Timeline

Sep 21, 2015:

11:25 PM Changeset in webkit [190106] by Chris Dumez

• 21 edits
  3 adds in trunk

time element should use HTMLTimeElement interface
​https://bugs.webkit.org/show_bug.cgi?id=148840
<rdar://problem/22586690>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C HTML test now that more checks are passing.

• web-platform-tests/html/semantics/text-level-semantics/the-time-element/001-expected.txt:

Source/WebCore:

Time element should be an instance of HTMLTimeElement instead of generic
HTMLElement:
​https://html.spec.whatwg.org/multipage/semantics.html#the-time-element

Firefox exposes HTMLTimeElement. This patch aligns our behavior with
the specification and Firefox.

No new tests, already covered by existing test.

• CMakeLists.txt:
• DerivedSources.cpp:
• DerivedSources.make:
• WebCore.vcxproj/WebCore.vcxproj:
• WebCore.vcxproj/WebCore.vcxproj.filters:
• WebCore.xcodeproj/project.pbxproj:
• html/HTMLElementsAllInOne.cpp:
• html/HTMLTagNames.in:
• html/HTMLTimeElement.cpp: Added.

(WebCore::HTMLTimeElement::create):
(WebCore::HTMLTimeElement::HTMLTimeElement):

• html/HTMLTimeElement.h: Added.
• html/HTMLTimeElement.idl: Added.

LayoutTests:

Rebaseline existing test now that HTMLTimeElement is exposed on the
global Window object.

• js/dom/global-constructors-attributes-expected.txt:
• platform/efl/js/dom/global-constructors-attributes-expected.txt:
• platform/gtk/js/dom/global-constructors-attributes-expected.txt:
• platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
• platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
• platform/mac/js/dom/global-constructors-attributes-expected.txt:
• platform/win/js/dom/global-constructors-attributes-expected.txt:

11:01 PM Changeset in webkit [190105] by Sukolsak Sakshuwong

• 5 edits
  2 adds in trunk/Source/JavaScriptCore

Implement the comma instruction in WebAssembly
​https://bugs.webkit.org/show_bug.cgi?id=149425

Reviewed by Geoffrey Garen.

This patch implements the comma instruction in WebAssembly. The comma
instruction evaluates the left operand and then the right operand and
returns the value of the right operand.

• tests/stress/wasm-comma.js: Added.

(shouldBe):

• wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::discard):

• wasm/WASMFunctionParser.cpp:

(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseComma):

• wasm/WASMFunctionParser.h:
• wasm/WASMFunctionSyntaxChecker.h:

(JSC::WASMFunctionSyntaxChecker::discard):

10:36 PM Changeset in webkit [190104] by Chris Dumez

• 11 edits
  2 adds in trunk

DOM attributes on prototypes should be configurable
​https://bugs.webkit.org/show_bug.cgi?id=134364

Reviewed by Sam Weinig.

Source/WebCore:

DOM attributes on prototypes should be configurable as per the Web IDL
specification:
​https://heycam.github.io/webidl/#es-attributes

This patch aligns our behavior with the specification and Firefox.

Test: fast/dom/attributes-configurable.html

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateAttributesHashTable):

LayoutTests:

Add a layout test to confirm that attributes on prototypes are configurable.

• fast/dom/attributes-configurable-expected.txt: Added.
• fast/dom/attributes-configurable.html: Added.

9:34 PM Changeset in webkit [190103] by fpizlo@apple.com

• 9 edits in trunk/Source

Always use the compiler's CAS implementation and get rid of ENABLE(COMPARE_AND_SWAP)
​https://bugs.webkit.org/show_bug.cgi?id=149438

Reviewed by Mark Lam.

Source/JavaScriptCore:

• heap/HeapInlines.h:

(JSC::Heap::reportExtraMemoryVisited):
(JSC::Heap::deprecatedReportExtraMemory):

Source/WebCore:

No new tests because no new behavior.

• platform/text/TextBreakIterator.cpp:

(WebCore::compareAndSwapNonSharedCharacterBreakIterator):
(WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator):

Source/WTF:

• wtf/Atomics.h: Make weakCompareAndSwap() just forward to the system CAS via WTF::Atomic.

(WTF::weakCompareAndSwap):
(WTF::weakCompareAndSwapUIntPtr): Deleted.
(WTF::weakCompareAndSwapSize): Deleted.

• wtf/Bitmap.h: Small changes to use the new API.

(WTF::WordType>::concurrentTestAndSet):

• wtf/Platform.h: Remove ENABLE(COMPARE_AND_SWAP)

9:27 PM Changeset in webkit [190102] by timothy_horton@apple.com

• 4 edits in trunk/Source

Allow DataDetectors to pre-filter telephone number menu items
​https://bugs.webkit.org/show_bug.cgi?id=149444
<rdar://problem/19286320>

Reviewed by Sam Weinig.

Source/WebCore:

• platform/spi/mac/DataDetectorsSPI.h:

Add some SPI.

Source/WebKit2:

• Platform/mac/MenuUtilities.mm:

(WebKit::menuItemForTelephoneNumber):
(WebKit::menuForTelephoneNumber):
Let DataDetectors know what kind of items we want, so that they can avoid
some unnecessary work in cases where we were just going to throw away the items anyway.

9:01 PM Changeset in webkit [190101] by rniwa@webkit.org

• 2 edits
  4 copies
  4 adds in trunk/LayoutTests

Add some style recalc tests for shadow DOM
​https://bugs.webkit.org/show_bug.cgi?id=149445

Reviewed by Antti Koivisto.

Add tests to make sure we trigger necessary style recalc.

• fast/shadow-dom/shadow-layout-after-attach-shadow-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/shadow-layout-after-attach-shadow.html: Added.
• fast/shadow-dom/shadow-layout-after-host-child-changes-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/shadow-layout-after-host-child-changes.html: Added.
• fast/shadow-dom/shadow-layout-after-inserting-or-removing-host-child-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/shadow-layout-after-inserting-or-removing-host-child.html: Added.
• fast/shadow-dom/shadow-layout-after-slot-changes-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/shadow-layout-after-slot-changes.html: Added.
• platform/mac/TestExpectations:

8:06 PM Changeset in webkit [190100] by ap@apple.com

• 2 edits
  2 adds in trunk/LayoutTests

​https://bugs.webkit.org/show_bug.cgi?id=149415
REGRESSION (r182648): UIWebView does not set location.hash synchronously
<rdar://problem/22169467>

Reviewed by Darin Adler.

• fast/loader/location-hash-user-gesture-expected.txt: Added.
• fast/loader/location-hash-user-gesture.html: Added.
• platform/ios-simulator-wk2/TestExpectations:

7:57 PM Changeset in webkit [190099] by Chris Dumez

• 6 edits in trunk

Update HTMLTableRowElement.rowIndex to behave according to the specification
​https://bugs.webkit.org/show_bug.cgi?id=148842
<rdar://problem/22586914>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline W3C HTML test now that one more check is passing.

• web-platform-tests/html/semantics/tabular-data/the-tr-element/rowIndex-expected.txt:

Source/WebCore:

Update HTMLTableRowElement.rowIndex to behave according to the
specification:
​https://html.spec.whatwg.org/multipage/tables.html#dom-tr-rowindex

In particular, rowIndex no longer returns -1 for <tr> elements that are
direct children of the table Element. Also,<tr> Elements in all <thead> /
<tfoot> children of the table Element now get a rowIndex, as per the
specification:

• ​https://html.spec.whatwg.org/multipage/tables.html#dom-table-rows

Previously, only <tr> elements in the first <thead> and the first <tbody>
children of the table would get a rowIndex.

Also, we now abort early and return -1 if the row is a grand-child of a
table element but its direct parent is not a <thead> / <tbody> / <tfoot>.
This avoid unnecessary traversal and matches the specification.

The code is refactored a bit to leverage HTMLTableElement.rows(), as
per the specification:
"return the index of the tr element in that table element's rows collection"

Previously, we would duplicate the table traversal logic. This
simplifies the code and fixes a bug as the traversal logic was slightly
different here and in HTMLTableRowsCollection. Because of this, only
<tr> elements in the first <thead> / <tfoot> would get a rowIndex.
Performance should be similar.

No new tests, already covered by existing test.

• html/HTMLTableRowElement.cpp:

(WebCore::HTMLTableRowElement::rowIndex):
(WebCore::HTMLTableRowElement::sectionRowIndex): Deleted.
(WebCore::HTMLTableRowElement::insertCell): Deleted.

LayoutTests:

Rebaseline existing test because rows in all <thead> / <tfoot> children
of the <table> Element now get a rowIndex.

• platform/mac/fast/table/rowindex-expected.txt:

7:26 PM Changeset in webkit [190098] by rniwa@webkit.org

• 2 edits
  8 copies
  8 adds in trunk/LayoutTests

Add more rendering tests for shadow DOM
​https://bugs.webkit.org/show_bug.cgi?id=149437

Reviewed by Antti Koivisto.

Added various tests for shadow tree rendering as well as tests for :host pseudo class and ::slotted pseudo element.

• fast/shadow-dom/css-scoping-shadow-assigned-node-with-before-after-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-assigned-node-with-before-after.html: Added.
• fast/shadow-dom/css-scoping-shadow-assigned-node-with-rules-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-assigned-node-with-rules.html: Added.
• fast/shadow-dom/css-scoping-shadow-host-functional-rule-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-host-functional-rule.html: Added.
• fast/shadow-dom/css-scoping-shadow-host-rule-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-host-rule.html: Added.
• fast/shadow-dom/css-scoping-shadow-host-with-before-after-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-host-with-before-after.html: Added.
• fast/shadow-dom/css-scoping-shadow-slot-display-override-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-slot-display-override.html: Added.
• fast/shadow-dom/css-scoping-shadow-slotted-rule-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-slotted-rule.html: Added.
• fast/shadow-dom/css-scoping-shadow-with-outside-rules-expected.html: Copied from LayoutTests/fast/shadow-dom/css-scoping-shadow-root-hides-children-expected.html.
• fast/shadow-dom/css-scoping-shadow-with-outside-rules.html: Added.
• platform/mac/TestExpectations:

6:27 PM Changeset in webkit [190097] by rniwa@webkit.org

• 3 edits in trunk/Source/WebCore

Fix release builds with security assertion after r190007.

• dom/DocumentOrderedMap.cpp:
• dom/DocumentOrderedMap.h:

6:21 PM Changeset in webkit [190096] by sbarati@apple.com

• 2 edits in trunk/Source/JavaScriptCore

functionProtoFuncToString should not rely on typeProfilingEndOffset()
​https://bugs.webkit.org/show_bug.cgi?id=149429

Reviewed by Geoffrey Garen.

We should be able to freely change typeProfilingEndOffset()
without worrying we will break Function.prototype.toString.

• runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

5:51 PM Changeset in webkit [190095] by yoon@igalia.com

• 13 edits in trunk/Source

[Threaded Compositor] Modified to use reference of GraphicsContext instead of pointer
​https://bugs.webkit.org/show_bug.cgi?id=149399

Reviewed by Darin Adler.

This fixes build failure after r189144

Source/WebCore:

• platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::tiledBackingStorePaint):

• platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
• platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
• platform/graphics/texmap/coordinated/CoordinatedSurface.h:
• platform/graphics/texmap/coordinated/Tile.cpp:

(WebCore::Tile::paintToSurfaceContext):

• platform/graphics/texmap/coordinated/Tile.h:
• platform/graphics/texmap/coordinated/TiledBackingStoreClient.h:
• platform/graphics/texmap/coordinated/UpdateAtlas.cpp:

Source/WebKit2:

• Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.cpp:

(WebKit::ThreadSafeCoordinatedSurface::paintToSurface):
(WebKit::ThreadSafeCoordinatedSurface::beginPaint):
(WebKit::ThreadSafeCoordinatedSurface::endPaint):

• Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.h:

5:38 PM Changeset in webkit [190094] by Brent Fulgham

• 2 edits in trunk/Source/WebKit

[Win] Unreviewed build fix.

• WebKit.vcxproj/WebKit/WebKitApple.props: We need to link against

libdispatch on Windows.

5:26 PM Changeset in webkit [190093] by rniwa@webkit.org

• 5 edits in trunk/Source/WebCore

The binding for getDistributedNodes unnecessarily makes a vector of nodes
​https://bugs.webkit.org/show_bug.cgi?id=149434

Reviewed by Darin Adler.

Added a jsArray for const Vector<T*>* so that we can generate the binding code for getDistributedNodes()
without having to create Vector<RefPtr<Node>> out of Vector<Node*>*.

• bindings/js/JSDOMBinding.h:

(WebCore::jsArray): Added.

• html/HTMLSlotElement.cpp:

(WebCore::HTMLSlotElement::assignedNodes):
(WebCore::HTMLSlotElement::getDistributedNodes): Deleted.

• html/HTMLSlotElement.h:
• html/HTMLSlotElement.idl:

5:21 PM Changeset in webkit [190092] by ap@apple.com

• 2 edits in trunk/Source/WebKit/mac

REGRESSION (r182648): UIWebView does not set location.hash synchronously
​https://bugs.webkit.org/show_bug.cgi?id=149415
<rdar://problem/22169467>

Reviewed by Darin Adler.

The problem was that the delegate in UI thread became asynchronous due to calling
into LaunchServices.

• WebCoreSupport/WebFrameLoaderClient.mm: (shouldTryAppLink): Don't attempt app

links for same domain navigations. This check is part of substantially more complicated
logic in WebKit2 that I don't understand, but that should be enough to demonstrate
that this fix is an improvement at least.

5:07 PM Changeset in webkit [190091] by Brent Fulgham

• 19 edits in trunk

Source/WebCore:
[Win] Show tiled drawing debug overlay on Windows
​https://bugs.webkit.org/show_bug.cgi?id=149426

Reviewed by Dean Jackson.

No new tests: No change in behavior.

• platform/graphics/ca/PlatformCALayer.cpp:

(WebCore::PlatformCALayer::drawRepaintIndicator): Revise signature to accept
a scale value and a font size.
(WebCore::PlatformCALayer::drawTextAtPoint): Revise signature for new arguments.

• platform/graphics/ca/PlatformCALayer.h:
• platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::drawTileMapContents): Removing scaling and text drawing code,
and call common CALayer drawing routine.

• platform/graphics/ca/win/CACFLayerTreeHost.cpp:

(WebCore::CACFLayerTreeHost::create): Switch to nullptr.
(WebCore::CACFLayerTreeHost::CACFLayerTreeHost): Switch to C++14 initializers.
(WebCore::CACFLayerTreeHost::setPage): Added.
(WebCore::CACFLayerTreeHost::rootLayer): Update debug info layer if requested by settings.
(WebCore::CACFLayerTreeHost::layerTreeDidChange): Ditto.
(WebCore::CACFLayerTreeHost::mainFrameTiledBacking): Added.
(WebCore::CACFLayerTreeHost::updateDbugInfoLayer): Added.

• platform/graphics/ca/win/CACFLayerTreeHost.h:
• platform/graphics/ca/win/PlatformCALayerWin.cpp:

(WebCore::PlatformCALayerWin::drawTextAtPoint): Revised signature for new arguments. Use
argument for font size (rather than hard-coded '18'). Adjust font size by passed scale value.

• platform/graphics/ca/win/PlatformCALayerWin.h:

Source/WebKit/win:
[Win] Show tiled drawing debug overlay on Windows
​https://bugs.webkit.org/show_bug.cgi?id=149426

Reviewed by Dean Jackson.

• Interfaces/IWebPreferencesPrivate.idl: Add new IWebPreferencesPrivate3 API version

so we can add new methods this cycle.

• WebPreferenceKeysPrivate.h: Add key for 'WebKitShowTiledScrollingIndicator'
• WebPreferences.cpp:

(WebPreferences::QueryInterface): Recognize the new IWebPreferencesPrivate3 API.
(WebPreferences::showTiledScrollingIndicator): Added.
(WebPreferences::setShowTiledScrollingIndicator): Ditto.

• WebPreferences.h:
• WebView.cpp:

(WebView::notifyPreferencesChanged): Update to recognize 'showTiledScrollingIndicator'.
(WebView::setAcceleratedCompositing): Link the CACFLayerTreeHost to the WebCore Page object
so that it can see settings information.

Tools:
Remove 'nullable' to fix older iOS builds.

Patch by Simon Fraser <Simon Fraser> on 2015-09-21

• WebKitTestRunner/cocoa/TestRunnerWKWebView.mm:

(-[TestRunnerWKWebView scrollViewDidEndZooming:withView:atScale:]):

5:05 PM Changeset in webkit [190090] by Csaba Osztrogonác

• 2 edits in trunk/Source/WTF

Remove old GCC cruft from wtf/StdLibExtras.h
​https://bugs.webkit.org/show_bug.cgi?id=149401

Reviewed by Alex Christensen.

• wtf/StdLibExtras.h:

4:22 PM Changeset in webkit [190089] by aestes@apple.com

• 2 edits in trunk/Source/WTF

Disable Parental Controls on the Apple TV platform
​https://bugs.webkit.org/show_bug.cgi?id=149421

Reviewed by Darin Adler.

• wtf/Platform.h:

4:03 PM Changeset in webkit [190088] by commit-queue@webkit.org

• 4 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r190086.
​https://bugs.webkit.org/show_bug.cgi?id=149427

Broke LayoutTests/inspector/model/remote-object.htm (Requested
by saamyjoon on #webkit).

Reverted changeset:

"Web Inspector: Basic Block Annotations and Type Profiler
annotations wrong for script with "class" with default
constructor"
​https://bugs.webkit.org/show_bug.cgi?id=149248
​http://trac.webkit.org/changeset/190086

3:50 PM Changeset in webkit [190087] by Simon Fraser

• 2 edits in trunk/Tools

Remove 'nullable' to fix older iOS builds.

• WebKitTestRunner/cocoa/TestRunnerWKWebView.mm:

(-[TestRunnerWKWebView scrollViewDidEndZooming:withView:atScale:]):

3:42 PM Changeset in webkit [190086] by sbarati@apple.com

• 4 edits in trunk/Source/JavaScriptCore

Web Inspector: Basic Block Annotations and Type Profiler annotations wrong for script with "class" with default constructor
​https://bugs.webkit.org/show_bug.cgi?id=149248

Reviewed by Mark Lam.

We keep track of which functions have and have not
executed so we can show visually, inside the inspector,
which functions have and have not executed. With a default
constructor, our parser parses code that isn't in the actual
JavaScript source code of the user. Our parser would then
give us a range of starting at "1" to "1 + default constructor length"
as being the text range of a function. But, this would then pollute
actual source code that was at these ranges.

Therefore, we should treat these default constructor source
codes as having "invalid" ranges. We use [UINT_MAX, UINT_MAX]
as the invalid range. This range has the effect of not polluting
valid ranges inside the source code.

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
(JSC::UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets):

• bytecode/UnlinkedFunctionExecutable.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitNewDefaultConstructor):

3:39 PM Changeset in webkit [190085] by Chris Dumez

• 25 edits
  2 adds in trunk

[JS Bindings] prototype.constructor should be writable
​https://bugs.webkit.org/show_bug.cgi?id=149412
<rdar://problem/22545096>

Reviewed by Geoffrey Garen.

LayoutTests/imported/w3c:

Rebaseline W3C DOM / HTML tests now that more checks are passing.

• web-platform-tests/dom/interfaces-expected.txt:
• web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

prototype.constructor should have the following properties:
{ Writable: true, Enumerable: false, Configurable: true }

as per the Web IDL specification:
​https://heycam.github.io/webidl/#interface-prototype-object

In WebKit, it is currently not writable. It is writable in Firefox.

Test: fast/events/event-prototype-constructor-properties.html

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateAttributesHashTable):

• bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
• bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
• bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
• bindings/scripts/test/JS/JSTestEventConstructor.cpp:
• bindings/scripts/test/JS/JSTestEventTarget.cpp:
• bindings/scripts/test/JS/JSTestException.cpp:
• bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
• bindings/scripts/test/JS/JSTestInterface.cpp:
• bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
• bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
• bindings/scripts/test/JS/JSTestNode.cpp:
• bindings/scripts/test/JS/JSTestNondeterministic.cpp:
• bindings/scripts/test/JS/JSTestObj.cpp:
• bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
• bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
• bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
• bindings/scripts/test/JS/JSTestTypedefs.cpp:
• bindings/scripts/test/JS/JSattribute.cpp:
• bindings/scripts/test/JS/JSreadonly.cpp:

LayoutTests:

Add layout test that checks that Event.prototype.constructor has the
expected properties and that it is actually writable.

• fast/events/event-prototype-constructor-properties-expected.txt: Added.
• fast/events/event-prototype-constructor-properties.html: Added.

3:27 PM Changeset in webkit [190084] by Antti Koivisto

• 7 edits in trunk

HTMLSlotElement should render its assigned nodes
​https://bugs.webkit.org/show_bug.cgi?id=149242

Reviewed by Ryosuke Niwa.

Source/WebCore:

Support rendering the assigned nodes under HTMLSlotElement.

• dom/SlotAssignment.cpp:

(WebCore::SlotAssignment::assignSlots):

Move the empty slot finding to the loop as the hash table may mutate.

• html/HTMLSlotElement.cpp:

(WebCore::HTMLSlotElement::attributeChanged):
(WebCore::HTMLSlotElement::assignedNodes):
(WebCore::HTMLSlotElement::getDistributedNodes):

• html/HTMLSlotElement.h:
• style/StyleResolveTree.cpp:

(WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
(WebCore::Style::attachSlot):
(WebCore::Style::attachRenderTree):
(WebCore::Style::detachChildren):
(WebCore::Style::detachShadowRoot):
(WebCore::Style::detachSlot):
(WebCore::Style::detachRenderTree):
(WebCore::Style::resolveChildren):
(WebCore::Style::resolveSlot):
(WebCore::Style::resolveTree):

LayoutTests:

Enable the relevant tests.

• platform/mac/TestExpectations:

3:08 PM Changeset in webkit [190083] by bshafiei@apple.com

• 1 copy in tags/Safari-601.1.46.25

New tag.

3:02 PM Changeset in webkit [190082] by Brent Fulgham

• 3 edits in trunk/Tools

[Win] Use command-line argument to launch in regular or High DPI mode.
​https://bugs.webkit.org/show_bug.cgi?id=149417

Reviewed by Dean Jackson.

• MiniBrowser/win/Common.cpp:

(parseCommandLine): Ignore the '--highDPI' argument. It's used at the
very start of execution, before the MiniBrowser.dll is loaded.

• win/DLLLauncher/DLLLauncherMain.cpp:

(shouldUseHighDPI): Check for '--highDPI', and use this mode if
present. On WinCairo, always use High DPI.

2:52 PM Changeset in webkit [190081] by achristensen@apple.com

• 1 edit
  1 delete in trunk/LayoutTests

Remove Windows-specific navigator-detached-no-crash-expected.
​https://bugs.webkit.org/show_bug.cgi?id=149414

Reviewed by Filip Pizlo.

When we switched to CMake, NAVIGATOR_HWCONCURRENCY got enabled.
There is no reason to disable it, and the expectations match the default expectations now.

• platform/win/fast/dom/navigator-detached-no-crash-expected.txt: Removed.

2:20 PM Changeset in webkit [190080] by Sukolsak Sakshuwong

• 8 edits in trunk/Source/JavaScriptCore

Implement call statements and call expressions of type void in WebAssembly
​https://bugs.webkit.org/show_bug.cgi?id=149411

Reviewed by Mark Lam.

Call instructions in WebAssembly can be both statements and expressions.
This patch implements call statements. It also implements call
expressions of type void. The only place where call expressions of type
void can occur is the left-hand side of the comma (,) operator, which
will be implemented in a subsequent patch. The comma operator requires
both of its operands to be expressions.

• tests/stress/wasm-calls.js:
• tests/stress/wasm/calls.wasm:
• wasm/WASMConstants.h:
• wasm/WASMFunctionParser.cpp:

(JSC::WASMFunctionParser::parseStatement):
(JSC::WASMFunctionParser::parseExpression):
(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseExpressionVoid):
(JSC::WASMFunctionParser::parseCallInternal):
(JSC::WASMFunctionParser::parseCallIndirect):
(JSC::WASMFunctionParser::parseCallImport):

• wasm/WASMFunctionParser.h:
• wasm/WASMReader.cpp:

(JSC::WASMReader::readOpExpressionVoid):

• wasm/WASMReader.h:

2:01 PM Changeset in webkit [190079] by timothy_horton@apple.com

• 3 edits in trunk/Source/WebCore

svg/custom/hidpi-masking-clipping.svg fails with accelerated drawing on
​https://bugs.webkit.org/show_bug.cgi?id=149413
<rdar://problem/22787058>

Reviewed by Dean Jackson.

No new tests, this is covered by existing tests.

• rendering/svg/RenderSVGResourcePattern.cpp:

(WebCore::RenderSVGResourcePattern::buildPattern):
(WebCore::RenderSVGResourcePattern::applyResource):
(WebCore::RenderSVGResourcePattern::createTileImage):

• rendering/svg/RenderSVGResourcePattern.h:

Make pattern images respect the accelerated bit of the parent GraphicsContext.

1:59 PM Changeset in webkit [190078] by Chris Dumez

• 10 edits in trunk

DOMTokenList.add() / remove() should run the update steps even if tokens were not modified
​https://bugs.webkit.org/show_bug.cgi?id=148780
<rdar://problem/22571794>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C DOM test now that more checks are passing.

• web-platform-tests/dom/nodes/MutationObserver-attributes-expected.txt:

Source/WebCore:

DOMTokenList.add() / remove() should run the update steps even if tokens
were not modified, as per the DOM specification:

• ​https://dom.spec.whatwg.org/#dom-domtokenlist-add
• ​https://dom.spec.whatwg.org/#dom-domtokenlist-remove

The update steps are specified at:

• ​https://dom.spec.whatwg.org/#concept-DTL-update

This will have several side effects if the DOMTokenList has an associated
attribute. It will overwrite the attribute value which will:

1. Generate a Mutation event.
2. Possibly change the attribute value as the new value is the "ordered set serializer for tokens". So it will get rid of extra spaces and duplicates in the attribute value.

Firefox already behaves according to the specification.

No new tests, already covered by existing tests.

• html/DOMTokenList.cpp:

(WebCore::DOMTokenList::addInternal):
(WebCore::DOMTokenList::removeInternal):
(WebCore::DOMTokenList::remove): Deleted.

LayoutTests:

Update / Rebaseline several classList /relList tests now that our
behavior has changed.

• fast/dom/HTMLElement/class-list-expected.txt:
• fast/dom/HTMLElement/class-list-quirks-expected.txt:
• fast/dom/HTMLElement/script-tests/class-list.js:
• fast/dom/rel-list-expected.txt:
• fast/dom/rel-list.html:

1:57 PM Changeset in webkit [190077] by achristensen@apple.com

• 2 edits in trunk

Disable PICTURE_SIZES in Windows CMake build like r189745.
​https://bugs.webkit.org/show_bug.cgi?id=149125

• Source/cmake/OptionsWin.cmake:

Do the same thing as r189745.

1:49 PM Changeset in webkit [190076] by fpizlo@apple.com

• 59 edits
  20 adds in trunk

JSC should infer property types
​https://bugs.webkit.org/show_bug.cgi?id=148610

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This change brings recursive type inference to JavaScript object properties in JSC. We check that a
value being stored into a property obeys a property's type before we do the store. If it doesn't,
we broaden the property's type to include the new value. If optimized code was relying on the old
type, we deoptimize that code.

The type system that this supports includes important primitive types like Int32 and Boolean. But
it goes further and also includes a type kind called ObjectWithStructure, which means that we
expect the property to always point to objects with a particular structure. This only works for
leaf structures (i.e. structures that have a valid transition watchpoint set). Invalidation of the
transition set causes the property type to become Object (meaning an object with any structure).
This capability gives us recursive type inference. It's possible for an expression like "o.f.g.h"
to execute without any type checks if .f and .g are both ObjectWithStructure.

The type inference of a property is tracked by an InferredType instance, which is a JSCell. This
means that it manages its own memory. That's convenient. For example, when the DFG is interested in
one of these, it can just list the InferredType as a weak reference in addition to setting a
watchpoint. This ensures that even if the InferredType is dropped by the owning structure, the DFG
won't read a dangling pointer. A mapping from property name to InferredType is implemented by
InferredTypeTable, which is also a JSCell. Each Structure may point to some InferredTypeTable.

This feature causes programs to be happier (run faster without otherwise doing bad things like
using lots of memory) when four conditions hold:

1) A property converges to one of the types that we support.
2) The property is loaded from more frequently than it is stored to.
3) The stores are all cached, so that we statically emit a type check.
4) We don't allocate a lot of meta-data for the property's type.

We maximize the likelihood of (1) by having a rich type system. But having a rich type system means
that a reflective put to a property has to have a large switch over the inferred type to decide how
to do the type check. That's why we need (3). We ensure (3) by having every reflective property
store (i.e. putDirectInternal in any context that isn't PutById) force the inferred type to become
Top. We don't really worry about ensuring (2); this is statistically true for most programs
already.

Probably the most subtle trickery goes into (4). Logically we'd like to say that each
(Structure, Property) maps to its own InferredType. If structure S1 has a transition edge to S2,
then we could ensure that the InferredType I1 where (S1, Property)->I1 has a data flow constraint
to I2 where (S2, Property)->I2. That would work, but it would involve a lot of memory. And when I1
gets invalidated in some way, it would have to tell I2 about it, and then I2 might tell other
InferredType objects downstream. That's madness. So, the first major compromise that we make here
is to say that if some property has some InferredType at some Structure, then anytime we
transition from that Structure, the new Structure shares the same InferredType for that property.
This unifies the type of the property over the entire transition tree starting at the Structure at
which the property was added. But this would still mean that each Structure would have its own
InferredTypeTable. We don't want that because experience with PropertyTable shows that this can be
a major memory hog. So, we don't create an InferredTypeTable until someone adds a property that is
subject to type inference (i.e. it was added non-reflectively), and we share that InferredTypeTable
with the entire structure transition tree rooted at the Structure that had the first inferred
property. We also drop the InferredTypeTable anytime that we do a dictionary transition, and we
don't allow further property type inference if a structure had ever been a dictionary.

This is a 3% speed-up on Octane and a 12% speed-up on Kraken on my setup. It's not a significant
slow-down on any benchmark I ran.

• CMakeLists.txt:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
• JavaScriptCore.xcodeproj/project.pbxproj:
• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::branchTest64):

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::branchTest64):
(JSC::MacroAssemblerX86_64::test64):

• bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generate):

• bytecode/PutByIdFlags.cpp:

(WTF::printInternal):

• bytecode/PutByIdFlags.h:

(JSC::encodeStructureID):
(JSC::decodeStructureID):

• bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeFromLLInt):
(JSC::PutByIdStatus::computeFor):
(JSC::PutByIdStatus::computeForStubInfo):

• bytecode/PutByIdVariant.cpp:

(JSC::PutByIdVariant::operator=):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::setter):
(JSC::PutByIdVariant::attemptToMerge):
(JSC::PutByIdVariant::dumpInContext):

• bytecode/PutByIdVariant.h:

(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::requiredType):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedInstruction::UnlinkedInstruction):

• bytecode/Watchpoint.h:

(JSC::InlineWatchpointSet::touch):
(JSC::InlineWatchpointSet::isBeingWatched):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::addConstantValue):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitDirectPutById):

• dfg/DFGAbstractInterpreter.h:

(JSC::DFG::AbstractInterpreter::filter):
(JSC::DFG::AbstractInterpreter::filterByValue):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::filter):

• dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::setType):
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
(JSC::DFG::AbstractValue::mergeOSREntryValue):
(JSC::DFG::AbstractValue::isType):
(JSC::DFG::AbstractValue::filter):
(JSC::DFG::AbstractValue::filterValueByType):

• dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::setType):
(JSC::DFG::AbstractValue::isType):
(JSC::DFG::AbstractValue::validate):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
(JSC::DFG::ByteCodeParser::handleGetByOffset):
(JSC::DFG::ByteCodeParser::handlePutByOffset):
(JSC::DFG::ByteCodeParser::load):
(JSC::DFG::ByteCodeParser::store):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):

• dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck):

• dfg/DFGDesiredInferredType.h: Added.

(JSC::DFG::DesiredInferredType::DesiredInferredType):
(JSC::DFG::DesiredInferredType::operator bool):
(JSC::DFG::DesiredInferredType::object):
(JSC::DFG::DesiredInferredType::expected):
(JSC::DFG::DesiredInferredType::isStillValid):
(JSC::DFG::DesiredInferredType::add):
(JSC::DFG::DesiredInferredType::operator==):
(JSC::DFG::DesiredInferredType::operator!=):
(JSC::DFG::DesiredInferredType::isHashTableDeletedValue):
(JSC::DFG::DesiredInferredType::hash):
(JSC::DFG::DesiredInferredType::dumpInContext):
(JSC::DFG::DesiredInferredType::dump):
(JSC::DFG::DesiredInferredTypeHash::hash):
(JSC::DFG::DesiredInferredTypeHash::equal):

• dfg/DFGDesiredWatchpoints.cpp:

(JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
(JSC::DFG::InferredTypeAdaptor::add):
(JSC::DFG::DesiredWatchpoints::DesiredWatchpoints):
(JSC::DFG::DesiredWatchpoints::~DesiredWatchpoints):
(JSC::DFG::DesiredWatchpoints::addLazily):
(JSC::DFG::DesiredWatchpoints::consider):
(JSC::DFG::DesiredWatchpoints::reallyAdd):
(JSC::DFG::DesiredWatchpoints::areStillValid):
(JSC::DFG::DesiredWatchpoints::dumpInContext):

• dfg/DFGDesiredWatchpoints.h:

(JSC::DFG::AdaptiveStructureWatchpointAdaptor::dumpInContext):
(JSC::DFG::InferredTypeAdaptor::hasBeenInvalidated):
(JSC::DFG::InferredTypeAdaptor::dumpInContext):
(JSC::DFG::DesiredWatchpoints::isWatched):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::isSafeToLoad):
(JSC::DFG::Graph::inferredTypeFor):
(JSC::DFG::Graph::livenessFor):
(JSC::DFG::Graph::tryGetConstantProperty):
(JSC::DFG::Graph::inferredValueForProperty):
(JSC::DFG::Graph::tryGetConstantClosureVar):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::registerInferredType):
(JSC::DFG::Graph::inferredTypeForProperty):

• dfg/DFGInferredTypeCheck.cpp: Added.

(JSC::DFG::insertInferredTypeCheck):

• dfg/DFGInferredTypeCheck.h: Added.
• dfg/DFGNode.h:
• dfg/DFGObjectAllocationSinkingPhase.cpp:
• dfg/DFGPropertyTypeKey.h: Added.

(JSC::DFG::PropertyTypeKey::PropertyTypeKey):
(JSC::DFG::PropertyTypeKey::operator bool):
(JSC::DFG::PropertyTypeKey::structure):
(JSC::DFG::PropertyTypeKey::uid):
(JSC::DFG::PropertyTypeKey::operator==):
(JSC::DFG::PropertyTypeKey::operator!=):
(JSC::DFG::PropertyTypeKey::hash):
(JSC::DFG::PropertyTypeKey::isHashTableDeletedValue):
(JSC::DFG::PropertyTypeKey::dumpInContext):
(JSC::DFG::PropertyTypeKey::dump):
(JSC::DFG::PropertyTypeKey::deletedUID):
(JSC::DFG::PropertyTypeKeyHash::hash):
(JSC::DFG::PropertyTypeKeyHash::equal):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileTypeOf):
(JSC::DFG::SpeculativeJIT::compileCheckStructure):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::speculateCell):
(JSC::DFG::SpeculativeJIT::speculateCellOrOther):
(JSC::DFG::SpeculativeJIT::speculateObject):
(JSC::DFG::SpeculativeJIT::speculate):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStoreBarrierInsertionPhase.cpp:
• dfg/DFGStructureAbstractValue.h:

(JSC::DFG::StructureAbstractValue::at):
(JSC::DFG::StructureAbstractValue::operator[]):
(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::forEach):

• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validate):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileCheckStructure):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCheckCell):
(JSC::FTL::DFG::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToLLVM::numberOrNotCellToInt32):
(JSC::FTL::DFG::LowerDFGToLLVM::checkInferredType):
(JSC::FTL::DFG::LowerDFGToLLVM::loadProperty):
(JSC::FTL::DFG::LowerDFGToLLVM::speculate):
(JSC::FTL::DFG::LowerDFGToLLVM::speculateCell):
(JSC::FTL::DFG::LowerDFGToLLVM::speculateCellOrOther):
(JSC::FTL::DFG::LowerDFGToLLVM::speculateMachineInt):
(JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::decodedCodeMapFor):
(JSC::AssemblyHelpers::branchIfNotType):
(JSC::AssemblyHelpers::purifyNaN):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::branchIfEqual):
(JSC::AssemblyHelpers::branchIfNotCell):
(JSC::AssemblyHelpers::branchIfCell):
(JSC::AssemblyHelpers::branchIfNotOther):
(JSC::AssemblyHelpers::branchIfInt32):
(JSC::AssemblyHelpers::branchIfNotInt32):
(JSC::AssemblyHelpers::branchIfNumber):
(JSC::AssemblyHelpers::branchIfNotNumber):
(JSC::AssemblyHelpers::branchIfEmpty):
(JSC::AssemblyHelpers::branchStructure):

• jit/Repatch.cpp:

(JSC::tryCachePutByID):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/InferredType.cpp: Added.

(JSC::InferredType::create):
(JSC::InferredType::destroy):
(JSC::InferredType::createStructure):
(JSC::InferredType::visitChildren):
(JSC::InferredType::kindForFlags):
(JSC::InferredType::Descriptor::forValue):
(JSC::InferredType::Descriptor::forFlags):
(JSC::InferredType::Descriptor::putByIdFlags):
(JSC::InferredType::Descriptor::merge):
(JSC::InferredType::Descriptor::removeStructure):
(JSC::InferredType::Descriptor::subsumes):
(JSC::InferredType::Descriptor::dumpInContext):
(JSC::InferredType::Descriptor::dump):
(JSC::InferredType::InferredType):
(JSC::InferredType::~InferredType):
(JSC::InferredType::canWatch):
(JSC::InferredType::addWatchpoint):
(JSC::InferredType::dump):
(JSC::InferredType::willStoreValueSlow):
(JSC::InferredType::makeTopSlow):
(JSC::InferredType::set):
(JSC::InferredType::removeStructure):
(JSC::InferredType::InferredStructureWatchpoint::fireInternal):
(JSC::InferredType::InferredStructureFinalizer::finalizeUnconditionally):
(JSC::InferredType::InferredStructure::InferredStructure):
(WTF::printInternal):

• runtime/InferredType.h: Added.
• runtime/InferredTypeTable.cpp: Added.

(JSC::InferredTypeTable::create):
(JSC::InferredTypeTable::destroy):
(JSC::InferredTypeTable::createStructure):
(JSC::InferredTypeTable::visitChildren):
(JSC::InferredTypeTable::get):
(JSC::InferredTypeTable::willStoreValue):
(JSC::InferredTypeTable::makeTop):
(JSC::InferredTypeTable::InferredTypeTable):
(JSC::InferredTypeTable::~InferredTypeTable):

• runtime/InferredTypeTable.h: Added.
• runtime/JSObject.h:

(JSC::JSObject::putDirectInternal):
(JSC::JSObject::putDirectWithoutTransition):

• runtime/Structure.cpp:

(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::removePropertyTransition):
(JSC::Structure::startWatchingInternalProperties):
(JSC::Structure::willStoreValueSlow):
(JSC::Structure::visitChildren):
(JSC::Structure::prototypeChainMayInterceptStoreTo):

• runtime/Structure.h:

(JSC::PropertyMapEntry::PropertyMapEntry):

• runtime/StructureInlines.h:

(JSC::Structure::get):

• runtime/VM.cpp:

(JSC::VM::VM):

• runtime/VM.h:
• tests/stress/prop-type-boolean-then-string.js: Added.
• tests/stress/prop-type-int32-then-string.js: Added.
• tests/stress/prop-type-number-then-string.js: Added.
• tests/stress/prop-type-object-or-other-then-string.js: Added.
• tests/stress/prop-type-object-then-string.js: Added.
• tests/stress/prop-type-other-then-string.js: Added.
• tests/stress/prop-type-string-then-object.js: Added.
• tests/stress/prop-type-struct-or-other-then-string.js: Added.
• tests/stress/prop-type-struct-then-object.js: Added.
• tests/stress/prop-type-struct-then-object-opt.js: Added.
• tests/stress/prop-type-struct-then-object-opt-fold.js: Added.
• tests/stress/prop-type-struct-then-object-opt-multi.js: Added.

Source/WTF:

• wtf/HashTable.h:

(WTF::HashTableAddResult::HashTableAddResult): Make it possible to say "HashMap::AddResult result" without assigning anything to it yet.

• wtf/PrintStream.h:

(WTF::printInternal): Beef up printing of some common WTF types, in particular RefPtr<UniquedStringImpl>.

1:34 PM Changeset in webkit [190075] by rniwa@webkit.org

• 2 edits in trunk/Tools

32-bit Mac build fix attempt after r190065.

• WebKitTestRunner/cocoa/TestRunnerWKWebView.mm:

1:24 PM Changeset in webkit [190074] by rniwa@webkit.org

• 2 edits
  6 adds in trunk/LayoutTests

Add some tests for shadow DOM rendering
​https://bugs.webkit.org/show_bug.cgi?id=149330

Reviewed by Antti Koivisto.

Added some ref tests for new shadow DOM API rendering with failing expectations everywhere.

This is a relanding of r189962 excluding css-scoping-shadow-rendering.html since it has since been added in r190006
as css-scoping-shadow-root-hides-children.html by Antti.

• fast/shadow-dom/css-scoping-shadow-invisible-slot-expected.html: Added.
• fast/shadow-dom/css-scoping-shadow-invisible-slot.html: Added.
• fast/shadow-dom/css-scoping-shadow-slot-expected.html: Added.
• fast/shadow-dom/css-scoping-shadow-slot.html: Added.
• fast/shadow-dom/css-scoping-shadow-with-rules-expected.html: Added.
• fast/shadow-dom/css-scoping-shadow-with-rules.html: Added.
• platform/mac/TestExpectations:

1:10 PM Changeset in webkit [190073] by fpizlo@apple.com

• 13 edits in trunk/Source/JavaScriptCore

WebCore shouldn't have to include DFG headers
​https://bugs.webkit.org/show_bug.cgi?id=149337

Reviewed by Michael Saboff.

This does some simple rewiring and outlining of CodeBlock/Heap functionality so that
those headers don't have to include DFG headers. As a result, WebCore no longer includes
DFG headers, except for two fairly innocent ones (DFGCommon.h and DFGCompilationMode.h).
This also changes the Xcode project file so that all but those two headers are Project
rather than Private. So, if WebCore accidentally includes any of them, we'll get a build
error.

The main group of headers that this prevents WebCore from including are the DFGDesired*.h
files and whatever those include. Those headers used to be fairly simple, but now they
are growing in complexity (especially with things like ​http://webkit.org/b/148610). So,
it makes sense to make sure they don't leak out of JSC.

• JavaScriptCore.xcodeproj/project.pbxproj:
• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::CallLinkInfo):
(JSC::CallLinkInfo::~CallLinkInfo):
(JSC::CallLinkInfo::clearStub):
(JSC::CallLinkInfo::visitWeak):
(JSC::CallLinkInfo::setFrameShuffleData):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::isVarargsCallType):
(JSC::CallLinkInfo::specializationKindFor):
(JSC::CallLinkInfo::frameShuffleData):
(JSC::CallLinkInfo::CallLinkInfo): Deleted.
(JSC::CallLinkInfo::~CallLinkInfo): Deleted.
(JSC::CallLinkInfo::setFrameShuffleData): Deleted.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::getOrAddArrayProfile):
(JSC::CodeBlock::codeOrigins):
(JSC::CodeBlock::numberOfDFGIdentifiers):
(JSC::CodeBlock::identifier):
(JSC::CodeBlock::updateAllPredictionsAndCountLiveness):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::hasExpressionInfo):
(JSC::CodeBlock::hasCodeOrigins):
(JSC::CodeBlock::numberOfIdentifiers):
(JSC::CodeBlock::identifier):
(JSC::CodeBlock::codeOrigins): Deleted.
(JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.

• bytecode/CodeOrigin.h:
• dfg/DFGDesiredIdentifiers.cpp:
• heap/Heap.cpp:

(JSC::Heap::didFinishIterating):
(JSC::Heap::completeAllDFGPlans):
(JSC::Heap::markRoots):
(JSC::Heap::deleteAllCodeBlocks):

• heap/Heap.h:
• heap/HeapInlines.h:

(JSC::Heap::deprecatedReportExtraMemory):
(JSC::Heap::forEachCodeBlock):
(JSC::Heap::forEachProtectedCell):

• runtime/Executable.h:
• runtime/JSCInlines.h:

(JSC::Heap::forEachCodeBlock): Deleted.

1:09 PM Changeset in webkit [190072] by eric.carlson@apple.com

• 25 edits in trunk/Source/WebCore

[MediaStream] Clean up MediaStream private interfaces
​https://bugs.webkit.org/show_bug.cgi?id=149381

Reviewed by Jer Noble.

No new tests, no functional change.

• Modules/mediastream/MediaStream.cpp:

(WebCore::MediaStream::create):
(WebCore::MediaStream::MediaStream):
(WebCore::MediaStream::clone):
(WebCore::MediaStream::getTrackById):
(WebCore::MediaStream::getAudioTracks):
(WebCore::MediaStream::getVideoTracks):
(WebCore::MediaStream::getTracks):
(WebCore::MediaStream::activeStatusChanged):
(WebCore::MediaStream::didAddTrack):
(WebCore::MediaStream::didRemoveTrack):
(WebCore::MediaStream::registry):
(WebCore::MediaStream::trackVectorForType):
(WebCore::MediaStream::didAddTrackToPrivate): Deleted.
(WebCore::MediaStream::didRemoveTrackFromPrivate): Deleted.

• Modules/mediastream/MediaStream.h:

• Modules/mediastream/MediaStreamRegistry.cpp:

(WebCore::MediaStreamRegistry::lookup):
(WebCore::MediaStreamRegistry::MediaStreamRegistry):

• Modules/mediastream/MediaStreamRegistry.h:

• Modules/mediastream/MediaStreamTrack.cpp:

(WebCore::MediaStreamTrack::MediaStreamTrack):
(WebCore::MediaStreamTrack::~MediaStreamTrack):
(WebCore::MediaStreamTrack::kind):
(WebCore::MediaStreamTrack::removeObserver):
(WebCore::MediaStreamTrack::trackEnded):
(WebCore::MediaStreamTrack::trackMutedChanged):
(WebCore::MediaStreamTrack::trackStatesChanged):
(WebCore::MediaStreamTrack::configureTrackRendering):

• Modules/mediastream/MediaStreamTrack.h:

• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::supportsType):
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::load):

• platform/graphics/avfoundation/objc/MediaStreamPrivateAVFObjC.h:
• platform/graphics/avfoundation/objc/MediaStreamPrivateAVFObjC.mm:

(WebCore::MediaStreamPrivateAVFObjC::create):
(WebCore::MediaStreamPrivateAVFObjC::MediaStreamPrivateAVFObjC):

• platform/mediastream/MediaStreamPrivate.cpp:

(WebCore::MediaStreamPrivate::create):
(WebCore::MediaStreamPrivate::MediaStreamPrivate):
(WebCore::MediaStreamPrivate::~MediaStreamPrivate):
(WebCore::MediaStreamPrivate::tracks):
(WebCore::MediaStreamPrivate::addTrack):
(WebCore::MediaStreamPrivate::removeTrack):

• platform/mediastream/MediaStreamPrivate.h:

(WebCore::MediaStreamPrivateClient::~MediaStreamPrivateClient):
(WebCore::MediaStreamPrivate::id):
(WebCore::MediaStreamPrivate::active):
(WebCore::MediaStreamPrivate::MediaStreamPrivate): Deleted.
(WebCore::MediaStreamPrivate::~MediaStreamPrivate): Deleted.

• platform/mediastream/MediaStreamTrackPrivate.cpp:

(WebCore::MediaStreamTrackPrivate::MediaStreamTrackPrivate):
(WebCore::MediaStreamTrackPrivate::~MediaStreamTrackPrivate):
(WebCore::MediaStreamTrackPrivate::addObserver):
(WebCore::MediaStreamTrackPrivate::removeObserver):
(WebCore::MediaStreamTrackPrivate::label):
(WebCore::MediaStreamTrackPrivate::endTrack):
(WebCore::MediaStreamTrackPrivate::sourceStopped):
(WebCore::MediaStreamTrackPrivate::sourceMutedChanged):
(WebCore::MediaStreamTrackPrivate::sourceStatesChanged):
(WebCore::MediaStreamTrackPrivate::preventSourceFromStopping):

• platform/mediastream/MediaStreamTrackPrivate.h:

(WebCore::MediaStreamTrackPrivate::Observer::~Observer):
(WebCore::MediaStreamTrackPrivate::ended):
(WebCore::MediaStreamTrackPrivate::startProducingData):
(WebCore::MediaStreamTrackPrivate::stopProducingData):
(WebCore::MediaStreamTrackPrivate::setMuted):
(WebCore::MediaStreamTrackPrivateClient::~MediaStreamTrackPrivateClient): Deleted.
(WebCore::MediaStreamTrackPrivate::setClient): Deleted.
(WebCore::MediaStreamTrackPrivate::client): Deleted.

• platform/mediastream/MediaStreamTrackSourcesRequestClient.h:

(WebCore::TrackSourceInfo::create):
(WebCore::TrackSourceInfo::id):
(WebCore::TrackSourceInfo::label):
(WebCore::TrackSourceInfo::groupId):
(WebCore::TrackSourceInfo::kind):
(WebCore::TrackSourceInfo::TrackSourceInfo):
(WebCore::TrackSourceInfo::deviceId): Deleted.

• platform/mediastream/RealtimeMediaSource.cpp:

(WebCore::RealtimeMediaSource::RealtimeMediaSource):
(WebCore::RealtimeMediaSource::reset):
(WebCore::RealtimeMediaSource::setMuted):
(WebCore::RealtimeMediaSource::statesDidChanged):
(WebCore::RealtimeMediaSource::readonly):

• platform/mediastream/RealtimeMediaSource.h:

(WebCore::RealtimeMediaSource::id):
(WebCore::RealtimeMediaSource::persistentId):
(WebCore::RealtimeMediaSource::setPersistentId):
(WebCore::RealtimeMediaSource::type):
(WebCore::RealtimeMediaSource::stopped):

• platform/mediastream/RealtimeMediaSourceCenter.h:
• platform/mediastream/mac/AVCaptureDeviceManager.mm:

(WebCore::AVCaptureDeviceManager::getSourcesInfo):

• platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:

(WebCore::RealtimeMediaSourceCenterMac::~RealtimeMediaSourceCenterMac):
(WebCore::RealtimeMediaSourceCenterMac::validateRequestConstraints):
(WebCore::RealtimeMediaSourceCenterMac::createMediaStream):
(WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources):

• platform/mediastream/mac/RealtimeMediaSourceCenterMac.h:

• platform/mediastream/openwebrtc/RealtimeMediaSourceCenterOwr.cpp:

(WebCore::RealtimeMediaSourceCenterOwr::~RealtimeMediaSourceCenterOwr):
(WebCore::RealtimeMediaSourceCenterOwr::validateRequestConstraints):

• platform/mediastream/openwebrtc/RealtimeMediaSourceCenterOwr.h:

• platform/mock/MockRealtimeMediaSourceCenter.cpp:

(WebCore::MockRealtimeMediaSourceCenter::registerMockRealtimeMediaSourceCenter):
(WebCore::MockRealtimeMediaSourceCenter::validateRequestConstraints):
(WebCore::MockRealtimeMediaSourceCenter::createMediaStream):
(WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources):

• platform/mock/MockRealtimeMediaSourceCenter.h:

1:05 PM Changeset in webkit [190071] by rniwa@webkit.org

• 2 edits in trunk/LayoutTests

Add image-only failure expectation to fast/shadow-dom/css-scoping-shadow-root-hides-children.html on non-Mac ports.

• TestExpectations:

12:43 PM Changeset in webkit [190070] by ap@apple.com

• 5 edits in trunk/Tools

[OS X] Update for Xcode 7.0 on Yosemite
​https://bugs.webkit.org/show_bug.cgi?id=149389

Reviewed by Dan Bernstein.

• DumpRenderTree/mac/DumpRenderTreeDraggingInfo.h:
• WebKitTestRunner/mac/WebKitTestRunnerDraggingInfo.h:

Removed unneeded declarations - conforming to a protocol is sufficient.

• DumpRenderTree/mac/DumpRenderTreeDraggingInfo.mm:
• WebKitTestRunner/mac/WebKitTestRunnerDraggingInfo.mm:

Changed the definitions to be compiled whenever the SDK requires it (so we will have
dead code compiled in when building for 10.10 with 10.11 SDK, somewhat unfortunately).

12:38 PM Changeset in webkit [190069] by achristensen@apple.com

• 2 edits in trunk/LayoutTests

Skip tests on Windows after r189947.

• platform/win/TestExpectations:

webkit-font-smoothing doesn't work on Windows.

12:15 PM Changeset in webkit [190068] by Csaba Osztrogonác

• 2 edits in trunk/Source/WebCore

Fix the !ENABLE(TEMPLATE_ELEMENT) build after r189945
​https://bugs.webkit.org/show_bug.cgi?id=149400

Reviewed by Darin Adler.

• xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::XMLDocumentParser::startElementNs):

12:15 PM Changeset in webkit [190067] by Chris Dumez

• 6 edits
  7 adds in trunk

Range.cloneContents() / extractContents should throw a HierarchyRequestError when encountering a doctype
​https://bugs.webkit.org/show_bug.cgi?id=148770
<rdar://problem/22570898>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C DOM test now that more checks are passing.

• web-platform-tests/dom/ranges/Range-cloneContents-expected.txt:

Source/WebCore:

Range.cloneContents() and Range.extractContents() should throw a
HierarchyRequestError when encountering a doctype:

• ​https://dom.spec.whatwg.org/#concept-range-clone (step 12)
• ​https://dom.spec.whatwg.org/#concept-range-extract (step 12)

However, Range.deleteContents() should not:

• ​https://dom.spec.whatwg.org/#dom-range-deletecontents

WebKit was not throwing in the Range.cloneContents() case. This
aligns updates our behavior to match the specification and
Firefox.

Tests: fast/dom/Range/clone-contents-document-type.html

fast/dom/Range/delete-contents-document-type.html
fast/dom/Range/extract-contents-document-type.html

• dom/Range.cpp:

(WebCore::Range::processContentsBetweenOffsets):

LayoutTests:

Add new tests to cover the behaviour of Range's cloneContents() / extractContents()
and deleteContents() when encountering a doctype.

• fast/dom/Range/clone-contents-document-type-expected.txt: Added.
• fast/dom/Range/clone-contents-document-type.html: Added.
• fast/dom/Range/delete-contents-document-type-expected.txt: Added.
• fast/dom/Range/delete-contents-document-type.html: Added.
• fast/dom/Range/extract-contents-document-type-expected.txt: Added.
• fast/dom/Range/extract-contents-document-type.html: Added.
• fast/dom/Range/resources/frame-with-doctype.html: Added.

12:11 PM Changeset in webkit [190066] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

Web Inspector: arrow function names are never inferred, call frames are labeled (anonymous function)
​https://bugs.webkit.org/show_bug.cgi?id=148318

Patch by Aleksandr Skachkov <​gskachkov@gmail.com> on 2015-09-21
Reviewed by Saam Barati.

Tiny change to support of the inferred name in arrow function

• parser/ASTBuilder.h:

(JSC::ASTBuilder::createAssignResolve):

12:10 PM Changeset in webkit [190065] by Simon Fraser

• 26 edits
  6 copies
  13 adds in trunk

Add the ability for tests to run script in the UI process in WebKitTestRunner
​https://bugs.webkit.org/show_bug.cgi?id=149356

Reviewed by Tim Horton.

Source/WebKit2:

Expose a few private functions for testing.

• UIProcess/API/Cocoa/WKWebView.mm:
• UIProcess/API/Cocoa/WKWebViewPrivate.h:

Tools:

This change adds testRunner.runUIScript(script, callback), which allows a test
to execute script in a JSContext which runs in the UI process. That context
has bindings exposed through the UIScriptController interface; currently one test
function, and some iOS-specific functions are included. UIScriptController can be
async with a callback, and runUIScript() itself is asynchronous. When the UI
script is complete, it calls uiController.uiScriptComplete(result), where 'result'
is a string passed back to the web process, and given to the runUIScript()
callback function.

Thanks to Gyuyoung Kim for help with the Gtk/Efl build.

• WebKitTestRunner/DerivedSources.make: Build UIScriptController.idl.
• WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl: Add runUIScript().
• WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::didReceiveMessageToPage): When the UI-side script is
complete, call back into TestRunner.

• WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::nextUIScriptCallbackID):
(WTR::TestRunner::runUIScript): Post a message to the injected bundle to run the UI script.
(WTR::TestRunner::runUIScriptCallback): When the UI script is done, execute its callback function.

• WebKitTestRunner/InjectedBundle/TestRunner.h:
• WebKitTestRunner/PlatformWebView.h:
• WebKitTestRunner/TestController.cpp:

(WTR::updateTestOptionsFromTestHeader):
(WTR::TestController::testOptionsForTest): Support "useFlexibleViewport" as a test argument.
(WTR::shouldUseFixedLayout): Deleted. Moved to a TestInvocation function.

• WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::shouldUseFixedLayout):
(WTR::TestInvocation::shouldUseThreadedScrolling):
(WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
(WTR::TestInvocation::runUISideScript): Run the UI-side script!
(WTR::TestInvocation::uiScriptDidComplete): Send a message back to the injected bundle.

• WebKitTestRunner/TestInvocation.h:
• WebKitTestRunner/TestOptions.h:
• WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
• WebKitTestRunner/cocoa/TestControllerCocoa.mm:
• WebKitTestRunner/cocoa/TestRunnerWKWebView.h: Copied from Tools/WebKitTestRunner/TestOptions.h.
• WebKitTestRunner/cocoa/TestRunnerWKWebView.mm: Added.

(-[TestRunnerWKWebView dragImage:at:offset:event:pasteboard:source:slideBack:]):
(-[TestRunnerWKWebView zoomToScale:animated:completionHandler:]):
(-[TestRunnerWKWebView scrollViewDidEndZooming:withView:atScale:]):
(-[TestRunnerWKWebView onDidEndZooming:]): Allow a test to hook into the end of zooming.

• WebKitTestRunner/ios/PlatformWebViewIOS.mm:

(WTR::PlatformWebView::PlatformWebView): Make a TestRunnerWKWebView on iOS.

• WebKitTestRunner/ios/UIScriptControllerIOS.mm: Added.

(WTR::UIScriptController::doAsyncTask):
(WTR::UIScriptController::zoomToScale):
(WTR::UIScriptController::zoomScale):
(WTR::UIScriptController::minimumZoomScale):
(WTR::UIScriptController::maximumZoomScale):
(WTR::UIScriptController::contentVisibleRect):

• WebKitTestRunner/mac/EventSenderProxy.mm:
• WebKitTestRunner/mac/PlatformWebViewMac.mm:

(-[TestRunnerWKWebView dragImage:at:offset:event:pasteboard:source:slideBack:]): Deleted.

• WebKitTestRunner/mac/TestControllerMac.mm:

(WTR::TestController::updatePlatformSpecificTestOptionsForTest):
(WTR::shouldUseThreadedScrolling): Deleted. Moved to TestInvocation.

• WebKitTestRunner/mac/WebKitTestRunnerDraggingInfo.h:
• WebKitTestRunner/uiscriptcontext/UIScriptContext.cpp: Added. Owns the JS context in the UI process.

(UIScriptContext::UIScriptContext):
(UIScriptContext::~UIScriptContext):
(UIScriptContext::runUIScript): Entrypoint to running the UI script. If the script didn't do anything
asynchronous, call the callback.
(UIScriptContext::nextTaskCallbackID):
(UIScriptContext::prepareForAsyncTask): Do setup for one async task (i.e. a UIScriptController function
that has a callback). Has to store the callbackID of the script, so code called from the completion
callback knows which UI script invoked it.
(UIScriptContext::asyncTaskComplete): Called when one task is finished.
(UIScriptContext::uiScriptComplete):
(UIScriptContext::objectFromRect): Make a JS object from a rect.

• WebKitTestRunner/uiscriptcontext/UIScriptContext.h: Copied from Tools/WebKitTestRunner/TestOptions.h.

(WTR::UIScriptContext::hasOutstandingAsyncTasks):

• WebKitTestRunner/uiscriptcontext/UIScriptController.cpp: Copied from Tools/WebKitTestRunner/TestOptions.h.

(WTR::UIScriptController::UIScriptController):
(WTR::UIScriptController::makeWindowObject):
(WTR::UIScriptController::wrapperClass):
(WTR::UIScriptController::doAsyncTask):
(WTR::UIScriptController::zoomToScale):
(WTR::UIScriptController::zoomScale):
(WTR::UIScriptController::minimumZoomScale):
(WTR::UIScriptController::maximumZoomScale):
(WTR::UIScriptController::contentVisibleRect):
(WTR::UIScriptController::uiScriptComplete):

• WebKitTestRunner/uiscriptcontext/UIScriptController.h: Copied from Tools/WebKitTestRunner/TestOptions.h.

(WTR::UIScriptController::create):

• WebKitTestRunner/uiscriptcontext/bindings/UIScriptController.idl: Copied from Tools/WebKitTestRunner/TestOptions.h.

LayoutTests:

Some new tests that exercise testRunner.runUIScript().

• TestExpectations:
• fast/harness/concurrent-ui-side-scripts-expected.txt: Added.
• fast/harness/concurrent-ui-side-scripts.html: Added.
• fast/harness/ui-side-scripts-expected.txt: Added.
• fast/harness/ui-side-scripts.html: Added.
• fast/zooming/zoom-to-scale.html: Added.
• platform/ios-simulator/TestExpectations:
• platform/mac/TestExpectations:

12:03 PM Changeset in webkit [190064] by timothy_horton@apple.com

• 19 edits in trunk/Source/WebKit2

Layout milestones aren't synchronized with UI-side compositing transactions
​https://bugs.webkit.org/show_bug.cgi?id=149362

Reviewed by Anders Carlsson.

Because layout milestones are primarily used to synchronize things with
the displayed layout/rendering of the page, they should fire at the same
time as the contents of the view change.

However, with UI-side compositing, the layer tree transaction will
most likely come in *after* the layout milestones associated with its
contents fire, breaking this synchronization.

Instead, put the layout milestones inside the transaction and fire them
immediately after it is committed in the UI process.

• Shared/mac/RemoteLayerTreeTransaction.h:

(WebKit::RemoteLayerTreeTransaction::setCallbackIDs):
(WebKit::RemoteLayerTreeTransaction::newlyReachedLayoutMilestones):
(WebKit::RemoteLayerTreeTransaction::setNewlyReachedLayoutMilestones):

• Shared/mac/RemoteLayerTreeTransaction.mm:

(WebKit::RemoteLayerTreeTransaction::RemoteLayerTreeTransaction):
(WebKit::RemoteLayerTreeTransaction::encode):
(WebKit::RemoteLayerTreeTransaction::decode):
Add LayoutMilestones to the transaction.

• UIProcess/API/APILoaderClient.h:

(API::LoaderClient::didLayout):

• UIProcess/API/APINavigationClient.h:

(API::NavigationClient::renderingProgressDidChange):

• UIProcess/API/C/WKPage.cpp:

(WKPageSetPageLoaderClient):
(WKPageSetPageNavigationClient):

• UIProcess/Cocoa/NavigationState.h:
• UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::NavigationClient::renderingProgressDidChange):

• UIProcess/WebPageProxy.messages.in:
• UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::didCommitLayerTree):
Remove the UserData parameter from didLayout/renderingProgressDidChange,
except for at the API level where we'll always pass null.
Nobody uses UserData on didLayout, and we'll assert if any client sets it
(and it won't get passed through to the UI process).

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didLayoutForCustomContentProvider):
Just call didLayout with the relevant milestones instead of reimplementing it.

(WebKit::WebPageProxy::didLayout):

• UIProcess/WebPageProxy.h:

Make didLayout public.

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDidLayout):
Let WebPage handle dispatching didLayout.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::dispatchDidLayout):

• WebProcess/WebPage/WebPage.h:

Let the DrawingArea handle dispatching didLayout.
If it doesn't want to handle it, we'll just do the normal thing
and dispatch an async message.

• UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
If we reach a new layout milestone, dispatch didLayout client/delegate callbacks.

• WebProcess/WebPage/DrawingArea.h:

(WebKit::DrawingArea::dispatchDidLayout):

• WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h:
• WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:

(WebKit::RemoteLayerTreeDrawingArea::flushLayers):
(WebKit::RemoteLayerTreeDrawingArea::dispatchDidLayout):
Queue up milestones as we reach them, and send them in the transaction.

11:59 AM Changeset in webkit [190063] by commit-queue@webkit.org

• 6 edits in trunk/Source/JavaScriptCore

New tests introduced in r188545 fail on 32 bit ARM
​https://bugs.webkit.org/show_bug.cgi?id=148376

Patch by Aleksandr Skachkov <​gskachkov@gmail.com> on 2015-09-19
Reviewed by Saam Barati.

Added correct support of the ARM CPU in JIT functions that are related to arrow function.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunction):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• jit/JIT.h:
• jit/JITInlines.h:

(JSC::JIT::callOperation):

• jit/JITOpcodes.cpp:

(JSC::JIT::emitNewFuncExprCommon):

11:47 AM Changeset in webkit [190062] by Sukolsak Sakshuwong

• 7 edits in trunk/Source/JavaScriptCore

Implement Store expressions in WebAssembly
​https://bugs.webkit.org/show_bug.cgi?id=149395

Reviewed by Geoffrey Garen.

The Store instruction in WebAssembly stores a value in the linear memory
at the given index. It can be both a statement and an expression. When
it is an expression, it returns the assigned value. This patch
implements Store as an expression.

Since Store uses two operands, which are the index and the value, we
need to pop the two operands from the stack and push the value back to
the stack. We can simply implement this by copying the value to where
the index is in the stack.

• tests/stress/wasm-linear-memory.js:
• wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::buildStore):

• wasm/WASMFunctionParser.cpp:

(JSC::WASMFunctionParser::parseStatement):
(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseStore):

• wasm/WASMFunctionParser.h:
• wasm/WASMFunctionSyntaxChecker.h:

(JSC::WASMFunctionSyntaxChecker::buildStore):

11:03 AM Changeset in webkit [190061] by timothy_horton@apple.com

• 4 edits in trunk/Source/WebCore

UserMediaClientMock leaks every test run
​https://bugs.webkit.org/show_bug.cgi?id=149358

Reviewed by Eric Carlson.

• Modules/mediastream/UserMediaController.cpp:

(WebCore::provideUserMediaTo):
Make provideUserMediaTo operate unconditionally, just like all of the
other similar functions, reverting r165733.

• Modules/mediastream/UserMediaController.h:
• testing/Internals.cpp:

(WebCore::Internals::Internals):
Remove the existing UserMediaController supplement before installing a new one.
This way, we're replacing it with the one Internals is trying to install,
instead of leaking UserMediaClientMocks.

11:00 AM Changeset in webkit [190060] by timothy_horton@apple.com

• 36 edits in trunk

Turn on threaded scrolling by default in the tests
​https://bugs.webkit.org/show_bug.cgi?id=149377

Reviewed by Simon Fraser.

• WebKitTestRunner/mac/TestControllerMac.mm:

(WTR::TestController::updatePlatformSpecificTestOptionsForTest):
(WTR::shouldUseThreadedScrolling): Deleted.
Turn on threaded scrolling by default.

• compositing/geometry/fixed-position-flipped-writing-mode.html:
• compositing/layer-creation/no-compositing-for-sticky.html:
• compositing/overflow/automatically-opt-into-composited-scrolling.html:
• compositing/overflow/clipping-ancestor-with-accelerated-scrolling-ancestor.html:
• compositing/overflow/composited-scrolling-creates-a-stacking-container.html:
• compositing/overflow/composited-scrolling-paint-phases.html:
• compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html:
• compositing/overflow/dynamic-composited-scrolling-status.html:
• compositing/overflow/iframe-inside-overflow-clipping.html:
• compositing/overflow/nested-scrolling.html:
• compositing/overflow/overflow-clip-with-accelerated-scrolling-ancestor.html:
• compositing/overflow/paint-neg-z-order-descendants-into-scrolling-contents-layer.html:
• compositing/overflow/scrolling-content-clip-to-viewport.html:
• compositing/overflow/scrolling-without-painting.html:
• compositing/overflow/textarea-scroll-touch.html:
• compositing/overflow/updating-scrolling-content.html:
• compositing/rtl/rtl-fixed-overflow-scrolled.html:
• compositing/rtl/rtl-overflow-scrolling.html:
• fast/block/positioning/rtl-fixed-positioning.html:
• fast/block/positioning/vertical-rl/fixed-positioning.html:
• fast/dom/horizontal-scrollbar-in-rtl.html:
• fast/dom/horizontal-scrollbar-when-dir-change.html:
• fast/dom/scroll-reveal-left-overflow.html:
• fast/dom/scroll-reveal-top-overflow.html:
• fast/dom/vertical-scrollbar-when-dir-change.html:
• fast/multicol/pagination/RightToLeft-rl-hittest.html:
• scrollingcoordinator/non-fast-scrollable-region-scaled-iframe.html:
• scrollingcoordinator/non-fast-scrollable-region-transformed-iframe.html:
• swipe/main-frame-pinning-requirement.html:

Turn off threaded scrolling in the cases where it sensibly affects the test result.
These cases are:

• tests that use scrollTo or similar, and then depend on the scrolling happening synchronously

• tests that use setAcceleratedCompositingForOverflowScrollEnabled, which asserts if combined with threaded scrolling

• fast/text/combining-character-sequence-vertical.html:
• fast/text/descent-clip-in-scaled-page.html:
• fast/text/descent-clip-in-scaled-page-expected.html:
• fast/text/vertical-quotation-marks.html:

Turn off threaded scrolling in three tests where it shouldn't affect the test result,
but for some reason does.

10:00 AM Changeset in webkit [190059] by achristensen@apple.com

• 5 edits in trunk/Source/WebCore

Generate WebCoreHeaderDetection.h with CMake on Windows
​https://bugs.webkit.org/show_bug.cgi?id=135861

Reviewed by Brent Fulgham.

This fixes many of the failing media tests.

• AVFoundationSupport.py:

(lookFor):
(fileContains):
Use a command line parameter for the WebKitLibraries directory
to not require the WEBKIT_LIBRARIES environment variable with the CMake build.

• DerivedSources.make:

Pass WEBKIT_LIBRARIES as a command line parameter.

• PlatformAppleWin.cmake:

Added missing sources for video.

• PlatformWin.cmake:

Generate WebCoreHeaderDetection.h correctly and copy the media controls sources to WebKit.resources.

9:30 AM Changeset in webkit [190058] by Matt Baker

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: requestAnimationFrame continues to be called after stopping the timeline recording
​https://bugs.webkit.org/show_bug.cgi?id=149390

Reviewed by Brian Burg.

• UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype._update):
Stop calling requestAnimationFrame if this._updating is false and recording end time is NaN.

2:38 AM Changeset in webkit [190057] by Carlos Garcia Campos

• 1 copy in releases/WebKitGTK/webkit-2.10.0

WebKitGTK+ 2.10.0

2:37 AM Changeset in webkit [190056] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.10

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.10.0 release.

.:

• Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

• gtk/NEWS: Add release notes for 2.10.0

2:14 AM Changeset in webkit [190055] by Sukolsak Sakshuwong

• 2 edits in trunk/Source/JavaScriptCore/wasm

Build fix for WebAssembly.

• wasm/JSWASMModule.cpp:
• wasm/WASMFunctionParser.cpp:

1:53 AM Changeset in webkit [190054] by ChangSeok Oh

• 3 edits
  2 adds in trunk

[GTK] media controls does not show up when playing video finishes.
​https://bugs.webkit.org/show_bug.cgi?id=149112

Reviewed by Philippe Normand.

Source/WebCore:

GTK port does not show controls after playing video. This behavior is different
from what Mac port does. They do show controls when playing video finishes.
At least, we should update the timeline before showing it up not to show incorrect numbers
when reappearing.

Test: media/media-controls-timeline-updates-after-playing.html

• Modules/mediacontrols/mediaControlsBase.js:

(Controller.prototype.setPlaying):
(Controller.prototype.showControls):

LayoutTests:

• media/media-controls-timeline-updates-after-playing-expected.txt: Added.
• media/media-controls-timeline-updates-after-playing.html: Added.

1:37 AM Changeset in webkit [190053] by ChangSeok Oh

• 3 edits
  2 adds in trunk

[GTK] timeline is not updated after few seconds when mouse hovers on controls
​https://bugs.webkit.org/show_bug.cgi?id=149111

Reviewed by Philippe Normand.

Source/WebCore:

Timeline is not updated if controlsAreHidden is true. The problem here is that
the function does not mean actually 'hidden' since it only checkes 'show' and 'hidden'
class existences. The panel's visibility are not only controlled by the two classes,
but also by video::-webkit-media-controls-panel:hover. The panel could be visible
by setting the pseudo hover class. So we need to check if panel is hovered as well in controlsAreHidden().

Test: media/media-controls-timeline-updates-when-hovered.html

• Modules/mediacontrols/mediaControlsBase.js:

(Controller.prototype.controlsAreHidden):

LayoutTests:

• media/media-controls-timeline-updates-when-hovered-expected.txt: Added.
• media/media-controls-timeline-updates-when-hovered.html: Added.

1:36 AM Changeset in webkit [190052] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r190007 - REGRESSION(r150187): updateIdForTreeScope may not be called inside shadow trees
​https://bugs.webkit.org/show_bug.cgi?id=149364

Reviewed by Antti Koivisto.

Since the tree scope is set to that of Document's inside removeBetween when a node is removed from a shadow tree,
oldScope != &treeScope() was already true inside Element::removedFrom. This can introduce an inconsistency in
DocumentOrderedMap which could result in a crash. Fixed the bug by checking it against document(), which is the
behavior we had prior to r150187.

Also added a consistency check in DocumentOrderedMap to catch bugs like this.

No new tests. New assertions fail in existing tests without this fix.

• dom/DocumentOrderedMap.cpp:

(WebCore::DocumentOrderedMap::add):
(WebCore::DocumentOrderedMap::remove):
(WebCore::DocumentOrderedMap::get):

• dom/DocumentOrderedMap.h:
• dom/Element.cpp:

(WebCore::Element::removedFrom):

1:36 AM Changeset in webkit [190051] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r190019 - [GTK] WebEditorClient::supportsGlobalSelection returns true under Wayland
​https://bugs.webkit.org/show_bug.cgi?id=149375

Reviewed by Darin Adler.

WebEditorClient::supportsGlobalSelection should return false when running under Wayland,
since Wayland does not have any equivalent for PRIMARY or the concept of a global selection.

• WebProcess/WebCoreSupport/WebEditorClient.cpp:

(WebKit::WebEditorClient::supportsGlobalSelection):

1:15 AM Changeset in webkit [190050] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.10

Merge r189954 - Multi-hop reference cycles not detected.
​https://bugs.webkit.org/show_bug.cgi?id=149181

Reviewed by John Honeycutt.

Source/WebCore:

SVG's cycle detection was not picking up a
case where an element was drawing a pattern, that
referenced another pattern, that referenced another
pattern, that referenced the original pattern.

The issue was that we were forgetting to check the
children of the renderer itself, rather than just
the children of the referenced renderers.

Found by running a test from Blink.

I also took the opportunity to clean up the debugging
code that logs cycle detection.

Test: svg/custom/pattern-3-step-cycle.html

• platform/Logging.h: Add a new SVG channel. I can't believe we

didn't already have one!

• rendering/svg/SVGResourcesCycleSolver.cpp:

(WebCore::SVGResourcesCycleSolver::resourceContainsCycles): Check the referenced
resources for cycles.
(WebCore::SVGResourcesCycleSolver::resolveCycles): Logging update.

LayoutTests:

Test comes from:
​https://chromium.googlesource.com/chromium/blink/+/master/LayoutTests/svg/custom/pattern-3-step-cycle.html

• svg/custom/pattern-3-step-cycle-expected.txt: Added.
• svg/custom/pattern-3-step-cycle.html: Added.

1:12 AM Changeset in webkit [190049] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.10

Cyclic resources were not detected if the reference had deep containers
​https://bugs.webkit.org/show_bug.cgi?id=149182

Reviewed by John Honeycutt.

Source/WebCore:

During our examination of the SVG rendering tree looking for cycles,
if a resource pointed to something that had a nested structure, and
one of the parent nodes in that structure was a container object
without resources itself, we were not looking into the children.

Test: svg/custom/pattern-content-cycle-w-resourceless-container.html

• rendering/svg/SVGResourcesCycleSolver.cpp:

(WebCore::SVGResourcesCycleSolver::resourceContainsCycles): We should still
check all children resources, but not exit early if there are none. Instead
we should recurse into any children.
(WebCore::SVGResourcesCycleSolver::resolveCycles): Changes to some debug
code that no longer compiled (it's still off by default, but at least
it will work now).

LayoutTests:

This test was ported from Blink. I believe it originally
came from:
​https://code.google.com/p/chromium/issues/detail?id=351713

• svg/custom/pattern-content-cycle-w-resourceless-container-expected.txt: Added.
• svg/custom/pattern-content-cycle-w-resourceless-container.html: Added.

1:10 AM Changeset in webkit [190048] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r190045 - [GTK] REGRESSION(188031): ASSERTION FAILED: menu
​https://bugs.webkit.org/show_bug.cgi?id=149379

Reviewed by Carlos Garcia Campos.

Remove assert that no longer makes sense.

• platform/gtk/ContextMenuGtk.cpp:

(WebCore::ContextMenu::setPlatformDescription): Deleted.

1:02 AM Changeset in webkit [190047] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10

Merge r188973 - [GTK] Disable ACCELERATED_2D_CANVAS by default
​https://bugs.webkit.org/show_bug.cgi?id=148473

Reviewed by Martin Robinson.

Currently ACCELERATED_2D_CANVAS is enabled by default on most systems (which have CairoGL)
but not on Debian (which does not). We've known this was problematic for a while, since it
means we have two different sets of distro-dependent bugs, but never decided whether that
outweighed the benefits of CarioGL or not. I'm making the call now: it's more important to
have the same bugs everywhere. We can turn this on again for other distros when we're ready
to turn it on for Debian.

Also, properly fail the build if ENABLE_ACCELERATED_2D_CANVAS is enabled but CairoGL is not
available.

• Source/cmake/OptionsGTK.cmake:

12:28 AM Changeset in webkit [190046] by Carlos Garcia Campos

• 2 edits in trunk/Tools

[GTK] run-gtk-tests doesn't provide feedback about crashing google tests
​https://bugs.webkit.org/show_bug.cgi?id=149252

Reviewed by Darin Adler.

In case of glib tests the test runner notifies about tests
crashing, but for google tests we don't get any feedback, which
means that in case of a test crashing we get a list of PASS
messages and at the summary we are notified that the test suite
has failed, but it's impossible to know which test cases have failed.

• Scripts/run-gtk-tests:

(TestRunner._run_google_test): Add a CRASH message if test
case crashed.

12:22 AM Changeset in webkit [190045] by Michael Catanzaro

• 2 edits in trunk/Source/WebCore

[GTK] REGRESSION(188031): ASSERTION FAILED: menu
​https://bugs.webkit.org/show_bug.cgi?id=149379

Reviewed by Carlos Garcia Campos.

Remove assert that no longer makes sense.

• platform/gtk/ContextMenuGtk.cpp:

(WebCore::ContextMenu::setPlatformDescription): Deleted.

12:12 AM Changeset in webkit [190044] by bshafiei@apple.com

• 3 edits in branches/safari-601.1.46-branch/Source/WebKit2

Roll out r189944. rdar://problem/22763066

Sep 20, 2015:

10:06 PM Changeset in webkit [190043] by Sukolsak Sakshuwong

• 10 edits in trunk/Source/JavaScriptCore

Implement SetLocal and SetGlobal expressions in WebAssembly
​https://bugs.webkit.org/show_bug.cgi?id=149383

Reviewed by Saam Barati.

SetLocal and SetGlobal in WebAssembly can be both statements and
expressions. We have implemented the statement version. This patch
implements the expression version.

SetLocal and SetGlobal expressions return the assigned value.
Since SetLocal and SetGlobal use only one operand, which is the assigned
value, we can simply implement them by not removing the value from the
top of the stack.

• tests/stress/wasm-globals.js:
• tests/stress/wasm-locals.js:
• tests/stress/wasm/globals.wasm:
• tests/stress/wasm/locals.wasm:
• wasm/WASMConstants.h:
• wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::buildSetLocal):
(JSC::WASMFunctionCompiler::buildSetGlobal):

• wasm/WASMFunctionParser.cpp:

(JSC::WASMFunctionParser::parseStatement):
(JSC::WASMFunctionParser::parseExpressionI32):
(JSC::WASMFunctionParser::parseExpressionF32):
(JSC::WASMFunctionParser::parseExpressionF64):
(JSC::WASMFunctionParser::parseSetLocal):
(JSC::WASMFunctionParser::parseSetGlobal):
(JSC::WASMFunctionParser::parseSetLocalStatement): Deleted.
(JSC::WASMFunctionParser::parseSetGlobalStatement): Deleted.

• wasm/WASMFunctionParser.h:
• wasm/WASMFunctionSyntaxChecker.h:

(JSC::WASMFunctionSyntaxChecker::buildSetLocal):
(JSC::WASMFunctionSyntaxChecker::buildSetGlobal):

9:36 PM Changeset in webkit [190042] by commit-queue@webkit.org

• 1 edit
  1 add in trunk/Source/JavaScriptCore

[ES6] Added controlFlowProfiler test for arrow function
​https://bugs.webkit.org/show_bug.cgi?id=145638

Patch by Aleksandr Skachkov <​gskachkov@gmail.com> on 2015-09-19
Reviewed by Saam Barati.

• Source/JavaScriptCore/tests/controlFlowProfiler/arrowfunction-expression.js: added

9:26 PM Changeset in webkit [190041] by aestes@apple.com

• 3 edits
  3 adds in trunk/LayoutTests

http/tests/contentfiltering/load-substitute-data-from-appcache.html crashes sometimes
​https://bugs.webkit.org/show_bug.cgi?id=148890

Reviewed by Alexey Proskuryakov.

Added a test to verify my theory that load-substitute-data-from-appcache.html will crash even with Content Filtering disabled.

• TestExpectations: Skipped the new test since it only works in WebKit2.
• http/tests/appcache/decide-navigation-policy-after-delay-expected.txt: Added.
• http/tests/appcache/decide-navigation-policy-after-delay.html: Added.
• http/tests/appcache/resources/decide-navigation-policy-after-delay-frame.html: Added.
• platform/wk2/TestExpectations: Enabled the test in WebKit2.

8:39 PM Changeset in webkit [190040] by Chris Dumez

• 2 edits in trunk/Source/WebCore

Unreviewed attempt to fix GTK build after r190030.

• bindings/gobject/WebKitDOMCustom.cpp:

(webkit_dom_html_link_element_set_sizes):

8:33 PM Changeset in webkit [190039] by Chris Dumez

• 3 edits in trunk/Source/WebCore

Unreviewed, another GTK build fix after r190017.

• bindings/scripts/CodeGeneratorGObject.pm:

(IsPropertyWriteable):

• bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_class_init):
(webkit_dom_test_obj_set_property): Deleted.

8:24 PM Changeset in webkit [190038] by Chris Dumez

• 4 edits in trunk/Source/WebCore

Unreviewed attempt to fix the GTK build after r190017.

• bindings/scripts/CodeGeneratorGObject.pm:

(SkipFunction):

8:01 PM Changeset in webkit [190037] by Chris Dumez

• 2 edits in trunk/LayoutTests

Unreviewed, rebaseline W3C HTML DOM test on iOS after r190030.

• platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

7:42 PM Changeset in webkit [190036] by Chris Dumez

• 72 edits in trunk/Source/WebCore

Pass JSC::ExecState to the custom bindings by reference
​https://bugs.webkit.org/show_bug.cgi?id=149393

Reviewed by Sam Weinig.

Pass JSC::ExecState to the custom bindings by reference instead of by
pointer as it is expected to be non-null.

5:28 PM Changeset in webkit [190035] by ap@apple.com

• 3 edits in trunk/Tools

WebKitTestRunner can leak user content script results between tests
​https://bugs.webkit.org/show_bug.cgi?id=149391

Reviewed by Sam Weinig.

Move WKBundlePageRemoveAllUserContent call so that it's executed before loading
about:blank, and thus about:blank doesn't have unintended side effects.

• WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::beginTesting):

• WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::InjectedBundlePage::resetAfterTest):

4:24 PM Changeset in webkit [190034] by Chris Dumez

• 3 edits in trunk/Source/WebCore

Regression(r190023): fast/dom/navigation-with-sideeffects-crash.html is crashing
​https://bugs.webkit.org/show_bug.cgi?id=149392

Reviewed by Alexey Proskuryakov.

In the generated code for [PutForwards=xxx], make sure the forwarded
implementation object is ref'd before calling toString() as toString()
can be overridden by JS and cause the object to get deref'd / destroyed.

No new tests, already covered by existing test.

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

• bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::setJSTestObjPutForwardsAttribute):
(WebCore::setJSTestObjPutForwardsNullableAttribute):

12:52 PM Changeset in webkit [190033] by ap@apple.com

• 2 edits in trunk/LayoutTests

Fix a relative path in accessibility/mac/removing-textarea-after-edit-crash.html
after moving the test.
​https://bugs.webkit.org/show_bug.cgi?id=149217

Patch by Chris Fleizach <Chris Fleizach> on 2015-09-20
Reviewed by Alexey Proskuryakov.

• accessibility/mac/removing-textarea-after-edit-crash.html:

12:20 PM Changeset in webkit [190032] by Sukolsak Sakshuwong

• 1 edit in trunk/Tools/Scripts/webkitpy/common/config/contributors.json

Unreviewed, updated my email address.

• Scripts/webkitpy/common/config/contributors.json:

9:44 AM Changeset in webkit [190031] by bshafiei@apple.com

• 4 edits
  2 copies in branches/safari-601.1.46-branch

Merged r189997. rdar://problem/22772263

9:43 AM Changeset in webkit [190030] by Chris Dumez

• 29 edits
  1 delete in trunk

Get rid of custom bindings for HTMLLinkElement.sizes setter
​https://bugs.webkit.org/show_bug.cgi?id=149382

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

• web-platform-tests/html/dom/interfaces-expected.txt:

Rebaseline test. Our bindings generator does not move attributes that have
a custom setter from the instance to the prototype. Now that the 'sizes'
attribute no longer has a custom setter, it has moved to the prototype,
where it is expected to be.

Source/WebCore:

Get rid of custom bindings for HTMLLinkElement.sizes setter by leveraging
the new [PutForwards=xxx] Web IDL extended attribute, as per the HTML
specification:

• ​https://html.spec.whatwg.org/#htmllinkelement

Also add FIXME comments in our IDL for various attributes that should be
using [PutForwards=xxx] according to the HTML specification but are not
currently. Those were not updated in this patch because it will subtly
change their web-exposed behavior.

No new tests, no intended web-exposed behavior change. However, one side
effect of the change is that the attribtue has moved to the prototype.
Our bindings generator was keeping this attribute on the instance because
it has a custom setter.
Bindings tests coverage was extended.

• CMakeLists.txt:
• WebCore.vcxproj/WebCore.vcxproj:
• WebCore.vcxproj/WebCore.vcxproj.filters:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/JSBindingsAllInOne.cpp:
• bindings/js/JSHTMLLinkElementCustom.cpp: Removed.

Drop custom bindings for HTMLLinkElement.sizes setter.

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

• Stop passing an extra isNull argument to getters of nullable attributes that have a wrapper type. These can return a null pointer so there is no need for an extra argument.
• When [PutForwards=xxx] is used, only do the null-check on the attribute getter if the attribute is marked as nullable. If the attribute is not marked as nullable, the implementation is expected to return a C++ reference, otherwise a raw pointer. This was needed because HTMLLinkElement::sizes() returns a reference as it can never return null.

• bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
• bindings/scripts/test/GObject/WebKitDOMTestObj.h:
• bindings/scripts/test/JS/JSTestObj.cpp:
• bindings/scripts/test/ObjC/DOMTestObj.h:
• bindings/scripts/test/ObjC/DOMTestObj.mm:
• bindings/scripts/test/TestObj.idl:

Add bindings tests coverage for using [PutForwards=xxx] on a
nullable attribute.

• dom/Document.idl:

Mark Document.location as nullable as per the specification. The
implementation returns a raw pointer and can return null. The
bindings generator expects a raw pointer and will do a null check
on it.

• html/HTMLAnchorElement.idl:
• html/HTMLAreaElement.idl:
• html/HTMLElement.idl:
• html/HTMLIFrameElement.idl:
• html/HTMLOutputElement.idl:
• html/HTMLTableCellElement.idl:

Add FIXME comments for attributes that are supposed to use
[PutForwards=xxx] as per the HTML specification but currently don't.

• html/HTMLLinkElement.idl:

Use [PutForwards=value] for the 'sizes' attribute, as per the
specification and stop using a custom setter.

9:41 AM Changeset in webkit [190029] by bshafiei@apple.com

• 3 edits in branches/safari-601.1.46-branch/Source/WebKit2

Merged r189944. rdar://problem/22763066

9:41 AM Changeset in webkit [190028] by Chris Dumez

• 52 edits in trunk/Source/WebCore

[CallWith=ScriptState] should pass ExecState to the implementation by reference
​https://bugs.webkit.org/show_bug.cgi?id=149378

Reviewed by Sam Weinig.

[CallWith=ScriptState] should pass ExecState to the implementation by
reference instead of pointer, as it is expected to be non-null.

Also rename the ExecState variables from 'exec' to 'state' in the
bindings as this is the preferred naming convention.

• Modules/indexeddb/IDBCursor.h:
• Modules/indexeddb/IDBObjectStore.h:
• Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::update):

• Modules/indexeddb/legacy/LegacyCursor.h:
• Modules/indexeddb/legacy/LegacyObjectStore.cpp:

(WebCore::LegacyObjectStore::add):
(WebCore::LegacyObjectStore::put):

• Modules/indexeddb/legacy/LegacyObjectStore.h:
• Modules/mediastream/CapabilityRange.cpp:

(WebCore::scriptValue):
(WebCore::CapabilityRange::min):
(WebCore::CapabilityRange::max):

• Modules/mediastream/CapabilityRange.h:
• Modules/streams/ReadableStreamController.h:

(WebCore::ReadableStreamController::error):
(WebCore::ReadableStreamController::enqueue):

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateEventListenerCall):
(GenerateGetOwnPropertySlotBody):
(GenerateHeader):
(GenerateOverloadedFunction):
(GetIndexedGetterExpression):
(GenerateImplementation):
(GenerateFunctionCastedThis):
(GenerateCallWith):
(GenerateArgumentsCountCheck):
(GenerateParametersCheck):
(GenerateReturnParameters):
(GenerateCallbackHeader):
(GenerateCallbackImplementation):
(GenerateImplementationFunctionCall):
(JSValueToNative):
(NativeToJSValue):
(GenerateOverloadedConstructorDefinition):
(GenerateConstructorDefinition):

9:37 AM Changeset in webkit [190027] by bshafiei@apple.com

• 5 edits in branches/safari-601.1.46-branch/Source

Versioning.

8:30 AM Changeset in webkit [190026] by ap@apple.com

• 5 edits in trunk

[Mac, iOS] AccessibilityController doesn't uninstall global notification handler
​https://bugs.webkit.org/show_bug.cgi?id=149384

Reviewed by Chris Fleizach.

Tools:

• DumpRenderTree/ios/AccessibilityControllerIOS.mm:

(AccessibilityController::addNotificationListener): Fixed a leak, and cleaned up the code.
(AccessibilityController::platformResetToConsistentState): Actually remove the handler,
regardless of whether someone else holds a reference (we also call -stopListening in
-dealloc).

• DumpRenderTree/mac/AccessibilityControllerMac.mm:

(AccessibilityController::platformResetToConsistentState):
(AccessibilityController::addNotificationListener):
Ditto.

LayoutTests:

• accessibility/mac/loaded-notification.html: Cleaned up the test - js-test-pre is

incompatible with directly using waitUntilDone.

3:30 AM Changeset in webkit [190025] by youenn.fablet@crf.canon.fr

• 21 edits in trunk

.:
Removing XHR_TIMEOUT guard

Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• Source/cmake/OptionsEfl.cmake:
• Source/cmake/OptionsGTK.cmake:
• Source/cmake/OptionsMac.cmake:
• Source/cmake/OptionsWin.cmake:
• Source/cmake/WebKitFeatures.cmake:

Source/JavaScriptCore:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• Configurations/FeatureDefines.xcconfig:

Source/WebCore:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

Covered by existing tests.

• Configurations/FeatureDefines.xcconfig:
• xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::XMLHttpRequest):
(WebCore::XMLHttpRequest::didFail):
(WebCore::XMLHttpRequest::didReachTimeout):
(WebCore::XMLHttpRequest::setTimeout):
(WebCore::XMLHttpRequest::setResponseType):
(WebCore::XMLHttpRequest::open):
(WebCore::XMLHttpRequest::createRequest):
(WebCore::XMLHttpRequest::internalAbort):
(WebCore::XMLHttpRequest::didFailRedirectCheck):
(WebCore::XMLHttpRequest::didSendData):
(WebCore::XMLHttpRequest::suspend):

• xml/XMLHttpRequest.h:
• xml/XMLHttpRequest.idl:

Source/WebKit/mac:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• Configurations/FeatureDefines.xcconfig:

Source/WebKit2:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• Configurations/FeatureDefines.xcconfig:

Source/WTF:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• wtf/FeatureDefines.h:

Tools:
Remove XHR_TIMEOUT compilation guard
​https://bugs.webkit.org/show_bug.cgi?id=149260

Reviewed by Benjamin Poulain.

• Scripts/webkitperl/FeatureList.pm:

12:38 AM Changeset in webkit [190024] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebCore

Add two missing files to the Xcode project

• WebCore.xcodeproj/project.pbxproj:

These are imported by files that are built for Mac, but missing from the project.