⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Feb 2, 2015:

10:14 PM Changeset in webkit [179541] by commit-queue@webkit.org
  • 6 edits in trunk/Source/WebKit2

Unreviewed, rolling out r179540.
​https://bugs.webkit.org/show_bug.cgi?id=141190

need further investigation to fix !WK_API_ENABLED (32bit)
build. (Requested by brrian_ on #webkit).

Reverted changeset:

"Convert WebInspectorProxy to use WKWebView API for the
inspector view"
​https://bugs.webkit.org/show_bug.cgi?id=141037
​http://trac.webkit.org/changeset/179540

9:28 PM Changeset in webkit [179540] by Brian Burg
  • 6 edits in trunk/Source/WebKit2

Convert WebInspectorProxy to use WKWebView API for the inspector view
​https://bugs.webkit.org/show_bug.cgi?id=141037

Reviewed by Timothy Hatcher.

Use the newer API for PLATFORM(MAC). The main difference is that the
WKWebView's page group cannot be set directly; instead, the group identifier
is passed. Also add some preference setters needed for the inspector.

Refactor some code to not use page groups directly. In a future patch,
the PageGroup-based inspector level system will be simplified. It is
it is no longer necessary to keep a static map of PageGroup instances,
since they are only used to save inspector window preferences. (These used
to prevent all levels of inspector from pausing together when a second-level
inspector hit a breakpoint. This is not necessary with multi-process
web inspectors.)

Also, adjust window resizing behavior when the inspector is docked to
the right. Window width resizes should not affect the width of the inspector
frame. This matches the behavior of height changes when docked to the bottom.

  • UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _logsPageMessagesToSystemConsoleEnabled]): Added.
(-[WKPreferences _setLogsPageMessagesToSystemConsoleEnabled:]): Added.
(-[WKPreferences _allowFileAccessFromFileURLs]): Added.
(-[WKPreferences _setAllowFileAccessFromFileURLs:]): Added.

  • UIProcess/API/Cocoa/WKPreferencesPrivate.h:
  • UIProcess/WebInspectorProxy.cpp:

(WebKit::WebInspectorProxy::WebInspectorProxy):
(WebKit::WebInspectorProxy::inspectorPagePreferences): Added.
(WebKit::WebInspectorProxy::attach):
(WebKit::WebInspectorProxy::detach):
(WebKit::WebInspectorProxy::setAttachedWindowHeight):
(WebKit::WebInspectorProxy::setAttachedWindowWidth):
(WebKit::WebInspectorProxy::createInspectorPage):
(WebKit::WebInspectorProxy::shouldOpenAttached):

  • UIProcess/WebInspectorProxy.h: Use default member initializers.
  • UIProcess/mac/WebInspectorProxyMac.mm:

(-[WKWebInspectorWKWebView _didRelaunchProcess]):
WKWebView doesn't implement this, so remove the super call.
(WebKit::WebInspectorProxy::closeTimerFired):
(WebKit::createDockButton):
(WebKit::WebInspectorProxy::platformCreateInspectorPage):
(WebKit::WebInspectorProxy::platformAttach):
(-[WKWebInspectorWKView _didRelaunchProcess]): Deleted.

9:23 PM Changeset in webkit [179539] by Darin Adler
  • 2 edits in trunk/Source/WebCore

REGRESSION (r170576): Storage leaks in parsing of CSS image sizes
​https://bugs.webkit.org/show_bug.cgi?id=141026

Reviewed by Brent Fulgham.

Forgot to actually fix the leak in the successful parse case!

  • css/CSSParser.cpp:

(WebCore::CSSParser::sourceSize): Added a call to destroy.

9:20 PM Changeset in webkit [179538] by fpizlo@apple.com
  • 10 edits
    6 adds in trunk/Source/JavaScriptCore

arguments[-1] should have well-defined behavior
​https://bugs.webkit.org/show_bug.cgi?id=141183

Reviewed by Mark Lam.

According to JSC's internal argument numbering, 0 is "this" and 1 is the first argument.
In the "arguments[i]" expression, "this" is not accessible and i = 0 refers to the first
argument. Previously we handled the bounds check in "arguments[i]" - where "arguments" is
statically known to be the current function's arguments object - as follows:

add 1, i
branchAboveOrEqual i, callFrame.ArgumentCount, slowPath


The problem with this is that if i = -1, this passes the test, and we end up accessing
what would be the "this" argument slot. That's wrong, since we should really be bottoming
out in arguments-1, which is usually undefined but could be anything. It's even worse
if the function is inlined or if we're in a constructor - in that case the "this" slot
could be garbage.

It turns out that we had this bug in all of our engines.

This fixes the issue by changing the algorithm to:

load32 callFrame.ArgumentCount, tmp
sub 1, tmp
branchAboveOrEqual i, tmp, slowPath


In some engines, we would have used the modified "i" (the one that had 1 added to it) for
the subsequent argument load; since we don't do this anymore I also had to change some of
the offsets on the BaseIndex arguments load.

This also includes tests that are written in such a way as to get coverage on LLInt and
Baseline JIT (get-my-argument-by-val-wrap-around-no-warm-up), DFG and FTL
(get-my-argument-by-val-wrap-around), and DFG when we're being paranoid about the user
overwriting the "arguments" variable (get-my-argument-by-val-safe-wrap-around). This also
includes off-by-1 out-of-bounds tests for each of these cases, since in the process of
writing the patch I broke the arguments[arguments.length] case in the DFG and didn't see
any test failures.

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):

  • jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::offsetOfArguments):
(JSC::AssemblyHelpers::offsetOfArgumentsIncludingThis): Deleted.

  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_get_argument_by_val):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_get_argument_by_val):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • tests/stress/get-my-argument-by-val-out-of-bounds-no-warm-up.js: Added.

(foo):

  • tests/stress/get-my-argument-by-val-out-of-bounds.js: Added.

(foo):

  • tests/stress/get-my-argument-by-val-safe-out-of-bounds.js: Added.

(foo):

  • tests/stress/get-my-argument-by-val-safe-wrap-around.js: Added.

(foo):

  • tests/stress/get-my-argument-by-val-wrap-around-no-warm-up.js: Added.

(foo):

  • tests/stress/get-my-argument-by-val-wrap-around.js: Added.

(foo):

9:06 PM Changeset in webkit [179537] by Brent Fulgham
  • 3 edits in trunk/LayoutTests

[Win] Activate HTTP tests

  • platform/win/TestExpectations:
  • platform/win/fast/dom/adopt-node-crash-2-expected.txt:
8:29 PM Changeset in webkit [179536] by fpizlo@apple.com
  • 3 edits
    1 add in trunk/Source/JavaScriptCore

MultiGetByOffset should be marked NodeMustGenerate
​https://bugs.webkit.org/show_bug.cgi?id=140137

Reviewed by Michael Saboff.

  • dfg/DFGNode.h:

(JSC::DFG::Node::convertToGetByOffset): We were sloppy - we should also clear NodeMustGenerate once it's a GetByOffset.
(JSC::DFG::Node::convertToMultiGetByOffset): Assert that we converted from something that already had NodeMustGenerate.

  • dfg/DFGNodeType.h: We shouldn't DCE a node that does checks and could be effectful in baseline. Making MultiGetByOffset as NodeMustGenerate prevents DCE. FTL could still DCE the actual loads, but the checks will stay.
  • tests/stress/multi-get-by-offset-dce.js: Added. This previously failed because the getter wasn't called.

(foo):

8:11 PM Changeset in webkit [179535] by benjamin@webkit.org
  • 3 edits
    16 adds in trunk

JIT Compile simple cases of :nth-last-child()
​https://bugs.webkit.org/show_bug.cgi?id=141053

Reviewed by Andreas Kling.

Source/WebCore:

This patch adds the code generator for :nth-last-child(), skipping
any :nth-last-child(An+B of selector list).

The code generator is boring here, nothing fancy.
There is no optimization opportunity here so it is basically the same
speed as the code generated by Clang when the simple selector is alone.

The only reason to JIT compile this is to avoid going to slow-path
for every selector that contain :nth-last-child().

  • cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::addNthChildType):
The code creating the intermediate representation of :nth-child() is exactly
the same as what we need for :nth-last-child(). I extracted the code from addPseudoClassType()
and share it for both simple selectors.

(WebCore::SelectorCompiler::addPseudoClassType):
I fail :nth-last-child(An+B of selector list). Let's add it later.

(WebCore::SelectorCompiler::minimumRegisterRequirements):
Oops, there was a bug with nthChildOfFilters.

(WebCore::SelectorCompiler::hasAnyCombinators):
(WebCore::SelectorCompiler::computeBacktrackingMemoryRequirements):
(WebCore::SelectorCompiler::computeBacktrackingInformation):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
(WebCore::SelectorCompiler::setChildrenAffectedByBackwardPositionalRules):
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChild):

LayoutTests:

There was almost no test coverage for :nth-last-child(). I copied the main tests
from :nth-child() and updated the expected results.

This is not ideal because we should have style update tests targetting
backward invalidation... Still better than nothing :)

  • fast/selectors/nth-last-child-as-first-simple-selector-style-update-expected.txt: Added.
  • fast/selectors/nth-last-child-as-first-simple-selector-style-update.html: Added.
  • fast/selectors/nth-last-child-basics-expected.txt: Added.
  • fast/selectors/nth-last-child-basics.html: Added.
  • fast/selectors/nth-last-child-bounds-expected.txt: Added.
  • fast/selectors/nth-last-child-bounds.html: Added.
  • fast/selectors/nth-last-child-chained-expected.txt: Added.
  • fast/selectors/nth-last-child-chained.html: Added.
  • fast/selectors/nth-last-child-on-root-expected.txt: Added.
  • fast/selectors/nth-last-child-on-root.html: Added.
  • fast/selectors/nth-last-child-style-update-expected.txt: Added.
  • fast/selectors/nth-last-child-style-update.html: Added.
  • fast/selectors/nth-last-child-with-backtracking-expected.txt: Added.
  • fast/selectors/nth-last-child-with-backtracking.html: Added.
  • fast/selectors/several-nth-last-child-expected.txt: Added.
  • fast/selectors/several-nth-last-child.html: Added.
7:08 PM Changeset in webkit [179534] by Alan Bujtas
  • 6 edits
    2 moves in trunk/Source/WebCore

Simple line layout: Rename FlowContentsIterator to TextFragmentIterator.
​https://bugs.webkit.org/show_bug.cgi?id=141177

Rubber-stamped by Antti Koivisto

FlowContentsIterator is easy to confuse with FlowContents::Iterator.
TextFragmentIterator reflects the functionality better.

No change in functionality.

  • CMakeLists.txt:
  • WebCore.vcxproj/WebCore.vcxproj:
  • WebCore.vcxproj/WebCore.vcxproj.filters:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::LineState::setOverflowedFragment):
(WebCore::SimpleLineLayout::LineState::overflowedFragment):
(WebCore::SimpleLineLayout::LineState::appendFragment):
(WebCore::SimpleLineLayout::begin):
(WebCore::SimpleLineLayout::end):
(WebCore::SimpleLineLayout::preWrap):
(WebCore::SimpleLineLayout::removeTrailingWhitespace):
(WebCore::SimpleLineLayout::splitFragmentToFitLine):
(WebCore::SimpleLineLayout::firstFragment):
(WebCore::SimpleLineLayout::createLineRuns):
(WebCore::SimpleLineLayout::closeLineEndingAndAdjustRuns):
(WebCore::SimpleLineLayout::splitRunsAtRendererBoundary):
(WebCore::SimpleLineLayout::createTextRuns):

  • rendering/SimpleLineLayoutTextFragmentIterator.cpp: Renamed from Source/WebCore/rendering/SimpleLineLayoutFlowContentsIterator.cpp.

(WebCore::SimpleLineLayout::TextFragmentIterator::Style::Style):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragmentIterator):
(WebCore::SimpleLineLayout::TextFragmentIterator::nextTextFragment):
(WebCore::SimpleLineLayout::TextFragmentIterator::textWidth):
(WebCore::SimpleLineLayout::nextBreakablePosition):
(WebCore::SimpleLineLayout::TextFragmentIterator::findNextBreakablePosition):
(WebCore::SimpleLineLayout::findNextNonWhitespace):
(WebCore::SimpleLineLayout::TextFragmentIterator::findNextNonWhitespacePosition):
(WebCore::SimpleLineLayout::TextFragmentIterator::runWidth):

  • rendering/SimpleLineLayoutTextFragmentIterator.h: Renamed from Source/WebCore/rendering/SimpleLineLayoutFlowContentsIterator.h.

(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::TextFragment):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::start):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::end):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::width):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::type):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::isCollapsed):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::isBreakable):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::isEmpty):
(WebCore::SimpleLineLayout::TextFragmentIterator::style):
(WebCore::SimpleLineLayout::TextFragmentIterator::segmentForPosition):
(WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::split):
(WebCore::SimpleLineLayout::TextFragmentIterator::characterAt):
(WebCore::SimpleLineLayout::TextFragmentIterator::isLineBreak):
(WebCore::SimpleLineLayout::TextFragmentIterator::isEnd):

6:22 PM Changeset in webkit [179533] by Chris Dumez
  • 4 edits in trunk/Source/WebCore

Add diagnostic logging for ResourceResponse's source
​https://bugs.webkit.org/show_bug.cgi?id=141170
<rdar://problem/19632080>

Reviewed by Antti Koivisto.

Add diagnostic logging for ResourceResponse's source (network, disk
cache, disk cache after validation) to give us an idea of our network
cache efficacy.

  • loader/ResourceLoader.cpp:

(WebCore::logResourceResponseSource):
(WebCore::ResourceLoader::didReceiveResponse):

  • page/DiagnosticLoggingKeys.cpp:

(WebCore::DiagnosticLoggingKeys::networkKey):
(WebCore::DiagnosticLoggingKeys::diskCacheKey):
(WebCore::DiagnosticLoggingKeys::diskCacheAfterValidationKey):
(WebCore::DiagnosticLoggingKeys::resourceResponseKey):
(WebCore::DiagnosticLoggingKeys::scriptKey):
(WebCore::DiagnosticLoggingKeys::sourceKey):

  • page/DiagnosticLoggingKeys.h:
6:22 PM Changeset in webkit [179532] by commit-queue@webkit.org
  • 4 edits in trunk/Source

Optimize matchesLangPseudoClass() of :lang()
​https://bugs.webkit.org/show_bug.cgi?id=140873

Patch by Dhi Aurrahman <​diorahman@rockybars.com> on 2015-02-02
Reviewed by Darin Adler.

Source/WebCore:

Avoid unnecessary memory allocation.

No new tests, no behavior changed.

  • css/SelectorCheckerTestFunctions.h:

(WebCore::equalIgnoringASCIICase):
(WebCore::containslanguageSubtagMatchingRange):
(WebCore::matchesLangPseudoClass):

Source/WTF:

Add some basic equality comparison operators.

  • wtf/text/StringView.h:

(WTF::operator==):
(WTF::operator!=):
(WTF::equal):
(WTF::equalIgnoringASCIICase):

5:47 PM Changeset in webkit [179531] by Brent Fulgham
  • 6 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178661. rdar://problem/19617731

2015-01-19 Brent Fulgham <Brent Fulgham>

Layers need to be already updated before we call adjustViewSize
​https://bugs.webkit.org/show_bug.cgi?id=135514

Reviewed by Simon Fraser.

Tested by 'fast/dynamic/layer-no-longer-paginated.html'

Defer painting operations until we have finished layout. This
has a couple of benefits:
(1) We do not attempt to modify render layers during layout.
(2) In WK1 we do not attempt to paint during layout.

Add a new virtual predicate to ScrollView indicating when we are in
layout so that calls to setContentsSize do not attempt
to adjust scrollbars.

Modify FrameView to set its ScrollView state to block paint
operations during layout. Also add a post-layout handler to
complete the scrollbar updates after layout is finished.

  • WebCore.exp.in: Move linker symbol to ScrollView (from FrameView).
  • page/FrameView.cpp: (WebCore::FrameView::layout): (WebCore::FrameView::shouldDeferScrollUpdateAfterContentSizeChange): Added. (WebCore::FrameView::scrollPositionChangedViaPlatformWidget): Removed (Renamed). (WebCore::FrameView::scrollPositionChangedViaPlatformWidgetImpl): Added (Renamed) (WebCore::FrameView::paintContents): Do not paint if we are inside view size adjustment.
  • page/FrameView.h:
  • platform/ScrollView.cpp: (WebCore::ScrollView::scrollPositionChangedViaPlatformWidget): Added. Checks whether we need to defer painting, and calls virtual scrollPositionChangedViaPlatformWidgetImpl if we do not. (WebCore::FrameView::scrollPositionChangedViaPlatformWidgetImpl): Added. (WebCore::ScrollView::handleDeferredScrollUpdateAfterContentSizeChange): Added. (WebCore::ScrollView::scrollTo): If we should defer painting, cache the the scroll delta and apply it after the layout is complete. (WebCore::ScrollView::completeUpdatesAfterScrollTo): Split off part of 'scrollTo' into its own method so we can reuse it in handleDeferredScrollUpdateAfterContentSizeChange.
  • platform/ScrollView.h: (WebCore::ScrollView::shouldDeferScrollUpdateAfterContentSizeChange): Added.
5:33 PM Changeset in webkit [179530] by roger_fong@apple.com
  • 9 edits in trunk/Source/WebCore

WebGL2: Implement spec section 3.7.1 Setting and getting state (Part 2).
​https://bugs.webkit.org/show_bug.cgi?id=141096
<rdar://problem/15002469>
Reviewed by Brent Fulgham.
This patch handles some of the valid arguments that could be passed into getParameter.
The unhandled cases will be implemented as the associated WebGL2 features are implemented.
In addition, getParameter queries that return 64 bit integer currently just return 0 as
we need to use ::glGetInteger64v which is only available in GLES 3.0 headers.
I will be adding these headers in a future patch.

  • bindings/js/JSWebGL2RenderingContextCustom.cpp:

(WebCore::toJS): Accept a 64 bit integer type.

  • html/canvas/WebGL2RenderingContext.cpp: Handle various parameter inputs.

(WebCore::WebGL2RenderingContext::getParameter):

  • html/canvas/WebGLGetInfo.cpp: Add a 64 bit integer type.

(WebCore::WebGLGetInfo::WebGLGetInfo):
(WebCore::WebGLGetInfo::getInt64):

  • html/canvas/WebGLGetInfo.h:
  • html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::getInt64Parameter):

  • html/canvas/WebGLRenderingContextBase.h:
  • platform/graphics/GraphicsContext3D.h:
  • platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:

(WebCore::GraphicsContext3D::getInteger64v):

5:18 PM Changeset in webkit [179529] by Chris Dumez
  • 3 edits in trunk/Source/WebKit2

Make NetworkCache's constructor private
​https://bugs.webkit.org/show_bug.cgi?id=141181

Reviewed by Antti Koivisto.

Make NetworkCache's constructor private and mark its destructor as
deleted as it is a singleton class.

  • NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::NetworkCache): Deleted.

  • NetworkProcess/cache/NetworkCache.h:
4:58 PM Changeset in webkit [179528] by matthew_hanson@apple.com
  • 1 edit
    1 move in branches/safari-600.5-branch

Merge r178846. rdar://problem/19670542

4:58 PM Changeset in webkit [179527] by matthew_hanson@apple.com
  • 6 edits
    1 add in branches/safari-600.5-branch

Merge r178845. rdar://problem/19670542

4:58 PM Changeset in webkit [179526] by matthew_hanson@apple.com
  • 2 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178834. rdar://problem/19670539

4:58 PM Changeset in webkit [179525] by matthew_hanson@apple.com
  • 4 edits
    2 adds in branches/safari-600.5-branch

Merge r178832. rdar://problem/19670627

4:57 PM Changeset in webkit [179524] by matthew_hanson@apple.com
  • 4 edits
    3 adds in branches/safari-600.5-branch

Merge r178831. rdar://problem/19670604

4:57 PM Changeset in webkit [179523] by matthew_hanson@apple.com
  • 7 edits in branches/safari-600.5-branch

Merge r178829. rdar://problem/19670575

4:57 PM Changeset in webkit [179522] by matthew_hanson@apple.com
  • 3 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178819. rdar://problem/19670617

4:57 PM Changeset in webkit [179521] by matthew_hanson@apple.com
  • 2 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178812. rdar://problem/19670533

4:57 PM Changeset in webkit [179520] by matthew_hanson@apple.com
  • 3 edits
    2 adds in branches/safari-600.5-branch

Merge r178786. rdar://problem/19670584

4:57 PM Changeset in webkit [179519] by matthew_hanson@apple.com
  • 2 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178783. rdar://problem/19670695

4:57 PM Changeset in webkit [179518] by matthew_hanson@apple.com
  • 3 edits in branches/safari-600.5-branch/Source/WebCore

Merge r178782. rdar://problem/19670695

4:57 PM Changeset in webkit [179517] by matthew_hanson@apple.com
  • 9 edits in branches/safari-600.5-branch

Merge r178781. rdar://problem/19670569

4:57 PM Changeset in webkit [179516] by matthew_hanson@apple.com
  • 10 edits in branches/safari-600.5-branch

Merge r178779. rdar://problem/19670503

4:43 PM Changeset in webkit [179515] by fpizlo@apple.com
  • 2 edits
    1 add in trunk/Source/JavaScriptCore

[FTL] inlined GetMyArgumentByVal with no arguments passed causes instant crash
​https://bugs.webkit.org/show_bug.cgi?id=141180
rdar://problem/19677552

Reviewed by Benjamin Poulain.

If we do a GetMyArgumentByVal on an inlined call frame that has no arguments, then the
bounds check already terminates execution. This means we can skip the part where we
previously did an out-of-bound array access on the inlined call frame arguments vector.

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::safelyInvalidateAfterTermination):
(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
(JSC::FTL::LowerDFGToLLVM::terminate):
(JSC::FTL::LowerDFGToLLVM::didAlreadyTerminate):
(JSC::FTL::LowerDFGToLLVM::crash):

  • tests/stress/get-my-argument-by-val-inlined-no-formal-parameters.js: Added.

(foo):
(bar):

4:40 PM Changeset in webkit [179514] by bshafiei@apple.com
  • 5 edits in branches/safari-600.5-branch/Source

Versioning.

4:38 PM Changeset in webkit [179513] by bshafiei@apple.com
  • 1 copy in tags/Safari-600.5.4

New tag.

4:18 PM Changeset in webkit [179512] by matthew_hanson@apple.com
  • 1 edit
    1 copy
    1 move
    1 delete in branches/safari-600.5-branch/LayoutTests

Merge r178778. rdar://problem/19670611

4:18 PM Changeset in webkit [179511] by matthew_hanson@apple.com
  • 6 edits
    2 adds in branches/safari-600.5-branch

Merge r178777. rdar://problem/19670611

3:53 PM Changeset in webkit [179510] by Alan Bujtas
  • 4 edits in trunk/Source/WebCore

Simple line layout: use std::upper_bound in splitFragmentToFitLine()
​https://bugs.webkit.org/show_bug.cgi?id=141146

Reviewed by Antti Koivisto.

Replace the custom binary search implementation with std::upper_bound and
move splitting functionality to TextFragment.

No change in functionality.

  • rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::FragmentForwardIterator::FragmentForwardIterator):
(WebCore::SimpleLineLayout::FragmentForwardIterator::operator++):
(WebCore::SimpleLineLayout::FragmentForwardIterator::operator!=):
(WebCore::SimpleLineLayout::FragmentForwardIterator::operator*):
(WebCore::SimpleLineLayout::begin):
(WebCore::SimpleLineLayout::end):
(WebCore::SimpleLineLayout::splitFragmentToFitLine):

  • rendering/SimpleLineLayoutFlowContentsIterator.cpp:

(WebCore::SimpleLineLayout::FlowContentsIterator::runWidth):

  • rendering/SimpleLineLayoutFlowContentsIterator.h:

(WebCore::SimpleLineLayout::FlowContentsIterator::TextFragment::split):

3:42 PM Changeset in webkit [179509] by matthew_hanson@apple.com
  • 2 edits in branches/safari-600.5-branch/Source/WebKit2

Merge r178750. rdar://problem/19670673

3:42 PM Changeset in webkit [179508] by matthew_hanson@apple.com
  • 6 edits in branches/safari-600.5-branch/Source

Merge r178745. rdar://problem/19670564

3:42 PM Changeset in webkit [179507] by matthew_hanson@apple.com
  • 9 edits
    3 adds in branches/safari-600.5-branch

Merge r178735. rdar://problem/19670597

3:42 PM Changeset in webkit [179506] by matthew_hanson@apple.com
  • 3 edits
    2 adds in branches/safari-600.5-branch

Merge r178731. rdar://problem/19670592

3:42 PM Changeset in webkit [179505] by matthew_hanson@apple.com
  • 6 edits in branches/safari-600.5-branch/Source/JavaScriptCore

Merge r178730. rdar://problem/19670732

3:36 PM Changeset in webkit [179504] by fpizlo@apple.com
  • 4 edits in trunk/Source/JavaScriptCore

REGRESSION(r179477): arguments simplification no longer works
​https://bugs.webkit.org/show_bug.cgi?id=141169

Reviewed by Mark Lam.

The operations involved in callee/scope access don't exit and shouldn't get in the way
of strength-reducing a Flush to a PhantomLocal. Then the PhantomLocal shouldn't get in
the way of further such strength-reduction. We also need to canonicalize PhantomLocal
before running arguments simplification.

  • dfg/DFGMayExit.cpp:

(JSC::DFG::mayExit):

  • dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThreadImpl):

  • dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

3:32 PM Changeset in webkit [179503] by fpizlo@apple.com
  • 18 edits
    1 add in trunk/Source/JavaScriptCore

VirtualRegister should really know how to dump itself
​https://bugs.webkit.org/show_bug.cgi?id=141171

Reviewed by Geoffrey Garen.

Gives VirtualRegister a dump() method that pretty-prints the virtual register. The rest of
the patch is all about using this new power.

(JSC::constantName):
(JSC::CodeBlock::registerName):

  • bytecode/CodeBlock.h:

(JSC::missingThisObjectMarker): Deleted.

  • bytecode/VirtualRegister.cpp: Added.

(JSC::VirtualRegister::dump):

  • bytecode/VirtualRegister.h:

(WTF::printInternal): Deleted.

  • dfg/DFGArgumentPosition.h:

(JSC::DFG::ArgumentPosition::dump):

  • dfg/DFGFlushedAt.cpp:

(JSC::DFG::FlushedAt::dump):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

  • dfg/DFGPutLocalSinkingPhase.cpp:
  • dfg/DFGSSAConversionPhase.cpp:

(JSC::DFG::SSAConversionPhase::run):

  • dfg/DFGValidate.cpp:

(JSC::DFG::Validate::reportValidationContext):

  • dfg/DFGValueSource.cpp:

(JSC::DFG::ValueSource::dump):

  • dfg/DFGVariableEvent.cpp:

(JSC::DFG::VariableEvent::dump):
(JSC::DFG::VariableEvent::dumpSpillInfo):

  • ftl/FTLExitArgumentForOperand.cpp:

(JSC::FTL::ExitArgumentForOperand::dump):

  • ftl/FTLExitValue.cpp:

(JSC::FTL::ExitValue::dumpInContext):

  • profiler/ProfilerBytecodeSequence.cpp:

(JSC::Profiler::BytecodeSequence::BytecodeSequence):

3:14 PM Changeset in webkit [179502] by gyuyoung.kim@samsung.com
  • 2 edits in trunk/LayoutTests

Unreviewed, EFL gardening. Update flakiness tests on W3C SVG 1.1 tests.

  • platform/efl/TestExpectations:
2:44 PM Changeset in webkit [179501] by Joseph Pecoraro
  • 3 edits in trunk/Source/WebInspectorUI

Web Inspector: CSS Autocompletion: Autodetect many color supporting properties
​https://bugs.webkit.org/show_bug.cgi?id=141166

Reviewed by Timothy Hatcher.

  • UserInterface/Base/Utilities.js:

Add String.prototype.endsWith. Group String extensions together.

  • UserInterface/Models/CSSKeywordCompletions.js:

(WebInspector.CSSKeywordCompletions.forProperty):
If a property name ends in "color", provide CSS color completions.

(WebInspector.CSSKeywordCompletions.isColorAwareProperty): Deleted.
This was unused and disagrees slightly with the implementation above.

2:27 PM Changeset in webkit [179500] by ggaren@apple.com
  • 9 edits in trunk/Source

Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
​https://bugs.webkit.org/show_bug.cgi?id=140900

Reviewed by Mark Hahnenberg.

Re-landing just the HandleBlock piece of this patch.

Source/JavaScriptCore:

  • heap/HandleBlock.h:
  • heap/HandleBlockInlines.h:

(JSC::HandleBlock::create):
(JSC::HandleBlock::destroy):
(JSC::HandleBlock::HandleBlock):
(JSC::HandleBlock::payloadEnd):

  • heap/HandleSet.cpp:

(JSC::HandleSet::~HandleSet):
(JSC::HandleSet::grow):

Source/WebCore:

  • platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::install):

Source/WTF:

  • wtf/FastMalloc.cpp:

(WTF::fastAlignedMalloc):
(WTF::fastAlignedFree):
(WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):

  • wtf/FastMalloc.h:
2:22 PM Changeset in webkit [179499] by Brent Fulgham
  • 2 edits in trunk/Source/WebCore

[Win] 64-bit build fix after r179492.

  • WebCore.vcxproj/WebCore.vcxproj: Forgot to build these files

as standalone under 64-bit target.

2:21 PM Changeset in webkit [179498] by Brent Fulgham
  • 2 edits in trunk/Source/WebKit

[Win] Unreviewed build fix after r179489.

Correct symbol export definitions for 32-bit and 64-bit builds.
Also add some drive-by fixes for 64-bit symbols.

  • WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:
2:00 PM Changeset in webkit [179497] by benjamin@webkit.org
  • 14 edits
    17 adds in trunk

Clean up attribute handling: part 2 - attributeNode
​https://bugs.webkit.org/show_bug.cgi?id=141109

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2015-02-02
Reviewed by Andreas Kling.

Source/WebCore:

Our implementation was covering some old legacy behaviors of Firefox,
even copying bugs in some cases.

The spec (​https://dom.spec.whatwg.org) now defines the behavior precisely,
let's move a bit closer to that.

Tests: fast/dom/Element/attribute-ascii-case-insensitive-3.html

fast/dom/Element/attribute-setAttributeNode-multiple-times.html
fast/dom/Element/attribute-setAttributeNodeNS-multiple-times.html
fast/dom/Element/mozilla-dom-base-tests/test_bug1075702.html
fast/dom/Element/mozilla-dom-base-tests/test_bug339494.html
fast/dom/Element/mozilla-dom-base-tests/test_bug364092.xhtml
fast/dom/Element/setAttributeNode-overriding-lowercase-values.html

  • dom/Element.cpp:

(WebCore::findAttrNodeInList):
New getter for the name-without-namespace case.

(WebCore::Element::setAttributeNode):
This one is the tricky one: ​https://dom.spec.whatwg.org/#dom-element-setattributenode

When setAttributeNode() is used with an AttributeNode without namespace,
getting the old value behaves like getAttribute(), with ASCII lowercase name matching.
When used with a namespace, getting the old value behaves like getAttributeNS().

Setting the value is a whole different story, the name used always keeps
the original case.

Now that's a bit tricky for us because AttributeNodes are just legacy stuff we don't
used internally.

We have 4 cases to handle:
1) The name being set is lowercase, there was no conflicting name on the element.

That's easy, we just override any node that would exist, set the name otherwise.

2) The name is lowercase but there was an existing attribute for it.

-We create a new AttributeNode for the name to represent the old name.
-We check the names are the same with attribute.name().matches(attrNode->qualifiedName())

and override the value.

3) The name has uppercase characters, there is no conflicting name.

We would not find an element to remove, we just use setAttributeInternal() as usual
to add the attribute;

4) The name has uppercase characters, there is a lowercase conflicing name.

This is the weird behavior: we need to nuke the old attribute, then add the new attribute
with a different case.

First we remove the attribute with a lowercase name with removeAttributeInternal().
That becomes the old node.

There might still be an element of the same name as what we are trying to add. We don't want
to add another version of the same attribute. We need to use findAttributeIndexByName() again
to find if there is a conflicting attribute. Then we call setAttributeInternal() which handle
the both the cases where there was an element or not.

(WebCore::Element::setAttributeNodeNS):
This should work like any "NS" method.

(WebCore::Element::removeAttributeNode):
The method removeAttributeNode() is supposed to be exact.

(WebCore::Element::getAttributeNode):
(WebCore::Element::hasAttribute):
(WebCore::Element::attrIfExists):

  • dom/Element.h:
  • dom/ElementData.cpp:

(WebCore::ElementData::findAttributeIndexByNameSlowCase): Deleted.
(WebCore::ElementData::findAttributeIndexByNameForAttributeNode): Deleted.
Kill the slow case, every caller has been updated now.

  • dom/ElementData.h:

(WebCore::ElementData::findAttributeIndexByName):

  • dom/QualifiedName.h:

(WebCore::QualifiedName::matchesIgnoringCaseForLocalName): Deleted.

LayoutTests:

Improve the coverage a little.

Not everything is right yet: some getters return an empty string when they
should return null.

  • fast/dom/Element/attribute-ascii-case-insensitive-1-expected.txt:

This is now fixed :)

  • fast/dom/Element/attribute-ascii-case-insensitive-3-expected.txt: Added.
  • fast/dom/Element/attribute-ascii-case-insensitive-3.html: Added.

Test prefixed-like attribute defined through the parser.

  • fast/dom/Element/attribute-setAttributeNode-multiple-times-expected.txt: Added.
  • fast/dom/Element/attribute-setAttributeNode-multiple-times.html: Added.

Make sure we don't accumulate nodes.

  • fast/dom/Element/attribute-setAttributeNodeNS-multiple-times-expected.txt: Added.
  • fast/dom/Element/attribute-setAttributeNodeNS-multiple-times.html: Added.

Same without the crazy setter.

  • fast/dom/Element/script-tests/getAttribute-check-case-sensitivity.js:
  • fast/dom/Element/getAttribute-check-case-sensitivity-expected.txt:

With the latest spec, getting a node with any uppercase character through
getAttributeNode() always fails. Update the test to use .getAttributeNodeNS()
were needed.

  • fast/dom/Element/mozilla-dom-base-tests/test_bug1075702-expected.txt: Added.
  • fast/dom/Element/mozilla-dom-base-tests/test_bug1075702.html: Added.
  • fast/dom/Element/mozilla-dom-base-tests/test_bug339494-expected.txt: Added.
  • fast/dom/Element/mozilla-dom-base-tests/test_bug339494.html: Added.
  • fast/dom/Element/mozilla-dom-base-tests/test_bug364092-expected.txt: Added.
  • fast/dom/Element/mozilla-dom-base-tests/test_bug364092.xhtml: Added.

(testGetAttributeNodeMixedCase):
(testAttribNodeNamePreservesCaseGetNode):
(testAttribNodeNamePreservesCaseGetNode2):
Some related tests from Gecko, for completeness.

  • fast/dom/Element/setAttributeNode-case-insensitivity-expected.txt:
  • fast/dom/Element/setAttributeNode-case-insensitivity.html:

Test that the getAttribute part of setAttributeNode() do not ignore the prefix. The spec
says to use the name, not the localname.

  • fast/dom/Element/setAttributeNode-for-existing-attribute-expected.txt:
  • fast/dom/Element/setAttributeNode-for-existing-attribute.html:

This test was for legacy behavior that came from Firefox. Firefox does not do that anymore.
Keep the test around for regression catching, but add a sentence explaining the 'incorrect'
behavior.

  • fast/dom/Element/setAttributeNode-overriding-lowercase-values-1-expected.txt: Added.
  • fast/dom/Element/setAttributeNode-overriding-lowercase-values-1.html: Added.
  • fast/dom/Element/setAttributeNode-overriding-lowercase-values-2-expected.txt: Added.
  • fast/dom/Element/setAttributeNode-overriding-lowercase-values-2.html: Added.

Some coverage for the name overriding craziness.

1:55 PM Changeset in webkit [179496] by Joseph Pecoraro
  • 2 edits in trunk/LayoutTests

Rebaseline test with new expected results.

  • http/tests/inspector-protocol/access-inspected-object-expected.txt:
1:39 PM Changeset in webkit [179495] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebCore

Memory is written to after deallocated, in GraphicsLayer::setMaskLayer.
​https://bugs.webkit.org/show_bug.cgi?id=141168

Patch by ​peavo@outlook.com <​peavo@outlook.com> on 2015-02-02
Reviewed by Brent Fulgham.

Visual Studio detected that a deallocated heap block had been modified in GraphicsLayer::setMaskLayer,
when called from RenderLayerBacking::updateChildClippingStrategy.

  • rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateChildClippingStrategy):

1:25 PM Changeset in webkit [179494] by akling@apple.com
  • 2 edits in trunk/Source/WebCore

[Cocoa] Make decoded image data purgeable ASAP.
<​https://webkit.org/b/140298>
<rdar://problem/19623377>

Reviewed by Antti Koivisto.

Re-landing this patch since it turned out to not be the cause of
the memory regression we saw around that revision.

Mark decoded images as "transient" which makes CoreGraphics mark
the backing stores as purgeable shortly after they're used.

The decoded representation will remain in CoreGraphics's caches
indefinitely unless the kernel gets starved and needs the pages.

Most resources will now reach a state where the encoded data is
mmap'ed from disk cache (once the entire resource is downloaded)
and the decoded data is purgeable.

This also has the side effect of making the MemoryCache more
palatial since the decoded data cost can be deducted for images,
allowing us to cache more resources.

Note that the worst case for this new behavior would be something
like hovering below 100% memory utilization and constantly having
to drop and re-decode images. While churny, it still beats
crashing the process, plus there's tiling to remove many of the
reasons we'd need the decoded data.

  • platform/graphics/cg/ImageSourceCG.cpp:

(WebCore::ImageSource::createFrameAtIndex):

1:07 PM Changeset in webkit [179493] by Joseph Pecoraro
  • 11 edits in trunk/Source

Web Inspector: Support console.table
​https://bugs.webkit.org/show_bug.cgi?id=141058

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

  • inspector/InjectedScriptSource.js:

Include the firstLevelKeys filter when generating previews.

  • runtime/ConsoleClient.cpp:

(JSC::appendMessagePrefix):
Differentiate console.table logs to system log.

Source/WebCore:

  • inspector/CommandLineAPIModuleSource.js:

Include "table(foo)" as an alias of "console.table(foo)" on
the command line.

Source/WebInspectorUI:

  • Localizations/en.lproj/localizedStrings.js:

New "Index", "(Index)", "Value", table header strings.

  • UserInterface/Views/ConsoleMessage.js:

Add "Table", but add FIXMEs to consider using the protocol generated enums.

  • UserInterface/Views/ConsoleMessageImpl.js:

(WebInspector.ConsoleMessageImpl.prototype._format):
Special case console.table messages.

(WebInspector.ConsoleMessageImpl.prototype._appendPropertyPreviews):
(WebInspector.ConsoleMessageImpl.prototype._propertyPreviewElement):
Factor out ProjectPreview printing. Also, replace newlines in strings
with return characters, like we did elsewhere.

(WebInspector.ConsoleMessageImpl.prototype._formatParameterAsTable):
Ultimately try to create a DataGrid from the output. Search first
for rich object data in the list. If no rich object data is found
just check for simple values. If the table is lossy, also do
a log of the object in case the user wants to see more data.

  • UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid):
The for..in enumeration is unordered and may not give us the
column ordering we wanted. So include an optional preferred
column names list to get the preferred order.

(WebInspector.DataGrid.createSortableDataGrid):
Numerous bug fixes here. Accidental globals, typos, and sorting failures.

(WebInspector.DataGrid.prototype.autoSizeColumns):
(WebInspector.DataGrid.prototype.textForDataGridNodeColumn):
(WebInspector.DataGrid.prototype._copyTextForDataGridNode):
Create a generic method to get the text for a datagrid node in a column.
This is important for getting the text from console.table previews which
contains Nodes.

  • UserInterface/Views/LogContentView.css:

(.console-messages:focus .console-item.selected .data-grid tr.selected):
(.console-item .data-grid tr.selected):
DataGrid selection colors while in the console which may or may
not have selected console items.

1:04 PM Changeset in webkit [179492] by roger_fong@apple.com
  • 5 edits in trunk/Source/WebCore

[Win] Build fix following r179482.

  • WebCore.vcxproj/WebCore.vcxproj:
  • WebCore.vcxproj/WebCore.vcxproj.filters:
  • bindings/js/JSBindingsAllInOne.cpp:
  • platform/graphics/GraphicsContext3D.h:
12:54 PM Changeset in webkit [179491] by fpizlo@apple.com
  • 4 edits in trunk

.:
Revert accidental change in r179490.

  • Makefile.shared:

Source/WebKit2:
Revert accidental (and super bad) change in r179490.

  • WebProcess/com.apple.WebProcess.sb.in:
12:52 PM Changeset in webkit [179490] by fpizlo@apple.com
  • 5 edits in trunk

BinarySwitch should be faster on average
​https://bugs.webkit.org/show_bug.cgi?id=141046

Reviewed by Anders Carlsson.

This optimizes our binary switch using math. It's strictly better than what we had before
assuming we bottom out in some case (rather than fall through), assuming all cases get
hit with equal probability. The difference is particularly large for large switch
statements. For example, a switch statement with 1000 cases would previously require on
average 13.207 branches to get to some case, while now it just requires 10.464.

This is also a progression for the fall-through case, though we could shave off another
1/6 branch on average if we wanted to - though it would regress taking a case (not falling
through) by 1/6 branch. I believe it's better to bias the BinarySwitch for not falling
through.

This also adds some randomness to the algorithm to minimize the likelihood of us
generating a switch statement that is always particularly bad for some input. Note that
the randomness has no effect on average-case performance assuming all cases are equally
likely.

This ought to have no actual performance change because we don't rely on binary switches
that much. The main reason why this change is interesting is that I'm finding myself
increasingly relying on BinarySwitch, and I'd like to know that it's optimal.

  • jit/BinarySwitch.cpp:

(JSC::BinarySwitch::BinarySwitch):
(JSC::BinarySwitch::~BinarySwitch):
(JSC::BinarySwitch::build):

  • jit/BinarySwitch.h:
12:50 PM Changeset in webkit [179489] by Chris Dumez
  • 29 edits in trunk/Source

Access MemoryCache singleton using MemoryCache::singleton()
​https://bugs.webkit.org/show_bug.cgi?id=141104

Reviewed by Andreas Kling.

Access MemoryCache singleton using MemoryCache::singleton() static
member function, instead of a free function, as per the recent
coding style discussion on WebKit-dev.

12:40 PM Changeset in webkit [179488] by Alan Bujtas
  • 4 edits in trunk/Source/WebCore

Ambiguous naming: Do not call replacedContentRect()'s return value paint rect.
​https://bugs.webkit.org/show_bug.cgi?id=141125

Reviewed by Simon Fraser.

It's the content box rect with the object-fit adjustment.

No change in functionality.

  • rendering/RenderHTMLCanvas.cpp:

(WebCore::RenderHTMLCanvas::paintReplaced):

  • rendering/RenderImage.cpp:

(WebCore::RenderImage::updateInnerContentRect):
(WebCore::RenderImage::paintReplaced):

  • rendering/RenderReplaced.cpp:

(WebCore::RenderReplaced::replacedContentRect):

  • rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::splitFragmentToFitLine):

12:29 PM Changeset in webkit [179487] by Brent Fulgham
  • 3 edits in trunk/Source/WebCore

[Win] Build fix after r179476.
​https://bugs.webkit.org/show_bug.cgi?id=141026

Reviewed by Anders Carlsson.

MSVC has a compiler bug that forces us to make some explicit statements about how
the passed pointer values are handled.

  • css/CSSParser.cpp:

(WebCore::CSSParser::SourceSize::SourceSize):
(WebCore::CSSParser::sourceSize):

  • css/CSSParser.h:
12:28 PM Changeset in webkit [179486] by fpizlo@apple.com
  • 2 edits in trunk

Unreviewed, revert accidental change to Makefile.shared in r179478

  • Makefile.shared:
12:13 PM Changeset in webkit [179485] by benjamin@webkit.org
  • 2 edits in trunk/Source/WebCore

Get rid of invalidSelectorVector, use Bison's error recovery instead
​https://bugs.webkit.org/show_bug.cgi?id=141147

Reviewed by Darin Adler.

  • css/CSSGrammar.y.in:

Instead of reducing a null selector, we can use a real parsing error
to get out of invalid selector endings.

When that happens, Bison will pop the stack until it can reduce any
valid error recovery rules.

The problem is to make sure there is no floating values because
none of the reduce block between the error and the recovery would
be executed.

In this case, "nth_selector_ending" is a non-recursive production of
the NTHCHILDFUNCTIONS. In turn, NTHCHILDFUNCTIONS are productions
of the non-recursive "pseudo". "pseudo" is only used as a trivial
production of "specifier". "specifier" is only used by "specifier_list".

"specifier_list" has error recovery code -> no production could have
generated a floating values between "specifier_list" and "nth_selector_ending".

12:10 PM Changeset in webkit [179484] by benjamin@webkit.org
  • 1 edit
    8 adds in trunk/LayoutTests

Multiple CSS plus selector not working after checkbox:checked
​https://bugs.webkit.org/show_bug.cgi?id=110594

Reviewed by Darin Adler.

I fixed the bug not so long ago.

This patch adds coverage for :checked since internal states
tend to have tricky update behaviors.

  • fast/selectors/checked-direct-adjacent-style-update-1-expected.txt: Added.
  • fast/selectors/checked-direct-adjacent-style-update-1.html: Added.
  • fast/selectors/checked-direct-adjacent-style-update-2-expected.txt: Added.
  • fast/selectors/checked-direct-adjacent-style-update-2.html: Added.
  • fast/selectors/checked-direct-adjacent-style-update-3-expected.txt: Added.
  • fast/selectors/checked-direct-adjacent-style-update-3.html: Added.
  • fast/selectors/checked-direct-adjacent-style-update-4-expected.txt: Added.
  • fast/selectors/checked-direct-adjacent-style-update-4.html: Added.
12:07 PM Changeset in webkit [179483] by commit-queue@webkit.org
  • 5 edits in trunk/Source

Web Inspector: Extend CSS.getSupportedCSSProperties to provide values for properties for CSS Augmented JSContext
​https://bugs.webkit.org/show_bug.cgi?id=141064

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2015-02-02
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

  • inspector/protocol/CSS.json:

Source/WebInspectorUI:

  • UserInterface/Models/CSSCompletions.js:
  • UserInterface/Models/CSSKeywordCompletions.js:

(WebInspector.CSSKeywordCompletions.addCustomCompletions):
(WebInspector.CSSKeywordCompletions.addPropertyCompletionValues):
If a property is specified with custom values, extend the
keyword completions map to make those values available
in autocompletion.

12:05 PM Changeset in webkit [179482] by roger_fong@apple.com
  • 15 edits in trunk

WebGL2: Implement spec section 3.7.1 Setting and getting state (Part 1).
​https://bugs.webkit.org/show_bug.cgi?id=141096
<rdar://problem/15002469>

Reviewed by Brent Fulgham.

This patch implements the WebGL2 versions of getParameter, getIndexedParameter and isEnabled.
It also removes the WebGL1 implementations from WebGLRenderingContextBase and moves it to WebGLRenderingContext.
I’ve stubbed out most of the parameters for now, some of which will be implemented in Part 2,
and the rest as the our WebGL2 implementation progresses.

  • bindings/js/JSWebGL2RenderingContextCustom.cpp:

(WebCore::toJS):
(WebCore::JSWebGL2RenderingContext::getIndexedParameter):

  • html/canvas/WebGL2RenderingContext.cpp:

(WebCore::WebGL2RenderingContext::getIndexedParameter):
(WebCore::WebGL2RenderingContext::getParameter):
(WebCore::WebGL2RenderingContext::validateCapability):

  • html/canvas/WebGL2RenderingContext.h:
  • html/canvas/WebGL2RenderingContext.idl:
  • html/canvas/WebGLRenderingContext.cpp:

(WebCore::WebGLRenderingContext::getParameter):
(WebCore::WebGLRenderingContext::validateCapability):

  • html/canvas/WebGLRenderingContext.h:
  • html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::getParameter): Deleted.
(WebCore::WebGLRenderingContextBase::validateCapability): Deleted.

  • html/canvas/WebGLRenderingContextBase.h:
  • html/canvas/WebGLRenderingContextBase.idl:
  • platform/graphics/GraphicsContext3D.h:

Two read format parameters were moved from the WebGL2 spec to the WebGL1 spec. Update tests accordingly.

  • fast/canvas/webgl/constants.html:
  • fast/canvas/webgl/webgl-specific-expected.txt:
  • fast/canvas/webgl/webgl-specific.html:
  • webgl/1.0.2/resources/webgl_test_files/conformance/misc/webgl-specific.html:
11:47 AM Changeset in webkit [179481] by dbates@webkit.org
  • 9 edits in trunk

[iOS] ASSERTION FAILED: m_scriptExecutionContext->isContextThread() in ContextDestructionObserver::observeContext
​https://bugs.webkit.org/show_bug.cgi?id=141057
<rdar://problem/19068790>

Reviewed by Alexey Proskuryakov.

Source/JavaScriptCore:

  • inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::receivedIndicateMessage): Modified to call WTF::callOnWebThreadOrDispatchAsyncOnMainThread().
(Inspector::dispatchAsyncOnQueueSafeForAnyDebuggable): Deleted; moved logic to common helper function,
WTF::callOnWebThreadOrDispatchAsyncOnMainThread() so that it can be called from both RemoteInspector::receivedIndicateMessage()
and CryptoKeyRSA::generatePair().

Source/WebCore:

Fixes an issue where we would create-/delete- the RSA crypto keys and dispatch callbacks on the wrong
thread in WebKit1 for iOS. In iOS WebKit1 we should perform such operations on thread WebThread.

This change is covered by existing layout tests.

  • crypto/mac/CryptoKeyRSAMac.cpp:

(WebCore::CryptoKeyRSA::generatePair):

Source/WTF:

  • wtf/MainThread.h:
  • wtf/mac/MainThreadMac.mm:

(WTF::callOnWebThreadOrDispatchAsyncOnMainThread): Added.

LayoutTests:

Un-skip crypto tests. Also, group skip entries for tests crypto/subtle/{rsa-indexeddb, rsa-indexeddb-non-exportable}.html
with other skipped IndexedDB tests.

  • platform/ios-simulator/TestExpectations:
11:40 AM Changeset in webkit [179480] by commit-queue@webkit.org
  • 11 edits in trunk/Source

Prevent crash when accessing WebAVPlayerController.delegate.
​https://bugs.webkit.org/show_bug.cgi?id=140893

Patch by Jeremy Jones <​jeremyj@apple.com> on 2015-02-02
Reviewed by Darin Adler.

Source/WebCore:

This patch aims to prevent a null delegate access during invalidation by adding null checks before accessing the delegate, by making explicit the recreation of m_playerController, and by consolidating and correcting the teardown sequence.

  • WebCore.exp.in:
  • platform/ios/WebVideoFullscreenInterface.h: add resetMediaState()
  • platform/ios/WebVideoFullscreenInterfaceAVKit.h: ditto.
  • platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerController playerViewController:shouldExitFullScreenWithReason:]): Check for null before accessing delegate.
(-[WebAVPlayerController play:]): ditto.
(-[WebAVPlayerController pause:]): ditto.
(-[WebAVPlayerController togglePlayback:]): ditto.
(-[WebAVPlayerController setPlaying:]): ditto.
(-[WebAVPlayerController beginScrubbing:]): ditto.
(-[WebAVPlayerController endScrubbing:]): ditto.
(-[WebAVPlayerController seekToTime:]): ditto.
(-[WebAVPlayerController beginScanningForward:]): ditto.
(-[WebAVPlayerController endScanningForward:]): ditto.
(-[WebAVPlayerController beginScanningBackward:]): ditto.
(-[WebAVPlayerController endScanningBackward:]): ditto.
(-[WebAVPlayerController seekToBeginning:]): ditto.
(-[WebAVPlayerController seekToEnd:]): ditto.
(-[WebAVPlayerController setCurrentAudioMediaSelectionOption:]): ditto.
(-[WebAVPlayerController setCurrentLegibleMediaSelectionOption:]): ditto.
(-[WebAVPlayerController layoutSublayersOfLayer:]): ditto.
(WebVideoFullscreenInterfaceAVKit::WebVideoFullscreenInterfaceAVKit): initialize m_playerController
(WebVideoFullscreenInterfaceAVKit::resetMediaState): Added.
(WebVideoFullscreenInterfaceAVKit::setDuration): remove playerController()
(WebVideoFullscreenInterfaceAVKit::setCurrentTime): ditto.
(WebVideoFullscreenInterfaceAVKit::setRate): ditto.
(WebVideoFullscreenInterfaceAVKit::setVideoDimensions): ditto.
(WebVideoFullscreenInterfaceAVKit::setSeekableRanges): ditto.
(WebVideoFullscreenInterfaceAVKit::setCanPlayFastReverse): ditto.
(WebVideoFullscreenInterfaceAVKit::setAudioMediaSelectionOptions): ditto.
(WebVideoFullscreenInterfaceAVKit::setLegibleMediaSelectionOptions): ditto.
(WebVideoFullscreenInterfaceAVKit::setExternalPlayback): ditto.
(WebVideoFullscreenInterfaceAVKit::setupFullscreenInternal): ditto.
(WebVideoFullscreenInterfaceAVKit::enterFullscreenStandard): ditto.
(WebVideoFullscreenInterfaceAVKit::cleanupFullscreenInternal): consolidated cleanup code from invalidate()
(WebVideoFullscreenInterfaceAVKit::invalidate): consolidate cleanup code.
(WebVideoFullscreenInterfaceAVKit::playerController): Deleted.

  • platform/ios/WebVideoFullscreenModelVideoElement.mm:

(WebVideoFullscreenModelVideoElement::setVideoElement): call resetMediaState()

Source/WebKit2:

Plumb new resetMediaState() through IPC interface WebVideoFullscreenManagerProxy.

  • UIProcess/ios/WebVideoFullscreenManagerProxy.messages.in:
  • UIProcess/ios/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::invalidate): remove redundant set to nullptr.

  • WebProcess/ios/WebVideoFullscreenManager.h:
  • WebProcess/ios/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::resetMediaState):

11:05 AM Changeset in webkit [179479] by saambarati1@gmail.com
  • 7 edits
    8 adds in trunk

Create tests for JSC's Control Flow Profiler
​https://bugs.webkit.org/show_bug.cgi?id=141123

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch creates a control flow profiler testing API in jsc.cpp
that accepts a function and a string as arguments. The string must
be a substring of the text of the function argument. The API returns
a boolean indicating whether or not the basic block that encloses the
substring has executed.

This patch uses this API to test that the control flow profiler
behaves as expected on basic block boundaries. These tests do not
provide full coverage for all JavaScript statements that can create
basic blocks boundaries. Full coverage will come in a later patch.

  • jsc.cpp:

(GlobalObject::finishCreation):
(functionHasBasicBlockExecuted):

  • runtime/ControlFlowProfiler.cpp:

(JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):

  • runtime/ControlFlowProfiler.h:
  • tests/controlFlowProfiler: Added.
  • tests/controlFlowProfiler.yaml: Added.
  • tests/controlFlowProfiler/driver: Added.
  • tests/controlFlowProfiler/driver/driver.js: Added.

(assert):

  • tests/controlFlowProfiler/if-statement.js: Added.

(testIf):
(noMatches):

  • tests/controlFlowProfiler/loop-statements.js: Added.

(forRegular):
(forIn):
(forOf):
(whileLoop):

  • tests/controlFlowProfiler/switch-statements.js: Added.

(testSwitch):

  • tests/controlFlowProfiler/test-jit.js: Added.

(tierUpToBaseline):
(tierUpToDFG):
(baselineTest):
(dfgTest):

Tools:

  • Scripts/run-javascriptcore-tests:

(runJSCStressTests):

  • Scripts/run-jsc-stress-tests:
10:38 AM Changeset in webkit [179478] by fpizlo@apple.com
  • 46 edits
    2 adds
    5 deletes in trunk

Polymorphic call inlining should be based on polymorphic call inline caching rather than logging
​https://bugs.webkit.org/show_bug.cgi?id=140660

Reviewed by Geoffrey Garen.

When we first implemented polymorphic call inlining, we did the profiling based on a call
edge log. The idea was to store each call edge (a tuple of call site and callee) into a
global log that was processed lazily. Processing the log would give precise counts of call
edges, and could be used to drive well-informed inlining decisions - polymorphic or not.
This was a speed-up on throughput tests but a slow-down for latency tests. It was a net win
nonetheless.

Experience with this code shows three things. First, the call edge profiler is buggy and
complex. It would take work to fix the bugs. Second, the call edge profiler incurs lots of
overhead for latency code that we care deeply about. Third, it's not at all clear that
having call edge counts for every possible callee is any better than just having call edge
counts for the limited number of callees that an inline cache would catch.

So, this patch removes the call edge profiler and replaces it with a polymorphic call inline
cache. If we miss the basic call inline cache, we inflate the cache to be a jump to an
out-of-line stub that cases on the previously known callees. If that misses again, then we
rewrite that stub to include the new callee. We do this up to some number of callees. If we
hit the limit then we switch to using a plain virtual call.

Substantial speed-up on V8Spider; undoes the slow-down that the original call edge profiler
caused. Might be a SunSpider speed-up (below 1%), depending on hardware.

Rolling this back in after fixing ​https://bugs.webkit.org/show_bug.cgi?id=141107.

(JSC::CallEdge::count):
(JSC::CallEdge::CallEdge):

  • bytecode/CallEdgeProfile.cpp: Removed.
  • bytecode/CallEdgeProfile.h: Removed.
  • bytecode/CallEdgeProfileInlines.h: Removed.
  • bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::unlink):
(JSC::CallLinkInfo::visitWeak):

  • bytecode/CallLinkInfo.h:
  • bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::CallLinkStatus):
(JSC::CallLinkStatus::computeFor):
(JSC::CallLinkStatus::computeFromCallLinkInfo):
(JSC::CallLinkStatus::isClosureCall):
(JSC::CallLinkStatus::makeClosureCall):
(JSC::CallLinkStatus::dump):
(JSC::CallLinkStatus::computeFromCallEdgeProfile): Deleted.

  • bytecode/CallLinkStatus.h:

(JSC::CallLinkStatus::CallLinkStatus):
(JSC::CallLinkStatus::isSet):
(JSC::CallLinkStatus::variants):
(JSC::CallLinkStatus::size):
(JSC::CallLinkStatus::at):
(JSC::CallLinkStatus::operator[]):
(JSC::CallLinkStatus::canOptimize):
(JSC::CallLinkStatus::edges): Deleted.
(JSC::CallLinkStatus::canTrustCounts): Deleted.

  • bytecode/CallVariant.cpp:

(JSC::variantListWithVariant):
(JSC::despecifiedVariantList):

  • bytecode/CallVariant.h:
  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::linkIncomingPolymorphicCall):
(JSC::CodeBlock::unlinkIncomingCalls):
(JSC::CodeBlock::noticeIncomingCall):

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::isIncomingCallAlreadyLinked): Deleted.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleInlining):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGDriver.cpp:

(JSC::DFG::compileImpl):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):

  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):
(JSC::DFG::TierUpCheckInjectionPhase::removeFTLProfiling): Deleted.

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • heap/Heap.cpp:

(JSC::Heap::collect):

  • jit/BinarySwitch.h:
  • jit/ClosureCallStubRoutine.cpp: Removed.
  • jit/ClosureCallStubRoutine.h: Removed.
  • jit/JITCall.cpp:

(JSC::JIT::compileOpCall):

  • jit/JITCall32_64.cpp:

(JSC::JIT::compileOpCall):

  • jit/JITOperations.cpp:
  • jit/JITOperations.h:

(JSC::operationLinkPolymorphicCallFor):
(JSC::operationLinkClosureCallFor): Deleted.

  • jit/JITStubRoutine.h:
  • jit/JITWriteBarrier.h:
  • jit/PolymorphicCallStubRoutine.cpp: Added.

(JSC::PolymorphicCallNode::~PolymorphicCallNode):
(JSC::PolymorphicCallNode::unlink):
(JSC::PolymorphicCallCase::dump):
(JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
(JSC::PolymorphicCallStubRoutine::~PolymorphicCallStubRoutine):
(JSC::PolymorphicCallStubRoutine::variants):
(JSC::PolymorphicCallStubRoutine::edges):
(JSC::PolymorphicCallStubRoutine::visitWeak):
(JSC::PolymorphicCallStubRoutine::markRequiredObjectsInternal):

  • jit/PolymorphicCallStubRoutine.h: Added.

(JSC::PolymorphicCallNode::PolymorphicCallNode):
(JSC::PolymorphicCallCase::PolymorphicCallCase):
(JSC::PolymorphicCallCase::variant):
(JSC::PolymorphicCallCase::codeBlock):

  • jit/Repatch.cpp:

(JSC::linkSlowFor):
(JSC::linkFor):
(JSC::revertCall):
(JSC::unlinkFor):
(JSC::linkVirtualFor):
(JSC::linkPolymorphicCall):
(JSC::linkClosureCall): Deleted.

  • jit/Repatch.h:
  • jit/ThunkGenerators.cpp:

(JSC::linkPolymorphicCallForThunkGenerator):
(JSC::linkPolymorphicCallThunkGenerator):
(JSC::linkPolymorphicCallThatPreservesRegsThunkGenerator):
(JSC::linkClosureCallForThunkGenerator): Deleted.
(JSC::linkClosureCallThunkGenerator): Deleted.
(JSC::linkClosureCallThatPreservesRegsThunkGenerator): Deleted.

  • jit/ThunkGenerators.h:

(JSC::linkPolymorphicCallThunkGeneratorFor):
(JSC::linkClosureCallThunkGeneratorFor): Deleted.

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):

  • runtime/Options.h:
  • runtime/VM.cpp:

(JSC::VM::prepareToDiscardCode):
(JSC::VM::ensureCallEdgeLog): Deleted.

  • runtime/VM.h:
10:15 AM Changeset in webkit [179477] by fpizlo@apple.com
  • 4 edits
    1 add in trunk/Source/JavaScriptCore

Converting Flushes and PhantomLocals to Phantoms requires an OSR availability analysis rather than just using the SetLocal's child
​https://bugs.webkit.org/show_bug.cgi?id=141107

Reviewed by Michael Saboff.

See the bugzilla for a discussion of the problem. This addresses the problem by ensuring
that Flushes are always strength-reduced to PhantomLocals, and CPS rethreading does a mini
OSR availability analysis to determine the right MovHint value to use for the Phantom.

  • dfg/DFGCPSRethreadingPhase.cpp:

(JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
(JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
(JSC::DFG::CPSRethreadingPhase::clearVariables):
(JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
(JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
(JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail): Deleted.

  • dfg/DFGNode.h:

(JSC::DFG::Node::convertPhantomToPhantomLocal):
(JSC::DFG::Node::convertFlushToPhantomLocal):
(JSC::DFG::Node::convertToPhantomLocal): Deleted.

  • dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

  • tests/stress/inline-call-that-doesnt-use-all-args.js: Added.

(foo):
(bar):
(baz):

10:12 AM Changeset in webkit [179476] by Darin Adler
  • 11 edits in trunk/Source/WebCore

REGRESSION (r170576): Storage leaks in parsing of CSS image sizes
​https://bugs.webkit.org/show_bug.cgi?id=141026

Reviewed by Anders Carlsson.

  • css/CSSGrammar.y.in: Fixed all the shift/reduce conflicts caused

by the ENABLE_PICTURE_SIZES code by removing all the redundant
maybe_space which caused them. Rearranged the productions for
ENABLE_PICTURE_SIZES to tighten up the code quite a bit. Changed
the code to build up the source size vector as a Vector instead of
a special class, and use the SourceSize struct from inside the
CSSParser class.'

  • css/CSSParser.cpp:

(WebCore::CSSParser::setupParser): Changed this to take a StringView.
In the future we can change all the parsing functions to take StringView,
since they don't work with the String in place.
(WebCore::CSSParser::parseSizesAttribute): Changed to return a vector
of SourceSize instead of a SourceSizeList. This is better because it's
a real CSS data structure that does not contain a CSSParserValue.
(WebCore::CSSParser::sourceSize): Added. Helper that creates a
SourceSize, mapping parser data structures into real CSS ones.

  • css/CSSParser.h: Updated for changes above.
  • css/MediaQuery.cpp:

(WebCore::MediaQuery::MediaQuery): Use std::make_unique and the copy
constructor directly instead of using a MediaQuery::copy function.

  • css/MediaQueryExp.cpp: Streamlined the class a little bit.
  • css/MediaQueryExp.h: Removed unneeded includes. Moved functions out

of the class body so the class is easier to read. Removed the unneeded
copy function.

  • css/SourceSizeList.cpp:

(WebCore::SourceSize::match): Changed to use WTF::move instead
of releasing and then re-creating the unique_ptr.
(WebCore::computeLength): Added a comment to explain this function
is using an incorrect strategy. Also added some type checking code
to handle cases where a null or non-primitive CSS value might be
returned. Probably dead code, but we don't want to risk a bad cast.
Worthe cleaning up when we fix the strategy.
(WebCore::SourceSizeList::getEffectiveSize): Updated since the
vector now contains actual SourceSize objects rather than pointers
to SourceSize objects on the heap.

  • css/SourceSizeList.h: Changed the CSSParserValue argument to be

an rvalue reference to make it clearer that we take ownership of it
when it's moved in. Added a move constructor and a destructor. Added
comments explaining that it's not correct design to use a
CSSParserValue here, outside the parser. Changed SourceSizeList's
append function to move a SourceSize in rather than a unique_ptr.
Made getEffectiveSize private. Moved the various inline functions to
the bottom of the file to make the class definitions easier to read.

  • css/SourceSizeList.cpp: Made almost everything about this private

to this source file instead of public in the header.
(WebCore::match): Made this a free function instead of a member function
and made it take the media query expression as an argument.
(WebCore::computeLength): Changed the argument type to CSSValue*,
rather than using CSSParserValue here outside the parser.
(WebCore::parseSizesAttribute): Streamlined and simplified this.
Now that the parser builds the list in the correct order, there was
no need to iterate backwards any more so we could use a modern for
loop.

  • css/SourceSizeList.h: Removed almost everything in this header.
  • html/HTMLImageElement.cpp:

(WebCore::HTMLImageElement::parseAttribute): Call the
parseSizesAttribute function as free function since it's no longer
a member of a SourceSizeList class.

  • html/parser/HTMLPreloadScanner.cpp:

(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
Ditto.

9:06 AM Changeset in webkit [179475] by Csaba Osztrogonác
  • 2 edits in trunk/Tools

Remove copy/paste code from run-jsc-stress-tests to determine numberOfTests
​https://bugs.webkit.org/show_bug.cgi?id=141158

Reviewed by Darin Adler.

  • Scripts/run-jsc-stress-tests:
12:48 AM Changeset in webkit [179474] by commit-queue@webkit.org
  • 2 edits in trunk/Tools

[GTK] MiniBrowser should close itself on Ctrl+W or Ctrl+Q
​https://bugs.webkit.org/show_bug.cgi?id=141142

Patch by Michael Catanzaro <Michael Catanzaro> on 2015-02-02
Reviewed by Carlos Garcia Campos.

  • MiniBrowser/gtk/BrowserWindow.c:

(browser_window_init): Quit on Ctrl+W or Ctrl+Q

12:27 AM Changeset in webkit [179473] by Darin Adler
  • 6 edits in trunk/Source/WebCore

Fix some leaks found by the leak bot
​https://bugs.webkit.org/show_bug.cgi?id=141149

Reviewed by Alexey Proskuryakov.

  • bindings/js/JSSubtleCryptoCustom.cpp:

(WebCore::importKey): Changed argument types to std::unique_ptr for better code clarity.
(WebCore::JSSubtleCrypto::importKey): Use WTF::move instead of release.
(WebCore::JSSubtleCrypto::wrapKey): Fixed leaks by adding missing delete calls to the
case where we get a DOM exception.
(WebCore::JSSubtleCrypto::unwrapKey): Ditto.

  • dom/SelectorQuery.cpp:

(WebCore::SelectorQuery::SelectorQuery): Use WTF::move here. Not clear how this could
have caused the storage leak, but it does seem obviously missing. The leak is pretty big,
implying that we leak almost all CSSSelectorList objects we parse; not sure this fixes it.

  • loader/WorkerThreadableLoader.cpp:

(WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse): Added code to
deleted the unguarded pointer if postTaskForModeToWorkerGlobalScope fails.
(WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData): Ditto.
(WebCore::WorkerThreadableLoader::MainThreadBridge::didFail): Ditto.
(WebCore::WorkerThreadableLoader::MainThreadBridge::didFailAccessControlCheck): Ditto.

  • platform/graphics/avfoundation/MediaSelectionGroupAVFObjC.mm:

(WebCore::MediaSelectionGroupAVFObjC::updateOptions): Added missing adoptNS.

  • platform/graphics/mac/GraphicsContextMac.mm:

(WebCore::GraphicsContext::updateDocumentMarkerResources): Added missing release.

Feb 1, 2015:

4:49 PM Changeset in webkit [179472] by Chris Dumez
  • 26 edits in trunk/Source

Use more references in HistoryItem
​https://bugs.webkit.org/show_bug.cgi?id=141133

Reviewed by Andreas Kling.

Use more references in HistoryItem instead of pointers.
Source/WebKit2:

  • WebProcess/InjectedBundle/InjectedBundleBackForwardListItem.cpp:

(WebKit::InjectedBundleBackForwardListItem::children):

  • WebProcess/WebCoreSupport/SessionStateConversion.cpp:

(WebKit::toFrameState):
(WebKit::applyFrameState):

  • WebProcess/WebPage/WebBackForwardListProxy.cpp:

(WebKit::WebBackForwardListProxy::addItem):

  • WebProcess/WebPage/WebBackForwardListProxy.h:
3:47 PM Changeset in webkit [179471] by commit-queue@webkit.org
  • 7 edits
    12 adds
    2 deletes in trunk

Unreviewed, rolling out r179467 and r179470.
​https://bugs.webkit.org/show_bug.cgi?id=141144

Broke svg/custom/use-events-crash.svg (Requested by ap on
#webkit).

Reverted changesets:

"Stop dispatching events with SVGElementInstance objects as
their targets"
​https://bugs.webkit.org/show_bug.cgi?id=141108
​http://trac.webkit.org/changeset/179467

"REGRESSION(r179467): svg/custom/use-events-crash.svg times
out"
​http://trac.webkit.org/changeset/179470

2:05 PM Changeset in webkit [179470] by ap@apple.com
  • 2 edits in trunk/LayoutTests

REGRESSION(r179467): svg/custom/use-events-crash.svg times out

Looks like the new test (svg/custom/use-event-retargeting.html) somehow breaks
subsequent one, let's try skipping it for now.

1:23 PM Changeset in webkit [179469] by youenn.fablet@crf.canon.fr
  • 2 edits in trunk/Tools

Web platform test server is not always launching properly on Mac EWS bots
​https://bugs.webkit.org/show_bug.cgi?id=141141

Unreviewed.

  • Scripts/webkitpy/layout_tests/servers/web_platform_test_launcher.py:

(create_wpt_empty_file_if_needed): Removed creation of empty init.py files from AutoInstalled modules.

10:42 AM Changeset in webkit [179468] by mitz@apple.com
  • 3 edits in trunk/Source/WebKit2

Remove ViewGestureController tracing
​https://bugs.webkit.org/show_bug.cgi?id=141137

Reviewed by Tim Horton.

Remove the tracing added in r176133, now that ​http://webkit.org/b/138750 is fixed.

  • UIProcess/ios/ViewGestureControllerIOS.mm:

(WebKit::ViewGestureController::beginSwipeGesture):
(WebKit::ViewGestureController::endSwipeGesture):
(WebKit::ViewGestureController::willCommitPostSwipeTransitionLayerTree):
(WebKit::ViewGestureController::removeSwipeSnapshot):
(WebKit::addLogEntry): Deleted.
(WebKit::dumpLogEntries): Deleted.

  • UIProcess/mac/ViewGestureController.h:
7:22 AM Changeset in webkit [179467] by Darin Adler
  • 6 edits
    2 adds
    12 deletes in trunk

Source/WebCore:
Stop dispatching events to with SVGElementInstance objects as their targets
​https://bugs.webkit.org/show_bug.cgi?id=141108

Reviewed by Anders Carlsson.

Test: svg/custom/use-event-retargeting.html

  • dom/EventDispatcher.cpp:

(WebCore::eventTargetRespectingTargetRules): Replaced the code that retargeted
events at SVGElementInstance objects with code that retargets them at the use
element instead. Also wrote the code in a simpler way.

LayoutTests:
Stop dispatching events with SVGElementInstance objects as their targets
​https://bugs.webkit.org/show_bug.cgi?id=141108

Reviewed by Anders Carlsson.

Many tests are no longer relevant once we aren't doing this any more.

  • platform/gtk/svg/custom/use-instanceRoot-event-bubbling-expected.png: Removed.
  • platform/gtk/svg/custom/use-instanceRoot-modifications-expected.png: Removed.
  • platform/gtk/svg/custom/use-instanceRoot-modifications-expected.txt: Removed.
  • platform/ios-sim-deprecated/svg/custom/use-instanceRoot-modifications-expected.txt: Removed.
  • platform/ios-simulator/svg/custom/use-instanceRoot-modifications-expected.txt: Removed.
  • platform/mac-mountainlion/svg/custom/use-instanceRoot-modifications-expected.txt: Removed.
  • platform/mac/svg/custom/use-instanceRoot-event-bubbling-expected.png: Removed.
  • platform/mac/svg/custom/use-instanceRoot-modifications-expected.png: Removed.
  • platform/mac/svg/custom/use-instanceRoot-modifications-expected.txt: Removed.
  • svg/custom/use-instanceRoot-modifications.svg: Removed.
  • svg/custom/use-instanceRoot-with-use-removed-expected.txt: Removed.
  • svg/custom/use-instanceRoot-with-use-removed.svg: Removed.
  • svg/custom/resources/use-instanceRoot-event-bubbling.js: Updated this test to expect

the events to be dispatched with the SVGUseElement as the target. I talked this over with
Sam Weinig and we decided this is good behavior for now, and it almost matches what the
spec says. Might be worth refining later.

  • svg/custom/use-instanceRoot-event-bubbling-expected.txt: Updated expected results.
  • svg/custom/use-instanceRoot-event-bubbling.xhtml: Tweaked the test a little. It still

could use improvement; it's like half a "repaint test", which is strange.

  • svg/custom/use-event-retargeting-expected.txt: Added. Got this test from Blink.
  • svg/custom/use-event-retargeting.html: Added. Ditto.
6:53 AM Changeset in webkit [179466] by gyuyoung.kim@samsung.com
  • 2 edits in trunk/LayoutTests

Unreviewd EFL gardening. Add new failing tests related to W3C SVG 1.1.

  • platform/efl/TestExpectations:
5:02 AM Changeset in webkit [179465] by gyuyoung.kim@samsung.com
  • 2 edits in trunk/LayoutTests

Unreviewed EFL gardening. Update crash tests related to webgl because
webgl isn't supported by EFL port at the moment.

  • platform/efl/TestExpectations:
4:22 AM Changeset in webkit [179464] by gyuyoung.kim@samsung.com
  • 2 edits in trunk/LayoutTests

Unreviewed EFL gardening. Update tests which don't have expectation result yet.

  • platform/efl/TestExpectations:
2:25 AM Changeset in webkit [179463] by zandobersek@gmail.com
  • 2 edits in trunk/Source/WebCore

[TexMap] Optimize TextureMapperLayer::removeAllChildren()
​https://bugs.webkit.org/show_bug.cgi?id=140734

Reviewed by Chris Dumez.

Instead of removing the children from the Vector member one by one,
move the Vector out and iterate through the ex-children, clearing
out the pointer to the parent.

  • platform/graphics/texmap/TextureMapperLayer.cpp:

(WebCore::TextureMapperLayer::removeAllChildren):

2:17 AM Changeset in webkit [179462] by zandobersek@gmail.com
  • 3 edits in trunk/Source/WebCore

[TexMap] Avoid unnecessary TransformationMatrix copies in GraphicsLayerTransform
​https://bugs.webkit.org/show_bug.cgi?id=140735

Reviewed by Chris Dumez.

  • platform/graphics/GraphicsLayerTransform.cpp:

(WebCore::GraphicsLayerTransform::combined): Return a const reference to the matrix.
(WebCore::GraphicsLayerTransform::combinedForChildren): Ditto.
(WebCore::GraphicsLayerTransform::combineTransforms): First copy the parent transform,
then apply the translation and multiplication. Previously this copied the parent
transform into a temporary object, performed the translation and multiplication, and
copied that temporary object again when assigning to the member variable.
(WebCore::GraphicsLayerTransform::combineTransformsForChildren): Mark const. m_childrenDirty
and m_combinedForChildren members are marked mutable.

  • platform/graphics/GraphicsLayerTransform.h:
Note: See TracTimeline for information about the timeline view.