):
(JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.

heap/Heap.cpp:

(JSC::Heap::collect):

inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset): Deleted.

inspector/agents/InspectorRuntimeAgent.h:
inspector/protocol/Runtime.json:
runtime/Executable.cpp:

(JSC::ScriptExecutable::ScriptExecutable):
(JSC::ProgramExecutable::ProgramExecutable):
(JSC::FunctionExecutable::FunctionExecutable):
(JSC::ProgramExecutable::initializeGlobalProperties):

runtime/Executable.h:

(JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset):
(JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset):

runtime/FunctionHasExecutedCache.cpp: Added.

(JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
(JSC::FunctionHasExecutedCache::insertUnexecutedRange):
(JSC::FunctionHasExecutedCache::removeUnexecutedRange):

runtime/FunctionHasExecutedCache.h: Added.

(JSC::FunctionHasExecutedCache::FunctionRange::FunctionRange):
(JSC::FunctionHasExecutedCache::FunctionRange::operator==):
(JSC::FunctionHasExecutedCache::FunctionRange::hash):

runtime/HighFidelityLog.cpp:

(JSC::HighFidelityLog::processHighFidelityLog):
(JSC::HighFidelityLog::actuallyProcessLogThreadFunction): Deleted.

runtime/HighFidelityLog.h:

(JSC::HighFidelityLog::recordTypeInformationForLocation):

runtime/HighFidelityTypeProfiler.cpp:

(JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
(JSC::HighFidelityTypeProfiler::insertNewLocation):
(JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
(JSC::descriptorMatchesTypeLocation):
(JSC::HighFidelityTypeProfiler::findLocation):
(JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset): Deleted.
(JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset): Deleted.
(JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset): Deleted.

runtime/HighFidelityTypeProfiler.h:

(JSC::QueryKey::QueryKey):
(JSC::QueryKey::isHashTableDeletedValue):
(JSC::QueryKey::operator==):
(JSC::QueryKey::hash):
(JSC::QueryKeyHash::hash):
(JSC::QueryKeyHash::equal):
(JSC::HighFidelityTypeProfiler::functionHasExecutedCache):
(JSC::HighFidelityTypeProfiler::typeLocationCache):

runtime/Structure.cpp:

(JSC::Structure::toStructureShape):

runtime/Structure.h:
runtime/TypeLocationCache.cpp: Added.

(JSC::TypeLocationCache::getTypeLocation):

runtime/TypeLocationCache.h: Added.

(JSC::TypeLocationCache::LocationKey::LocationKey):
(JSC::TypeLocationCache::LocationKey::operator==):
(JSC::TypeLocationCache::LocationKey::hash):

runtime/TypeSet.cpp:

(JSC::TypeSet::getRuntimeTypeForValue):
(JSC::TypeSet::addTypeForValue):
(JSC::TypeSet::seenTypes):
(JSC::TypeSet::doesTypeConformTo):
(JSC::TypeSet::displayName):
(JSC::TypeSet::allPrimitiveTypeNames):
(JSC::TypeSet::allStructureRepresentations):
(JSC::TypeSet::leastCommonAncestor):
(JSC::StructureShape::StructureShape):
(JSC::StructureShape::addProperty):
(JSC::StructureShape::propertyHash):
(JSC::StructureShape::leastCommonAncestor):
(JSC::StructureShape::stringRepresentation):
(JSC::StructureShape::inspectorRepresentation):
(JSC::StructureShape::leastUpperBound): Deleted.

runtime/TypeSet.h:

(JSC::StructureShape::setConstructorName):
(JSC::StructureShape::constructorName):
(JSC::StructureShape::setProto):

runtime/VM.cpp:

(JSC::VM::dumpHighFidelityProfilingTypes):
(JSC::VM::getTypesForVariableAtOffset): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.

runtime/VM.h:

(JSC::VM::isProfilingTypesWithHighFidelity):
(JSC::VM::highFidelityTypeProfiler):

10:17 PM Changeset in webkit [171509] by Simon Fraser

2 edits in trunk/Source/WebKit2

[iOS WK2] Some help.apple.com pages not scrollable
https://bugs.webkit.org/show_bug.cgi?id=135228
<rdar://problem/17790792>

Reviewed by Benjamin Poulain.

On pages which size their document to the device size, the WKContentView size
never changes after it's created. In this situation, we never set a bounds
on the _rootContentView, so it remains zero-sized which breaks hit testing
on all enclosed UIScrollViews for overflow:scroll.

Fix by making the _rootContentView and the _inspectorIndicationView use autosizing
so they are always the size of their parent view, and remove the explicit setting
of their bounds.

UIProcess/ios/WKContentView.mm:

(-[WKContentView initWithFrame:context:configuration:webView:]):
(-[WKContentView setShowingInspectorIndication:]):
(-[WKContentView _didCommitLayerTree:]):

10:16 PM Changeset in webkit [171508] by fpizlo@apple.com

2 edits in branches/ftlopt/Source/JavaScriptCore

Fix debug build.

bytecode/CallLinkStatus.h:

(JSC::CallLinkStatus::CallLinkStatus):

10:02 PM Changeset in webkit [171507] by benjamin@webkit.org

2 edits in trunk/Source/WebKit2

[iOS][WK2] r171124 is incorrect when the virtual keyboard is up
https://bugs.webkit.org/show_bug.cgi?id=135187

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-07-23
Reviewed by Simon Fraser.

Unfortunately, restricting the input into the document rect does not work.
When the keyboard is up, the keyboard bounds can overlap the WKWebView, and
the valid range should account for that.

Instead of playing with the keyboard rect, we can limit the scroll position
inside the valid range of UIScrollView. The keyboard always adjusts the UIScrollView
range as needed to give access to the content. Using that range is a bit more permissive
because the page could scroll to reveal content in the content inset defined by the client
of the API (this could actually be quite useful for hybrid apps).

There was already a function to change the content offset in the valid scrollview
range: changeContentOffsetBoundedInValidRange(), I extracted the range check
to contentOffsetBoundedInValidRange() for the needs of -[WKWebView _scrollToContentOffset:].

So...contentOffsetBoundedInValidRange() is cool, but it is not in the right coordinate
system. The scroll position we get from the WebProcess is in document coordinates, while
contentOffsetBoundedInValidRange() works with the UIScrollView coordinates.
To fix that, we scale the input position to get to the same scale as UIScrollView, then
apply the insets with the weirdly named [WKWebView _adjustedContentOffset:].

UIProcess/API/Cocoa/WKWebView.mm:

(contentOffsetBoundedInValidRange):
(changeContentOffsetBoundedInValidRange):
(-[WKWebView _scrollToContentOffset:]):

9:38 PM Changeset in webkit [171506] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Transparent fullscreen background when video is not present.
https://bugs.webkit.org/show_bug.cgi?id=135226

Patch by Jeremy Jones <jeremyj@apple.com> on 2014-07-23
Reviewed by Simon Fraser.

Set background to black just before beginning the animation to fullscreen.

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(WebVideoFullscreenInterfaceAVKit::enterFullscreen): set background color black.

7:39 PM Changeset in webkit [171505] by commit-queue@webkit.org

4 edits in trunk/Source/WebCore

ScriptController::updateDocument ASSERT mutating map while iterating map
https://bugs.webkit.org/show_bug.cgi?id=135211

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-23
Reviewed by Oliver Hunt.

Avoid iterating over m_windowShells in more places. This prevents
the possibility of a collection during JSC allocation which might
cause a mutation to m_windowShells (HTMLMediaElement destruction).

Have ScriptController defriend ScriptCachedFrameData by providing
a getter for the list of window shells.

bindings/js/ScriptCachedFrameData.cpp:

(WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
(WebCore::ScriptCachedFrameData::restore):

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::windowShells):
(WebCore::ScriptController::clearWindowShell):
(WebCore::ScriptController::attachDebugger):
(WebCore::ScriptController::updateDocument):

bindings/js/ScriptController.h:

6:13 PM Changeset in webkit [171504] by commit-queue@webkit.org

8 edits in trunk/Source

Unreviewed, rolling out r171498.
https://bugs.webkit.org/show_bug.cgi?id=135223

It will regress some scroll position restoration on navigation
(r167916). (Requested by smfr on #webkit).

Reverted changeset:

"[iOS WK2] Header bar on nytimes articles lands in the wrong
place after rubberbanding"
https://bugs.webkit.org/show_bug.cgi?id=135221
http://trac.webkit.org/changeset/171498

6:00 PM Changeset in webkit [171503] by matthew_hanson@apple.com

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171474. <rdar://problem/17041912>

5:57 PM Changeset in webkit [171502] by matthew_hanson@apple.com

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171490. <rdar://problem/17739108>

5:54 PM Changeset in webkit [171501] by matthew_hanson@apple.com

2 edits in branches/safari-600.1-branch/Source/WebCore

Merge r171499. <rdar://problem/17783423>

5:52 PM Changeset in webkit [171500] by matthew_hanson@apple.com

2 edits in tags/Safari-600.1.2/Source/WebCore

Merge r171499. <rdar://problem/17783423>

5:24 PM Changeset in webkit [171499] by timothy_horton@apple.com

2 edits in trunk/Source/WebCore

REGRESSION (r171376): Sometimes we detect less than the whole phone number
https://bugs.webkit.org/show_bug.cgi?id=135220
<rdar://problem/17783423>

Reviewed by Brady Eidson.

editing/Editor.cpp:

(WebCore::Editor::scanSelectionForTelephoneNumbers):
Use the visible selection's start and end instead of base and extent, because they'll
always be in the right order in the case of a directional selection (base can be *after* extent
if you select from right to left). This fixes the code that expands the selection.

Pass the *entire* expanded selection to DataDetectors, instead of using TextIterator.
This way, we will find each number only once, and will never get part of a phone number once
and then the whole phone number later.

5:23 PM Changeset in webkit [171498] by Simon Fraser

8 edits in trunk/Source

[iOS WK2] Header bar on nytimes articles lands in the wrong place after rubberbanding
https://bugs.webkit.org/show_bug.cgi?id=135221

Reviewed by Tim Horton.

Source/WebCore:

Add a function on GraphicsLayer to force a flush of the layer position
to the underlying graphics system, so that when layers cease being
scroll-coordinated, we can ensure that their layers are repositioned
in the correct location.

WebCore.exp.in:
platform/graphics/GraphicsLayer.h:

(WebCore::GraphicsLayer::forcePositionUpdate):

platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::forcePositionUpdate):

platform/graphics/ca/GraphicsLayerCA.h:
rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer):

Source/WebKit2:

Fix by m_webPageProxy->didCommitLayerTree() after the scrolling tree has been
committed.

UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):

5:08 PM Changeset in webkit [171497] by psolanki@apple.com

5 edits in trunk/Source/WebCore

Get rid of SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator
https://bugs.webkit.org/show_bug.cgi?id=135219

Reviewed by Anders Carlsson.

No new tests because no functional changes.

loader/ResourceBuffer.h:
loader/mac/ResourceBuffer.mm:

(WebCore::ResourceBuffer::createNSData):

platform/SharedBuffer.h:

(WebCore::SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator::NSDataRetainPtrWithoutImplicitConversionOperator): Deleted.

platform/mac/SharedBufferMac.mm:

(WebCore::SharedBuffer::createNSData):

4:20 PM Changeset in webkit [171496] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Build fix after r171361.

public/js/helper-classes.js:

(.this.formattedBuildTime):

4:06 PM Changeset in webkit [171495] by fpizlo@apple.com

18 edits
2 adds in branches/ftlopt/Source/JavaScriptCore

[ftlopt] Phantoms in SSA form should be aggressively hoisted
https://bugs.webkit.org/show_bug.cgi?id=135111

Reviewed by Oliver Hunt.

In CPS form, Phantom means three things: (1) that the children should be kept alive so long
as they are relevant to OSR (due to a MovHint), (2) that the children are live-in-bytecode
at the point of the Phantom, and (3) that some checks should be performed. In SSA, the
second meaning is not used but the other two stay.

The fact that a Phantom that is used to keep a node alive could be anywhere in the graph,
even in a totally different basic block, complicates some SSA transformations. It's not
possible to just jettison some successor, since tha successor could have a Phantom that we
care about.

This change rationalizes how Phantoms work so that:

1) Phantoms keep children alive so long as those children are relevant to OSR. This is true

in both CPS and SSA. This was true before and it's true now.

2) Phantoms are used for live-in-bytecode only in CPS. This was true before and it's true

now, except that now we also don't bother preserving the live-in-bytecode information
that Phantoms convey, when we are in SSA.

3) Phantoms may incidentally have checks, but in cases where we only want checks, we now

use Check instead of Phantom. Notably, DCE phase has dead nodes decay to Check, not
Phantom.

The biggest part of this change is that in SSA, we canonicalize Phantoms:

All Phantoms are replaced with Check nodes that include only those edges that have checks.

Nodes that were the children of any Phantoms have a Phantom right after them.

For example, the following code:

5: ArithAdd(@1, @2)
6: ArithSub(@5, @3)
7: Phantom(Int32:@5)

would be turned into the following:

5: ArithAdd(@1, @2)
8: Phantom(@5) @5 was the child of a Phantom, so we create a new Phantom right after

@5. This is the only Phantom we will have for @5.

6: ArithSub(@5, @3)
7: Check(Int32:@5) We replace the Phantom with a Check; in this case since Int32: is

a checking edge, we leave it.

This is a slight speed-up across the board, presumably because we now do a better job of
reducing the size of the graph during compilation. It could also be a fluke, though. The
main purpose of this is to unlock some other work (like CFG simplification in SSA). It will
become a requirement to run phantom canonicalization prior to some SSA phases. None of the
current phases need it, but future phases probably will.

CMakeLists.txt:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDCEPhase.cpp:

(JSC::DFG::DCEPhase::run):
(JSC::DFG::DCEPhase::findTypeCheckRoot):
(JSC::DFG::DCEPhase::countEdge):
(JSC::DFG::DCEPhase::fixupBlock):
(JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):

dfg/DFGEdge.cpp:

(JSC::DFG::Edge::dump):

dfg/DFGEdge.h:

(JSC::DFG::Edge::isProved):
(JSC::DFG::Edge::needsCheck): Deleted.

dfg/DFGNodeFlags.h:
dfg/DFGPhantomCanonicalizationPhase.cpp: Added.

(JSC::DFG::PhantomCanonicalizationPhase::PhantomCanonicalizationPhase):
(JSC::DFG::PhantomCanonicalizationPhase::run):
(JSC::DFG::performPhantomCanonicalization):

dfg/DFGPhantomCanonicalizationPhase.h: Added.
dfg/DFGPhantomRemovalPhase.cpp:

(JSC::DFG::PhantomRemovalPhase::run):

dfg/DFGPhantomRemovalPhase.h:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThreadImpl):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):

3:55 PM Changeset in webkit [171494] by Alan Bujtas

3 edits in trunk/Source/WebCore

Subpixel rendering: Cleanup RenderLayerCompositor::deviceScaleFactor()
https://bugs.webkit.org/show_bug.cgi?id=135208

Reviewed by Simon Fraser.

Use m_renderView.document() to retrieve device scale factor value. m_renderView.document()
is always available while this->page() is not.

No change in behavior.

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateTransform):
(WebCore::RenderLayerBacking::computeTransformOriginForPainting):

rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::deviceScaleFactor):

3:03 PM Changeset in webkit [171493] by oliver@apple.com

2 edits in trunk/Source/WebKit2

Add a pseudo target to create sandbox override roots
https://bugs.webkit.org/show_bug.cgi?id=135216
<rdar://17785560>

Reviewed by Alexey Proskuryakov.

Just a duplicate of the standard ios sandbox target, targetting
the profile overrides directory. This means we can make roots
that "Just Work".

WebKit2.xcodeproj/project.pbxproj:

2:56 PM Changeset in webkit [171492] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

[WinCairo] Gstreamer rendering is not working.
https://bugs.webkit.org/show_bug.cgi?id=135201

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-07-23
Reviewed by Alex Christensen.

WinCairo does not support accelerated rendering yet.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

(WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):

2:51 PM Changeset in webkit [171491] by Lucas Forschler

2 edits in tags/Safari-600.1.2/Source/WebKit2

Merged r171490. <rdar://problem/17739108>

2:43 PM Changeset in webkit [171490] by oliver@apple.com

2 edits in trunk/Source/WebKit2

Incorrect commit for sandbox profile
https://bugs.webkit.org/show_bug.cgi?id=135214
<rdar://17739108>

Reviewed by Anders Carlsson.

Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

2:16 PM Changeset in webkit [171489] by Brian Burg

7 edits in trunk

Web Inspector: InspectorBackend's promise-based agent API does not support multiple return values
https://bugs.webkit.org/show_bug.cgi?id=135207

Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:
The promise wrapper implementation assumed that the protocol callback supplies a single 'payload'
return value, but InspectorBackend will actually unpack multiple return values as multiple
callback arguments. Set a special flag so it will not try to apply multiple return values.

It would read better if multiple return values could be spread to the resolve callback, but
multiple argument support are not required by the Promises specification, so we won't use them.

UserInterface/Controllers/ReplayManager.js: Fix uses of promise return values.

(WebInspector.ReplayManager):

UserInterface/Models/ReplaySession.js:
UserInterface/Models/ReplaySessionSegment.js:

(WebInspector.ReplaySessionSegment):

UserInterface/Protocol/InspectorBackend.js:

(InspectorBackend.Command.prototype.promise):

LayoutTests:

http/tests/inspector/replay/replay-test.js: fix uses of promise API return values.

1:59 PM Changeset in webkit [171488] by commit-queue@webkit.org

9 edits
2 deletes in trunk

Unreviewed, rolling out r171455.
https://bugs.webkit.org/show_bug.cgi?id=135209

completely broke selection highlight invalidation (Requested
by thorton on #webkit).

Reverted changeset:

"REGRESSION (r169105): Crash in selection"
https://bugs.webkit.org/show_bug.cgi?id=134303
http://trac.webkit.org/changeset/171455

1:34 PM Changeset in webkit [171487] by Joseph Pecoraro

2 edits in trunk/Tools

Unreviewed iOS build fix after r171355.

TestWebKitAPI/Configurations/Base.xcconfig:

Since all the Tests/WebKit2Cocoa tests are already explicitly skipped on iOS,
simplify to skipping all the tests in the directory. PlatformUtilities are not
building on iOS, which means we are missing necessary Util functions.

1:19 PM Changeset in webkit [171486] by achristensen@apple.com

4 edits in trunk/Source/WebCore

Compile window-inactive and fullscreen pseudoclasses in css selectors.
https://bugs.webkit.org/show_bug.cgi?id=135200

Reviewed by Benjamin Poulain.

css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne):
Removed the check of context.hasSelectionPseudo for a window-inactive pseudoclass.
Moved logic to SelectorCheckerTestFunctions.h to share with the selector compiler.

css/SelectorCheckerTestFunctions.h:

(WebCore::isWindowInactive):
(WebCore::matchesFullScreenAnimatingFullScreenTransitionPseudoClass):
(WebCore::matchesFullScreenAncestorPseudoClass):
(WebCore::matchesFullScreenDocumentPseudoClass):
Added from SelectorChecker.cpp.

cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::addPseudoClassType):
Added unoptimized pseudoclass cases for window-inactive and fullscreen pseudoclasses.
Explicitly listed uncompiled pseudoclasses for future work instead of using a default.

1:18 PM Changeset in webkit [171485] by mitz@apple.com

2 edits in trunk/Source/WebKit2

<rdar://problem/17782623> [iOS] Client-certificate authentication isn’t working with some certificates
https://bugs.webkit.org/show_bug.cgi?id=135206

Reviewed by Anders Carlsson.

Shared/cf/ArgumentCodersCF.cpp:

(IPC::copyPersistentRef): Added this helper function. It differs from
SecKeyCopyPersistentRef in that if multiple copies of the key exist in the keychain, it
ensures that we get a reference to the copy that is in the keychain access group that the
Networking process can use.
(IPC::encode): Use copyPersistentRef.

12:49 PM Changeset in webkit [171484] by Lucas Forschler

2 edits in tags/Safari-600.1.2/Source/JavaScriptCore

Merged r171474. <rdar://problem/17041912>

11:39 AM Changeset in webkit [171483] by Brent Fulgham

2 edits in trunk/Source/JavaScriptCore

Build fix after r171482.

Rubberstamped by Joe Pecoraro.

runtime/Identifier.h: Make header declarations match

implementation file.

11:18 AM Changeset in webkit [171482] by Brent Fulgham

8 edits in trunk/Source

../JavaScriptCore: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows
https://bugs.webkit.org/show_bug.cgi?id=135199

Reviewed by Mark Lam.

jsc.cpp:

(WTF::RuntimeArray::deleteProperty): Stop using ugly
compiler work-around on Windows; use NO_RETURN_DUE_TO_CRASH
codepath instead.

runtime/Identifier.h: Add NO_RETURN_DUE_TO_CRASH

to header so function declaration matches implementation.

../WebCore: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows.
https://bugs.webkit.org/show_bug.cgi?id=13519

Reviewed by Mark Lam.

svg/SVGZoomAndPan.h: Add NO_RETURN_DUE_TO_CRASH to

header so function declarations match implementation.

../WTF: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows.
https://bugs.webkit.org/show_bug.cgi?id=13519

Reviewed by Mark Lam.

wtf/Assertions.h: Add MSVC to list of compilers supporting this macro.
wtf/FastMalloc.cpp: Correct function declaration for NO_RETURN_DUE_TO_CRASH.

10:57 AM Changeset in webkit [171481] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

JSDOMWindowShell leaks on pages with media elements
https://bugs.webkit.org/show_bug.cgi?id=135178

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-23
Reviewed by Oliver Hunt.

The DOMWindowWorld for HTMLMediaElements with MEDIA_CONTROLS_SCRIPT
was not getting cleared and removed.

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::clearWindowShell):
Iterate over a copy of the values. A sweep / garbage collection caused by
any JSC allocation during iteration could trigger a mutation of the m_windowShells
table that was being iterating. So instead iterate a list that won't mutate.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::~HTMLMediaElement):
If we had an isolated world, release as much memory as possible.

10:56 AM Changeset in webkit [171480] by Bem Jones-Bey

4 edits
8 adds in trunk

Ensure we compute the min and max height of replaced elements to 'none' or 0 when appropriate.
https://bugs.webkit.org/show_bug.cgi?id=135181

Reviewed by David Hyatt.

Source/WebCore:
If a replaced element has a percentage min or max height specified then that height value should
compute to 'none' for max-height and 0 for min-height when its containing block
does not have a height 'specified explicitly'.

This is based on a Blink patch by Robert Hogan.

Tests: css2.1/20110323/max-height-percentage-003.html

fast/replaced/max-height-percentage-quirks.html
fast/replaced/min-height-percentage-quirks.html
fast/replaced/min-height-percentage.html

rendering/RenderBox.cpp:

(WebCore::RenderBox::logicalHeightComputesAsNone):
(WebCore::RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight):

rendering/RenderBox.h:

LayoutTests:

css2.1/20110323/max-height-percentage-003-expected.html: Added.
css2.1/20110323/max-height-percentage-003.html: Added.
fast/replaced/max-height-percentage-quirks-expected.html: Added.
fast/replaced/max-height-percentage-quirks.html: Added.
fast/replaced/min-height-percentage-expected.html: Added.
fast/replaced/min-height-percentage-quirks-expected.html: Added.
fast/replaced/min-height-percentage-quirks.html: Added.
fast/replaced/min-height-percentage.html: Added.

10:35 AM Changeset in webkit [171479] by Bem Jones-Bey

19 edits in trunk

Remove CSS_EXCLUSIONS compile flag and leftover code
https://bugs.webkit.org/show_bug.cgi?id=135175

Reviewed by Zoltan Horvath.

At this point, the CSS_EXCLUSIONS flag guards nothing but some useless
stubs. This removes the flag and the useless code.

Source/cmake/WebKitFeatures.cmake:
Source/cmakeconfig.h.cmake:

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:
No new tests, just removing code.

Configurations/FeatureDefines.xcconfig:
bindings/generic/RuntimeEnabledFeatures.cpp:

(WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):

bindings/generic/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setCSSExclusionsEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::cssExclusionsEnabled): Deleted.

testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setCSSExclusionsEnabled): Deleted.

testing/InternalSettings.h:
testing/InternalSettings.idl:

Source/WebKit/mac:

Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Configurations/FeatureDefines.xcconfig:

WebKitLibraries:

win/tools/vsprops/FeatureDefines.props:
win/tools/vsprops/FeatureDefinesCairo.props:

9:20 AM Changeset in webkit [171478] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

[MSE][Mac] Support abort() in SourceBufferPrivateAVFObjC.
https://bugs.webkit.org/show_bug.cgi?id=135163

Reviewed by Brent Fulgham.

Recreate the parser when asked to abort().

platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:

(WebCore::SourceBufferPrivateAVFObjC::abort):

7:57 AM Changeset in webkit [171477] by mmaxfield@apple.com

30 edits in trunk/Source/WebCore

Migrate accessibility/ to using nullptr instead of 0
https://bugs.webkit.org/show_bug.cgi?id=135185

Reviewed by Simon Fraser.

No new tests because there is no behavior change.

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::focusedImageMapUIElement):
(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::get):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::rootObject):
(WebCore::AXObjectCache::rootObjectForFrame):

accessibility/AXObjectCache.h:

(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::get):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::rootObject):
(WebCore::AXObjectCache::rootObjectForFrame):
(WebCore::AXObjectCache::rootAXEditableElement):

accessibility/AccessibilityARIAGridRow.cpp:

(WebCore::AccessibilityARIAGridRow::disclosedByRow):

accessibility/AccessibilityImageMapLink.cpp:

(WebCore::AccessibilityImageMapLink::AccessibilityImageMapLink):
(WebCore::AccessibilityImageMapLink::parentObject):

accessibility/AccessibilityListBox.cpp:

(WebCore::AccessibilityListBox::listBoxOptionAccessibilityObject):
(WebCore::AccessibilityListBox::elementAccessibilityHitTest):

accessibility/AccessibilityListBoxOption.cpp:

(WebCore::AccessibilityListBoxOption::AccessibilityListBoxOption):
(WebCore::AccessibilityListBoxOption::parentObject):
(WebCore::AccessibilityListBoxOption::listBoxOptionParentNode):

accessibility/AccessibilityMenuListPopup.cpp:

(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):

accessibility/AccessibilityMockObject.cpp:

(WebCore::AccessibilityMockObject::AccessibilityMockObject):

accessibility/AccessibilityMockObject.h:
accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::detach):
(WebCore::AccessibilityNodeObject::firstChild):
(WebCore::AccessibilityNodeObject::lastChild):
(WebCore::AccessibilityNodeObject::previousSibling):
(WebCore::AccessibilityNodeObject::nextSibling):
(WebCore::AccessibilityNodeObject::parentObject):
(WebCore::AccessibilityNodeObject::document):
(WebCore::AccessibilityNodeObject::anchorElement):
(WebCore::nativeActionElement):
(WebCore::AccessibilityNodeObject::actionElement):
(WebCore::AccessibilityNodeObject::mouseButtonListener):
(WebCore::AccessibilityNodeObject::labelForElement):
(WebCore::AccessibilityNodeObject::menuItemElementForMenu):
(WebCore::AccessibilityNodeObject::menuButtonForMenu):

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::AccessibilityObject):
(WebCore::AccessibilityObject::detach):
(WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
(WebCore::AccessibilityObject::findMatchingObjects):
(WebCore::renderListItemContainerForNode):
(WebCore::AccessibilityObject::accessibilityObjectForPosition):
(WebCore::AccessibilityObject::document):
(WebCore::AccessibilityObject::page):
(WebCore::AccessibilityObject::documentFrameView):
(WebCore::AccessibilityObject::anchorElementForNode):
(WebCore::AccessibilityObject::headingElementForNode):
(WebCore::AccessibilityObject::firstAnonymousBlockChild):
(WebCore::AccessibilityObject::element):
(WebCore::AccessibilityObject::focusedUIElement):
(WebCore::AccessibilityObject::scrollToMakeVisibleWithSubFocus):

accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::node):
(WebCore::AccessibilityObject::renderer):
(WebCore::AccessibilityObject::selectedRadioButton):
(WebCore::AccessibilityObject::selectedTabItem):
(WebCore::AccessibilityObject::accessibilityHitTest):
(WebCore::AccessibilityObject::firstChild):
(WebCore::AccessibilityObject::lastChild):
(WebCore::AccessibilityObject::previousSibling):
(WebCore::AccessibilityObject::nextSibling):
(WebCore::AccessibilityObject::parentObjectIfExists):
(WebCore::AccessibilityObject::observableObject):
(WebCore::AccessibilityObject::titleUIElement):
(WebCore::AccessibilityObject::correspondingLabelForControlElement):
(WebCore::AccessibilityObject::correspondingControlForLabelElement):
(WebCore::AccessibilityObject::scrollBar):
(WebCore::AccessibilityObject::anchorElement):
(WebCore::AccessibilityObject::actionElement):
(WebCore::AccessibilityObject::widget):
(WebCore::AccessibilityObject::widgetForAttachmentView):
(WebCore::AccessibilityObject::activeDescendant):
(WebCore::AccessibilityObject::mathRadicandObject):
(WebCore::AccessibilityObject::mathRootIndexObject):
(WebCore::AccessibilityObject::mathUnderObject):
(WebCore::AccessibilityObject::mathOverObject):
(WebCore::AccessibilityObject::mathNumeratorObject):
(WebCore::AccessibilityObject::mathDenominatorObject):
(WebCore::AccessibilityObject::mathBaseObject):
(WebCore::AccessibilityObject::mathSubscriptObject):
(WebCore::AccessibilityObject::mathSuperscriptObject):
(WebCore::AccessibilityObject::getScrollableAreaIfScrollable):

accessibility/AccessibilityProgressIndicator.cpp:

(WebCore::AccessibilityProgressIndicator::progressElement):
(WebCore::AccessibilityProgressIndicator::meterElement):

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::detach):
(WebCore::AccessibilityRenderObject::renderBoxModelObject):
(WebCore::AccessibilityRenderObject::firstChild):
(WebCore::AccessibilityRenderObject::lastChild):
(WebCore::startOfContinuations):
(WebCore::childBeforeConsideringContinuations):
(WebCore::AccessibilityRenderObject::previousSibling):
(WebCore::AccessibilityRenderObject::nextSibling):
(WebCore::nextContinuation):
(WebCore::AccessibilityRenderObject::renderParentObject):
(WebCore::AccessibilityRenderObject::parentObject):
(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::textUnderElement):
(WebCore::AccessibilityRenderObject::node):
(WebCore::AccessibilityRenderObject::labelElementContainer):
(WebCore::AccessibilityRenderObject::internalLinkElement):
(WebCore::AccessibilityRenderObject::titleUIElement):
(WebCore::AccessibilityRenderObject::setFocused):
(WebCore::AccessibilityRenderObject::topRenderer):
(WebCore::AccessibilityRenderObject::document):
(WebCore::AccessibilityRenderObject::widget):
(WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
(WebCore::AccessibilityRenderObject::documentFrameView):
(WebCore::AccessibilityRenderObject::widgetForAttachmentView):
(WebCore::AccessibilityRenderObject::rootEditableElementForPosition):
(WebCore::AccessibilityRenderObject::visiblePositionForPoint):
(WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
(WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
(WebCore::AccessibilityRenderObject::accessibilityHitTest):
(WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
(WebCore::AccessibilityRenderObject::correspondingLabelForControlElement):
(WebCore::AccessibilityRenderObject::observableObject):
(WebCore::AccessibilityRenderObject::inheritsPresentationalRole):
(WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
(WebCore::AccessibilityRenderObject::addHiddenChildren):
(WebCore::AccessibilityRenderObject::setAccessibleName):
(WebCore::AccessibilityRenderObject::getScrollableAreaIfScrollable):
(WebCore::AccessibilityRenderObject::mathRadicandObject):
(WebCore::AccessibilityRenderObject::mathRootIndexObject):
(WebCore::AccessibilityRenderObject::mathNumeratorObject):
(WebCore::AccessibilityRenderObject::mathDenominatorObject):
(WebCore::AccessibilityRenderObject::mathUnderObject):
(WebCore::AccessibilityRenderObject::mathOverObject):
(WebCore::AccessibilityRenderObject::mathBaseObject):
(WebCore::AccessibilityRenderObject::mathSubscriptObject):
(WebCore::AccessibilityRenderObject::mathSuperscriptObject):

accessibility/AccessibilitySVGRoot.cpp:

(WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):

accessibility/AccessibilityScrollView.cpp:

(WebCore::AccessibilityScrollView::detach):
(WebCore::AccessibilityScrollView::scrollBar):
(WebCore::AccessibilityScrollView::updateScrollbars):
(WebCore::AccessibilityScrollView::addChildScrollbar):
(WebCore::AccessibilityScrollView::clearChildren):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::accessibilityHitTest):
(WebCore::AccessibilityScrollView::documentFrameView):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):

accessibility/AccessibilityScrollbar.cpp:

(WebCore::AccessibilityScrollbar::document):

accessibility/AccessibilitySpinButton.cpp:

(WebCore::AccessibilitySpinButton::AccessibilitySpinButton):

accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::AccessibilityTable):
(WebCore::AccessibilityTable::clearChildren):
(WebCore::AccessibilityTable::cellForColumnAndRow):

accessibility/AccessibilityTableCell.cpp:

(WebCore::AccessibilityTableCell::parentTable):
(WebCore::AccessibilityTableCell::titleUIElement):

accessibility/AccessibilityTableColumn.cpp:

(WebCore::AccessibilityTableColumn::headerObject):
(WebCore::AccessibilityTableColumn::headerObjectForSection):

accessibility/AccessibilityTableRow.cpp:

(WebCore::AccessibilityTableRow::parentTable):
(WebCore::AccessibilityTableRow::headerObject):

accessibility/ios/AXObjectCacheIOS.mm:

(WebCore::AXObjectCache::detachWrapper):

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper detach]):
(-[WebAccessibilityObjectWrapper tableCellParent]):
(-[WebAccessibilityObjectWrapper tableParent]):
(-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
(-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
(rendererForView):
(-[WebAccessibilityObjectWrapper _convertToDOMRange:]):

accessibility/mac/AXObjectCacheMac.mm:

(WebCore::AXObjectCache::detachWrapper):

accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::AccessibilityObject::detachFromParent):
(WebCore::AccessibilityObject::accessibilityIgnoreAttachment):

accessibility/mac/WebAccessibilityObjectWrapperBase.mm:

(-[WebAccessibilityObjectWrapperBase detach]):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(CreateCGColorIfDifferent):
(-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
(rendererForView):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

accessibility/win/AccessibilityObjectWrapperWin.h:

(WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):

5:12 AM Changeset in webkit [171476] by mihnea@adobe.com

3 edits
2 adds in trunk

ASSERTION FAILED: generatingElement() in WebCore::RenderNamedFlowFragment::regionOversetState
https://bugs.webkit.org/show_bug.cgi?id=135153

Reviewed by David Hyatt.

Source/WebCore:
Even though the CSSRegions spec defines the behaviour of a multicolumn region,
we currently do not support this functionality. This patch ensures that a multicolumn
element does not become a region. In the future, when we will implement the multicolumn
as region functionality, http://dev.w3.org/csswg/css-regions/#multi-column-regions, we
will remove this restriction.

Test: fast/regions/multicol-as-region-prevented.html

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):

LayoutTests:

fast/regions/multicol-as-region-prevented-expected.html: Added.
fast/regions/multicol-as-region-prevented.html: Added.

4:30 AM Changeset in webkit [171475] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

[CMake] Avoid building WebCore with ANGLE's OpenGL/EGL headers
https://bugs.webkit.org/show_bug.cgi?id=135167

Reviewed by Martin Robinson.

CMakeLists.txt: Don't add ANGLE/include to the WebCore_INCLUDE_DIRECTORIES list

as this results in ANGLE's OpenGL and EGL headers being included, instead of the
headers that are provided by the system. Only the ANGLESupport library should be built
with that specific header inclusion path.

3:31 AM Changeset in webkit [171474] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r171367.
https://bugs.webkit.org/show_bug.cgi?id=135192

broke three API tests (Requested by thorton on #webkit).

Reverted changeset:

"JSLock release should only modify the AtomicStringTable if it
modified in acquire"
https://bugs.webkit.org/show_bug.cgi?id=135143
http://trac.webkit.org/changeset/171367

3:27 AM Changeset in webkit [171473] by Lucas Forschler

5 edits in branches/safari-600.1-branch/Source

Versioning.

3:25 AM Changeset in webkit [171472] by Lucas Forschler

1 copy in tags/Safari-600.1.2

New Tag.

3:24 AM Changeset in webkit [171471] by timothy_horton@apple.com

7 edits in trunk/Source/WebKit2

REGRESSION (r171239): Much more time spent taking snapshots during the PLT
https://bugs.webkit.org/show_bug.cgi?id=135177
<rdar://problem/17764847>

Reviewed by Dan Bernstein.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPageProxy::willChangeCurrentHistoryItem): Deleted.

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::willChangeCurrentHistoryItem):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPage::willChangeCurrentHistoryItem): Deleted.

WebProcess/WebPage/WebPage.h:

Rename WillChangeCurrentHistoryItem to WillChangeCurrentHistoryItemForMainFrame.
Only send it when the current history item for the main frame changes.

2:59 AM Changeset in webkit [171470] by Michał Pakuła vel Rutka

2 edits in trunk/Tools

[EFL] Fix build after r171454
https://bugs.webkit.org/show_bug.cgi?id=135191

Reviewed by Csaba Osztrogonác.

MiniBrowser/efl/CMakeLists.txt: Add path to new EWebKit2.h location .

1:47 AM Changeset in webkit [171469] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171384. <rdar://problem/17739108>

1:44 AM Changeset in webkit [171468] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit/win

Merged r171403. <rdar://problem/16721055>

1:42 AM Changeset in webkit [171467] by Lucas Forschler

24 edits in branches/safari-600.1-branch/Source

Merged r171370. <rdar://problem/16721055>

1:36 AM Changeset in webkit [171466] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171368. <rdar://problem/17740149>

1:32 AM Changeset in webkit [171465] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171367. <rdar://problem/17041912>

1:29 AM Changeset in webkit [171464] by Lucas Forschler

3 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171363. <rdar://problem/17755931>

1:26 AM Changeset in webkit [171463] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171373. <rdar://problem/17654369>

1:23 AM Changeset in webkit [171462] by Lucas Forschler

9 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171356. <rdar://problem/17654369>

1:20 AM Changeset in webkit [171461] by Lucas Forschler

7 edits
1 copy in branches/safari-600.1-branch

Merged r171355. <rdar://problem/17735912>

1:10 AM Changeset in webkit [171460] by Lucas Forschler

2 edits
1 copy in branches/safari-600.1-branch/Source/JavaScriptCore

Merged r171354. <rdar://problem/17763909>

1:07 AM Changeset in webkit [171459] by Lucas Forschler

2 edits in branches/safari-600.1-branch/Source/WebCore

Merged r171353. <rdar://problem/17770227>

1:03 AM Changeset in webkit [171458] by Lucas Forschler

3 edits in branches/safari-600.1-branch/Source/WebKit2

Merged r171352. <rdar://problem/17754921>

12:58 AM Changeset in webkit [171457] by Lucas Forschler

3 edits
2 copies in branches/safari-600.1-branch

Merged r171347. <rdar://problem/16826229>

12:54 AM Changeset in webkit [171456] by Lucas Forschler

11 edits in branches/safari-600.1-branch/Source

Merged r171345. <rdar://problem/17001716>

12:52 AM Changeset in webkit [171455] by abucur@adobe.com

9 edits
2 adds in trunk

REGRESSION (r169105): Crash in selection
https://bugs.webkit.org/show_bug.cgi?id=134303

Reviewed by David Hyatt.

Source/WebCore:

Also, the selectionStart/End members in RenderView have been renamed to fix problems caused by the fact that
RenderView inherits SelectionSubtreeRoot, which also has the same selectionStart/End members.

Test: fast/regions/selection/crash-deselect.html

WebCore.xcodeproj/project.pbxproj:
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::isSelectionRoot):

rendering/RenderSelectionInfo.h:
rendering/RenderView.cpp:

(WebCore::RenderView::RenderView):
(WebCore::RenderView::setSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
(WebCore::RenderView::splitSelectionBetweenSubtrees):
(WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
(WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
(WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
(WebCore::RenderView::getSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
(WebCore::RenderView::setSubtreeSelection): Deleted.