Context Navigation

← Previous Period
Next Period →

Timeline

Jul 18, 2015:

9:38 PM Changeset in webkit [187008] by timothy_horton@apple.com

2 edits in trunk/Source/WebCore

Simplify Path(CG)::transform/translate
https://bugs.webkit.org/show_bug.cgi?id=147077

Reviewed by Simon Fraser.

No new tests; no behavior change.

platform/graphics/cg/PathCG.cpp:

(WebCore::Path::translate):
(WebCore::Path::transform):
Use CGPathCreateMutableCopyByTransformingPath to do the copy and transform
in a single call instead of two.

Make use of transform() to implement translate() instead of duplicating the code.
Move the two functions near each other.

(WebCore::Path::boundingRect):
Remove irrelevant reference to Snow Leopard.

8:37 PM Changeset in webkit [187007] by Simon Fraser

3 edits in trunk/Tools

MiniBrowser window title is just "Window" when page has no <title>
https://bugs.webkit.org/show_bug.cgi?id=147076

Reviewed by Tim Horton.

Make MiniBrowser windows show the filename from the URL if we never get a title changed
notification.

MiniBrowser/mac/WK1BrowserWindowController.m:

(-[WK1BrowserWindowController updateTitle:]):
(-[WK1BrowserWindowController webView:didCommitLoadForFrame:]):
(-[WK1BrowserWindowController webView:didReceiveTitle:forFrame:]):

MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController updateTitle:]):
(-[WK2BrowserWindowController observeValueForKeyPath:ofObject:change:context:]):
(-[WK2BrowserWindowController webView:didCommitNavigation:]):

7:14 PM Changeset in webkit [187006] by mrajca@apple.com

5 edits
2 adds in trunk

Media Session: Add support for 'Content' interruption types
https://bugs.webkit.org/show_bug.cgi?id=147042

Reviewed by Eric Carlson.

Tests: Added media/session/content-interruptions

Modules/mediasession/MediaSession.cpp:

(WebCore::MediaSession::handleIndefinitePauseInterruption): Indefinitely pause the session by pausing media

elements and removing them from the set of active participating elements.

Modules/mediasession/MediaSession.h:
Modules/mediasession/MediaSessionManager.cpp:

(WebCore::MediaSessionManager::didReceiveStartOfInterruptionNotification): Implemented support for 'Content'

interruption types as described in 4.5.2.

6:36 PM Changeset in webkit [187005] by mrajca@apple.com

2 edits in trunk/Source/WebCore

Media Session: add support for telephony interruptions
https://bugs.webkit.org/show_bug.cgi?id=147016

Reviewed by Eric Carlson.

platform/audio/mac/MediaSessionInterruptionProviderMac.mm:

(WebCore::callDidBeginRinging): Forward this event to media sessions as a 'Transient' interruption.
(WebCore::MediaSessionInterruptionProviderMac::beginListeningForInterruptions):
(WebCore::MediaSessionInterruptionProviderMac::stopListeningForInterruptions):

6:30 PM Changeset in webkit [187004] by mrajca@apple.com

7 edits in trunk/Source/WebCore

Media Session: add infrastructure for testing interruptions
https://bugs.webkit.org/show_bug.cgi?id=147060

Reviewed by Eric Carlson.

Modules/mediasession/MediaSession.h: Export methods to be used with tests.
Modules/mediasession/MediaSessionManager.h: Ditto.
bindings/scripts/CodeGeneratorJS.pm: JSMediaSession needs to be marked with WEBCORE_EXPORT so it works with JSInternals.
testing/Internals.cpp:

(WebCore::Internals::sendMediaSessionStartOfInterruptionNotification): Let tests send interruptions to MediaSessionManager.
(WebCore::Internals::sendMediaSessionEndOfInterruptionNotification): Ditto.
(WebCore::Internals::mediaSessionCurrentState): Expose the current state of media sessions to tests.

testing/Internals.h:
testing/Internals.idl: Add interfaces for sending interruptions from JS tests.

5:36 PM Changeset in webkit [187003] by saambarati1@gmail.com

4 edits
1 add in trunk/Source/JavaScriptCore

lexical scoping is broken with respect to "break" and "continue"
https://bugs.webkit.org/show_bug.cgi?id=147063

Reviewed by Filip Pizlo.

Bug #142944 which introduced "let" and lexical scoping
didn't properly hook into the bytecode generator's machinery
for calculating scope depth deltas for "break" and "continue". This
resulted in the bytecode generator popping an incorrect number
of scopes when lexical scopes were involved.

This patch fixes this problem and generalizes this machinery a bit.
This patch also renames old functions in a sensible way that is more
coherent in a world with lexical scoping.

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::newLabelScope):
(JSC::BytecodeGenerator::emitProfileType):
(JSC::BytecodeGenerator::pushLexicalScope):
(JSC::BytecodeGenerator::popLexicalScope):
(JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
(JSC::BytecodeGenerator::resolveType):
(JSC::BytecodeGenerator::emitResolveScope):
(JSC::BytecodeGenerator::emitGetFromScope):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPushWithScope):
(JSC::BytecodeGenerator::emitGetParentScope):
(JSC::BytecodeGenerator::emitPopScope):
(JSC::BytecodeGenerator::emitPopWithOrCatchScope):
(JSC::BytecodeGenerator::emitPopScopes):
(JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler):
(JSC::BytecodeGenerator::localScopeDepth):
(JSC::BytecodeGenerator::labelScopeDepth):
(JSC::BytecodeGenerator::emitThrowReferenceError):
(JSC::BytecodeGenerator::emitPushFunctionNameScope):
(JSC::BytecodeGenerator::pushScopedControlFlowContext):
(JSC::BytecodeGenerator::popScopedControlFlowContext):
(JSC::BytecodeGenerator::emitPushCatchScope):
(JSC::BytecodeGenerator::currentScopeDepth): Deleted.

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::hasFinaliser):
(JSC::BytecodeGenerator::scopeDepth): Deleted.

bytecompiler/NodesCodegen.cpp:

(JSC::ContinueNode::trivialTarget):
(JSC::BreakNode::trivialTarget):
(JSC::ReturnNode::emitBytecode):
(JSC::WithNode::emitBytecode):
(JSC::TryNode::emitBytecode):

tests/stress/lexical-scoping-break-continue.js: Added.

(assert):
(.):

5:16 PM Changeset in webkit [187002] by Gyuyoung Kim

86 edits in trunk/Source

Reduce PassRefPtr in WebKit2 - 3
https://bugs.webkit.org/show_bug.cgi?id=146995

Reviewed by Daniel Bates.

To remove PassRefPtr, this patch reduces use of PassRefPtr in WebKit2.
Because some uses depend on WebCore, WebCore, WK1 ports are modified as well.

Source/WebCore:

loader/EmptyClients.cpp:

(WebCore::EmptyChromeClient::createPopupMenu):
(WebCore::EmptyChromeClient::createSearchPopupMenu):
(WebCore::EmptyFrameLoaderClient::createDocumentLoader):
(WebCore::EmptyFrameLoaderClient::createFrame):
(WebCore::EmptyFrameLoaderClient::createPlugin):

loader/EmptyClients.h:
loader/FrameLoader.cpp:

(WebCore::FrameLoader::init):
(WebCore::FrameLoader::load):
(WebCore::FrameLoader::loadWithNavigationAction):
(WebCore::FrameLoader::reloadWithOverrideEncoding):
(WebCore::FrameLoader::reload):

loader/FrameLoaderClient.h:
loader/ResourceLoadScheduler.cpp:

(WebCore::ResourceLoadScheduler::scheduleSubresourceLoad):
(WebCore::ResourceLoadScheduler::schedulePluginStreamLoad):

loader/ResourceLoadScheduler.h:
loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::create):

loader/SubresourceLoader.h:
page/ChromeClient.h:
platform/graphics/texmap/TextureMapperBackingStore.h:
platform/graphics/texmap/TextureMapperLayer.h:

(WebCore::TextureMapperLayer::texture):

platform/graphics/texmap/TextureMapperSurfaceBackingStore.cpp:

(WebCore::TextureMapperSurfaceBackingStore::texture):

platform/graphics/texmap/TextureMapperSurfaceBackingStore.h:
platform/graphics/texmap/TextureMapperTile.h:

(WebCore::TextureMapperTile::texture):

platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:

(WebCore::TextureMapperTiledBackingStore::texture):

platform/graphics/texmap/TextureMapperTiledBackingStore.h:
storage/StorageNamespace.h:

Source/WebKit/mac:

WebCoreSupport/WebFrameLoaderClient.h:
WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::createDocumentLoader):

Source/WebKit/win:

WebCoreSupport/WebFrameLoaderClient.cpp:

(WebFrameLoaderClient::createDocumentLoader):

WebCoreSupport/WebFrameLoaderClient.h:

Source/WebKit2:

DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateUniqueIDBDatabase):

DatabaseProcess/DatabaseProcess.h:
PluginProcess/PluginControllerProxy.cpp:

(WebKit::PluginControllerProxy::takeInitializationReply):

PluginProcess/PluginControllerProxy.h:
Shared/CoordinatedGraphics/CoordinatedBackingStore.cpp:

(WebKit::CoordinatedBackingStore::texture):

Shared/CoordinatedGraphics/CoordinatedBackingStore.h:

(WebKit::CoordinatedBackingStore::create):

Shared/CoordinatedGraphics/WebCoordinatedSurface.cpp:

(WebKit::WebCoordinatedSurface::create):
(WebKit::WebCoordinatedSurface::createWithSurface):

Shared/CoordinatedGraphics/WebCoordinatedSurface.h:
UIProcess/API/APILoaderClient.h:

(API::LoaderClient::webCryptoMasterKey):

UIProcess/API/APINavigationClient.h:

(API::NavigationClient::webCryptoMasterKey):

UIProcess/API/C/WKPage.cpp:

(WKPageSetPageLoaderClient):
(WKPageSetPageNavigationClient):

UIProcess/API/gtk/PageClientImpl.cpp:

(WebKit::PageClientImpl::createPopupMenuProxy):
(WebKit::PageClientImpl::createContextMenuProxy):
(WebKit::PageClientImpl::createColorPicker):

UIProcess/API/gtk/PageClientImpl.h:
UIProcess/Authentication/WebCredential.h:
UIProcess/Authentication/WebProtectionSpace.h:
UIProcess/AutoCorrectionCallback.h:
UIProcess/Cocoa/NavigationState.h:
UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::webCryptoMasterKey):

UIProcess/CoordinatedGraphics/WebView.cpp:

(WebKit::WebView::createPopupMenuProxy):
(WebKit::WebView::createContextMenuProxy):
(WebKit::WebView::createColorPicker):

UIProcess/CoordinatedGraphics/WebView.h:
UIProcess/PageClient.h:
UIProcess/WebPageProxy.h:
UIProcess/efl/WebViewEfl.cpp:

(WebKit::WebViewEfl::createPopupMenuProxy):
(WebKit::WebViewEfl::createContextMenuProxy):
(WebKit::WebViewEfl::createColorPicker):

UIProcess/efl/WebViewEfl.h:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::createPopupMenuProxy):
(WebKit::PageClientImpl::createContextMenuProxy):

UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::dataSelectionForPasteboard):

UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::createPopupMenuProxy):
(WebKit::PageClientImpl::createContextMenuProxy):
(WebKit::PageClientImpl::createColorPicker):

UIProcess/mac/WebPageProxyMac.mm:

(WebKit::WebPageProxy::dataSelectionForPasteboard):

WebProcess/Network/WebResourceLoadScheduler.cpp:

(WebKit::WebResourceLoadScheduler::scheduleSubresourceLoad):
(WebKit::WebResourceLoadScheduler::schedulePluginStreamLoad):

WebProcess/Network/WebResourceLoadScheduler.h:
WebProcess/Plugins/Netscape/NetscapePlugin.cpp:

(WebKit::NetscapePlugin::fromNPP):
(WebKit::NetscapePlugin::snapshot):
(WebKit::NetscapePlugin::liveResourceData):

WebProcess/Plugins/Netscape/NetscapePlugin.h:
WebProcess/Plugins/Plugin.h:
WebProcess/Plugins/PluginProxy.cpp:

(WebKit::PluginProxy::snapshot):
(WebKit::PluginProxy::liveResourceData):

WebProcess/Plugins/PluginProxy.h:
WebProcess/Storage/StorageNamespaceImpl.cpp:

(WebKit::StorageNamespaceImpl::storageArea):
(WebKit::StorageNamespaceImpl::copy):

WebProcess/Storage/StorageNamespaceImpl.h:
WebProcess/WebCoreSupport/SessionStateConversion.cpp:

(WebKit::toHistoryItem):

WebProcess/WebCoreSupport/SessionStateConversion.h:
WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createPopupMenu):
(WebKit::WebChromeClient::createSearchPopupMenu):

WebProcess/WebCoreSupport/WebChromeClient.h:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::createDocumentLoader):
(WebKit::WebFrameLoaderClient::createFrame):
(WebKit::WebFrameLoaderClient::createPlugin):

WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::create):
(WebKit::WebPage::createDocumentLoader):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::lookupTextAtLocation):

4:54 PM Changeset in webkit [187001] by Simon Fraser

2 edits in trunk/Source/WebKit2

Scroll position jumps when scrolling scaling pages down in split view
https://bugs.webkit.org/show_bug.cgi?id=147072
rdar://problem/21769577

Reviewed by Sam Weinig.

When apple.com/music is in Split View at a reduced scale, scrolling the page
can cause unwanted scroll jumps. This happened because we'd enter
TiledCoreAnimationDrawingArea::scaleViewToFitDocumentIfNeeded() with a pending
layout, so run the autosizing logic. When scrolled near the bottom, the unconstrained
layout resulted in a shorter document, which truncated the scroll position. The
scaled layout then restored the longer document, but it also restored that
truncated scroll position.

Forcing a layout is sufficient to fix the bug for this page, and doing a single
layout (which will happen anyway) is preferable to running the autosize logic
if layout happens to be dirty.

I was not able to make a test to reproduce the problem. Entering
scaleViewToFitDocumentIfNeeded() with pending layout was triggerable
using a transform transition, but I was not able to reproduce incorrect
scroll position restoration.

WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:

(WebKit::TiledCoreAnimationDrawingArea::scaleViewToFitDocumentIfNeeded):

4:41 PM Changeset in webkit [187000] by ddkilzer@apple.com

2 edits in trunk/LayoutTests

inspector/console/command-line-api.html is slow on Debug Yosemite WK2

<http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=inspector%2Fconsole%2Fcommand-line-api.html>

platform/mac-wk2/TestExpectations: Mark test as slow on Debug

Yosemite WK2:

inspector/console/command-line-api.html

4:32 PM Changeset in webkit [186999] by ddkilzer@apple.com

2 edits in trunk/LayoutTests

http/tests/cache/disk-cache/disk-cache-disable.html is flaky on Release Yosemite WK2

<http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=http%2Ftests%2Fcache%2Fdisk-cache%2Fdisk-cache-disable.html>

platform/mac-wk2/TestExpectations: Mark test as flaky on

Release Yosemite WK2:

http/tests/cache/disk-cache/disk-cache-disable.html

4:32 PM Changeset in webkit [186998] by ddkilzer@apple.com

2 edits in trunk/LayoutTests

media/restore-from-page-cache.html is flaky on Debug Mavericks

<https://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Frestore-from-page-cache.html>

When the test fails, the computed width and height is
300px × 150px instead of the expected 320px × 240px.

platform/mac/TestExpectations: Mark test as flaky on Debug Mavericks:
media/restore-from-page-cache.html

2:21 PM Changeset in webkit [186997] by commit-queue@webkit.org

4 edits
1 delete in trunk/Source/JavaScriptCore

Unreviewed, rolling out r186996.
https://bugs.webkit.org/show_bug.cgi?id=147070

Broke JSC tests (Requested by smfr on #webkit).

Reverted changeset:

"lexical scoping is broken with respect to "break" and
"continue""
https://bugs.webkit.org/show_bug.cgi?id=147063
http://trac.webkit.org/changeset/186996

1:12 PM Changeset in webkit [186996] by saambarati1@gmail.com

4 edits
1 add in trunk/Source/JavaScriptCore

lexical scoping is broken with respect to "break" and "continue"
https://bugs.webkit.org/show_bug.cgi?id=147063

Reviewed by Filip Pizlo.

This patch fixes this problem and generalizes this machinery a bit.
This patch also renames old functions in a sensible way that is more
coherent in a world with lexical scoping.

bytecompiler/BytecodeGenerator.cpp:

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::hasFinaliser):
(JSC::BytecodeGenerator::scopeDepth): Deleted.

bytecompiler/NodesCodegen.cpp:

(JSC::ContinueNode::trivialTarget):
(JSC::BreakNode::trivialTarget):
(JSC::ReturnNode::emitBytecode):
(JSC::WithNode::emitBytecode):
(JSC::TryNode::emitBytecode):

tests/stress/lexical-scoping-break-continue.js: Added.

(assert):
(.):

12:48 PM Changeset in webkit [186995] by Alan Bujtas

2 edits in trunk/LayoutTests

[Win] Skip input range repaint test.

platform/win/TestExpectations:

7:22 AM Changeset in webkit [186994] by ddkilzer@apple.com

2 edits in trunk/LayoutTests

REGRESSION (r186981): fast/repaint/block-inputrange-repaint.html is starting out life as flaky

<https://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Frepaint%2Fblock-inputrange-repaint.html>

fast/repaint/block-inputrange-repaint.html:
Use setTimeout() to give WebKit time to repaint.

6:54 AM Changeset in webkit [186993] by ddkilzer@apple.com

4 edits in trunk/LayoutTests

REGRESSION (r186905,r186992): Incorrect results for platform/{gtk,efl,win}/fast/shrink-wrap/rect-shrink-wrap-expected.txt

platform/efl/fast/shrink-wrap/rect-shrink-wrap-expected.txt:
platform/gtk/fast/shrink-wrap/rect-shrink-wrap-expected.txt:
platform/win/fast/shrink-wrap/rect-shrink-wrap-expected.txt:
Update to correct expected results.

5:54 AM Changeset in webkit [186992] by ddkilzer@apple.com

1 edit
4 adds in trunk/LayoutTests

REGRESSION (r186858): GTK and EFL ports don't composite <canvas> elements

Jul 17, 2015:

11:32 PM Changeset in webkit [186987] by commit-queue@webkit.org

2 edits in trunk

Bring back the GNU ar check to create thin archives on non-Linux systems
https://bugs.webkit.org/show_bug.cgi?id=146681

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2015-07-17
Reviewed by Martin Robinson.

We already use GNU ar thin archive feature to save time and disk space
on creating static archives, but it is only enabled on Linux. Without
this feature, the debug build of WebCore can be larger than 4 GiB,
which can cause error because GNU ar format uses 32-bit integer to
store offsets in the symbol table. This patch is similar to
https://bugs.webkit.org/show_bug.cgi?id=128596.

Source/cmake/OptionsCommon.cmake:

10:51 PM Changeset in webkit [186986] by fpizlo@apple.com

5 edits in trunk/Source/JavaScriptCore

DFG should have some obvious mitigations against watching structures that are unprofitable to watch
https://bugs.webkit.org/show_bug.cgi?id=147034

Reviewed by Mark Lam and Michael Saboff.

This implements two guards against the DFG watching structures that are likely to fire
their watchpoints:

Don't watch dictionaries or any structure that had a dictionary in its past. Dictionaries can be flattened, and then they can transform back to dictionaries.

Don't watch structures whose past structures were transitioned-away from while their transition watchpoints were being watched. This property gives us monotonicity: if we recompile because we watched structure S1 of object O, then we won't make the same mistake again when object O has structure S2, S3, and so on.

This is a 1.5% speed-up on Kraken. It does penalize some Octane tests, but it also seems to
help some of them, so on Octane it's basically neutral.

bytecode/Watchpoint.h:

(JSC::WatchpointSet::invalidate):
(JSC::WatchpointSet::isBeingWatched):
(JSC::WatchpointSet::addressOfState):
(JSC::WatchpointSet::addressOfSetIsNotEmpty):
(JSC::InlineWatchpointSet::touch):
(JSC::InlineWatchpointSet::isBeingWatched):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::createStructure):
(JSC::JSGlobalObject::registerWeakMap):

runtime/Structure.cpp:

(JSC::Structure::Structure):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::didTransitionFromThisStructure):

runtime/Structure.h:

10:49 PM Changeset in webkit [186985] by fpizlo@apple.com

8 edits
2 deletes in trunk/Source/JavaScriptCore

Remove DFG::DesiredWriteBarriers because it's just a very difficult way of saying "please barrier the machine code block owner"
https://bugs.webkit.org/show_bug.cgi?id=147030

Reviewed by Andreas Kling.

All of the users of DesiredWriteBarriers were just using it to request that Plan
finalization executes a barrier on codeBlock->ownerExecutable. Indeed, that's the only
owning cell in the heap that compilation affects. So, we might as well just have Plan
unconditionally execute that barrier and then we don't need DesiredWriteBarriers at
all.

CMakeLists.txt:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

dfg/DFGDesiredWriteBarriers.cpp: Removed.
dfg/DFGDesiredWriteBarriers.h: Removed.
dfg/DFGGraph.cpp:

(JSC::DFG::Graph::registerFrozenValues):

dfg/DFGPlan.cpp:

(JSC::DFG::Plan::reallyAdd):
(JSC::DFG::Plan::notifyCompiling):
(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):

dfg/DFGPlan.h:

10:20 PM Changeset in webkit [186984] by Alan Bujtas

3 edits
2 adds in trunk

REGRESSION (r169105): Do not assign a renderer to multiple selection subtrees.
https://bugs.webkit.org/show_bug.cgi?id=147038
rdar://problem/21819351

Reviewed by David Kilzer.

A renderer should never be assigned to multiple selection subtrees. (Currently RenderObject maintains the last selection state.)
RenderView::applySubtreeSelection() loops from the start to the end of the selection to find renderers that are inside the selection.
However, in case of regions (when multiple selection roots are present) traversing the renderer tree by calling RenderObject::nextInPreOrder() could
end up going across selection roots.
This patch ensures that we assign renderers to a specific selection only when the current selection root and the renderer's selection root match.

Source/WebCore:

Test: fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2.html

rendering/RenderView.cpp:

(WebCore::SelectionIterator::SelectionIterator):
(WebCore::SelectionIterator::current):
(WebCore::SelectionIterator::checkForSpanner):
(WebCore::RenderView::applySubtreeSelection):

LayoutTests:

fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2-expected.txt: Added.
fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2.html: Added.

9:44 PM Changeset in webkit [186983] by aestes@apple.com

12 edits
17 adds in branches/safari-600.1.4.17-branch

Merge r186982. rdar://problem/21709404

8:47 PM Changeset in webkit [186982] by aestes@apple.com

12 edits
17 adds in trunk

[iOS] Further tighten the sandbox around pages fetched with Content-Disposition: attachment
https://bugs.webkit.org/show_bug.cgi?id=147044
rdar://problem/21567820

Reviewed by Brady Eidson.

Source/WebCore:

In addition to placing resources fetched with 'Content-Disposition: attachment' in a unique origin,
this change does the following:

Switches the sandbox type from SandboxOrigin to SandboxAll, which enforces the same restrictions as <iframe sandbox>.
Disables processing of <meta http-equiv> elements.
Disables loading of cross-origin subframes.

Tests: http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled.html

http/tests/contentdispositionattachmentsandbox/form-submission-disabled.html
http/tests/contentdispositionattachmentsandbox/http-equiv-disabled.html
http/tests/contentdispositionattachmentsandbox/plugins-disabled.html
http/tests/contentdispositionattachmentsandbox/scripts-disabled.html

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Switched to calling Document::httpEquivPolicy(). Logged an error to the console for policies other than Enabled.
(WebCore::Document::initSecurityContext): Switched sandbox enforcement from SandboxOrigin to SandboxAll.
(WebCore::Document::httpEquivPolicy): Returned a HttpEquivPolicy based on shouldEnforceContentDispositionAttachmentSandbox() and Settings::httpEquivEnabled().
(WebCore::Document::shouldEnforceContentDispositionAttachmentSandbox): Returned true if Settings::contentDispositionAttachmentSandboxEnabled()
and the document was fetched as an attachment.

dom/Document.h:
loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::canRequest): When requesting a subframe main resource when the parent frame enforces an attachment sandbox,
only continue if the parent frame's SecurityOrigin allows the request.

page/Settings.in: Added contentDispositionAttachmentSandboxEnabled with an initial value of false.

Source/WebKit/mac:

WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]): Enabled Content-Disposition: attachment sandbox on iOS.

Source/WebKit2:

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage): Enabled Content-Disposition: attachment sandbox on iOS.

Tools:

WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::InjectedBundlePage::decidePolicyForResponse): Only log the message about attachments if the custom policy delegate is enabled.
This matches the behavior of DumpRenderTree.

LayoutTests:

http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled-expected.txt: Added.
http/tests/contentdispositionattachmentsandbox/cross-origin-frames-disabled.html: Added.
http/tests/contentdispositionattachmentsandbox/form-submission-disabled-expected.txt: Added.
http/tests/contentdispositionattachmentsandbox/form-submission-disabled.html: Added.
http/tests/contentdispositionattachmentsandbox/http-equiv-disabled-expected.txt: Added.
http/tests/contentdispositionattachmentsandbox/http-equiv-disabled.html: Added.
http/tests/contentdispositionattachmentsandbox/plugins-disabled-expected.html: Added.
http/tests/contentdispositionattachmentsandbox/plugins-disabled.html: Added.
http/tests/contentdispositionattachmentsandbox/resources/cross-origin-frames-frame.php: Added.
http/tests/contentdispositionattachmentsandbox/resources/form-submission-frame.php: Added.
http/tests/contentdispositionattachmentsandbox/resources/http-equiv-frame.php: Added.
http/tests/contentdispositionattachmentsandbox/resources/plugins-frame.php: Added.
http/tests/contentdispositionattachmentsandbox/resources/scripts-frame.php: Added.
http/tests/contentdispositionattachmentsandbox/scripts-disabled-expected.txt: Added.
http/tests/contentdispositionattachmentsandbox/scripts-disabled.html: Added.

8:46 PM Changeset in webkit [186981] by Alan Bujtas

3 edits
2 adds in trunk

(display: block)input range's thumb disappears when moved.
https://bugs.webkit.org/show_bug.cgi?id=146896
<rdar://problem/21787807>

Reviewed by Simon Fraser.

Since the thumb is positioned after the layout for the input (shadow) subtree is finished, the repaint rects
issued during the layout will not cover the re-positioned thumb.
We need to issue a repaint soon after the thumb is re-positioned.

Source/WebCore:

Test: fast/repaint/block-inputrange-repaint.html

html/shadow/SliderThumbElement.cpp:

(WebCore::RenderSliderContainer::layout):

LayoutTests:

fast/repaint/block-inputrange-repaint-expected.txt: Added.
fast/repaint/block-inputrange-repaint.html: Added.

8:16 PM Changeset in webkit [186980] by Simon Fraser

3 edits in trunk/Source/WebCore

Attempt to fix the build.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::webkitCurrentPlaybackTargetIsWireless):

html/HTMLMediaElement.h:

5:30 PM Changeset in webkit [186979] by dino@apple.com

3 edits in trunk/Source/WebCore

Picture in Picture interacts poorly with AirPlay/HDMI
https://bugs.webkit.org/show_bug.cgi?id=147061
<rdar://problem/19192076>

Reviewed by Tim Horton.

When we are actively playing to an external target, the
picture in picture button should be hidden.

Also, the availability of picture in picture is also
dependent on AirPlay, so that we don't auto-pip when
we're displaying on a TV.

Modules/mediacontrols/mediaControlsiOS.js:

(ControllerIOS.prototype.configureInlineControls): Call the update function.
(ControllerIOS.prototype.updatePictureInPictureButton): Add or remove a hidden class.

html/MediaElementSession.cpp:

(WebCore::MediaElementSession::allowsPictureInPicture): Check Airplay status.

5:20 PM Changeset in webkit [186978] by timothy_horton@apple.com

6 edits in trunk/Source

[iOS] TextIndicator has a large forehead when line-height > 1
https://bugs.webkit.org/show_bug.cgi?id=147058
<rdar://problem/21643094>

Reviewed by Dean Jackson.

editing/FrameSelection.cpp:

(WebCore::FrameSelection::getClippedVisibleTextRectangles):

editing/FrameSelection.h:

Add a parameter controlling whether getClippedVisibleTextRectangles
returns selection-height rects (including extra line-height) or text-height
rects (including only the text height). Plumb it down.

page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange):
(WebCore::TextIndicator::createWithSelectionInFrame):
Use the tighter text-height rects on iOS, where there's no selection highlight to cover up.
Remove an assertion that is no longer always true, and which is mostly obsoleted by the
fact that we don't let FrameSnapshotting code arbitrarily decide the rect to snapshot anymore.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):
Apply a review comment that I left myself and then forgot about.

4:59 PM Changeset in webkit [186977] by enrica@apple.com

2 edits in trunk/Source/WebKit2

[iOS] Implement selectionInteractionAssistant accessor.
https://bugs.webkit.org/show_bug.cgi?id=147054
rdar://problem/20864286

Reviewed by Tim Horton.

One more change to adopt the new selection interaction
model on iOS.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView selectionInteractionAssistant]):

4:55 PM Changeset in webkit [186976] by timothy_horton@apple.com

9 edits in trunk

Improve rect shrink-wrapping algorithm
https://bugs.webkit.org/show_bug.cgi?id=147037
<rdar://problem/21643094>

Reviewed by Simon Fraser.

platform/graphics/FloatPoint.h:

(WebCore::areEssentiallyEqual):
Added; implementation is the same as FloatSize's.

platform/graphics/PathUtilities.cpp:

(WebCore::FloatPointGraph::FloatPointGraph):
(WebCore::FloatPointGraph::~FloatPointGraph):
(WebCore::FloatPointGraph::Node::Node):
(WebCore::FloatPointGraph::Node::nextPoints):
(WebCore::FloatPointGraph::Node::addNextPoint):
(WebCore::FloatPointGraph::Node::isVisited):
(WebCore::FloatPointGraph::Node::visit):
(WebCore::FloatPointGraph::Node::reset):
(WebCore::FloatPointGraph::reset):
(WebCore::FloatPointGraph::findOrCreateNode):
(WebCore::findLineSegmentIntersection):
(WebCore::addIntersectionPoints):
(WebCore::walkGraphAndExtractPolygon):
(WebCore::findUnvisitedPolygonStartPoint):
(WebCore::unitePolygons):
(WebCore::edgesForRect):
(WebCore::PathUtilities::pathWithShrinkWrappedRects):
(WebCore::addShrinkWrapRightCorner): Deleted.
(WebCore::addShrinkWrapLeftCorner): Deleted.
(WebCore::addShrinkWrappedPathForRects): Deleted.
(WebCore::rectsIntersectOrTouch): Deleted.
(WebCore::findSetContainingRect): Deleted.
Add a new implementation of shrink-wrap, which is significantly more
generic than the old one, which assumed a top-down progression of rects.

This version uses polygon intersection to find the path around the
set of rects, and then follows said path and adds appropriately-sized
arcs for the corners.

The polygon intersection algorithm first finds all the intersection points
between all of the rects, then builds a graph of edges outward from one point.
It then traverses the graph, choosing at each point the next edge which
has not been visited and has the greatest interior angle, recording the polygon as it goes.

If at the end of the traversal we have not returned to the initial node,
we give up on shrink-wrapping and just use a bounding box around the rects.

If any of the original rects have not been visited at all, we repeat the traversal
starting with that rect, making an additional polygon (since we removed completely contained
rects before we started, having not visited the rect at all means that it's not connected
to the others).

Once we have a set of united polygons, we follow each one, determining the ideal (always
equal in width and height, never more than half the length of either edge, so that we always
have a smooth curve) arc radius and projecting it onto the edge, and then
adding an arc between the end of the previous path and beginning of the next.

Because the shrink-wrap algorithm is fairly expensive, if there are more than 20 rects,
we fall back to a bounding box. Given the current use cases, this is more than enough
rects, but can certainly be adjusted in the future if needed.

testing/Internals.cpp:

(WebCore::Internals::pathWithShrinkWrappedRects):

testing/Internals.h:
testing/Internals.idl:

Add a radius parameter.

fast/shrink-wrap/rect-shrink-wrap-expected.png:
fast/shrink-wrap/rect-shrink-wrap.html:

Add a radius parameter to testRects, defaulting to 8.

Add an offset parameter to testRects, making it easier to slide
the rect sets around.

Add some more test cases.

4:47 PM Changeset in webkit [186975] by bshafiei@apple.com

1 copy in tags/Safari-601.1.41

New tag.

4:32 PM Changeset in webkit [186974] by commit-queue@webkit.org

3 edits
2 adds in trunk

AX: iframe within table cell is inaccessible to VoiceOver
https://bugs.webkit.org/show_bug.cgi?id=147001
<rdar://problem/21106945>

Patch by Nan Wang <n_wang@apple.com> on 2015-07-17
Reviewed by Chris Fleizach.

Source/WebCore:

When a table cell is created before its parent table determines if it should be ignored or not,
the table cell may cache the wrong role. Fix that by allowing each table cell to update its role
after the table makes this determination.

Test: accessibility/iframe-within-cell.html

accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::addChildren):
(WebCore::AccessibilityTable::addChildrenFromSection):

LayoutTests:

accessibility/iframe-within-cell-expected.txt: Added.
accessibility/iframe-within-cell.html: Added.

4:32 PM Changeset in webkit [186973] by bshafiei@apple.com

5 edits in branches/safari-601.1-branch/Source

Versioning.

4:26 PM Changeset in webkit [186972] by bshafiei@apple.com

5 edits in branches/safari-600.8-branch/Source

Versioning.

4:26 PM Changeset in webkit [186971] by mmaxfield@apple.com

3 edits
2 adds in trunk

style.fontFamily accessor crashes on unstyled node created from DOMParser().parseFromString()
https://bugs.webkit.org/show_bug.cgi?id=147026
<rdar://problem/21864487>

Reviewed by Andreas Kling.

Source/WebCore:

Font CSS properties are a little special because they are used as indices into caches.
Normally, StyleResolver gives all nodes a default font family, so our cache works correctly.
However, if the document doesn't have a Settings object, StyleResolver wasn't doing this.
Documents created from DOMParser().parseFromString() don't have a Settings object.

Test: fast/text/crash-font-family-parsed.html

css/StyleResolver.cpp:

(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::initializeFontStyle): Set a font family even if we don't have a
Settings object.

LayoutTests:

fast/text/crash-font-family-parsed-expected.txt: Added.
fast/text/crash-font-family-parsed.html: Added.

4:18 PM Changeset in webkit [186970] by Yusuke Suzuki

2 edits
1 move in trunk/LayoutTests

Unreviewed, rename test file from promise-resolve-non-dom.js to promise-resolve-in-non-dom.js
https://bugs.webkit.org/show_bug.cgi?id=146828

This is the simple follow up patch.
When executing the JSC stress tests, script-tests's file name and the expectation file name should be equal.

js/promise-resolve-in-non-dom.html:
js/script-tests/promise-resolve-in-non-dom.js: Renamed from LayoutTests/js/script-tests/promise-resolve-non-dom.js.

(value.then):

js/script-tests/promise-resolve-non-dom.js:

(value.then): Deleted.

4:05 PM Changeset in webkit [186969] by mitz@apple.com

2 edits in trunk/Source/WebKit2

REGRESSION (r186964): Crash in WebKit2.CloseFromWithinCreatePage
https://bugs.webkit.org/show_bug.cgi?id=147055

Reviewed by Alex Christensen.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::createNewPage): Grab the main frame’s URL before calling out to the
client, who may destroy the frame.

4:01 PM Changeset in webkit [186968] by mmaxfield@apple.com

3 edits
2 adds in trunk

Video posters disappear once media has loaded
https://bugs.webkit.org/show_bug.cgi?id=147045

Reviewed by Simon Fraser.

Source/WebCore:

After r184932, all video elements are composited. However, there is logic in
RenderLayerBacking::updateConfiguration() which adds the video layer to the page
if the video is composited, without checking first to see if it should actually
do so.

Test: compositing/video/poster.html

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateConfiguration):

LayoutTests:

compositing/video/poster-expected.html: Added.
compositing/video/poster.html: Added.

3:54 PM Changeset in webkit [186967] by bshafiei@apple.com

1 copy in tags/Safari-600.8.4

New tag.

3:40 PM Changeset in webkit [186966] by Yusuke Suzuki

11 edits
6 adds in trunk

Integrate automatic microtask draining into JSC framework and re-enable Promise
https://bugs.webkit.org/show_bug.cgi?id=146828

Reviewed by Sam Weinig.

Source/JavaScriptCore:

Add automatic microtask draining system into JSC framework.
When the depth of VM lock becomes 0, before this, we drain the queued microtasks.
Enqueuing behavior can be injected by the JSGlobalObject's method table.
It is utilized in WebCore to post the microtask to WebCore's event loop.

In the case of JSC interactive shell, VM depth is always greater than 0.
So we manually drains the queued microtasks after evaluating the written line.

Since now JSC framework has the microtask queue, we can drain the queued microtasks.
So re-enable the Promise in the JSC framework context.

API/JSContextRef.cpp:

(javaScriptRuntimeFlags): Deleted.

API/tests/testapi.c:

(main):

API/tests/testapi.mm:

(testObjectiveCAPIMain):

jsc.cpp:

(runInteractive):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::queueMicrotask):

runtime/JSLock.cpp:

(JSC::JSLock::willReleaseLock):

runtime/VM.cpp:

(JSC::VM::queueMicrotask):
(JSC::VM::drainMicrotasks):
(JSC::QueuedTask::run):

runtime/VM.h:

(JSC::QueuedTask::QueuedTask):

LayoutTests:

Add Promise tests mainly focusing on microtasks.
They can be executed in JSC shell. So they are locate in js/ directory (not js/dom).

js/promise-nested-microtasks-expected.txt: Added.
js/promise-nested-microtasks.html: Added.
js/promise-resolve-in-non-dom-expected.txt: Added.
js/promise-resolve-in-non-dom.html: Added.
js/script-tests/promise-nested-microtasks.js: Added.

(Promise.resolve.then):

js/script-tests/promise-resolve-non-dom.js: Added.

(value.then):

resources/standalone-post.js:

2:47 PM Changeset in webkit [186965] by commit-queue@webkit.org

4 edits in trunk

[Content Extensions] Term::isUniversalTransition() incorrectly expects the end-of-line assertion in character sets
https://bugs.webkit.org/show_bug.cgi?id=147032

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-07-17
Reviewed by Alex Christensen.

Source/WebCore:

contentextensions/Term.h:

(WebCore::ContentExtensions::Term::isUniversalTransition):
The universal transition is not supposed to account for the end-of-line assertion,
it should be a transition matching any character.

Here, we were counting 128 transitions, the 127 characters plus the
transition on zero we are using for EOL.

The end result is Term::isUniversalTransition() was completely useless.
The only code using it is the pattern simplificaton phase. That part
was not working correclty and was allowing useless ".*" in the patterns.

Tools:

TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp:

Test that the useless terms are eliminated by counting
the number of NFA nodes generated.

2:16 PM Changeset in webkit [186964] by mitz@apple.com

10 edits
1 add in trunk

Source/WebCore:
WebCore part of <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

Test: TestWebKitAPI/Tests/WebKit2Cocoa/ShouldOpenExternalURLsInNewWindowActions.mm

loader/FrameLoader.cpp:

(WebCore::shouldOpenExternalURLsPolicyToApply): Pulled the logic out of
applyShouldOpenExternalURLsPolicyToNewDocumentLoader into this new helper.
(WebCore::FrameLoader::loadURL): When targeting a new frame, apply the external URLs policy
to the action passed to checkNewWindowPolicy.
(WebCore::FrameLoader::applyShouldOpenExternalURLsPolicyToNewDocumentLoader): Call the new
helper function.
(WebCore::createWindow): Include the external URL policy in the action passed to
createWindow.

Source/WebKit2:
WebKit2 part of <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

UIProcess/Cocoa/UIDelegate.mm:

(WebKit::UIDelegate::UIClient::createNewPage): Disallow App Links if the new page is for the
same protocol, host and port as the main frame of this page.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForNavigationAction): Disallow App Links if
m_shouldSuppressAppLinksInNextNavigationPolicyDecision is set, and reset it. See below for
when we set it.
(WebKit::WebPageProxy::decidePolicyForNewWindowAction): Disallow App Links if the new window
is for the same protocol, host and port as the main frame of this page.
(WebKit::WebPageProxy::createNewPage): Make the new page disallow App Links in the first
policy decision if it is for the same protocol, host and port as the main frame of this
page.

UIProcess/WebPageProxy.h: Added m_shouldSuppressAppLinksInNextNavigationPolicyDecision

member variable.

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createWindow): Pass the shouldOpenExternalURLsPolicy.

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction): Ditto.

Tools:
Tests for <rdar://problem/21803781> The external URL policy is not reported correctly in navigation actions that create new windows
https://bugs.webkit.org/show_bug.cgi?id=147040

Reviewed by Dean Jackson.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/ShouldOpenExternalURLsInNewWindowActions.mm: Added.

(-[ShouldOpenExternalURLsInNewWindowActionsController webView:decidePolicyForNavigationAction:decisionHandler:]):
(-[ShouldOpenExternalURLsInNewWindowActionsController webView:didFinishNavigation:]):
(-[ShouldOpenExternalURLsInNewWindowActionsController webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:]):
(TEST):

12:35 PM Changeset in webkit [186963] by andersca@apple.com

2 edits in trunk/Source/WebCore

ScrollView.h should be self-contained
https://bugs.webkit.org/show_bug.cgi?id=147004

Reviewed by Sam Weinig.

platform/ScrollView.h:

12:23 PM Changeset in webkit [186962] by bshafiei@apple.com

33 edits in tags/Safari-601.1.36.2

Merged r186881. rdar://problem/21822278

12:00 PM Changeset in webkit [186961] by beidson@apple.com

2 edits in trunk/Source/WebCore

Rolling r186895 back in, in its entirety.
https://bugs.webkit.org/show_bug.cgi?id=146976

Rubberstamped by Tim Horton.

platform/network/cf/CookieJarCFNet.cpp:

(WebCore::createCookies): Use new CFNetwork SPI.

11:50 AM Changeset in webkit [186960] by bshafiei@apple.com

5 edits in tags/Safari-601.1.36.2/Source

Versioning.

11:48 AM Changeset in webkit [186959] by saambarati1@gmail.com

65 edits in trunk

Function parameters should be parsed in the same parser arena as the function body
https://bugs.webkit.org/show_bug.cgi?id=145995

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch changes how functions are parsed in JSC. A function's
parameters are now parsed in the same arena as the function itself.
This allows us to arena allocate all destructuring AST nodes and
the FunctionParameters node. This will help make implementing ES6
default parameter values sane.

A source code that represents a function now includes the text of the function's
parameters. The starting offset is at the opening parenthesis of the parameter
list or at the starting character of the identifier for arrow functions that
have single arguments and don't start with parenthesis.

For example:

"function (param1, param2) { ... }"

^{| This offset used to be the starting offset of a function's SourceCode}

^{| This is the new starting offset for a function's SourceCode.}

This requires us to change how some offsets are calculated
and also requires us to report some different line numbers for internal
metrics that use a SourceCode's starting line and column numbers.

This patch also does a bit of cleanup with regards to how
functions are parsed in general (especially arrow functions).
It removes some unnecessary #ifdefs and the likes for arrow
to make things clearer and more deliberate.

API/JSScriptRef.cpp:

(parseScript):

builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::createExecutableInternal):

bytecode/UnlinkedCodeBlock.cpp:

(JSC::generateFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
(JSC::UnlinkedFunctionExecutable::visitChildren):
(JSC::UnlinkedFunctionExecutable::parameterCount): Deleted.

bytecode/UnlinkedCodeBlock.h:
bytecompiler/NodesCodegen.cpp:

(JSC::DestructuringAssignmentNode::emitBytecode):
(JSC::assignDefaultValueIfUndefined):
(JSC::ArrayPatternNode::collectBoundIdentifiers):
(JSC::DestructuringPatternNode::~DestructuringPatternNode): Deleted.

parser/ASTBuilder.h:

(JSC::ASTBuilder::createClassExpr):
(JSC::ASTBuilder::createFunctionExpr):
(JSC::ASTBuilder::createFunctionBody):
(JSC::ASTBuilder::createArrowFunctionExpr):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createElementList):
(JSC::ASTBuilder::createFormalParameterList):
(JSC::ASTBuilder::appendParameter):
(JSC::ASTBuilder::createClause):
(JSC::ASTBuilder::createClauseList):
(JSC::ASTBuilder::createFuncDeclStatement):
(JSC::ASTBuilder::createForInLoop):
(JSC::ASTBuilder::createForOfLoop):
(JSC::ASTBuilder::isResolve):
(JSC::ASTBuilder::createDestructuringAssignment):
(JSC::ASTBuilder::createArrayPattern):
(JSC::ASTBuilder::appendArrayPatternSkipEntry):
(JSC::ASTBuilder::appendArrayPatternEntry):
(JSC::ASTBuilder::appendArrayPatternRestEntry):
(JSC::ASTBuilder::finishArrayPattern):
(JSC::ASTBuilder::createObjectPattern):
(JSC::ASTBuilder::appendObjectPatternEntry):
(JSC::ASTBuilder::createBindingLocation):
(JSC::ASTBuilder::setEndOffset):

parser/Lexer.cpp:

(JSC::Lexer<T>::Lexer):
(JSC::Lexer<T>::nextTokenIsColon):
(JSC::Lexer<T>::setTokenPosition):
(JSC::Lexer<T>::lex):
(JSC::Lexer<T>::clear):

parser/Lexer.h:

(JSC::Lexer::setIsReparsingFunction):
(JSC::Lexer::isReparsingFunction):
(JSC::Lexer::lineNumber):
(JSC::Lexer::setIsReparsing): Deleted.
(JSC::Lexer::isReparsing): Deleted.

parser/NodeConstructors.h:

(JSC::TryNode::TryNode):
(JSC::FunctionParameters::FunctionParameters):
(JSC::FuncExprNode::FuncExprNode):
(JSC::FuncDeclNode::FuncDeclNode):
(JSC::ArrayPatternNode::ArrayPatternNode):
(JSC::ObjectPatternNode::ObjectPatternNode):
(JSC::BindingNode::BindingNode):
(JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
(JSC::ParameterNode::ParameterNode): Deleted.
(JSC::ArrayPatternNode::create): Deleted.
(JSC::ObjectPatternNode::create): Deleted.
(JSC::BindingNode::create): Deleted.

parser/Nodes.cpp:

(JSC::ProgramNode::ProgramNode):
(JSC::EvalNode::EvalNode):
(JSC::FunctionBodyNode::FunctionBodyNode):
(JSC::FunctionBodyNode::finishParsing):
(JSC::FunctionNode::FunctionNode):
(JSC::FunctionNode::finishParsing):
(JSC::FunctionParameters::create): Deleted.
(JSC::FunctionParameters::FunctionParameters): Deleted.
(JSC::FunctionParameters::~FunctionParameters): Deleted.

parser/Nodes.h:

(JSC::ProgramNode::startColumn):
(JSC::ProgramNode::endColumn):
(JSC::EvalNode::startColumn):
(JSC::EvalNode::endColumn):
(JSC::FunctionParameters::size):
(JSC::FunctionParameters::at):
(JSC::FunctionParameters::append):
(JSC::FuncExprNode::body):
(JSC::DestructuringPatternNode::~DestructuringPatternNode):
(JSC::DestructuringPatternNode::isBindingNode):
(JSC::DestructuringPatternNode::emitDirectBinding):
(JSC::ArrayPatternNode::appendIndex):
(JSC::ObjectPatternNode::appendEntry):
(JSC::BindingNode::boundProperty):
(JSC::BindingNode::divotStart):
(JSC::BindingNode::divotEnd):
(JSC::DestructuringAssignmentNode::bindings):
(JSC::FuncDeclNode::body):
(JSC::ParameterNode::pattern): Deleted.
(JSC::ParameterNode::nextParam): Deleted.
(JSC::FunctionParameters::patterns): Deleted.

parser/Parser.cpp:

(JSC::Parser<LexerType>::Parser):
(JSC::Parser<LexerType>::~Parser):
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::allowAutomaticSemicolon):
(JSC::Parser<LexerType>::parseSourceElements):
(JSC::Parser<LexerType>::createBindingPattern):
(JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
(JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
(JSC::Parser<LexerType>::parseSwitchClauses):
(JSC::Parser<LexerType>::parseSwitchDefaultClause):
(JSC::Parser<LexerType>::parseBlockStatement):
(JSC::Parser<LexerType>::parseStatement):
(JSC::Parser<LexerType>::parseFormalParameters):
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::stringForFunctionMode):
(JSC::Parser<LexerType>::parseFunctionParameters):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseFunctionDeclaration):
(JSC::Parser<LexerType>::parseClass):
(JSC::Parser<LexerType>::parsePrimaryExpression):
(JSC::Parser<LexerType>::parseMemberExpression):
(JSC::Parser<LexerType>::parseArrowFunctionExpression):
(JSC::operatorString):
(JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBody): Deleted.

parser/Parser.h:

(JSC::Parser::positionBeforeLastNewline):
(JSC::Parser::locationBeforeLastToken):
(JSC::Parser::findCachedFunctionInfo):
(JSC::Parser::isofToken):
(JSC::Parser::isEndOfArrowFunction):
(JSC::Parser::isArrowFunctionParamters):
(JSC::Parser::tokenStart):
(JSC::Parser::isLETMaskedAsIDENT):
(JSC::Parser::autoSemiColon):
(JSC::Parser::setEndOfStatement):
(JSC::Parser::canRecurse):
(JSC::Parser<LexerType>::parse):
(JSC::parse):

parser/ParserFunctionInfo.h:
parser/ParserModes.h:

(JSC::functionNameIsInScope):

parser/SourceCode.h:

(JSC::makeSource):
(JSC::SourceCode::subExpression):
(JSC::SourceCode::subArrowExpression): Deleted.

parser/SourceProviderCache.h:

(JSC::SourceProviderCache::get):

parser/SourceProviderCacheItem.h:

(JSC::SourceProviderCacheItem::endFunctionToken):
(JSC::SourceProviderCacheItem::usedVariables):
(JSC::SourceProviderCacheItem::writtenVariables):
(JSC::SourceProviderCacheItem::SourceProviderCacheItem):

parser/SyntaxChecker.h:

(JSC::SyntaxChecker::SyntaxChecker):
(JSC::SyntaxChecker::createClassExpr):
(JSC::SyntaxChecker::createFunctionExpr):
(JSC::SyntaxChecker::createFunctionBody):
(JSC::SyntaxChecker::createArrowFunctionExpr):
(JSC::SyntaxChecker::setFunctionNameStart):
(JSC::SyntaxChecker::createArguments):
(JSC::SyntaxChecker::createPropertyList):
(JSC::SyntaxChecker::createElementList):
(JSC::SyntaxChecker::createFormalParameterList):
(JSC::SyntaxChecker::appendParameter):
(JSC::SyntaxChecker::createClause):
(JSC::SyntaxChecker::createClauseList):

runtime/CodeCache.cpp:

(JSC::CodeCache::getGlobalCodeBlock):
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

runtime/Completion.cpp:

(JSC::checkSyntax):

runtime/Executable.cpp:

(JSC::ProgramExecutable::checkSyntax):

tests/controlFlowProfiler/conditional-expression.js:

(testConditionalFunctionCall):

LayoutTests:

fast/profiler/anonymous-event-handler-expected.txt:
fast/profiler/anonymous-function-called-from-different-contexts-expected.txt:
fast/profiler/anonymous-function-calls-built-in-functions-expected.txt:
fast/profiler/anonymous-function-calls-eval-expected.txt:
fast/profiler/anonymous-functions-with-display-names-expected.txt:
fast/profiler/apply-expected.txt:
fast/profiler/built-in-function-calls-anonymous-expected.txt:
fast/profiler/built-in-function-calls-user-defined-function-expected.txt:
fast/profiler/call-expected.txt:
fast/profiler/calling-the-function-that-started-the-profiler-from-another-scope-expected.txt:
fast/profiler/compare-multiple-profiles-expected.txt:
fast/profiler/constructor-expected.txt:
fast/profiler/dead-time-expected.txt:
fast/profiler/document-dot-write-expected.txt:
fast/profiler/event-handler-expected.txt:
fast/profiler/execution-context-and-eval-on-same-line-expected.txt:
fast/profiler/inline-event-handler-expected.txt:
fast/profiler/many-calls-in-the-same-scope-expected.txt:
fast/profiler/multiple-and-different-scoped-anonymous-function-calls-expected.txt:
fast/profiler/multiple-and-different-scoped-function-calls-expected.txt:
fast/profiler/multiple-anonymous-functions-called-from-the-same-function-expected.txt:
fast/profiler/multiple-frames-expected.txt:
fast/profiler/named-functions-with-display-names-expected.txt:
fast/profiler/nested-anonymous-functon-expected.txt:
fast/profiler/nested-start-and-stop-profiler-expected.txt:
fast/profiler/one-execution-context-expected.txt:
fast/profiler/profile-calls-in-included-file-expected.txt:
fast/profiler/profile-with-no-title-expected.txt:
fast/profiler/profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting-expected.txt:
fast/profiler/profiling-from-a-nested-location-expected.txt:
fast/profiler/simple-event-call-expected.txt:
fast/profiler/simple-no-level-change-expected.txt:
fast/profiler/start-and-stop-profiler-multiple-times-expected.txt:
fast/profiler/start-and-stop-profiling-in-the-same-function-expected.txt:
fast/profiler/stop-profiling-after-setTimeout-expected.txt:
fast/profiler/stop-then-function-call-expected.txt:
fast/profiler/two-execution-contexts-expected.txt:
fast/profiler/user-defined-function-calls-built-in-functions-expected.txt:
fast/profiler/window-dot-eval-expected.txt:
js/dom/script-start-end-locations-expected.txt:

11:46 AM Changeset in webkit [186958] by bshafiei@apple.com

1 copy in tags/Safari-601.1.36.2

New tag.

11:28 AM Changeset in webkit [186957] by commit-queue@webkit.org

7 edits
9 adds in trunk

[Content Extensions] CSS-display-none rules are not working properly
https://bugs.webkit.org/show_bug.cgi?id=147024

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-07-17
Reviewed by Sam Weinig.

Source/WebCore:

There were 2 bugs prevening rules with css-display-none and a url-filter from working
correctly.

First, ContentExtensions::serializeActions() was merging selectors regardless of their
trigger. All the CSS Selectors would be grouped together and applied regardless of which
rule apply.

That problem was fixed by grouping CSS rules by trigger. We want all the undistinguishable
CSS rules to be merged. The trigger makes 2 rules dinstinguishable as one rule can apply
on a page while the next rule does not. The simplest approach is to group by trigger.

The second problem had to do with rules added before the document is created.
When accumulating those rules, we were only keeping the last one. The reason was that
DocumentLoader::addPendingContentExtensionDisplayNoneSelector() would only keep a single
selector list by extension.

This is fixed by keeping a vector of all the rules that apply.

Tests: http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html

http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html
http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html

contentextensions/ContentExtensionCompiler.cpp:

(WebCore::ContentExtensions::serializeActions):

contentextensions/ContentExtensionRule.h:

(WebCore::ContentExtensions::Trigger::isEmpty):
(WebCore::ContentExtensions::TriggerHash::hash):
(WebCore::ContentExtensions::TriggerHash::equal):
(WebCore::ContentExtensions::TriggerHashTraits::constructDeletedValue):
(WebCore::ContentExtensions::TriggerHashTraits::isDeletedValue):
(WebCore::ContentExtensions::TriggerHashTraits::emptyValue):
(WebCore::ContentExtensions::TriggerHashTraits::isEmptyValue):

contentextensions/ContentExtensionsBackend.cpp:

(WebCore::ContentExtensions::ContentExtensionsBackend::processContentExtensionRulesForLoad): Deleted.

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::commitData):
(WebCore::DocumentLoader::addPendingContentExtensionDisplayNoneSelector):

loader/DocumentLoader.h:

LayoutTests:

http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged-expected.txt: Added.
http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html: Added.
http/tests/contentextensions/css-display-none-with-different-case-sensitivity-are-not-merged.html.json: Added.
http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged-expected.txt: Added.
http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html: Added.
http/tests/contentextensions/css-display-none-with-different-triggers-are-not-merged.html.json: Added.
http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource-expected.txt: Added.
http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html: Added.
http/tests/contentextensions/two-distinguishable-css-display-none-rules-on-main-resource.html.json: Added.

11:24 AM Changeset in webkit [186956] by timothy_horton@apple.com

9 edits in trunk/Source

iOS TextIndicators include text that is not supposed to be indicated
https://bugs.webkit.org/show_bug.cgi?id=147028
<rdar://problem/21643094>

Reviewed by Sam Weinig.

Paint the selection and background, but not other foregrounds, for iOS TextIndicators.

page/FrameSnapshotting.cpp:

(WebCore::snapshotFrameRect):

page/FrameSnapshotting.h:

Add a new snapshot option where we'll paint backgrounds and the selected
foreground and nothing else.
Pass the new snapshot option through as a paint behavior.

page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange):
Implement the incantations necessary to make a temporary selection
change not get sent to the UI process and actually have WebCore know about it
and accurately respond to questions about it.

(WebCore::TextIndicator::createWithSelectionInFrame):
Paint selection and backgrounds on iOS.

rendering/PaintPhase.h:
rendering/RenderLayer.cpp:

(WebCore::RenderLayer::paintLayerContents):

rendering/RenderElement.cpp:

(WebCore::RenderElement::selectionColor):
Add a new paint behavior, SelectionAndBackgroundsOnly, which behaves
the same as selection only except it allows backgrounds to paint.

WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::shouldCreateTransientPaintingSnapshot):

11:11 AM Changeset in webkit [186955] by mark.lam@apple.com

25 edits in trunk

Remove leak of objects between isolated worlds on custom events, message events, and pop state events.
https://bugs.webkit.org/show_bug.cgi?id=118884

Reviewed by Filip Pizlo and Mark Lam.
Patch by Keith Miller <keith_miller@apple.com>.

Source/WebCore:

Tests: fast/events/event-leak-objects.html

fast/events/event-properties-gc.html

Fixes an issue where objects passed as certain properties of events could cross isolated worlds. This
was fixed by checking that any object passed by an event must be serializable or originate from the same
isolated world as the one it is currently being accessed in. In the case of MessageEvents and PopStateEvents we
cache the values of the data and state properties, respectively, as they may be a deserialized object. In case
an object was deserialized in a world with elevated privileges we also check the cached value is from the same
world, if it is from a different world we recompute it. For testing purposes, I added a new function to Internals
that determines whether a JSObject originated in the current world.

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/DOMWrapperWorld.h:

(WebCore::worldForDOMObject):

bindings/js/JSBindingsAllInOne.cpp:
bindings/js/JSCustomEventCustom.cpp: Copied from Source/WebCore/dom/CustomEvent.cpp.

(WebCore::JSCustomEvent::detail):

bindings/js/JSMessageEventCustom.cpp:

(WebCore::JSMessageEvent::data):

bindings/js/JSPopStateEventCustom.cpp:

(WebCore::JSPopStateEvent::state):

dom/CustomEvent.cpp:

(WebCore::CustomEvent::initCustomEvent):
(WebCore::CustomEvent::trySerializeDetail):

dom/CustomEvent.h:
dom/CustomEvent.idl:
dom/MessageEvent.cpp:

(WebCore::MessageEvent::initMessageEvent):
(WebCore::MessageEvent::trySerializeData):

dom/MessageEvent.h:
dom/PopStateEvent.cpp:

(WebCore::PopStateEvent::trySerializeState):

dom/PopStateEvent.h:
testing/Internals.cpp:

(WebCore::Internals::isFromCurrentWorld):

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

These tests ensure ensure objects are not leaked across isolated worlds and that those properties are not prematurely
garbage collected.

fast/events/constructors/custom-event-constructor-expected.txt:
fast/events/constructors/custom-event-constructor.html:
fast/events/event-leak-objects-expected.txt: Added.
fast/events/event-leak-objects.html: Added.
fast/events/event-properties-gc-expected.txt: Added.
fast/events/event-properties-gc.html: Added.

2:23 AM Changeset in webkit [186954] by Carlos Garcia Campos

7 edits in trunk/Source

[GTK] Cleanup PasteboardHelper
https://bugs.webkit.org/show_bug.cgi?id=147035

Reviewed by Žan Doberšek.

Source/WebCore:

It's actually a singleton, but the API suggests you can create
your own or use the default one, but the default one should be the
only one. Rename PasteboardHelper::defaultPasteboardHelper() as
PasteboardHelper::singleton() and make it non-copyable and never
destroyed.

platform/gtk/PasteboardGtk.cpp:

(WebCore::Pasteboard::writePlainText): Use PasteboardHelper::singleton().
(WebCore::Pasteboard::write): Ditto.
(WebCore::Pasteboard::writePasteboard): Ditto.
(WebCore::Pasteboard::clear): Ditto.
(WebCore::Pasteboard::canSmartReplace): Ditto.
(WebCore::Pasteboard::read): Ditto.
(WebCore::Pasteboard::hasData): Ditto.
(WebCore::Pasteboard::types): Ditto.
(WebCore::Pasteboard::readString): Ditto.
(WebCore::Pasteboard::readFilenames): Ditto.

platform/gtk/PasteboardHelper.cpp:

(WebCore::PasteboardHelper::singleton): Renamed as singleton, also
use NeverDestroyed and return a reference instead of a pointer.
(WebCore::PasteboardHelper::PasteboardHelper): Do all
initializations here and remove the initialization static flag,
since this is a real singleton now. Also use
gdk_atom_intern_static_string() to initialize the atoms instead of
gdk_atom_intern().
(WebCore::PasteboardHelper::targetList):
(WebCore::PasteboardHelper::targetListForDataObject):
(WebCore::getClipboardContentsCallback):

platform/gtk/PasteboardHelper.h:

Source/WebKit2:

Use PasteboardHelper::singleton() instead of
PasteboardHelper::defaultPasteboardHelper().

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseConstructed):

UIProcess/gtk/DragAndDropHandler.cpp:

(WebKit::DragAndDropHandler::startDrag):
(WebKit::DragAndDropHandler::fillDragData):
(WebKit::DragAndDropHandler::dataObjectForDropData):
(WebKit::DragAndDropHandler::requestDragData):

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed