Timeline

Jul 17, 2015:

11:32 PM Changeset in webkit [186987] by commit-queue@webkit.org

• 2 edits in trunk

Bring back the GNU ar check to create thin archives on non-Linux systems
​https://bugs.webkit.org/show_bug.cgi?id=146681

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2015-07-17
Reviewed by Martin Robinson.

We already use GNU ar thin archive feature to save time and disk space
on creating static archives, but it is only enabled on Linux. Without
this feature, the debug build of WebCore can be larger than 4 GiB,
which can cause error because GNU ar format uses 32-bit integer to
store offsets in the symbol table. This patch is similar to
​https://bugs.webkit.org/show_bug.cgi?id=128596.

• Source/cmake/OptionsCommon.cmake:

10:51 PM Changeset in webkit [186986] by fpizlo@apple.com

• 5 edits in trunk/Source/JavaScriptCore

DFG should have some obvious mitigations against watching structures that are unprofitable to watch
​https://bugs.webkit.org/show_bug.cgi?id=147034

Reviewed by Mark Lam and Michael Saboff.

This implements two guards against the DFG watching structures that are likely to fire
their watchpoints:

• Don't watch dictionaries or any structure that had a dictionary in its past. Dictionaries can be flattened, and then they can transform back to dictionaries.

• Don't watch structures whose past structures were transitioned-away from while their transition watchpoints were being watched. This property gives us monotonicity: if we recompile because we watched structure S1 of object O, then we won't make the same mistake again when object O has structure S2, S3, and so on.

This is a 1.5% speed-up on Kraken. It does penalize some Octane tests, but it also seems to
help some of them, so on Octane it's basically neutral.

• bytecode/Watchpoint.h:

(JSC::WatchpointSet::invalidate):
(JSC::WatchpointSet::isBeingWatched):
(JSC::WatchpointSet::addressOfState):
(JSC::WatchpointSet::addressOfSetIsNotEmpty):
(JSC::InlineWatchpointSet::touch):
(JSC::InlineWatchpointSet::isBeingWatched):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::createStructure):
(JSC::JSGlobalObject::registerWeakMap):

• runtime/Structure.cpp:

(JSC::Structure::Structure):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::didTransitionFromThisStructure):

• runtime/Structure.h:

10:49 PM Changeset in webkit [186985] by fpizlo@apple.com

• 8 edits
  2 deletes in trunk/Source/JavaScriptCore

Remove DFG::DesiredWriteBarriers because it's just a very difficult way of saying "please barrier the machine code block owner"
​https://bugs.webkit.org/show_bug.cgi?id=147030

Reviewed by Andreas Kling.

All of the users of DesiredWriteBarriers were just using it to request that Plan
finalization executes a barrier on codeBlock->ownerExecutable. Indeed, that's the only
owning cell in the heap that compilation affects. So, we might as well just have Plan
unconditionally execute that barrier and then we don't need DesiredWriteBarriers at
all.

• CMakeLists.txt:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
• JavaScriptCore.xcodeproj/project.pbxproj:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

• dfg/DFGDesiredWriteBarriers.cpp: Removed.
• dfg/DFGDesiredWriteBarriers.h: Removed.
• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::registerFrozenValues):

• dfg/DFGPlan.cpp:

(JSC::DFG::Plan::reallyAdd):
(JSC::DFG::Plan::notifyCompiling):
(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):

• dfg/DFGPlan.h:

10:20 PM Changeset in webkit [186984] by Alan Bujtas

• 3 edits
  2 adds in trunk

REGRESSION (r169105): Do not assign a renderer to multiple selection subtrees.
​https://bugs.webkit.org/show_bug.cgi?id=147038
rdar://problem/21819351

Reviewed by David Kilzer.

A renderer should never be assigned to multiple selection subtrees. (Currently RenderObject maintains the last selection state.)
RenderView::applySubtreeSelection() loops from the start to the end of the selection to find renderers that are inside the selection.
However, in case of regions (when multiple selection roots are present) traversing the renderer tree by calling RenderObject::nextInPreOrder() could
end up going across selection roots.
This patch ensures that we assign renderers to a specific selection only when the current selection root and the renderer's selection root match.

Source/WebCore:

Test: fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2.html

• rendering/RenderView.cpp:

(WebCore::SelectionIterator::SelectionIterator):
(WebCore::SelectionIterator::current):
(WebCore::SelectionIterator::checkForSpanner):
(WebCore::RenderView::applySubtreeSelection):

LayoutTests:

• fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2-expected.txt: Added.
• fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2.html: Added.

9:44 PM Changeset in webkit [186983] by aestes@apple.com

• 12 edits
  17 adds in branches/safari-600.1.4.17-branch

Merge r186982. rdar://problem/21709404

8:47 PM Changeset in webkit [186982] by aestes@apple.com

• 12 edits
  17 adds in trunk

[iOS] Further tighten the sandbox around pages fetched with Content-Disposition: attachment
​https://bugs.webkit.org/show_bug.cgi?id=147044
rdar://problem/21567820

Reviewed by Brady Eidson.

Source/WebCore:

In addition to placing resources fetched with 'Content-Disposition: attachment' in a unique origin,
this change does the following:

• Switches the sandbox type from SandboxOrigin to SandboxAll, which enforces the same restrictions as <iframe sandbox>.
• Disables processing of <meta http-equiv> elements.
• Disables loading of cross-origin subframes.

Tests: http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled.html

http/tests/contentdispositionattachmentsandbox/form-submission-disabled.html
http/tests/contentdispositionattachmentsandbox/http-equiv-disabled.html
http/tests/contentdispositionattachmentsandbox/plugins-disabled.html
http/tests/contentdispositionattachmentsandbox/scripts-disabled.html

• dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Switched to calling Document::httpEquivPolicy(). Logged an error to the console for policies other than Enabled.
(WebCore::Document::initSecurityContext): Switched sandbox enforcement from SandboxOrigin to SandboxAll.
(WebCore::Document::httpEquivPolicy): Returned a HttpEquivPolicy based on shouldEnforceContentDispositionAttachmentSandbox() and Settings::httpEquivEnabled().
(WebCore::Document::shouldEnforceContentDispositionAttachmentSandbox): Returned true if Settings::contentDispositionAttachmentSandboxEnabled()
and the document was fetched as an attachment.

• dom/Document.h:
• loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::canRequest): When requesting a subframe main resource when the parent frame enforces an attachment sandbox,
only continue if the parent frame's SecurityOrigin allows the request.

• page/Settings.in: Added contentDispositionAttachmentSandboxEnabled with an initial value of false.

Source/WebKit/mac:

• WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]): Enabled Content-Disposition: attachment sandbox on iOS.

Source/WebKit2:

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage): Enabled Content-Disposition: attachment sandbox on iOS.

Tools:

• WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::InjectedBundlePage::decidePolicyForResponse): Only log the message about attachments if the custom policy delegate is enabled.
This matches the behavior of DumpRenderTree.

LayoutTests:

• http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled-expected.txt: Added.
• http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled.html: Added.
• http/tests/contentdispositionattachmentsandbox/form-submission-disabled-expected.txt: Added.
• http/tests/contentdispositionattachmentsandbox/form-submission-disabled.html: Added.
• http/tests/contentdispositionattachmentsandbox/http-equiv-disabled-expected.txt: Added.
• http/tests/contentdispositionattachmentsandbox/http-equiv-disabled.html: Added.
• http/tests/contentdispositionattachmentsandbox/plugins-disabled-expected.html: Added.
• http/tests/contentdispositionattachmentsandbox/plugins-disabled.html: Added.
• http/tests/contentdispositionattachmentsandbox/resources/cross-origin-frames-frame.php: Added.
• http/tests/contentdispositionattachmentsandbox/resources/form-submission-frame.php: Added.
• http/tests/contentdispositionattachmentsandbox/resources/http-equiv-frame.php: Added.
• http/tests/contentdispositionattachmentsandbox/resources/plugins-frame.php: Added.
• http/tests/contentdispositionattachmentsandbox/resources/scripts-frame.php: Added.
• http/tests/contentdispositionattachmentsandbox/scripts-disabled-expected.txt: Added.
• http/tests/contentdispositionattachmentsandbox/scripts-disabled.html: Added.

8:46 PM Changeset in webkit [186981] by Alan Bujtas

• 3 edits
  2 adds in trunk

(display: block)input range's thumb disappears when moved.
​https://bugs.webkit.org/show_bug.cgi?id=146896
<rdar://problem/21787807>

Reviewed by Simon Fraser.

Since the thumb is positioned after the layout for the input (shadow) subtree is finished, the repaint rects
issued during the layout will not cover the re-positioned thumb.
We need to issue a repaint soon after the thumb is re-positioned.

Source/WebCore:

Test: fast/repaint/block-inputrange-repaint.html

• html/shadow/SliderThumbElement.cpp:

(WebCore::RenderSliderContainer::layout):

LayoutTests:

• fast/repaint/block-inputrange-repaint-expected.txt: Added.
• fast/repaint/block-inputrange-repaint.html: Added.

8:16 PM Changeset in webkit [186980] by Simon Fraser

• 3 edits in trunk/Source/WebCore

Attempt to fix the build.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::webkitCurrentPlaybackTargetIsWireless):

• html/HTMLMediaElement.h:

5:30 PM Changeset in webkit [186979] by dino@apple.com

• 3 edits in trunk/Source/WebCore

Picture in Picture interacts poorly with AirPlay/HDMI
​https://bugs.webkit.org/show_bug.cgi?id=147061
<rdar://problem/19192076>

Reviewed by Tim Horton.

When we are actively playing to an external target, the
picture in picture button should be hidden.

Also, the availability of picture in picture is also
dependent on AirPlay, so that we don't auto-pip when
we're displaying on a TV.

• Modules/mediacontrols/mediaControlsiOS.js:

(ControllerIOS.prototype.configureInlineControls): Call the update function.
(ControllerIOS.prototype.updatePictureInPictureButton): Add or remove a hidden class.

• html/MediaElementSession.cpp:

(WebCore::MediaElementSession::allowsPictureInPicture): Check Airplay status.

5:20 PM Changeset in webkit [186978] by timothy_horton@apple.com

• 6 edits in trunk/Source

[iOS] TextIndicator has a large forehead when line-height > 1
​https://bugs.webkit.org/show_bug.cgi?id=147058
<rdar://problem/21643094>

Reviewed by Dean Jackson.

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::getClippedVisibleTextRectangles):

• editing/FrameSelection.h:

Add a parameter controlling whether getClippedVisibleTextRectangles
returns selection-height rects (including extra line-height) or text-height
rects (including only the text height). Plumb it down.

• page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange):
(WebCore::TextIndicator::createWithSelectionInFrame):
Use the tighter text-height rects on iOS, where there's no selection highlight to cover up.
Remove an assertion that is no longer always true, and which is mostly obsoleted by the
fact that we don't let FrameSnapshotting code arbitrarily decide the rect to snapshot anymore.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):
Apply a review comment that I left myself and then forgot about.

4:59 PM Changeset in webkit [186977] by enrica@apple.com

• 2 edits in trunk/Source/WebKit2

[iOS] Implement selectionInteractionAssistant accessor.
​https://bugs.webkit.org/show_bug.cgi?id=147054
rdar://problem/20864286

Reviewed by Tim Horton.

One more change to adopt the new selection interaction
model on iOS.

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView selectionInteractionAssistant]):

4:55 PM Changeset in webkit [186976] by timothy_horton@apple.com

• 9 edits in trunk

Improve rect shrink-wrapping algorithm
​https://bugs.webkit.org/show_bug.cgi?id=147037
<rdar://problem/21643094>

Reviewed by Simon Fraser.

• platform/graphics/FloatPoint.h:

(WebCore::areEssentiallyEqual):
Added; implementation is the same as FloatSize's.

• platform/graphics/PathUtilities.cpp:

(WebCore::FloatPointGraph::FloatPointGraph):
(WebCore::FloatPointGraph::~FloatPointGraph):
(WebCore::FloatPointGraph::Node::Node):
(WebCore::FloatPointGraph::Node::nextPoints):
(WebCore::FloatPointGraph::Node::addNextPoint):
(WebCore::FloatPointGraph::Node::isVisited):
(WebCore::FloatPointGraph::Node::visit):
(WebCore::FloatPointGraph::Node::reset):
(WebCore::FloatPointGraph::reset):
(WebCore::FloatPointGraph::findOrCreateNode):
(WebCore::findLineSegmentIntersection):
(WebCore::addIntersectionPoints):
(WebCore::walkGraphAndExtractPolygon):
(WebCore::findUnvisitedPolygonStartPoint):
(WebCore::unitePolygons):
(WebCore::edgesForRect):
(WebCore::PathUtilities::pathWithShrinkWrappedRects):
(WebCore::addShrinkWrapRightCorner): Deleted.
(WebCore::addShrinkWrapLeftCorner): Deleted.
(WebCore::addShrinkWrappedPathForRects): Deleted.
(WebCore::rectsIntersectOrTouch): Deleted.
(WebCore::findSetContainingRect): Deleted.
Add a new implementation of shrink-wrap, which is significantly more
generic than the old one, which assumed a top-down progression of rects.

This version uses polygon intersection to find the path around the
set of rects, and then follows said path and adds appropriately-sized
arcs for the corners.

The polygon intersection algorithm first finds all the intersection points
between all of the rects, then builds a graph of edges outward from one point.
It then traverses the graph, choosing at each point the next edge which
has not been visited and has the greatest interior angle, recording the polygon as it goes.

If at the end of the traversal we have not returned to the initial node,
we give up on shrink-wrapping and just use a bounding box around the rects.

If any of the original rects have not been visited at all, we repeat the traversal
starting with that rect, making an additional polygon (since we removed completely contained
rects before we started, having not visited the rect at all means that it's not connected
to the others).

Once we have a set of united polygons, we follow each one, determining the ideal (always
equal in width and height, never more than half the length of either edge, so that we always
have a smooth curve) arc radius and projecting it onto the edge, and then
adding an arc between the end of the previous path and beginning of the next.

Because the shrink-wrap algorithm is fairly expensive, if there are more than 20 rects,
we fall back to a bounding box. Given the current use cases, this is more than enough
rects, but can certainly be adjusted in the future if needed.

• testing/Internals.cpp:

(WebCore::Internals::pathWithShrinkWrappedRects):

• testing/Internals.h:
• testing/Internals.idl:

Add a radius parameter.

• fast/shrink-wrap/rect-shrink-wrap-expected.png:
• fast/shrink-wrap/rect-shrink-wrap.html:

Add a radius parameter to testRects, defaulting to 8.

Add an offset parameter to testRects, making it easier to slide
the rect sets around.

Add some more test cases.

4:47 PM Changeset in webkit [186975] by bshafiei@apple.com

• 1 copy in tags/Safari-601.1.41

New tag.

4:32 PM Changeset in webkit [186974] by commit-queue@webkit.org

• 3 edits
  2 adds in trunk

AX: iframe within table cell is inaccessible to VoiceOver
​https://bugs.webkit.org/show_bug.cgi?id=147001
<rdar://problem/21106945>

Patch by Nan Wang <​n_wang@apple.com> on 2015-07-17
Reviewed by Chris Fleizach.

Source/WebCore:

When a table cell is created before its parent table determines if it should be ignored or not,
the table cell may cache the wrong role. Fix that by allowing each table cell to update its role
after the table makes this determination.

Test: accessibility/iframe-within-cell.html

• accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::addChildren):
(WebCore::AccessibilityTable::addChildrenFromSection):

LayoutTests:

• accessibility/iframe-within-cell-expected.txt: Added.
• accessibility/iframe-within-cell.html: Added.

4:32 PM Changeset in webkit [186973] by bshafiei@apple.com

• 5 edits in branches/safari-601.1-branch/Source

Versioning.

4:26 PM Changeset in webkit [186972] by bshafiei@apple.com

• 5 edits in branches/safari-600.8-branch/Source

Versioning.

4:26 PM Changeset in webkit [186971] by mmaxfield@apple.com

• 3 edits
  2 adds in trunk

style.fontFamily accessor crashes on unstyled node created from DOMParser().parseFromString()
​https://bugs.webkit.org/show_bug.cgi?id=147026
<rdar://problem/21864487>

Reviewed by Andreas Kling.

Source/WebCore:

Font CSS properties are a little special because they are used as indices into caches.
Normally, StyleResolver gives all nodes a default font family, so our cache works correctly.
However, if the document doesn't have a Settings object, StyleResolver wasn't doing this.
Documents created from DOMParser().parseFromString() don't have a Settings object.

Test: fast/text/crash-font-family-parsed.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::initializeFontStyle): Set a font family even if we don't have a
Settings object.

LayoutTests:

• fast/text/crash-font-family-parsed-expected.txt: Added.
• fast/text/crash-font-family-parsed.html: Added.

4:18 PM Changeset in webkit [186970] by Yusuke Suzuki

• 2 edits
  1 move in trunk/LayoutTests

Unreviewed, rename test file from promise-resolve-non-dom.js to promise-resolve-in-non-dom.js
​https://bugs.webkit.org/show_bug.cgi?id=146828

This is the simple follow up patch.
When executing the JSC stress tests, script-tests's file name and the expectation file name should be equal.

• js/promise-resolve-in-non-dom.html:
• js/script-tests/promise-resolve-in-non-dom.js: Renamed from LayoutTests/js/script-tests/promise-resolve-non-dom.js.

(value.then):

• js/script-tests/promise-resolve-non-dom.js:

(value.then): Deleted.

4:05 PM Changeset in webkit [186969] by mitz@apple.com

• 2 edits in trunk/Source/WebKit2

REGRESSION (r186964): Crash in WebKit2.CloseFromWithinCreatePage
​https://bugs.webkit.org/show_bug.cgi?id=147055

Reviewed by Alex Christensen.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::createNewPage): Grab the main frame’s URL before calling out to the
client, who may destroy the frame.

4:01 PM Changeset in webkit [186968] by mmaxfield@apple.com

• 3 edits
  2 adds in trunk

Video posters disappear once media has loaded
​https://bugs.webkit.org/show_bug.cgi?id=147045

Reviewed by Simon Fraser.

Source/WebCore:

After r184932, all video elements are composited. However, there is logic in
RenderLayerBacking::updateConfiguration() which adds the video layer to the page
if the video is composited, without checking first to see if it should actually
do so.

Test: compositing/video/poster.html

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateConfiguration):

LayoutTests:

• compositing/video/poster-expected.html: Added.
• compositing/video/poster.html: Added.

3:54 PM Changeset in webkit [186967] by bshafiei@apple.com

• 1 copy in tags/Safari-600.8.4

New tag.

3:40 PM Changeset in webkit [186966] by Yusuke Suzuki

• 11 edits
  6 adds in trunk

Integrate automatic microtask draining into JSC framework and re-enable Promise
​https://bugs.webkit.org/show_bug.cgi?id=146828

Reviewed by Sam Weinig.

Source/JavaScriptCore:

Add automatic microtask draining system into JSC framework.
When the depth of VM lock becomes 0, before this, we drain the queued microtasks.
Enqueuing behavior can be injected by the JSGlobalObject's method table.
It is utilized in WebCore to post the microtask to WebCore's event loop.

In the case of JSC interactive shell, VM depth is always greater than 0.
So we manually drains the queued microtasks after evaluating the written line.

Since now JSC framework has the microtask queue, we can drain the queued microtasks.
So re-enable the Promise in the JSC framework context.

• API/JSContextRef.cpp:

(javaScriptRuntimeFlags): Deleted.

• API/tests/testapi.c:

(main):

• API/tests/testapi.mm:

(testObjectiveCAPIMain):

• jsc.cpp:

(runInteractive):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::queueMicrotask):

• runtime/JSLock.cpp:

(JSC::JSLock::willReleaseLock):

• runtime/VM.cpp:

(JSC::VM::queueMicrotask):
(JSC::VM::drainMicrotasks):
(JSC::QueuedTask::run):

• runtime/VM.h:

(JSC::QueuedTask::QueuedTask):

LayoutTests:

Add Promise tests mainly focusing on microtasks.
They can be executed in JSC shell. So they are locate in js/ directory (not js/dom).

• js/promise-nested-microtasks-expected.txt: Added.
• js/promise-nested-microtasks.html: Added.
• js/promise-resolve-in-non-dom-expected.txt: Added.
• js/promise-resolve-in-non-dom.html: Added.
• js/script-tests/promise-nested-microtasks.js: Added.

(Promise.resolve.then):

• js/script-tests/promise-resolve-non-dom.js: Added.

(value.then):

• resources/standalone-post.js:

2:47 PM Changeset in webkit [186965] by commit-queue@webkit.org

• 4 edits in trunk

[Content Extensions] Term::isUniversalTransition() incorrectly expects the end-of-line assertion in character sets
​https://bugs.webkit.org/show_bug.cgi?id=147032

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2015-07-17
Reviewed by Alex Christensen.

Source/WebCore:

• contentextensions/Term.h:

(WebCore::ContentExtensions::Term::isUniversalTransition):
The universal transition is not supposed to account for the end-of-line assertion,
it should be a transition matching any character.

Here, we were counting 128 transitions, the 127 characters plus the
transition on zero we are using for EOL.

The end result is Term::isUniversalTransition() was completely useless.
The only code using it is the pattern simplificaton phase. That part
was not working correclty and was allowing useless ".*" in the patterns.

Tools:

• TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp:

Test that the useless terms are eliminated by counting
the number of NFA nodes generated.

2:16 PM Changeset in webkit [186964] by mitz@apple.com

• 10 edits
  1 add in trunk

Source/WebCore:
WebCore part of <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
​https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

Test: TestWebKitAPI/Tests/WebKit2Cocoa/ShouldOpenExternalURLsInNewWindowActions.mm

• loader/FrameLoader.cpp:

(WebCore::shouldOpenExternalURLsPolicyToApply): Pulled the logic out of
applyShouldOpenExternalURLsPolicyToNewDocumentLoader into this new helper.
(WebCore::FrameLoader::loadURL): When targeting a new frame, apply the external URLs policy
to the action passed to checkNewWindowPolicy.
(WebCore::FrameLoader::applyShouldOpenExternalURLsPolicyToNewDocumentLoader): Call the new
helper function.
(WebCore::createWindow): Include the external URL policy in the action passed to
createWindow.

Source/WebKit2:
WebKit2 part of <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
​https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

• UIProcess/Cocoa/UIDelegate.mm:

(WebKit::UIDelegate::UIClient::createNewPage): Disallow App Links if the new page is for the
same protocol, host and port as the main frame of this page.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForNavigationAction): Disallow App Links if
m_shouldSuppressAppLinksInNextNavigationPolicyDecision is set, and reset it. See below for
when we set it.
(WebKit::WebPageProxy::decidePolicyForNewWindowAction): Disallow App Links if the new window
is for the same protocol, host and port as the main frame of this page.
(WebKit::WebPageProxy::createNewPage): Make the new page disallow App Links in the first
policy decision if it is for the same protocol, host and port as the main frame of this
page.

• UIProcess/WebPageProxy.h: Added m_shouldSuppressAppLinksInNextNavigationPolicyDecision

member variable.

• WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createWindow): Pass the shouldOpenExternalURLsPolicy.

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction): Ditto.

Tools:
Tests for <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
​https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2Cocoa/ShouldOpenExternalURLsInNewWindowActions.mm: Added.

(-[ShouldOpenExternalURLsInNewWindowActionsController webView:decidePolicyForNavigationAction:decisionHandler:]):
(-[ShouldOpenExternalURLsInNewWindowActionsController webView:didFinishNavigation:]):
(-[ShouldOpenExternalURLsInNewWindowActionsController webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:]):
(TEST):

12:35 PM Changeset in webkit [186963] by andersca@apple.com

• 2 edits in trunk/Source/WebCore

ScrollView.h should be self-contained
​https://bugs.webkit.org/show_bug.cgi?id=147004

Reviewed by Sam Weinig.

• platform/ScrollView.h:

12:23 PM Changeset in webkit [186962] by bshafiei@apple.com

• 33 edits in tags/Safari-601.1.36.2

Merged r186881. rdar://problem/21822278

12:00 PM Changeset in webkit [186961] by beidson@apple.com

• 2 edits in trunk/Source/WebCore

Rolling r186895 back in, in its entirety.
​https://bugs.webkit.org/show_bug.cgi?id=146976

Rubberstamped by Tim Horton.

• platform/network/cf/CookieJarCFNet.cpp:

(WebCore::createCookies): Use new CFNetwork SPI.

11:50 AM Changeset in webkit [186960] by bshafiei@apple.com

• 5 edits in tags/Safari-601.1.36.2/Source

Versioning.

11:48 AM Changeset in webkit [186959] by saambarati1@gmail.com

• 65 edits in trunk

Function parameters should be parsed in the same parser arena as the function body
​https://bugs.webkit.org/show_bug.cgi?id=145995

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch changes how functions are parsed in JSC. A function's
parameters are now parsed in the same arena as the function itself.
This allows us to arena allocate all destructuring AST nodes and
the FunctionParameters node. This will help make implementing ES6
default parameter values sane.

A source code that represents a function now includes the text of the function's
parameters. The starting offset is at the opening parenthesis of the parameter
list or at the starting character of the identifier for arrow functions that
have single arguments and don't start with parenthesis.

For example:

"function (param1, param2) { ... }"

^{| This offset used to be the starting offset of a function's SourceCode}

^{| This is the new starting offset for a function's SourceCode.}

This requires us to change how some offsets are calculated
and also requires us to report some different line numbers for internal
metrics that use a SourceCode's starting line and column numbers.

This patch also does a bit of cleanup with regards to how
functions are parsed in general (especially arrow functions).
It removes some unnecessary #ifdefs and the likes for arrow
to make things clearer and more deliberate.

• API/JSScriptRef.cpp:

(parseScript):

• builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::createExecutableInternal):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::generateFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
(JSC::UnlinkedFunctionExecutable::visitChildren):
(JSC::UnlinkedFunctionExecutable::parameterCount): Deleted.

• bytecode/UnlinkedCodeBlock.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::DestructuringAssignmentNode::emitBytecode):
(JSC::assignDefaultValueIfUndefined):
(JSC::ArrayPatternNode::collectBoundIdentifiers):
(JSC::DestructuringPatternNode::~DestructuringPatternNode): Deleted.

• parser/ASTBuilder.h:

(JSC::ASTBuilder::createClassExpr):
(JSC::ASTBuilder::createFunctionExpr):
(JSC::ASTBuilder::createFunctionBody):
(JSC::ASTBuilder::createArrowFunctionExpr):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createElementList):
(JSC::ASTBuilder::createFormalParameterList):
(JSC::ASTBuilder::appendParameter):
(JSC::ASTBuilder::createClause):
(JSC::ASTBuilder::createClauseList):
(JSC::ASTBuilder::createFuncDeclStatement):
(JSC::ASTBuilder::createForInLoop):
(JSC::ASTBuilder::createForOfLoop):
(JSC::ASTBuilder::isResolve):
(JSC::ASTBuilder::createDestructuringAssignment):
(JSC::ASTBuilder::createArrayPattern):
(JSC::ASTBuilder::appendArrayPatternSkipEntry):
(JSC::ASTBuilder::appendArrayPatternEntry):
(JSC::ASTBuilder::appendArrayPatternRestEntry):
(JSC::ASTBuilder::finishArrayPattern):
(JSC::ASTBuilder::createObjectPattern):
(JSC::ASTBuilder::appendObjectPatternEntry):
(JSC::ASTBuilder::createBindingLocation):
(JSC::ASTBuilder::setEndOffset):

• parser/Lexer.cpp:

(JSC::Lexer<T>::Lexer):
(JSC::Lexer<T>::nextTokenIsColon):
(JSC::Lexer<T>::setTokenPosition):
(JSC::Lexer<T>::lex):
(JSC::Lexer<T>::clear):

• parser/Lexer.h:

(JSC::Lexer::setIsReparsingFunction):
(JSC::Lexer::isReparsingFunction):
(JSC::Lexer::lineNumber):
(JSC::Lexer::setIsReparsing): Deleted.
(JSC::Lexer::isReparsing): Deleted.

• parser/NodeConstructors.h:

(JSC::TryNode::TryNode):
(JSC::FunctionParameters::FunctionParameters):
(JSC::FuncExprNode::FuncExprNode):
(JSC::FuncDeclNode::FuncDeclNode):
(JSC::ArrayPatternNode::ArrayPatternNode):
(JSC::ObjectPatternNode::ObjectPatternNode):
(JSC::BindingNode::BindingNode):
(JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
(JSC::ParameterNode::ParameterNode): Deleted.
(JSC::ArrayPatternNode::create): Deleted.
(JSC::ObjectPatternNode::create): Deleted.
(JSC::BindingNode::create): Deleted.

• parser/Nodes.cpp:

(JSC::ProgramNode::ProgramNode):
(JSC::EvalNode::EvalNode):
(JSC::FunctionBodyNode::FunctionBodyNode):
(JSC::FunctionBodyNode::finishParsing):
(JSC::FunctionNode::FunctionNode):
(JSC::FunctionNode::finishParsing):
(JSC::FunctionParameters::create): Deleted.
(JSC::FunctionParameters::FunctionParameters): Deleted.
(JSC::FunctionParameters::~FunctionParameters): Deleted.

• parser/Nodes.h:

(JSC::ProgramNode::startColumn):
(JSC::ProgramNode::endColumn):
(JSC::EvalNode::startColumn):
(JSC::EvalNode::endColumn):
(JSC::FunctionParameters::size):
(JSC::FunctionParameters::at):
(JSC::FunctionParameters::append):
(JSC::FuncExprNode::body):
(JSC::DestructuringPatternNode::~DestructuringPatternNode):
(JSC::DestructuringPatternNode::isBindingNode):
(JSC::DestructuringPatternNode::emitDirectBinding):
(JSC::ArrayPatternNode::appendIndex):
(JSC::ObjectPatternNode::appendEntry):
(JSC::BindingNode::boundProperty):
(JSC::BindingNode::divotStart):
(JSC::BindingNode::divotEnd):
(JSC::DestructuringAssignmentNode::bindings):
(JSC::FuncDeclNode::body):
(JSC::ParameterNode::pattern): Deleted.
(JSC::ParameterNode::nextParam): Deleted.
(JSC::FunctionParameters::patterns): Deleted.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::Parser):
(JSC::Parser<LexerType>::~Parser):
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::allowAutomaticSemicolon):
(JSC::Parser<LexerType>::parseSourceElements):
(JSC::Parser<LexerType>::createBindingPattern):
(JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
(JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
(JSC::Parser<LexerType>::parseSwitchClauses):
(JSC::Parser<LexerType>::parseSwitchDefaultClause):
(JSC::Parser<LexerType>::parseBlockStatement):
(JSC::Parser<LexerType>::parseStatement):
(JSC::Parser<LexerType>::parseFormalParameters):
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::stringForFunctionMode):
(JSC::Parser<LexerType>::parseFunctionParameters):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseFunctionDeclaration):
(JSC::Parser<LexerType>::parseClass):
(JSC::Parser<LexerType>::parsePrimaryExpression):
(JSC::Parser<LexerType>::parseMemberExpression):
(JSC::Parser<LexerType>::parseArrowFunctionExpression):
(JSC::operatorString):
(JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBody): Deleted.

• parser/Parser.h:

(JSC::Parser::positionBeforeLastNewline):
(JSC::Parser::locationBeforeLastToken):
(JSC::Parser::findCachedFunctionInfo):
(JSC::Parser::isofToken):
(JSC::Parser::isEndOfArrowFunction):
(JSC::Parser::isArrowFunctionParamters):
(JSC::Parser::tokenStart):
(JSC::Parser::isLETMaskedAsIDENT):
(JSC::Parser::autoSemiColon):
(JSC::Parser::setEndOfStatement):
(JSC::Parser::canRecurse):
(JSC::Parser<LexerType>::parse):
(JSC::parse):

• parser/ParserFunctionInfo.h:
• parser/ParserModes.h:

(JSC::functionNameIsInScope):

• parser/SourceCode.h:

(JSC::makeSource):
(JSC::SourceCode::subExpression):
(JSC::SourceCode::subArrowExpression): Deleted.

• parser/SourceProviderCache.h:

(JSC::SourceProviderCache::get):

• parser/SourceProviderCacheItem.h:

(JSC::SourceProviderCacheItem::endFunctionToken):
(JSC::SourceProviderCacheItem::usedVariables):
(JSC::SourceProviderCacheItem::writtenVariables):
(JSC::SourceProviderCacheItem::SourceProviderCacheItem):

• parser/SyntaxChecker.h:

(JSC::SyntaxChecker::SyntaxChecker):
(JSC::SyntaxChecker::createClassExpr):
(JSC::SyntaxChecker::createFunctionExpr):
(JSC::SyntaxChecker::createFunctionBody):
(JSC::SyntaxChecker::createArrowFunctionExpr):
(JSC::SyntaxChecker::setFunctionNameStart):
(JSC::SyntaxChecker::createArguments):
(JSC::SyntaxChecker::createPropertyList):
(JSC::SyntaxChecker::createElementList):
(JSC::SyntaxChecker::createFormalParameterList):
(JSC::SyntaxChecker::appendParameter):
(JSC::SyntaxChecker::createClause):
(JSC::SyntaxChecker::createClauseList):

• runtime/CodeCache.cpp:

(JSC::CodeCache::getGlobalCodeBlock):
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

• runtime/Completion.cpp:

(JSC::checkSyntax):

• runtime/Executable.cpp:

(JSC::ProgramExecutable::checkSyntax):

• tests/controlFlowProfiler/conditional-expression.js:

(testConditionalFunctionCall):

LayoutTests:

• fast/profiler/anonymous-event-handler-expected.txt:
• fast/profiler/anonymous-function-called-from-different-contexts-expected.txt:
• fast/profiler/anonymous-function-calls-built-in-functions-expected.txt:
• fast/profiler/anonymous-function-calls-eval-expected.txt:
• fast/profiler/anonymous-functions-with-display-names-expected.txt:
• fast/profiler/apply-expected.txt:
• fast/profiler/built-in-function-calls-anonymous-expected.txt:
• fast/profiler/built-in-function-calls-user-defined-function-expected.txt:
• fast/profiler/call-expected.txt:
• fast/profiler/calling-the-function-that-started-the-profiler-from-another-scope-expected.txt:
• fast/profiler/compare-multiple-profiles-expected.txt:
• fast/profiler/constructor-expected.txt:
• fast/profiler/dead-time-expected.txt:
• fast/profiler/document-dot-write-expected.txt:
• fast/profiler/event-handler-expected.txt:
• fast/profiler/execution-context-and-eval-on-same-line-expected.txt:
• fast/profiler/inline-event-handler-expected.txt:
• fast/profiler/many-calls-in-the-same-scope-expected.txt:
• fast/profiler/multiple-and-different-scoped-anonymous-function-calls-expected.txt:
• fast/profiler/multiple-and-different-scoped-function-calls-expected.txt:
• fast/profiler/multiple-anonymous-functions-called-from-the-same-function-expected.txt:
• fast/profiler/multiple-frames-expected.txt:
• fast/profiler/named-functions-with-display-names-expected.txt:
• fast/profiler/nested-anonymous-functon-expected.txt:
• fast/profiler/nested-start-and-stop-profiler-expected.txt:
• fast/profiler/one-execution-context-expected.txt:
• fast/profiler/profile-calls-in-included-file-expected.txt:
• fast/profiler/profile-with-no-title-expected.txt:
• fast/profiler/profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting-expected.txt:
• fast/profiler/profiling-from-a-nested-location-expected.txt:
• fast/profiler/simple-event-call-expected.txt:
• fast/profiler/simple-no-level-change-expected.txt:
• fast/profiler/start-and-stop-profiler-multiple-times-expected.txt:
• fast/profiler/start-and-stop-profiling-in-the-same-function-expected.txt:
• fast/profiler/stop-profiling-after-setTimeout-expected.txt:
• fast/profiler/stop-then-function-call-expected.txt:
• fast/profiler/two-execution-contexts-expected.txt:
• fast/profiler/user-defined-function-calls-built-in-functions-expected.txt:
• fast/profiler/window-dot-eval-expected.txt:
• js/dom/script-start-end-locations-expected.txt:

11:46 AM Changeset in webkit [186958] by bshafiei@apple.com

• 1 copy in tags/Safari-601.1.36.2

New tag.

11:28 AM Changeset in webkit [186957] by commit-queue@webkit.org

• 7 edits
  9 adds in trunk

[Content Extensions] CSS-display-none rules are not working properly
​https://bugs.webkit.org/show_bug.cgi?id=147024

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2015-07-17
Reviewed by Sam Weinig.

Source/WebCore:

There were 2 bugs prevening rules with css-display-none and a url-filter from working
correctly.

First, ContentExtensions::serializeActions() was merging selectors regardless of their
trigger. All the CSS Selectors would be grouped together and applied regardless of which
rule apply.

That problem was fixed by grouping CSS rules by trigger. We want all the undistinguishable
CSS rules to be merged. The trigger makes 2 rules dinstinguishable as one rule can apply
on a page while the next rule does not. The simplest approach is to group by trigger.

The second problem had to do with rules added before the document is created.
When accumulating those rules, we were only keeping the last one. The reason was that
DocumentLoader::addPendingContentExtensionDisplayNoneSelector() would only keep a single
selector list by extension.

This is fixed by keeping a vector of all the rules that apply.

Tests: http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html

http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html
http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html

• contentextensions/ContentExtensionCompiler.cpp:

(WebCore::ContentExtensions::serializeActions):

• contentextensions/ContentExtensionRule.h:

(WebCore::ContentExtensions::Trigger::isEmpty):
(WebCore::ContentExtensions::TriggerHash::hash):
(WebCore::ContentExtensions::TriggerHash::equal):
(WebCore::ContentExtensions::TriggerHashTraits::constructDeletedValue):
(WebCore::ContentExtensions::TriggerHashTraits::isDeletedValue):
(WebCore::ContentExtensions::TriggerHashTraits::emptyValue):
(WebCore::ContentExtensions::TriggerHashTraits::isEmptyValue):

• contentextensions/ContentExtensionsBackend.cpp:

(WebCore::ContentExtensions::ContentExtensionsBackend::processContentExtensionRulesForLoad): Deleted.

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::commitData):
(WebCore::DocumentLoader::addPendingContentExtensionDisplayNoneSelector):

• loader/DocumentLoader.h:

LayoutTests:

• http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged-expected.txt: Added.
• http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html: Added.
• http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html.json: Added.
• http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged-expected.txt: Added.
• http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html: Added.
• http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html.json: Added.
• http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource-expected.txt: Added.
• http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html: Added.
• http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html.json: Added.

11:24 AM Changeset in webkit [186956] by timothy_horton@apple.com

• 9 edits in trunk/Source

iOS TextIndicators include text that is not supposed to be indicated
​https://bugs.webkit.org/show_bug.cgi?id=147028
<rdar://problem/21643094>

Reviewed by Sam Weinig.

Paint the selection and background, but not other foregrounds, for iOS TextIndicators.

• page/FrameSnapshotting.cpp:

(WebCore::snapshotFrameRect):

• page/FrameSnapshotting.h:

Add a new snapshot option where we'll paint backgrounds and the selected
foreground and nothing else.
Pass the new snapshot option through as a paint behavior.

• page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange):
Implement the incantations necessary to make a temporary selection
change not get sent to the UI process and actually have WebCore know about it
and accurately respond to questions about it.

(WebCore::TextIndicator::createWithSelectionInFrame):
Paint selection and backgrounds on iOS.

• rendering/PaintPhase.h:
• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::paintLayerContents):

• rendering/RenderElement.cpp:

(WebCore::RenderElement::selectionColor):
Add a new paint behavior, SelectionAndBackgroundsOnly, which behaves
the same as selection only except it allows backgrounds to paint.

• WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::shouldCreateTransientPaintingSnapshot):

11:11 AM Changeset in webkit [186955] by mark.lam@apple.com

• 25 edits in trunk

Remove leak of objects between isolated worlds on custom events, message events, and pop state events.
​https://bugs.webkit.org/show_bug.cgi?id=118884

Reviewed by Filip Pizlo and Mark Lam.
Patch by Keith Miller <​keith_miller@apple.com>.

Source/WebCore:

Tests: fast/events/event-leak-objects.html

fast/events/event-properties-gc.html

Fixes an issue where objects passed as certain properties of events could cross isolated worlds. This
was fixed by checking that any object passed by an event must be serializable or originate from the same
isolated world as the one it is currently being accessed in. In the case of MessageEvents and PopStateEvents we
cache the values of the data and state properties, respectively, as they may be a deserialized object. In case
an object was deserialized in a world with elevated privileges we also check the cached value is from the same
world, if it is from a different world we recompute it. For testing purposes, I added a new function to Internals
that determines whether a JSObject originated in the current world.

• CMakeLists.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/DOMWrapperWorld.h:

(WebCore::worldForDOMObject):

• bindings/js/JSBindingsAllInOne.cpp:
• bindings/js/JSCustomEventCustom.cpp: Copied from Source/WebCore/dom/CustomEvent.cpp.

(WebCore::JSCustomEvent::detail):

• bindings/js/JSMessageEventCustom.cpp:

(WebCore::JSMessageEvent::data):

• bindings/js/JSPopStateEventCustom.cpp:

(WebCore::JSPopStateEvent::state):

• dom/CustomEvent.cpp:

(WebCore::CustomEvent::initCustomEvent):
(WebCore::CustomEvent::trySerializeDetail):

• dom/CustomEvent.h:
• dom/CustomEvent.idl:
• dom/MessageEvent.cpp:

(WebCore::MessageEvent::initMessageEvent):
(WebCore::MessageEvent::trySerializeData):

• dom/MessageEvent.h:
• dom/PopStateEvent.cpp:

(WebCore::PopStateEvent::trySerializeState):

• dom/PopStateEvent.h:
• testing/Internals.cpp:

(WebCore::Internals::isFromCurrentWorld):

• testing/Internals.h:
• testing/Internals.idl:

LayoutTests:

These tests ensure ensure objects are not leaked across isolated worlds and that those properties are not prematurely
garbage collected.

• fast/events/constructors/custom-event-constructor-expected.txt:
• fast/events/constructors/custom-event-constructor.html:
• fast/events/event-leak-objects-expected.txt: Added.
• fast/events/event-leak-objects.html: Added.
• fast/events/event-properties-gc-expected.txt: Added.
• fast/events/event-properties-gc.html: Added.

2:23 AM Changeset in webkit [186954] by Carlos Garcia Campos

• 7 edits in trunk/Source

[GTK] Cleanup PasteboardHelper
​https://bugs.webkit.org/show_bug.cgi?id=147035

Reviewed by Žan Doberšek.

Source/WebCore:

It's actually a singleton, but the API suggests you can create
your own or use the default one, but the default one should be the
only one. Rename PasteboardHelper::defaultPasteboardHelper() as
PasteboardHelper::singleton() and make it non-copyable and never
destroyed.

• platform/gtk/PasteboardGtk.cpp:

(WebCore::Pasteboard::writePlainText): Use PasteboardHelper::singleton().
(WebCore::Pasteboard::write): Ditto.
(WebCore::Pasteboard::writePasteboard): Ditto.
(WebCore::Pasteboard::clear): Ditto.
(WebCore::Pasteboard::canSmartReplace): Ditto.
(WebCore::Pasteboard::read): Ditto.
(WebCore::Pasteboard::hasData): Ditto.
(WebCore::Pasteboard::types): Ditto.
(WebCore::Pasteboard::readString): Ditto.
(WebCore::Pasteboard::readFilenames): Ditto.

• platform/gtk/PasteboardHelper.cpp:

(WebCore::PasteboardHelper::singleton): Renamed as singleton, also
use NeverDestroyed and return a reference instead of a pointer.
(WebCore::PasteboardHelper::PasteboardHelper): Do all
initializations here and remove the initialization static flag,
since this is a real singleton now. Also use
gdk_atom_intern_static_string() to initialize the atoms instead of
gdk_atom_intern().
(WebCore::PasteboardHelper::targetList):
(WebCore::PasteboardHelper::targetListForDataObject):
(WebCore::getClipboardContentsCallback):

• platform/gtk/PasteboardHelper.h:

Source/WebKit2:

Use PasteboardHelper::singleton() instead of
PasteboardHelper::defaultPasteboardHelper().

• UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseConstructed):

• UIProcess/gtk/DragAndDropHandler.cpp:

(WebKit::DragAndDropHandler::startDrag):
(WebKit::DragAndDropHandler::fillDragData):
(WebKit::DragAndDropHandler::dataObjectForDropData):
(WebKit::DragAndDropHandler::requestDragData):

Jul 16, 2015:

11:24 PM Changeset in webkit [186953] by matthew_hanson@apple.com

• 3 edits in branches/safari-601.1-branch/Source/WebKit2

Merge r186808. rdar://problem/21801544

11:15 PM Changeset in webkit [186952] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebInspectorUI

Merge r186926. rdar://problem/21868062

11:15 PM Changeset in webkit [186951] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebInspectorUI

Merge r186925. rdar://problem/21868413

11:15 PM Changeset in webkit [186950] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebKit2

Merge r186924. rdar://problem/21669802

11:15 PM Changeset in webkit [186949] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/JavaScriptCore

Merge r186920. rdar://problem/21764196

11:15 PM Changeset in webkit [186948] by matthew_hanson@apple.com

• 4 edits in branches/safari-601.1-branch/Source

Merge r186919. rdar://problem/21834578

11:15 PM Changeset in webkit [186947] by matthew_hanson@apple.com

• 34 edits in branches/safari-601.1-branch

Merge r186881. rdar://problem/21822278

11:15 PM Changeset in webkit [186946] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186799. rdar://problem/20542574

11:15 PM Changeset in webkit [186945] by matthew_hanson@apple.com

• 7 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186798. rdar://problem/20542574

10:33 PM Changeset in webkit [186944] by matthew_hanson@apple.com

• 3 edits
  2 adds in branches/safari-601.1-branch

Merge r186911. rdar://problem/21822541

10:33 PM Changeset in webkit [186943] by matthew_hanson@apple.com

• 3 edits in branches/safari-601.1-branch/Source/WebKit/mac

Merge r186909. rdar://problem/21802456

10:33 PM Changeset in webkit [186942] by matthew_hanson@apple.com

• 3 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186895. rdar://problem/21692212

10:33 PM Changeset in webkit [186941] by matthew_hanson@apple.com

• 9 edits in branches/safari-601.1-branch/Source/WebKit2

Merge r186887. rdar://problem/21692212

10:33 PM Changeset in webkit [186940] by matthew_hanson@apple.com

• 3 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186879. rdar://problem/21758704

10:33 PM Changeset in webkit [186939] by matthew_hanson@apple.com

• 6 edits in branches/safari-601.1-branch/Source

Merge r186878. rdar://problem/21758722

10:33 PM Changeset in webkit [186938] by matthew_hanson@apple.com

• 4 edits
  3 adds in branches/safari-601.1-branch

Merge r186868. rdar://problem/21758704

10:32 PM Changeset in webkit [186937] by matthew_hanson@apple.com

• 5 edits
  2 adds in branches/safari-601.1-branch

Merge r186865. rdar://problem/21823835

10:32 PM Changeset in webkit [186936] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186857. rdar://problem/21840845

10:32 PM Changeset in webkit [186935] by matthew_hanson@apple.com

• 4 edits
  4 adds in branches/safari-601.1-branch

Merge r186840. rdar://problem/21823681

10:32 PM Changeset in webkit [186934] by matthew_hanson@apple.com

• 3 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186837. rdar://problem/21774358

10:32 PM Changeset in webkit [186933] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebCore

Merge r186828. rdar://problem/19925709

10:32 PM Changeset in webkit [186932] by matthew_hanson@apple.com

• 5 edits
  2 adds in branches/safari-601.1-branch

Merge r186827. rdar://problem/21736723

10:32 PM Changeset in webkit [186931] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebKit2

Merge r186814. rdar://problem/21605505

10:32 PM Changeset in webkit [186930] by matthew_hanson@apple.com

• 2 edits in branches/safari-601.1-branch/Source/WebKit2

Merge r186812. rdar://problem/21818117

10:32 PM Changeset in webkit [186929] by matthew_hanson@apple.com

• 4 edits
  15 adds in branches/safari-601.1-branch

Merge r186807. rdar://problem/21782350

10:32 PM Changeset in webkit [186928] by matthew_hanson@apple.com

• 5 edits in branches/safari-601.1-branch/Source

Merge r186786. rdar://problem/9222837

8:59 PM Changeset in webkit [186927] by commit-queue@webkit.org

• 4 edits in trunk/Tools

webkit-patch uses incorrect credentials from keychain to login until account lockout
​https://bugs.webkit.org/show_bug.cgi?id=146923

Patch by Dean Johnson <​dean_johnson@apple.com> on 2015-07-16
Reviewed by Daniel Bates.

When webkit-patch upload asks for login credentials for bugs.webkit.org, if you
provide incorrect credentials then ask for them to be saved to the keychain
webkit-patch will then use those incorrect credentials until 5 total attempts
have been made to log in. This will lock the user out of Bugzilla for a
half hour.

• Scripts/webkitpy/common/net/bugzilla/bugzilla.py:

(Bugzilla.authenticate): Added argument to read_credentials() that
passes in whether or not to use stored credentials.

• Scripts/webkitpy/common/net/credentials.py:

(Credentials.read_credentials): Added optional argument 'use_stored_credentials'
that specifies whether or not to use credentials stored on the system. If it
does, we do not auto-fill credentials since either the credentials caused
the failure, or they weren't used in the first place so there is no reason
to try and use them again if a failure happened.

• Scripts/webkitpy/common/net/credentials_unittest.py: Added unit test for newly added

use_stored_credentials argument.
(test_do_not_use_stored_credentials): Added unit test to make sure functions that
retrieve username/password information from the local system (environment, Git, keychain,
keyring) are never called. It also tests that we get back our mocked username and password.
(test_do_not_use_stored_credentials.MockKeyring): Mock keyring
(test_do_not_use_stored_credentials.MockKeyring.get_password): Assert this is never called.
(test_do_not_use_stored_credentials.FakeCredentials): Mock credentials
(test_do_not_use_stored_credentials.FakeCredentials._credentials_from_keychain): Assert this
is never called.
(test_do_not_use_stored_credentials.FakeCredentials._credentials_from_environment): Ditto
(test_do_not_use_stored_credentials.FakeCredentials._offer_to_store_credentials_in_keyring): Ditto
(test_do_not_use_stored_credentials.FakeUser): Mock the User class
(test_do_not_use_stored_credentials.FakeUser.prompt): Returns a username to assert against.
(test_do_not_use_stored_credentials.FakeUser.prompt_password): Returns a password to assert
against.

8:59 PM Changeset in webkit [186926] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: REGRESSION (r186218) ScriptTimelineRecord attempts to access null property
​https://bugs.webkit.org/show_bug.cgi?id=147025

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2015-07-16
Reviewed by Timothy Hatcher.

The issue here was two ScriptTimelineRecord's were created for the same
profile payload. When the first ScriptTimelineRecord processed the
payload to create a Profile we modified the payload, then when the
second ScriptTimelineRecord tries to process the payload the data is
in an unexpected state and it crashes.

The solution here is to stash the result on the payload, so when the
payload is shared we can just immediately jump to the resulting Profile.
The longer term solution will be to share higher level objects and not
attempt to process the payload multiple times. That is tracked by:
<​https://webkit.org/b/147029> Web Inspector: Better share objects generated from timeline events (Records)

• UserInterface/Models/ScriptTimelineRecord.js:

(WebInspector.ScriptTimelineRecord.prototype._initializeProfileFromPayload):
When processing the profile payload, store the Profile on the payload
so if another ScriptTimelineRecord has that payload they can avoid
re-processing it.

8:55 PM Changeset in webkit [186925] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Total Size of Resources number in dashboard is wrong (does not update during load)
​https://bugs.webkit.org/show_bug.cgi?id=147027

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2015-07-16
Reviewed by Timothy Hatcher.

• UserInterface/Models/DefaultDashboard.js:

(WebInspector.DefaultDashboard.prototype._resourceSizeDidChange):
Restore implementation of callback from r183328 to update total resource
size as resources are downloaded.

8:55 PM Changeset in webkit [186924] by Matt Baker

• 2 edits in trunk/Source/WebKit2

[Mac] Web Inspector toolbar can be covered by the Safari tab bar when docked to the right
​https://bugs.webkit.org/show_bug.cgi?id=146994

Reviewed by Timothy Hatcher.

WebInspectorProxy contained logic which ignored the next frame change notification from the inspected view,
whenever it updated the frames of both the Inspector view and inspected view. This patch removes that logic,
as it prevented the Inspector's frame from being adjusted after changes to the browser's top content inset.

• UIProcess/mac/WebInspectorProxyMac.mm:

(-[WKWebInspectorProxyObjCAdapter ignoreNextInspectedViewFrameDidChange]): Deleted.
(-[WKWebInspectorProxyObjCAdapter inspectedViewFrameDidChange:]): Deleted.
(WebKit::WebInspectorProxy::inspectedViewFrameDidChange): Deleted.

8:33 PM Changeset in webkit [186923] by fpizlo@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, fix build for newer LLVMs.

• llvm/LLVMHeaders.h:
• llvm/library/LLVMExports.cpp:

7:56 PM Changeset in webkit [186922] by Gyuyoung Kim

• 2 edits in trunk/Tools

Unreviewed, remove my redundant email information.

• Scripts/webkitpy/common/config/contributors.json:

7:45 PM Changeset in webkit [186921] by hyungwook.lee@navercorp.com

• 2 edits in trunk/Tools

Unreviewed. Add Hyungwook Lee as a committer.

• Scripts/webkitpy/common/config/contributors.json:

7:27 PM Changeset in webkit [186920] by mark.lam@apple.com

• 2 edits in trunk/Source/JavaScriptCore

RegExp::match() should set m_state to ByteCode if compilation fails.
​https://bugs.webkit.org/show_bug.cgi?id=147023

Reviewed by Michael Saboff.

A RegExp has a YarrCodeBlock that has 4 MacroAssemblerCodeRefs for compiled code.
If one of these compilations succeeds, RegExp::m_state will be set to JITCode.
Subsequently, if RegExp tries to compile another one of these but fails, m_state
will be left untouched i.e. it still says JITCode. As a result, when
RegExp::match() later tries to execute the non-existant compiled code, it will
crash.

The fix is to downgrade m_state to ByteCode if RegExp ever fails to compile.
This failure should be rare. We'll do the minimal work here to fix the issue and
keep an eye on the perf bots. If perf regresses, we can do some optimization work then.

This issue is difficult to test for since it either requires a low memory condition
to trigger a failed RegExp compilation at the right moment, or for the RegExp to
succeed compilation in the MatchedOnly mode but fail in IncludeSubpatterns mode.
Instead, I manually tested it by instrumenting RegExp::compile() to fail once in every
10 compilation attempts.

• runtime/RegExp.cpp:

(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

5:29 PM Changeset in webkit [186919] by commit-queue@webkit.org

• 4 edits in trunk/Source

Web Inspector: [Mac] Save dialog not working when inspector is docked
​https://bugs.webkit.org/show_bug.cgi?id=146991

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2015-07-16
Reviewed by Sam Weinig.

Source/WebKit/mac:

• WebCoreSupport/WebInspectorClient.mm:

(WebInspectorFrontendClient::save):
(-[WebInspectorWindowController webView:runOpenPanelForFileButtonWithResultListener:allowMultipleFiles:]):
When the window is nil (docked) use a non-window version of running the dialog.

Source/WebKit2:

• UIProcess/mac/WebInspectorProxyMac.mm:

(WebKit::runOpenPanel):
(WebKit::WebInspectorProxy::platformSave):
When the window is nil (docked) use a non-window version of running the dialog.

4:36 PM Changeset in webkit [186918] by mrajca@apple.com

• 5 edits in trunk/Source/WebCore

Media Session: handle 'Transient' and 'Transient Solo' interruption events ​https://bugs.webkit.org/show_bug.cgi?id=146840

Reviewed by Eric Carlson.

• Modules/mediasession/MediaSession.cpp:

(WebCore::MediaSession::handleDuckInterruption): Added stub.
(WebCore::MediaSession::handleUnduckInterruption): Added stub.
(WebCore::MediaSession::handlePauseInterruption): Pause active media elements. We use our helper method to do this

"safely" since pausing a media element can change the collection we're iterating.

(WebCore::MediaSession::handleUnpauseInterruption): Unpause active media elements. We use our helper method to do this

"safely" since unpausing a media element can change the collection we're iterating.

(WebCore::MediaSession::togglePlayback): Factored out "safe" iteration into a helper method elsewhere.
(WebCore::MediaSession::safelyIterateActiveMediaElements): Safely iterate through the collection of active media

elements.

• Modules/mediasession/MediaSession.h:
• Modules/mediasession/MediaSessionManager.cpp:

(WebCore::MediaSessionManager::MediaSessionManager): On Mac, register for platform-specific interruptions.
(WebCore::MediaSessionManager::didReceiveStartOfInterruptionNotification): Implemented section 4.5.2 of Media Session spec.
(WebCore::MediaSessionManager::didReceiveEndOfInterruptionNotification): Ditto.

• Modules/mediasession/MediaSessionManager.h:

4:22 PM Changeset in webkit [186917] by mrajca@apple.com

• 2 edits
  6 adds in trunk/Source/WebCore

Media Session: add support for platform-specific interruption providers
​https://bugs.webkit.org/show_bug.cgi?id=147008

Reviewed by Eric Carlson.

• WebCore.xcodeproj/project.pbxproj: Include new source files.
• platform/mediasession/MediaSessionInterruptionProvider.cpp: Added base class to be used by MediaSessionManager to listen for interruption notifications.

(WebCore::MediaSessionInterruptionProvider::MediaSessionInterruptionProvider): Begin listening for interruptions

upon construction.

(WebCore::MediaSessionInterruptionProvider::~MediaSessionInterruptionProvider): Stop listening for interruptions

before destruction.

(WebCore::MediaSessionInterruptionProvider::beginListeningForInterruptions): To be overridden by subclasses.
(WebCore::MediaSessionInterruptionProvider::stopListeningForInterruptions): To be overridden by subclasses.

• platform/mediasession/MediaSessionInterruptionProvider.h: Added.

(WebCore::MediaSessionInterruptionProviderClient::~MediaSessionInterruptionProviderClient):
(WebCore::MediaSessionInterruptionProvider::client):

• platform/mediasession/mac/MediaSessionInterruptionProviderMac.h: Added for providing Mac-specific interruptions.

(WebCore::MediaSessionInterruptionProviderMac::~MediaSessionInterruptionProviderMac):

• platform/mediasession/mac/MediaSessionInterruptionProviderMac.mm: Added stubs.

(WebCore::MediaSessionInterruptionProviderMac::beginListeningForInterruptions):
(WebCore::MediaSessionInterruptionProviderMac::stopListeningForInterruptions):

4:14 PM Changeset in webkit [186916] by timothy_horton@apple.com

• 10 edits in trunk/Source

Add shrink-wrapped link highlights
​https://bugs.webkit.org/show_bug.cgi?id=147021
<rdar://problem/21643094>

Reviewed by Enrica Casucci.

• Shared/InteractionInformationAtPosition.cpp:

(WebKit::InteractionInformationAtPosition::encode):
(WebKit::InteractionInformationAtPosition::decode):

• Shared/InteractionInformationAtPosition.h:

Add a TextIndicator to InteractionInformationAtPosition.
Make use of some new C++ features.

• UIProcess/ios/WKContentViewInteraction.h:
• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView willPresentPreviewViewController:forPosition:inSourceView:]):
(-[WKContentView didDismissPreviewViewController:committing:]):
Make use of the TextIndicator (if we have one) to show a shrink-wrapped
snapshot of the link.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):
Build a TextIndicator for the link if possible.

• WebCore.xcodeproj/project.pbxproj:
• page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange):
(WebCore::TextIndicator::createWithSelectionInFrame):

• page/TextIndicator.h:

Add a margin parameter to TextIndicator; this inflates each text rect
by the given amount.

Use snapshotFrameRect instead of snapshotSelection because we really
want an image that exactly fits textBoundingRectInDocumentCoordinates,
and snapshotSelection comes up with selection rects in different ways,
especially on iOS (where it comes up with nothing!).

For now, avoid forcing black text or painting only the selection on iOS.
Eventually, we should have TextIndicator options for these things that
are then respected at the presentation layer.

3:57 PM Changeset in webkit [186915] by Wenson Hsieh

• 2 edits in trunk/Tools

Added myself to the list of contributors.

Reviewed by Brent Fulgham.

• Scripts/webkitpy/common/config/contributors.json:

3:50 PM Changeset in webkit [186914] by Lucas Forschler

• 3 edits in branches/safari-601.1-branch/Source/WebCore

Merged r186764. rdar://problem/9222837

3:27 PM Changeset in webkit [186913] by mrajca@apple.com

• 12 edits in trunk/Source

Media Session: remove plumbing for delivering start/end-of-interruption events
​https://bugs.webkit.org/show_bug.cgi?id=147005

Reviewed by Eric Carlson.

Instead of receiving interruptions through WebKit, we will provide platform-specific implementations in WebCore
so the same behavior is available to all clients.

WebCore:

• Modules/mediasession/MediaSessionEvents.h:
• page/Page.cpp:
• page/Page.h:

WebKit:

• UIProcess/API/C/WKPage.cpp:
• UIProcess/API/C/WKPagePrivate.h:
• UIProcess/WebPageProxy.cpp:
• UIProcess/WebPageProxy.h:
• WebProcess/WebPage/WebPage.cpp:
• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:

3:08 PM Changeset in webkit [186912] by achristensen@apple.com

• 8 edits in trunk

[Content Extensions] Cache domain actions
​https://bugs.webkit.org/show_bug.cgi?id=146817

Reviewed by Benjamin Poulain.

Source/WebCore:

Right now we run regular expressions on the domain every time we have any rules that match with if-domain or unless-domain.
This caches the results of running regular expressions on the domain of the main document's url so we only need to
run those regular expressions when the main document changes domain. We also spend less time adding unused actions into HashSets.

All behavior is covered by existing api tests, but I added some to explicitly test if-domain and unless-domain with multiple load types.

• contentextensions/ContentExtension.cpp:

(WebCore::ContentExtensions::ContentExtension::globalDisplayNoneStyleSheet):
(WebCore::ContentExtensions::ContentExtension::cachedDomainActions):

• contentextensions/ContentExtension.h:

(WebCore::ContentExtensions::ContentExtension::identifier):
(WebCore::ContentExtensions::ContentExtension::compiledExtension):

• contentextensions/ContentExtensionsBackend.cpp:

(WebCore::ContentExtensions::ContentExtensionsBackend::actionsForResourceLoad):

• contentextensions/DFABytecodeInterpreter.cpp:

(WebCore::ContentExtensions::getJumpDistance):
(WebCore::ContentExtensions::matchesDomain):
(WebCore::ContentExtensions::DFABytecodeInterpreter::interpretAppendAction):
(WebCore::ContentExtensions::DFABytecodeInterpreter::interpretTestFlagsAndAppendAction):
(WebCore::ContentExtensions::DFABytecodeInterpreter::actionsForDefaultStylesheetFromDFARoot):
(WebCore::ContentExtensions::DFABytecodeInterpreter::interpretWithDomains):
(WebCore::ContentExtensions::DFABytecodeInterpreter::interpret):

• contentextensions/DFABytecodeInterpreter.h:

Tools:

• TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp:

(TestWebKitAPI::TEST_F):
Test if-domain and unless-domain with multiple load types.

2:54 PM Changeset in webkit [186911] by Simon Fraser

• 3 edits
  2 adds in trunk

Fix disappearing position:fixed elements in fixed layout mode
​https://bugs.webkit.org/show_bug.cgi?id=147019

Reviewed by Tim Horton.
Source/WebCore:

Test: compositing/fixed-with-fixed-layout.html

When in fixed layout mode, and being scaled down, viewportConstrainedVisibleContentRect() is
the wrong thing to use to determine if position:fixed elements are clipped out. In this case,
use the simpler document bounds (before scaling).

In the long term, there needs to be an equivalent of viewportConstrainedVisibleContentRect()
that gives an appropriate rect that can be used here.

• rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::requiresCompositingForPosition):

LayoutTests:

Test with four fixed elements in fixed layout mode.

• compositing/fixed-with-fixed-layout-expected.txt: Added.
• compositing/fixed-with-fixed-layout.html: Added.

2:51 PM Changeset in webkit [186910] by benjamin@webkit.org

• 12 edits
  1 add in trunk

[Content extensions] Combine suffixes when generating NFAs
​https://bugs.webkit.org/show_bug.cgi?id=146961

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2015-07-16
Reviewed by Alex Christensen.

Source/WebCore:

In this patch, I add a mechanism very similar to the prefix tree
but for the suffix (called a reverse suffix tree here).

The idea is here is to reuse the existing NFA nodes when generating
a chain of suffix Term that were already generated previously.
When generating a disjunction ending with the same suffix, we now
have the same trailing NFA nodes for both sides of the disjunction.

Mixing the prefix and suffix generation can be tricky, we do not want
transitions from a pattern to creep into the suffix of an other.

To avoid any conflict, the rules here are very simple:
-Only use the reverse suffix tree for terms without actions

up to a leaf term with actions.

This rule ensure that no action will accidentally make its way
to an other rule by resuing a vertex of the reverse suffix tree.

-Only use the reverse suffix tree for chains of terms in which

each term only has zero or one following term.

With this condition, when taking any vertex of the reverse suffix
tree, there is only one edge that move out of that vertex when reading
from left to right.
For any vertex, there is only one possible string generated
left-to-right, a single suffix.

This is overly restrictive but it is fast, easier to verify, and it works
well in practice.
For all the more complicated cases, we can count on the Minimizer to
find a better solution.

With all the simple suffixes merged, our NFAs are smaller, which
let us combine more patterns.
The DFAs are also smaller and faster to produce since their size
is relative to the NFA sizes.

Overall, I get the following gains:
-Chris's test case:

compile time -40%.
bytecode size -14%.

-Armand's test case:

compile time -53%.
bytecode size -13%.

• WebCore.xcodeproj/project.pbxproj:
• contentextensions/CombinedURLFilters.cpp:

(WebCore::ContentExtensions::ActiveSubtree::ActiveSubtree):
(WebCore::ContentExtensions::generateInfixUnsuitableForReverseSuffixTree):
(WebCore::ContentExtensions::generateSuffixWithReverseSuffixTree):
(WebCore::ContentExtensions::clearReverseSuffixTree):
(WebCore::ContentExtensions::generateNFAForSubtree):

• contentextensions/DFA.cpp:

(WebCore::ContentExtensions::DFA::debugPrintDot):
Forgot to close a tag, dot was not happy.

• contentextensions/HashableActionList.h: Added.

(WebCore::ContentExtensions::HashableActionList::HashableActionList):
(WebCore::ContentExtensions::HashableActionList::isEmptyValue):
(WebCore::ContentExtensions::HashableActionList::isDeletedValue):
(WebCore::ContentExtensions::HashableActionList::operator==):
(WebCore::ContentExtensions::HashableActionList::operator!=):
(WebCore::ContentExtensions::HashableActionListHash::hash):
(WebCore::ContentExtensions::HashableActionListHash::equal):
We need a way to group reverse suffix tree by their terminal actions.
This new hash structure lets us find unique vertex for a list of actions
in any order.

• contentextensions/ImmutableNFANodeBuilder.h:

(WebCore::ContentExtensions::ImmutableNFANodeBuilder::isValid):
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::nodeId):
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::addTransition):
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::addEpsilonTransition):
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::ImmutableNFANodeBuilder): Deleted.
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::~ImmutableNFANodeBuilder): Deleted.
(WebCore::ContentExtensions::ImmutableNFANodeBuilder::operator=): Deleted.

• contentextensions/Term.h:

(WebCore::ContentExtensions::Term::generateGraph):
(WebCore::ContentExtensions::Term::generateSubgraphForAtom):
Node building changes a bit.

Previously, it was assumed nodes are always built from left to right.
Getting the node on the right was done by providing the left node and the term
doing the transition.

Now we have both left to right and right to left generation.

The right-to-left has a specific property: no edge can be added after
it's initial term (rule 2 of our reverse suffix tree). This simplifies
things a bit since we can finalize all the nodes in the suffix tree.
All we need is to keep their ID to be able to link new nodes
to the reverse suffix tree.

Source/WTF:

• wtf/Vector.h:

(WTF::minCapacity>::Vector):
(WTF::=):
Copying a vector with a different inline capacity was broken due to
the addition of MinimumCapacity.

This feature was needed by this patch so I fixed WTF.

Tools:

• TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp:

(TestWebKitAPI::compareContents):

• TestWebKitAPI/Tests/WebCore/DFAMinimizer.cpp:

2:50 PM Changeset in webkit [186909] by Simon Fraser

• 3 edits in trunk/Source/WebKit/mac

[iOS] Expose contentsSizeRespectingOverflow() via WebView so UIWebView can use it
​https://bugs.webkit.org/show_bug.cgi?id=146924
WebKit part of rdar://problem/21802456

Reviewed by Tim Horton.

Expose the FrameView's contentsSizeRespectingOverflow() via WebView, for use
by UIKit.

• WebView/WebView.mm:

(-[WebView _contentsSizeRespectingOverflow]):

• WebView/WebViewPrivate.h:

2:40 PM Changeset in webkit [186908] by Andres Gomez

• 3 edits in trunk/Source/WebInspectorUI

[GTK] Web Inspector: Further optimize the weight and time icons taken back to the toolbar dashboard for the GTK+ port
​https://bugs.webkit.org/show_bug.cgi?id=147010

SVG images optimized with a combination of sed replacements, the
usage of the scour tool (​http://www.codedread.com/scour/) and a
forked version of the svgo tool (​https://github.com/tanty/svgo).

Also, added the class attribute to the shape elements following
the convention used in Apple's images.

Reviewed by Martin Robinson.

• UserInterface/Images/gtk/Time.svg: Optimized.
• UserInterface/Images/gtk/Weight.svg: Optimized.

1:24 PM Changeset in webkit [186907] by beidson@apple.com

• 2 edits in trunk/Source/WebCore

Rolling out part of r186895 until rdar://problem/21861167 is resolved.
​https://bugs.webkit.org/show_bug.cgi?id=146976

• platform/network/cf/CookieJarCFNet.cpp:

(WebCore::createCookies): Don’t use this new SPI quite yet.

1:19 PM Changeset in webkit [186906] by fpizlo@apple.com

• 25 edits in trunk

Unreviewed, roll out ​http://trac.webkit.org/changeset/186903. It broke the build.

Source/WebCore:

• CMakeLists.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/DOMWrapperWorld.h:

(WebCore::currentWorld):
(WebCore::worldForDOMObject): Deleted.

• bindings/js/JSBindingsAllInOne.cpp:
• bindings/js/JSCustomEventCustom.cpp:

(WebCore::JSCustomEvent::detail): Deleted.

• bindings/js/JSMessageEventCustom.cpp:

(WebCore::JSMessageEvent::data):

• bindings/js/JSPopStateEventCustom.cpp:

(WebCore::JSPopStateEvent::state):

• dom/CustomEvent.cpp:

(WebCore::CustomEvent::initCustomEvent):
(WebCore::CustomEvent::eventInterface):
(WebCore::CustomEvent::trySerializeDetail): Deleted.

• dom/CustomEvent.h:
• dom/CustomEvent.idl:
• dom/MessageEvent.cpp:

(WebCore::MessageEvent::initMessageEvent):
(WebCore::MessageEvent::data):
(WebCore::MessageEvent::trySerializeData): Deleted.

• dom/MessageEvent.h:
• dom/PopStateEvent.cpp:

(WebCore::PopStateEvent::create):
(WebCore::PopStateEvent::eventInterface):
(WebCore::PopStateEvent::trySerializeState): Deleted.

• dom/PopStateEvent.h:
• testing/Internals.cpp:

(WebCore::Internals::deserializeBuffer):
(WebCore::Internals::setUsesOverlayScrollbars):
(WebCore::Internals::isFromCurrentWorld): Deleted.

• testing/Internals.h:
• testing/Internals.idl:

LayoutTests:

• fast/events/constructors/custom-event-constructor-expected.txt:
• fast/events/constructors/custom-event-constructor.html:
• fast/events/event-leak-objects-expected.txt:
• fast/events/event-leak-objects.html:
• fast/events/event-properties-gc-expected.txt:
• fast/events/event-properties-gc.html:

1:07 PM Changeset in webkit [186905] by timothy_horton@apple.com

• 1 edit
  2 adds in trunk/LayoutTests

Rebaseline test for Windows.

• platform/win/fast/shrink-wrap: Added.
• platform/win/fast/shrink-wrap/rect-shrink-wrap-expected.txt: Added.

1:06 PM Changeset in webkit [186904] by Michael Catanzaro

• 2 edits in trunk/Source/WebKit2

REGRESSION(r186464): [SOUP] ASSERTION FAILED: !m_messageReceiverMapCount when closing any tab
​https://bugs.webkit.org/show_bug.cgi?id=147006

Reviewed by Anders Carlsson.

Remove the message receiver before it is deallocated.

• UIProcess/Network/CustomProtocols/soup/CustomProtocolManagerProxySoup.cpp:

(WebKit::CustomProtocolManagerProxy::~CustomProtocolManagerProxy):

12:30 PM Changeset in webkit [186903] by fpizlo@apple.com

• 20 edits
  5 adds in trunk

Remove leak of objects between isolated worlds on custom events, message events, and pop state events.
​https://bugs.webkit.org/show_bug.cgi?id=118884

Patch by Keith Miller <​keith_miller@apple.com> on 2015-07-16
Reviewed by Filip Pizlo.

Source/WebCore:

Tests: fast/events/event-leak-objects.html

fast/events/event-properties-gc.html

Fixes an issue where objects passed as certain properties of events could cross isolated worlds. This
was fixed by checking that any object passed by an event must be serializable or originate from the same
isolated world as the one it is currently being accessed in. In the case of MessageEvents and PopStateEvents we
cache the values of the data and state properties, respectively, as they may be a deserialized object. In case
an object was deserialized in a world with elevated privileges we also check the cached value is from the same
world, if it is from a different world we recompute it. For testing purposes, I added a new function to Internals
that determines whether a JSObject originated in the current world.

• CMakeLists.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/DOMWrapperWorld.h:

(WebCore::worldForDOMObject):

• bindings/js/JSBindingsAllInOne.cpp:
• bindings/js/JSCustomEventCustom.cpp: Copied from Source/WebCore/dom/CustomEvent.cpp.

(WebCore::JSCustomEvent::detail):

• bindings/js/JSMessageEventCustom.cpp:

(WebCore::JSMessageEvent::data):

• bindings/js/JSPopStateEventCustom.cpp:

(WebCore::JSPopStateEvent::state):

• dom/CustomEvent.cpp:

(WebCore::CustomEvent::initCustomEvent):
(WebCore::CustomEvent::trySerializeDetail):

• dom/CustomEvent.h:
• dom/CustomEvent.idl:
• dom/MessageEvent.cpp:

(WebCore::MessageEvent::initMessageEvent):
(WebCore::MessageEvent::trySerializeData):

• dom/MessageEvent.h:
• dom/PopStateEvent.cpp:

(WebCore::PopStateEvent::trySerializeState):

• dom/PopStateEvent.h:
• testing/Internals.cpp:

(WebCore::Internals::isFromCurrentWorld):

• testing/Internals.h:
• testing/Internals.idl:

LayoutTests:

These tests ensure ensure objects are not leaked across isolated worlds and that those properties are not prematurely
garbage collected.

• fast/events/constructors/custom-event-constructor-expected.txt:
• fast/events/constructors/custom-event-constructor.html:
• fast/events/event-leak-objects-expected.txt: Added.
• fast/events/event-leak-objects.html: Added.
• fast/events/event-properties-gc-expected.txt: Added.
• fast/events/event-properties-gc.html: Added.

12:16 PM Changeset in webkit [186902] by bshafiei@apple.com

• 5 edits in branches/safari-600.1.4.17-branch/Source

Versioning.

11:31 AM Changeset in webkit [186901] by Andres Gomez

• 1 edit
  1 add in trunk/Source/WebInspectorUI

[GTK] Web Inspector: Add new Network icon for the GTK+ port
​https://bugs.webkit.org/show_bug.cgi?id=147002

Reviewed by Martin Robinson.

• UserInterface/Images/gtk/Network.svg: Added.

Icon for the new Network tab.

11:23 AM Changeset in webkit [186900] by ddkilzer@apple.com

• 2 edits in trunk/LayoutTests

Mark fast/canvas/canvas-too-large-to-draw.html as crashing on El Capitan

Fix is tracked by <rdar://problem/21857102>.

• platform/mac/TestExpectations: Mark test as crashing:
• fast/canvas/canvas-too-large-to-draw.html

10:52 AM Changeset in webkit [186899] by Brent Fulgham

• 2 edits in trunk/Source/WebKit

[Win] Unreviewed gardening.

• WebKit.vcxproj/WebKit/WebKit.vcxproj.filters: Move file into the

appropriate category in the project.

10:42 AM Changeset in webkit [186898] by Brent Fulgham

• 2 edits in trunk/Source/WebKit/win

[Win] Gross workaround to fix build after r186858.

• WebView.cpp:

(WebView::unused5): Force export of WebCore symbol through
WebKit.dll.

10:39 AM Changeset in webkit [186897] by beidson@apple.com

• 2 edits in trunk/Source/WebKit2

Review feedback followup for:
REGRESSION(r186088): Crash under WebKit::WebPageProxy::didFailLoadForFrame
<rdar://problem/21692212> and ​https://bugs.webkit.org/show_bug.cgi?id=146988

• UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::refView): CFRetain instead of Obj-C retain.
(WebKit::PageClientImpl::derefView): CFRelease instead of Obj-C release.

10:26 AM Changeset in webkit [186896] by Andres Gomez

• 1 edit
  1 add in trunk/Source/WebInspectorUI

[GTK] Web Inspector: Add new composite record icon for the GTK+ port
​https://bugs.webkit.org/show_bug.cgi?id=146998

Reviewed by Martin Robinson.

• UserInterface/Images/gtk/TimelineRecordComposite.svg: Added.

New composite record icon.

10:25 AM Changeset in webkit [186895] by beidson@apple.com

• 3 edits in trunk/Source/WebCore

WebKit document.cookie mis-parsing.
rdar://problem/21715050 and ​https://bugs.webkit.org/show_bug.cgi?id=146976

Reviewed by Sam Weinig.

• platform/network/cf/CookieJarCFNet.cpp:

(WebCore::createCookies): Use new SPI if available.
(WebCore::setCookiesFromDOM):

• platform/spi/cf/CFNetworkSPI.h:

10:21 AM Changeset in webkit [186894] by andersca@apple.com

• 19 edits in trunk/Source/WebCore

Headers that use WEBCORE_EXPORT should include PlatformExportMacros.h
​https://bugs.webkit.org/show_bug.cgi?id=146984

Reviewed by Daniel Bates.

• contentextensions/DFA.h:
• dom/ContextDestructionObserver.h:
• dom/DeviceOrientationData.h:
• dom/ExceptionCodePlaceholder.h:
• editing/cocoa/HTMLConverter.h:
• html/track/AudioTrack.h:
• loader/FrameLoaderStateMachine.h:
• loader/appcache/ApplicationCacheHost.h:
• loader/cache/CachedResourceHandle.h:
• platform/URL.h:
• platform/animation/Animation.h:
• platform/audio/AudioHardwareListener.h:
• platform/audio/AudioSession.h:
• platform/graphics/transforms/AffineTransform.h:
• platform/network/Credential.h:
• platform/network/CredentialBase.h:
• platform/network/ResourceHandleClient.h:
• platform/network/mac/AuthenticationMac.h:

8:34 AM Changeset in webkit [186893] by Michael Catanzaro

• 2 edits in trunk/Source/WebKit2

[Linux] Seccomp: fix -Wmismatched-tags
​https://bugs.webkit.org/show_bug.cgi?id=146990

Reviewed by Žan Doberšek.

WebProcessCreationParameters is a struct nowadays, not a class, so declare it appropriately.

• Shared/linux/SeccompFilters/SyscallPolicy.h:

3:29 AM Changeset in webkit [186892] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit2

REGRESSION(r185415): [GTK] Browsers crash when an input method is enabled
​https://bugs.webkit.org/show_bug.cgi?id=146639

Reviewed by Žan Doberšek.

In r185415 I assumed that preedit signals were always emitted
after a keypress was handled by the WebView. However, some input
methods handle the keyboard events before the WebView, and preedit
signals are emitted but no key event has been handled by the
WebView. So, instead of asserting when filter key event completion
handler is nullptr, we should check whether the current event was
generated for a WebView filter request or not. In case the
completion handler is nullptr, we send the event directly to the
page, instead of going through the WebView, since there won't be
editing commands for those events anyway.

• UIProcess/gtk/InputMethodFilter.cpp:

(WebKit::InputMethodFilter::handleKeyboardEvent):
(WebKit::InputMethodFilter::handleKeyboardEventWithCompositionResults):

1:57 AM Changeset in webkit [186891] by commit-queue@webkit.org

• 4 edits
  2 adds
  2 deletes in trunk

Web Inspector: update $$() to return an Array
​https://bugs.webkit.org/show_bug.cgi?id=146964

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2015-07-16
Reviewed by Brian Burg.

Source/WebCore:

Test: inspector/console/command-line-api.html

• inspector/CommandLineAPIModuleSource.js:

Update $$(...) to return an array.
Also InjectedScriptHost.type was renamed to subtype
a while ago.

LayoutTests:

• inspector/console/command-line-api-expected.txt: Added.
• inspector/console/command-line-api.html: Added.

Add back a command line api test.

• platform/efl/inspector/console/command-line-api-expected.txt: Removed.
• platform/mac/inspector/console/command-line-api-expected.txt: Removed.

Remove old platform expected results for the old version of this test.

• platform/win/TestExpectations:

Speculatively skipping on Windows since other inspector/console tests are skipped.