Timeline
Feb 8, 2016:
- 9:26 PM Changeset in webkit [196304] by
-
- 7 edits in trunk/PerformanceTests
Address Said's comments on the benchmark, and do some clean up.
- Animometer/developer.html:
- Animometer/resources/debug-runner/animometer.css: Add styles for averages.
- Animometer/resources/debug-runner/animometer.js: Use the right
Strings constants.
- Animometer/resources/debug-runner/graph.js:
(_addRegressionLine): Add missing code to draw the line and standard
deviation highlight.
(onGraphTypeChanged): Remove unneeded variables
(onTimeGraphOptionsChanged):
- Animometer/resources/runner/benchmark-runner.js:
(_runBenchmarkAndRecordResults): Rename samplers to suiteResults and
_suitesSamplers to _suitesResults.
- Animometer/tests/resources/main.js:
(results): Call processSamples().
(update): Change sampling timestamp comparison.
(_animateLoop): Move shouldStop call to before the update.
- Animometer/tests/resources/sampler.js:
(process): Rename to processSamples().
- 9:15 PM Changeset in webkit [196303] by
-
- 21 edits in trunk
Attribute getters should not require an explicit 'this' value for Window properties
https://bugs.webkit.org/show_bug.cgi?id=153968
Reviewed by Darin Adler.
LayoutTests/imported/w3c:
Rebaseline W3C test now that more checks are passing.
- web-platform-tests/html/dom/interfaces-expected.txt:
Source/WebCore:
Attribute getters should not require an explicit 'this' value for
Window properties. This is because the Window interface is marked
as [ImplicitThis]:
This matches the behavior of Firefox and the expectations of the W3C
web-platform-tests.
No new tests, already covered by existing tests.
- bindings/scripts/CodeGeneratorJS.pm:
In attribute getters of an interface marked as [ImplicitThis],
if 'thisValue' is undefined or null, fall back to using the
global object as 'thisValue'.
- bindings/scripts/IDLAttributes.txt:
Add support for [ImplicitThis]:
http://heycam.github.io/webidl/#ImplicitThis
- bindings/scripts/test/JS/JSTestEventConstructor.cpp:
- bindings/scripts/test/JS/JSTestException.cpp:
- bindings/scripts/test/JS/JSTestInterface.cpp:
- bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
- bindings/scripts/test/JS/JSTestNode.cpp:
- bindings/scripts/test/JS/JSTestNondeterministic.cpp:
- bindings/scripts/test/JS/JSTestObj.cpp:
- bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
- bindings/scripts/test/JS/JSTestTypedefs.cpp:
- bindings/scripts/test/JS/JSattribute.cpp:
Rebaseline bindings tests.
- page/DOMWindow.idl:
Mark Window as [ImplicitThis]:
http://heycam.github.io/webidl/#ImplicitThis
LayoutTests:
Rebaseline existing tests now that more checks are passing.
- fast/dom/Window/getOwnPropertyDescriptor-other-window-expected.txt:
- fast/dom/Window/getOwnPropertyDescriptor-other-window.html:
- js/getOwnPropertyDescriptor-window-attributes-expected.txt:
- 7:46 PM Changeset in webkit [196302] by
-
- 2 edits1 add in trunk/Source/JavaScriptCore
Error construction for inlined operations should not use the inliner's CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=154021
Reviewed by Mark Lam.
Previously, if one function, A, was inlined into another function, B, in the DFG/FTL
we would use B's DFG/FTL CodeBlock to construct source information about the Error.
We would correctly compute the bytecodeOffset in A for the an expression but we would
not use one of A's CodeBlocks when looking up source. This caused crashes during
operationIn as we expected to be able to find the text "in" in the source.
- runtime/ErrorInstance.cpp:
(JSC::appendSourceToError):
- tests/stress/inlined-error-gets-correct-codeblock-for-bytecodeoffset.js: Added.
(map):
(n):
(one):
(catch):
- 7:33 PM Changeset in webkit [196301] by
-
- 2 edits in trunk/Source/WebInspectorUI
Web Inspector: Uncaught exception merging script profiler records
https://bugs.webkit.org/show_bug.cgi?id=154004
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.
- UserInterface/Controllers/TimelineManager.js:
(WebInspector.TimelineManager.prototype._mergeScriptProfileRecords):
Stop if we've merged all script profiler records.
- 7:31 PM Changeset in webkit [196300] by
-
- 2 edits in trunk/Source/JavaScriptCore
runtimeTypeForValue should protect against seeing TDZ value
https://bugs.webkit.org/show_bug.cgi?id=154023
Reviewed by Michael Saboff.
There are a few back traces I've seen from crashes that bottom out
inside runtimeTypeForValue. I haven't been able to reproduce
any such crash, but it's likely that we're encountering the
empty JSValue. It's better to just have this function protect
against seeing the empty value instead of dereferencing a null
pointer when it thinks the value is a cell.
- runtime/RuntimeType.cpp:
(JSC::runtimeTypeForValue):
- 7:30 PM Changeset in webkit [196299] by
-
- 2 edits in trunk/PerformanceTests
Teach Controller to measure intervals, and turn off the frame length estimator.
- Animometer/tests/resources/main.js: Default interval length is 100 ms.
(start): Set the first interval.
(_measureAndResetInterval): Reports the average frame length of the interval that just
completed, and sets up the next interval.
(update): If there is no length, then just use the estimator per frame, otherwise the
estimator measures per interval. Add a didFinishInterval for subclasses to process
prior to recording the sample. Update tune() to include whether an interval had
finished.
(StepController): Step controllers don't measure on an interval basis.
- 7:30 PM Changeset in webkit [196298] by
-
- 2 edits in trunk/PerformanceTests
Minor refactoring. Rename Controller._estimator to Controller._frameLengthEstimator
and switch the parameters for start(), update(), and tune(), so that the timestamp
is first and stage is second.
- Animometer/tests/resources/main.js:
- 7:30 PM Changeset in webkit [196297] by
-
- 5 edits in trunk/PerformanceTests
Move ResultsTable functionality not needed for release tests out.
Move reporting of score and mean to selection of the time-based graph.
- Animometer/developer.html: Rename graph-options to time-graph-options.
- Animometer/resources/debug-runner/animometer.js:
(DeveloperResultsTable): Moved from runner/animometer.js. Switch from mean
values to "average" objects which can hold stdev. Move graph button and
calculation of noisy measurements here. Sophisticated header processing
is not needed in release suite.
(populateTable): Use DeveloperResultsTable.
- Animometer/resources/debug-runner/graph.js: Pull time graph creation to
its own function, and add a new onGraphTypeChanged handler in preparation
of a complexity graph to be added later.
- Animometer/resources/runner/animometer.js:
(ResultsTable): Simplify to just handle test names and scores.
- 7:30 PM Changeset in webkit [196296] by
-
- 5 edits in trunk/PerformanceTests
Tests: reuse objects already made.
Avoid thrash of object creation and removal by maintaining an index that
moves along the array as the adjust values change. If the tune value
requires more objects than the maximum size of the object array, then create
new objects. This means that the object array size never decreases.
- Animometer/tests/master/resources/canvas-stage.js: Maintain a separate
offsetIndex. For these tests, we want to avoid drawing the oldest objects,
so the scene will draw the object at offsetIndex to the end of the array.
(tune): Reverse the logic since "removal" of objects is much simpler and
involves simply changing the offsetIndex.
(animate): Update the for loop to draw from offsetIndex to the end.
(complexity): Update the definition.
- Animometer/tests/master/resources/canvas-tests.js: Maintain a separate
offsetIndex. For these tests, we want to avoid drawing the newest objects,
so the scene will draw the object at index 0 to the object at offsetIndex.
(SimpleCanvasStage.animate): Fly-by removal of local stage variable,
which is unneeded. Update the for loop to draw from offsetIndex to the end.
- Animometer/tests/simple/resources/simple-canvas-paths.js:
(SimpleCanvasStage.animate): Update the for loop to draw from 0 to
offsetIndex.
- Animometer/tests/simple/resources/simple-canvas.js:
(tune): Update logic. Here, offsetIndex represents the boundary of the last
index to render.
(animate): Update the for loop to draw from 0 to offsetIndex.
(complexity): Update the definition.
- 7:30 PM Changeset in webkit [196295] by
-
- 7 edits in trunk/PerformanceTests
Tests: refactor and update styles.
- Animometer/tests/resources/main.js: Add helper methods that return
a color that hue rotates based on the date, and a counter value that
increases based on the date. Fix randomInt() to not bias against the min and
max values.
- Animometer/tests/master/resources/canvas-tests.js: Use new helper methods.
- Animometer/tests/master/resources/dom-particles.js: Ditto.
- Animometer/tests/master/resources/particles.js: Ditto.
- Animometer/tests/simple/resources/simple-canvas-paths.js: Refactor to
use a rotating color instead of a random color. The fast switching of color
is too vivid to watch.
- Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:
(BouncingSvgParticlesStage.call.createGradient): Fix the gradient so
that the last stop is located at the end.
- 7:30 PM Changeset in webkit [196294] by
-
- 12 edits in trunk/PerformanceTests
Refactor tune() to not return the complexity of the scene.
We have stage.complexity() now, so returning the complexity through tune
is unnecessary.
- Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
- Animometer/tests/master/resources/canvas-stage.js:
- Animometer/tests/master/resources/particles.js:
- Animometer/tests/misc/resources/canvas-electrons.js:
- Animometer/tests/misc/resources/canvas-stars.js:
- Animometer/tests/resources/main.js:
- Animometer/tests/simple/resources/simple-canvas.js:
- Animometer/tests/simple/resources/tiled-canvas-image.js:
- Animometer/tests/template/resources/template-canvas.js:
- Animometer/tests/template/resources/template-css.js:
- Animometer/tests/template/resources/template-svg.js:
- Animometer/tests/text/resources/layering-text.js:
- 7:30 PM Changeset in webkit [196293] by
-
- 4 edits in trunk/PerformanceTests
Make the fixed controller a step controller instead. Halfway through the test
it will bump up the complexity 4-fold. Calculate the step timestamp using options
instead of a separate parameter to the Controller constructor.
- Animometer/developer.html: Change value to "step"
- Animometer/resources/debug-runner/animometer.js:
(window.suitesManager.updateEditsElementsState): Show number inputs when set to "step".
- Animometer/tests/resources/main.js:
(update): Provide a hook for subclasses to tune.
(StepController): Maintain a flag determining whether we've stepped, and the time
we should step.
(Benchmark): Use the new StepController.
- 7:30 PM Changeset in webkit [196292] by
-
- 5 edits in trunk/PerformanceTests
Adjust the FPS graph scale.
Instead of making the FPS graph linearly scale, scale it based on the frame length,
but show the data in terms of FPS. Because it is inversely proportional, and most
of the data never gets below 20, concentrate the axis from 20-60 FPS, since otherwise
over half of the available graph space ends up blank.
This means we should convert all of the FPS data to frame length data.
- Animometer/resources/debug-runner/graph.js: Update the domain to be based on
frame length in milliseconds instead of FPS. Update the cursor to consider all of the
values being shown, and then pick the min and max values to represent the length of the
cursor.
- Animometer/resources/runner/animometer.js:
- Animometer/resources/strings.js:
- Animometer/tests/resources/main.js:
(processSamples): Add the ability to only sample a range of the data instead of everything
after an offset index. Update sampler to record the frame lengths instead of the frame
rate.
- 7:30 PM Changeset in webkit [196291] by
-
- 4 edits in trunk/PerformanceTests
Add option to use different methods for retrieving a timestamp.
- Animometer/developer.html: Add performance.now and Date.now options.
- Animometer/resources/runner/animometer.js: Default to performance.now.
(window.benchmarkController.startBenchmark):
- Animometer/tests/resources/main.js: Tie the desired method to _getTimestamp.
(run): Use _getTimestamp.
(_animateLoop): Ditto.
- 7:30 PM Changeset in webkit [196290] by
-
- 7 edits in trunk/PerformanceTests
Allow adding any number of markers to the graph. The markers can be labeled
and contain timestamp and sample index data. Make it a part of the controller
rather than keeping it in the sampler.
- Animometer/resources/debug-runner/animometer.css: Add styles for markers
- Animometer/resources/debug-runner/graph.js: Create the markers and add
text labels.
- Animometer/resources/runner/animometer.js: Assume the samplingTimeOffset
is just one of the marks provided.
- Animometer/resources/strings.js: Add Strings.json.marks.
- Animometer/tests/resources/main.js:
(Controller): Keep marks here. They are keyed by the marker name, so no two
markers should have the same name.
(recordFirstSample): Refactor to use mark.
(mark): Allows for arbitrary data if needed later. The timestamp maintained
is relative to the absolute start timestamp.
(containsMark): Checks whether a mark with a specific comment exists.
(processSamples): Removes the _startTimestamp offset from the marks before
setting it in results.
- Animometer/tests/resources/sampler.js: Remove marks.
- 7:30 PM Changeset in webkit [196289] by
-
- 22 edits in trunk/PerformanceTests
Get rid of options member variable in Benchmark.
Options are only needed when initializing the stage or benchmark, so there's no
need to also keep a reference to it.
- Animometer/tests/resources/main.js: Get rid of options variable in Benchmark.
Pass options to Controllers and Stages.
(Controller.Utilities.createClass):
(Benchmark.Utilities.createClass):
(get options): Deleted.
- Animometer/tests/bouncing-particles/resources/bouncing-canvas-images.js:
- Animometer/tests/bouncing-particles/resources/bouncing-canvas-particles.js:
- Animometer/tests/bouncing-particles/resources/bouncing-canvas-shapes.js:
- Animometer/tests/bouncing-particles/resources/bouncing-css-images.js:
- Animometer/tests/bouncing-particles/resources/bouncing-css-shapes.js:
- Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
- Animometer/tests/bouncing-particles/resources/bouncing-svg-images.js:
- Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:
- Animometer/tests/master/resources/canvas-stage.js:
- Animometer/tests/master/resources/canvas-tests.js:
- Animometer/tests/master/resources/particles.js:
- Animometer/tests/misc/resources/canvas-electrons.js:
- Animometer/tests/misc/resources/canvas-stars.js:
- Animometer/tests/misc/resources/compositing-transforms.js:
- Animometer/tests/simple/resources/simple-canvas-paths.js:
- Animometer/tests/simple/resources/tiled-canvas-image.js:
- Animometer/tests/template/resources/template-canvas.js:
- Animometer/tests/template/resources/template-css.js:
- Animometer/tests/template/resources/template-svg.js:
- Animometer/tests/text/resources/layering-text.js:
- 7:25 PM Changeset in webkit [196288] by
-
- 10 edits in trunk/PerformanceTests
Update how the benchmark is run
https://bugs.webkit.org/show_bug.cgi?id=153960
Provisionally reviewed by Said Abou-Hallawa.
Introduce the notion of a Controller. It is responsible for recording, updating,
and processing the statistics and complexity of the benchmark. This allows
plugging in different Controllers.
This strips most of the functionality from Animator and BenchmarkState, so fold
what's left into Benchmark. Now, Benchmarks only own a stage and a controller, but
are responsible for driving the animation loop.
Rewrite Animator._shouldRequestAnotherFrame into two different Controllers. One
maintains a fixed complexity, and the other adapts the complexity to meet a
fixed FPS.
Fix the Kalman estimator to be modeled on a scalar variable with no model.
- Animometer/tests/resources/main.js: Remove BenchmarkState and Animator, and
replace it with a Controller. Add a FixedController and refactor the previous controller
to an AdaptiveController.
(Controller): Controllers own the estimator and the sampler. When a new frame is
displayed, the animation loop calls update(). The estimator and sampler record
stats, then tune. Samplers can track multiple series of data. The basic controller
tracks timestamp, complexity, and estimated frame rate.
The Kalman estimation is based on the frame length rather than the frame
rate. Because FPS is inverse proportional to frame length, in the case where the measured
frame length is very small, the FPS ends up being a wildly large number (in the order of
600-1000 "FPS"), and it pulls the estimator up drastically enough that it takes a while
for it to settle back down. Using frame length reduces the impact of these spikes.
Converging the estimation takes enough time to avoid initializing it immediately
when the benchmark starts. Instead, the benchmark runs for a brief period of time (100ms)
before running it in earnest. Allow controllers an opportunity to set the complexity
before starting recording.
When the benchmark is complete, the controller has an opportunity to process
the samples. The default implementation calculates the raw FPS based on the time
difference of the samples, and calculates the complexity score. This is moved from
Benchmark.processSamples.
(Controller): Initialize timestamps. These are at first relative to the start of the
benchmark, but are offset by the absolute start time during start(). By default maintain
3 data series, but subclasses can override.
(start): Calls recordFirstSample() for subclasses to override if needed.
(recordFirstSample): For basic controller, start sampling at the beginning.
(update): Update the frame length estimator and sample.
(shouldStop): Checks that the time is before _endTimestamp.
(results): Returns the processed samples.
(processSamples): Iterate through the sample data and collate them. Include scores.
(FixedComplexityController): Controller that tunes the stage to the desired complexity
prior to starting, and keeps it at that complexity.
(AdaptiveController): Have the estimator estimate the interval frame rate instead of the
raw frame rate.
The previous version of this controller ignored the frame that came after the
adjustment. The raw FPS show that whatever noise the scene change adds is negligible
compared to the noise of the system overall. Stop ignoring that frame and include all
frames in the measurements.
(Benchmark): Remove dependency on animator, and instantiate a runner based on what is
selected. Most of the loop's functionality is in Controller, so remove here.
(Benchmark.run): Remove start() since it is only called from run(), and fold it in here.
(Benchmark._animateLoop): Fold in from Animator.animateLoop. Let the benchmark run for
a brief period before calling Controller.start().
- Animometer/tests/resources/math.js: Fix the Kalman estimator. The filter estimates
a scalar variable, and makes basic assumptions regarding the model. As a result
none of the linear algebra classes are needed, so remove Matrix, Vector3, and Matrix3.
(SimpleKalmanEstimator): Calculate the gain based on the provided process and
measurement errors.
(KalmanEstimator): Deleted.
(IdentityEstimator): Deleted.
(PIDController): Refactor to use the Utilities.createClass() helper.
The Kalman filter algorithm is explained here http://greg.czerniak.info/guides/kalman1/.
The state, represented by a scalar, is the estimated frame length. There is no user
transition of the state, and the state is the same as the measurement. With this model,
the estimation error converges, so calculate the gain ahead of time.
- Animometer/developer.html: Remove fixed-after-warmup since it is not useful.
Replace the option to toggle the estimator, and make it possible to customize the
estimator's error parameters. Show raw FPS by default, and remove interval FPS,
which will be shown instead of the filtered raw FPS.
- Animometer/resources/debug-runner/animometer.css: Put the header behind the graph.
Remove #intervalFPS rules; move the color to #filteredFPS.
- Animometer/resources/debug-runner/graph.js:
(updateGraphData): Update the hr style to force the layout to be calculated
correctly. Change the tick format to be in terms of seconds, since the timestamps
are in milliseconds. Remove interval data.
- Animometer/resources/runner/animometer.js:
(window.benchmarkController.startBenchmark): Set Kalman parameters.
- Animometer/resources/runner/benchmark-runner.js:
(_runBenchmarkAndRecordResults): When a benchmark completes, expect it to return
the final data, rather than passing a sampler from the controller. This avoids
needing to expose the sampler variable in the benchmark.
- Animometer/tests/resources/sampler.js:
(process): Move the setting of the target frame rate to AdaptiveController.
- 7:04 PM Changeset in webkit [196287] by
-
- 5 edits2 adds in trunk
AX: crash at WebCore::Range::selectNodeContents(WebCore::Node*, int&)
https://bugs.webkit.org/show_bug.cgi?id=154018
Reviewed by Chris Fleizach.
Source/WebCore:
Sometimes rangeForUnorderedCharacterOffsets call is accessing derefed node objects
and leading to a crash. Fixed it by checking isNodeInUse before creating the CharacterOffset
object.
Test: accessibility/text-marker/text-marker-range-stale-node-crash.html
- accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::visiblePositionForTextMarkerData):
(WebCore::AXObjectCache::characterOffsetForTextMarkerData):
(WebCore::AXObjectCache::traverseToOffsetInRange):
- accessibility/AXObjectCache.h:
- accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper rangeForTextMarkerRange:]):
(characterOffsetForTextMarker):
(-[WebAccessibilityObjectWrapper characterOffsetForTextMarker:]):
(textMarkerForVisiblePosition):
LayoutTests:
- accessibility/text-marker/text-marker-range-stale-node-crash-expected.txt: Added.
- accessibility/text-marker/text-marker-range-stale-node-crash.html: Added.
- 6:22 PM Changeset in webkit [196286] by
-
- 7 edits in trunk/Source
[iOS] Throw away some unlinked code when navigating to a new page.
<https://webkit.org/b/154014>
Reviewed by Gavin Barraclough.
Source/JavaScriptCore:
- runtime/VM.cpp:
(JSC::VM::deleteAllCodeExceptCaches):
(JSC::VM::deleteAllLinkedCode): Deleted.
- runtime/VM.h:
Source/WebCore:
Extended the mechanism introduced earlier to also throw away unlinked code
that's only relevant to the page that we're navigating away from.
The new JSC::VM API is deleteAllCodeExceptCaches() and it does what it sounds
like, deleting unlinked and linked code but leaving code caches alone.
This means that if the page we're navigating to wants to parse some of the
same JS that the page we're leaving had on it, it might still be found in the
JSC::CodeCache.
Doing a back navigation to a PageCache'd page may now incur some reparsing,
just like leaving the app or tab would.
- bindings/js/GCController.cpp:
(WebCore::GCController::deleteAllCodeExceptCaches):
(WebCore::GCController::deleteAllLinkedCode): Deleted.
- bindings/js/GCController.h:
- loader/FrameLoader.cpp:
(WebCore::FrameLoader::commitProvisionalLoad):
- 5:55 PM Changeset in webkit [196285] by
-
- 3 edits in trunk/Source/WebInspectorUI
Web Inspector: Search doesn't seem to find text that is present in multiple places
https://bugs.webkit.org/show_bug.cgi?id=154016
<rdar://problem/23391307>
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.
- UserInterface/Controllers/DebuggerManager.js:
(WebInspector.DebuggerManager.prototype.get searchableScripts):
- UserInterface/Views/SearchSidebarPanel.js:
(WebInspector.SearchSidebarPanel.prototype.performSearch):
Only search scripts with a URL. Don't search the potentially
large number of anonymous scripts.
- 5:50 PM Changeset in webkit [196284] by
-
- 4 edits2 adds in trunk
Web Inspector: Zooming in on the timeline graph does not increase its time resolution from minutes
https://bugs.webkit.org/show_bug.cgi?id=154013
<rdar://problem/23844527>
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.
Source/WebInspectorUI:
- UserInterface/Base/Utilities.js:
(Number.secondsToString):
Simplify logic and ensure that when under high resolution we
don't go above seconds for our units.
(Number.bytesToString):
Simplify logic.
- UserInterface/Views/LinearTimelineOverview.js:
(WebInspector.LinearTimelineOverview):
Reduce the rather large maximum seconds per pixel from 60 seconds
per pixel to 2 seconds per pixel. This means when the user zooms
out of a timeline they don't see such large time values.
LayoutTests:
- inspector/unit-tests/number-utilities-expected.txt: Added.
- inspector/unit-tests/number-utilities.html: Added.
Basic tests for our Number utilities methods.
- 5:26 PM Changeset in webkit [196283] by
-
- 23 edits30 adds in trunk
CSP connect-src directive should block redirects
https://bugs.webkit.org/show_bug.cgi?id=69359
<rdar://problem/24383025>
Reviewed by Brent Fulgham.
Source/WebCore:
Inspired by Blink patch:
<https://src.chromium.org/viewvc/blink?revision=150246&view=revision>
Apply the connect-src directive of the Content Security Policy for the document or worker to the redirect URL
of an XMLHttpRequest and EventSource load so as to conform to section Paths and Redirects of the CSP 2.0 spec.,
<https://w3c.github.io/webappsec-csp/2/#source-list-paths-and-redirects> (29 August 2015).
Additionally, check that each requested script URL passed to WorkerGlobalScope.importScripts() is allowed by
the CSP of the worker before initiating a load for it. If some URL i is blocked by the CSP policy
then we do not try to load URLs j >= i.
Tests: http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html
http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html
http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html
http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html
- fileapi/FileReaderLoader.cpp:
(WebCore::FileReaderLoader::start): Do not enforce a CSP directive as CSP is not applicable to File API.
- inspector/InspectorNetworkAgent.cpp:
(WebCore::InspectorNetworkAgent::loadResource): Do not enforce a CSP directive as CSP should not interfere
with the Web Inspector.
- loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::loadResourceSynchronously): Modified to take an optional ContentSecurityPolicy
and pass it through to DocumentThreadableLoader::create().
(WebCore::DocumentThreadableLoader::create): Modified to take an optional ContentSecurityPolicy and pass it through
to DocumentThreadableLoader::DocumentThreadableLoader().
(WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Modified to take an optional ContentSecurityPolicy.
Asserts that the CSP allows the load of the request URL so as to catch when a caller creates a loader for a request
that is not allowed by the CSP. The caller should not create a loader for such a request.
(WebCore::DocumentThreadableLoader::redirectReceived): Check if the CSP allows the redirect URL. If it does not
then notify the client that the redirect check failed.
(WebCore::DocumentThreadableLoader::loadRequest): Ditto.
(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Checks that the specified URL is allowed
by the enforced CSP directive.
(WebCore::DocumentThreadableLoader::contentSecurityPolicy): Returns the ContentSecurityPolicy object passed to
DocumentThreadableLoader on instantiation or the ContentSecurityPolicy object of the associated document.
- loader/DocumentThreadableLoader.h: Add overloaded variants of DocumentThreadableLoader::{create, loadResourceSynchronously}()
that take a std::unique_ptr<ContentSecurityPolicy>&&. Remove some unnecessary headers.
- loader/ThreadableLoader.cpp:
(WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Take the CSP directive to enforce and store it.
(WebCore::ThreadableLoaderOptions::isolatedCopy): Copy the CSP directive to enforce.
- loader/ThreadableLoader.h: Added member field to store the CSP directive to enforce (defaults to enforce the
directive connect-src - the most appropriate directive in most circumstances). As of the time of writing,
only WorkerGlobalScope.importScripts() enforces a different directive: script-src.
- loader/WorkerThreadableLoader.cpp:
(WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Pass the SecurityOrigin and ContentSecurityPolicy associated
with the WorkerGlobalScope to WorkerThreadableLoader::MainThreadBridge::MainThreadBridge().
(WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Pass a copy of the worker's ContentSecurityPolicy
to the DocumentThreadableLoader.
- loader/WorkerThreadableLoader.h:
- page/EventSource.cpp:
(WebCore::EventSource::connect): Enforce the CSP directive connect-src on redirects unless we are running in an isolated world.
- workers/AbstractWorker.cpp:
(WebCore::AbstractWorker::resolveURL): Modified to take a boolean whether to bypass the main world Content Security Policy
instead of querying for it directly.
- workers/AbstractWorker.h:
- workers/Worker.cpp:
(WebCore::Worker::create): Added FIXME to enforce child-src directive of the document's CSP to the worker's script URL
on redirect once we fix <https://bugs.webkit.org/show_bug.cgi?id=153562>. For now, do not enforce a CSP policy on redirect
of the worker's script URL.
- workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::importScripts): Check that the requested URL is allowed by the CSP of the worker (if applicable).
Enforce the CSP directive script-src on redirects unless we are running in an isolated world.
- workers/WorkerScriptLoader.cpp:
(WebCore::WorkerScriptLoader::loadSynchronously): Pass SecurityOrigin and ContentSecurityPolicyEnforcement to WorkerThreadableLoader.
(WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
- workers/WorkerScriptLoader.h:
- xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::createRequest): Enforce the CSP directive connect-src on redirects unless we are running in
an isolated world.
LayoutTests:
Add more tests, update erroneous expected results, and remove some entries from TestExpectations for tests
that now pass.
- TestExpectations: Remove entries for tests that now pass. The failure of test http/tests/security/contentSecurityPolicy/worker-importscripts-blocked.html
was erroneously attributed to <https://bugs.webkit.org/show_bug.cgi?id=153562>.
- http/tests/security/contentSecurityPolicy/resources/determine-content-security-policy-header.php: Added.
- http/tests/security/contentSecurityPolicy/resources/script-set-value.js: Use global variable self instead of window so as to
make this script work both from a Document and a Web Worker. In a document, self refers to the Window object and in a worker
it refers to the WorkerGlobalScope object.
- http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-allowed.php: Added.
- http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-blocked.php: Added.
- http/tests/security/contentSecurityPolicy/resources/worker-xhr-allowed.php: Added.
- http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-allowed.php: Added.
- http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.php: Added.
- http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-expected.txt: Remove Blink-specific messages so that the test passes.
- http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html: Added.
- http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html: Added.
- http/tests/security/contentSecurityPolicy/worker-importscripts-blocked-expected.txt: Substitute Blink-specific error text with the analogous WebKit error text.
- http/tests/security/contentSecurityPolicy/worker-importscripts-blocked.html: Ditto.
- http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed-expected.txt: Added.
- http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScripts-redirect-cross-origin-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScript-redirect-cross-origin-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html: Added.
- http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html: Added.
- http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html: Added.
- 5:25 PM Changeset in webkit [196282] by
-
- 2 edits in trunk/Source/WebCore
Try to fix Yosemite build.
- dom/ComposedTreeIterator.h:
(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::traverseNext):
- 5:15 PM Changeset in webkit [196281] by
-
- 5 edits1 add in trunk/Source/WebCore
Implement ComposedTreeIterator in terms of ElementAndTextDescendantIterator
https://bugs.webkit.org/show_bug.cgi?id=154003
Reviewed by Darin Adler.
Currently ComposedTreeIterator implements tree traversal using NodeTraversal. This makes it overly complicated.
It can also return nodes other than Element and Text which should not be part of the composed tree.
This patch adds a new iterator type, ElementAndTextDescendantIterator, similar to the existing ElementDescendantIterator.
ComposedTreeIterator is then implemented using this new iterator.
When entering a shadow tree or a slot the local iterator is pushed along with the context stack and a new local
iterator is initialized for the new context. When leaving a shadow tree the context stack is popped and the previous
local iterator becomes active.
- WebCore.xcodeproj/project.pbxproj:
- dom/ComposedTreeIterator.cpp:
(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::pushContext):
(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::ComposedTreeIterator::traverseNextLeavingContext):
(WebCore::ComposedTreeIterator::advanceInSlot):
(WebCore::ComposedTreeIterator::traverseSiblingInSlot):
(WebCore::ComposedTreeIterator::initializeShadowStack): Deleted.
(WebCore::ComposedTreeIterator::traverseParentInShadowTree): Deleted.
(WebCore::ComposedTreeIterator::traverseNextSiblingSlot): Deleted.
(WebCore::ComposedTreeIterator::traversePreviousSiblingSlot): Deleted.
- dom/ComposedTreeIterator.h:
(WebCore::ComposedTreeIterator::operator*):
(WebCore::ComposedTreeIterator::operator->):
(WebCore::ComposedTreeIterator::operator==):
(WebCore::ComposedTreeIterator::operator!=):
(WebCore::ComposedTreeIterator::operator++):
(WebCore::ComposedTreeIterator::Context::Context):
(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):
(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::traverseNext):
(WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
(WebCore::ComposedTreeIterator::traverseNextSibling):
(WebCore::ComposedTreeIterator::traversePreviousSibling):
(WebCore::ComposedTreeDescendantAdapter::ComposedTreeDescendantAdapter):
(WebCore::ComposedTreeDescendantAdapter::begin):
(WebCore::ComposedTreeDescendantAdapter::end):
(WebCore::ComposedTreeDescendantAdapter::at):
(WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
(WebCore::ComposedTreeChildAdapter::ComposedTreeChildAdapter):
(WebCore::ComposedTreeChildAdapter::begin):
(WebCore::ComposedTreeChildAdapter::end):
(WebCore::ComposedTreeChildAdapter::at):
(WebCore::ComposedTreeIterator::ShadowContext::ShadowContext): Deleted.
(WebCore::ComposedTreeIterator::traverseParent): Deleted.
- dom/ElementAndTextDescendantIterator.h: Added.
New iterator type that traverses Element and Text nodes (that is renderable nodes only).
It also tracks depth for future use.
- 5:06 PM Changeset in webkit [196280] by
-
- 3 edits in trunk/Source/JavaScriptCore
B3::foldPathConstants() needs to execute its insertion set
https://bugs.webkit.org/show_bug.cgi?id=154020
Reviewed by Saam Barati.
- b3/B3FoldPathConstants.cpp:
- b3/testb3.cpp:
(JSC::B3::testFoldPathEqual): Added this. It used to crash in validation.
(JSC::B3::run):
- 3:29 PM Changeset in webkit [196279] by
-
- 1 copy in tags/Safari-601.3.9.1.3
New tag.
- 3:18 PM Changeset in webkit [196278] by
-
- 20 edits2 copies in branches/safari-601-branch
Merged r187245. rdar://problem/19861992
- 3:15 PM Changeset in webkit [196277] by
-
- 20 edits2 copies in branches/safari-601.3.9.1-branch
Merged r187245. rdar://problem/19861992
- 3:14 PM Changeset in webkit [196276] by
-
- 5 edits in trunk/Source/JavaScriptCore
[JSC] Introduce @isObject bytecode intrinsic and use it instead of JS implemented one
https://bugs.webkit.org/show_bug.cgi?id=153976
Reviewed by Darin Adler.
Use bytecode op_is_object directly.
- builtins/GlobalObject.js:
(isObject): Deleted.
- bytecode/BytecodeIntrinsicRegistry.h:
- bytecompiler/NodesCodegen.cpp:
(JSC::BytecodeIntrinsicNode::emit_intrinsic_toString):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isObject):
- runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init): Deleted.
- 3:13 PM Changeset in webkit [196275] by
-
- 22 edits in trunk/Source/WebInspectorUI
Web Inspector: Extract a few common unicode characters into global variables
https://bugs.webkit.org/show_bug.cgi?id=154008
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Timothy Hatcher.
- UserInterface/Base/Utilities.js:
Create global variables for
emDashandellipsisto use all over the tools.
- UserInterface/Views/ConsoleMessageView.js:
(WebInspector.ConsoleMessageView.prototype._formatParameterAsTable): Deleted.
- UserInterface/Views/DefaultDashboardView.js:
(WebInspector.DefaultDashboardView.prototype._updateDisplay):
- UserInterface/Views/HierarchicalPathComponent.js:
(WebInspector.HierarchicalPathComponent.prototype._updateElementTitleAndText):
(WebInspector.HierarchicalPathComponent.prototype._updateSelectElement.createOption):
(WebInspector.HierarchicalPathComponent.prototype._updateSelectElement):
- UserInterface/Views/HierarchicalPathNavigationItem.js:
(WebInspector.HierarchicalPathNavigationItem.prototype.updateLayout):
- UserInterface/Views/LayerTreeDataGridNode.js:
(WebInspector.LayerTreeDataGridNode.prototype.set layer):
- UserInterface/Views/LayoutTimelineDataGridNode.js:
(WebInspector.LayoutTimelineDataGridNode.prototype.createCellContent):
(WebInspector.LayoutTimelineDataGridNode):
- UserInterface/Views/MemoryCategoryView.js:
(WebInspector.MemoryCategoryView.prototype._updateDetails): Deleted.
(WebInspector.MemoryCategoryView): Deleted.
- UserInterface/Views/MemoryTimelineView.js:
(WebInspector.MemoryTimelineView.prototype._clearUsageLegend):
(WebInspector.MemoryTimelineView.prototype._updateUsageLegend):
(WebInspector.MemoryTimelineView.prototype._clearMaxComparisonLegend):
(WebInspector.MemoryTimelineView.prototype._updateMaxComparisonLegend):
- UserInterface/Views/MultipleScopeBarItem.js:
(WebInspector.MultipleScopeBarItem.set scopeBarItems.createOption):
(WebInspector.MultipleScopeBarItem.prototype.set scopeBarItems):
- UserInterface/Views/ObjectPreviewView.js:
(WebInspector.ObjectPreviewView.prototype._appendEntryPreviews):
(WebInspector.ObjectPreviewView.prototype._appendPropertyPreviews):
- UserInterface/Views/ProfileNodeDataGridNode.js:
(WebInspector.ProfileNodeDataGridNode.prototype.createCellContent):
(WebInspector.ProfileNodeDataGridNode):
- UserInterface/Views/RenderingFrameTimelineDataGridNode.js:
(WebInspector.RenderingFrameTimelineDataGridNode.prototype.createCellContent):
(WebInspector.RenderingFrameTimelineDataGridNode):
- UserInterface/Views/ResourceDetailsSidebarPanel.js:
(WebInspector.ResourceDetailsSidebarPanel.prototype._refreshRequestAndResponse): Deleted.
(WebInspector.ResourceDetailsSidebarPanel.prototype._valueForSize): Deleted.
- UserInterface/Views/ResourceTimelineDataGridNode.js:
(WebInspector.ResourceTimelineDataGridNode.prototype.createCellContent):
- UserInterface/Views/ScriptTimelineDataGridNode.js:
(WebInspector.ScriptTimelineDataGridNode.prototype.createCellContent):
(WebInspector.ScriptTimelineDataGridNode):
- UserInterface/Views/SearchResultTreeElement.js:
(WebInspector.SearchResultTreeElement.truncateAndHighlightTitle):
- UserInterface/Views/TimelineDataGridNode.js:
(WebInspector.TimelineDataGridNode.prototype.createCellContent):
- UserInterface/Views/TypeTreeElement.js:
(WebInspector.TypeTreeElement.prototype.onpopulate):
- UserInterface/Views/TypeTreeView.js:
(WebInspector.TypeTreeView.prototype._populate):
(WebInspector.TypeTreeView):
- 3:12 PM Changeset in webkit [196274] by
-
- 6 edits in trunk
{Map,Set}.prototype.forEach should be visible as own properties
https://bugs.webkit.org/show_bug.cgi?id=153974
Reviewed by Darin Adler.
Source/JavaScriptCore:
Now, Map and Set uses builtin tables. We should inlude it in class info.
- runtime/MapPrototype.cpp:
- runtime/SetPrototype.cpp:
LayoutTests:
- js/Object-getOwnPropertyNames-expected.txt:
- js/script-tests/Object-getOwnPropertyNames.js:
- 3:00 PM Changeset in webkit [196273] by
-
- 2 edits in trunk/Source/JavaScriptCore
Baseline JIT should not require its input to be constant-propagated
https://bugs.webkit.org/show_bug.cgi?id=154011
rdar://problem/24290933
Reviewed by Mark Lam.
- jit/JITArithmetic.cpp:
(JSC::JIT::emitBitBinaryOpFastPath):
(JSC::JIT::emitRightShiftFastPath):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
- 2:31 PM Changeset in webkit [196272] by
-
- 2 edits in trunk/Source/JavaScriptCore
CodeCache should give up on evals if there are variables under TDZ
https://bugs.webkit.org/show_bug.cgi?id=154002
rdar://problem/24300998
Reviewed by Mark Lam.
Disable the code cache optimization because our approach to TDZ for scoped variables - using
a separate check_tdz opcode when logically it's the get_from_scope's job to do it - makes
caching code impossible if there are any variables in TDZ.
We should do the right thing in the future, and fold the TDZ check into the get_from_scope.
This is better not only because it will restore caching, but because our bytecode for heap
accesses is usually at the highest practically doable level of abstraction, so that ICs,
compilers and caches can see the intended meaning of the bytecode more easily.
This doesn't appear to slow anything down, but that's just because we don't have enough ES6
benchmarks. I've filed: https://bugs.webkit.org/show_bug.cgi?id=154010
- runtime/CodeCache.cpp:
(JSC::CodeCache::getGlobalCodeBlock):
- 2:07 PM Changeset in webkit [196271] by
-
- 2 edits in trunk/Source/WebInspectorUI
Web Inspector: ⇧⌘→ when editing text in the Elements tree shouldn't switch inspector tab
https://bugs.webkit.org/show_bug.cgi?id=154006
<rdar://problem/22892489>
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Timothy Hatcher.
- UserInterface/Views/EditingSupport.js:
(WebInspector.isEventTargetAnEditableField):
Check the WebInspector's custom editing state.
- 1:50 PM Changeset in webkit [196270] by
-
- 4 edits2 adds in trunk
Web Inspector: copy({x:1}) should copy "{x:1}", not "[object Object]"
https://bugs.webkit.org/show_bug.cgi?id=148605
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.
Source/WebCore:
Test: inspector/console/command-line-api-copy.html
- inspector/CommandLineAPIModuleSource.js:
(CommandLineAPIImpl.prototype.copy):
Support copying different types. This is meant to be more
convenient then just JSON.stringify, so it handles types
like Node, Symbol, RegExp, and Function a bit better.
LayoutTests:
- inspector/console/command-line-api-copy-expected.txt: Added.
- inspector/console/command-line-api-copy.html: Added.
- http/tests/inspector/console/cross-domain-inspected-node-access-expected.txt:
- 1:47 PM Changeset in webkit [196269] by
-
- 2 edits in trunk/LayoutTests
Mark fast/text/crash-complex-text-surrogate.html as flaky on mac-wk2
https://bugs.webkit.org/show_bug.cgi?id=154005
Unreviewed test gardening.
- platform/mac-wk2/TestExpectations:
- 12:54 PM Changeset in webkit [196268] by
-
- 19 edits2 adds in trunk
REGRESSION(r181345): SVG polyline and polygon leak page
https://bugs.webkit.org/show_bug.cgi?id=152759
Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-08
Reviewed by Darin Adler.
Source/WebCore:
The leak happens because of cyclic reference between SVGListPropertyTearOff
and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
There is also cyclic reference between SVGAnimatedProperty and SVGElement
and this causes the whole document to be leaked. So if the JS requests, for
example, an instance of SVGPolylineElement.points, the whole document will be
leaked.
The fix depends on having the cyclic reference as is since the owning and the
owned classes have to live together if any of them is referenced. But the owning
class caches a raw 'ref-counted' pointer of the owned class. If it is requested
for an instance of the owned class it returned a RefPtr<> of it. Once the owned
class is not used, it can delete itself. The only thing needed here is to notify
the owner class of the deletion so it cleans its caches and be able to create a
new pointer if it is requested for an instance of the owned class later.
Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
to break the cyclic reference between SVGElement and SVGAnimatedProperty.
Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
animVal() to break cyclic reference between SVGListPropertyTearOff and
SVGAnimatedListPropertyTearOff.
Test: svg/animations/smil-leak-list-property-instances.svg
- bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue): The SVG non-string list tear-off properties became of
type RefPtr<>. So we need to use get() with the casting expressions.
- svg/SVGMarkerElement.cpp:
(WebCore::SVGMarkerElement::orientType):
Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
- svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::pathByteStream):
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGPathElement::pathSegList):
(WebCore::SVGPathElement::normalizedPathSegList):
(WebCore::SVGPathElement::animatedPathSegList):
(WebCore::SVGPathElement::animatedNormalizedPathSegList):
- svg/SVGPathElement.h:
Change the return value from raw pointer to RefPtr<>.
- svg/SVGPathSegWithContext.h:
(WebCore::SVGPathSegWithContext::animatedProperty):
Change the return type to be RefPtr<> to preserve the value from being deleted.
- svg/SVGPolyElement.cpp:
(WebCore::SVGPolyElement::parseAttribute):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGPolyElement::points):
(WebCore::SVGPolyElement::animatedPoints):
- svg/SVGPolyElement.h:
Change the return value from raw pointer to RefPtr<>.
- svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::setTransformString):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.
(WebCore::SVGViewSpec::transform):
- svg/SVGViewSpec.h:
Change the return value from raw pointer to RefPtr<>.
- svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
Change the return value from raw pointer to RefPtr<> and change the cached
value from RefPtr<> to raw pointer. If the property is null, it will be
created, its raw pointer will be cached and the only ref-counted RefPtr<>
will be returned. This will guarantee, the RefPtr<> will be deleted once
it is not used anymore.
(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
actual pointer. This function will be called from the destructor of
SVGListPropertyTearOff.
(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
We have to ensure the baseVal() is created before using it.
(WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
to the animVal(). This will prevent deleting m_animVal while animation.
- svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.
(WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
Same as what is done in SVGAnimatedListPropertyTearOff.
- svg/properties/SVGAnimatedProperty.h:
(WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
Change the return value from raw reference to Ref<> and change the
cached value from Ref<> to raw pointer. This reverts the change of
r181345 in this function.
(WebCore::SVGAnimatedProperty::lookupWrapper):
Change the return value from raw pointer to RefPtr<>.
- svg/properties/SVGAnimatedPropertyMacros.h:
Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
- svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
(WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.
- svg/properties/SVGListPropertyTearOff.h:
(WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
its raw pointers when the RefPtr<> deletes itself.
LayoutTests:
- TestExpectations: Remove flaky tests from test expectation.
- svg/animations/smil-leak-list-property-instances-expected.txt: Added.
- svg/animations/smil-leak-list-property-instances.svg: Added.
Ensure if SVGPolylineElement.points is requested from JS, the document will
not leak.
- 12:53 PM Changeset in webkit [196267] by
-
- 2 edits in trunk/Source/WebKit/mac
Crash when trying to chain to the old -[NSView setNeedsDisplayInRect:]
https://bugs.webkit.org/show_bug.cgi?id=154001
rdar://problem/24519975
Reviewed by Dan Bernstein.
If our replaced -[NSView setNeedsDisplayInRect:] is called before the old IMP has been initialized,
we can end up trying to call a null pointer.
Fix this by using method_exchangeImplementations instead of method_setImplementation, since the former is done
atomically.
- WebView/WebHTMLView.mm:
(-[NSView _web_setNeedsDisplayInRect:]):
(+[WebHTMLViewPrivate initialize]):
(setNeedsDisplayInRect): Deleted.
- 11:49 AM Changeset in webkit [196266] by
-
- 5 edits in trunk/Source/WebInspectorUI
Web Inspector: Long values for comma separated CSS properties overflow the Visual sidebar area
https://bugs.webkit.org/show_bug.cgi?id=153890
<rdar://problem/24510216>
Patch by Devin Rousso <Devin Rousso> on 2016-02-08
Reviewed by Timothy Hatcher.
For especially long values in comma-separated CSS properties (such as
background-image), the text will not be clipped as expected due to the
way in which the width is calculated for the element (the value, inside
the title element, is the only child with a specified width other than
100%). This overflowing causes the width of the section containing that
property to expand, pushing content outside of the inspector window. To
remedy this, a specified width is set on the relevant properties based
on the width of the sidebar to ensure proper text clipping.
- UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item.visual-style-font-family-list-item > .visual-style-comma-separated-keyword-item-editor):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item > .titles):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item > .titles > .subtitle):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container): Deleted.
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list): Deleted.
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item): Deleted.
- UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.js:
(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.set specifiedWidth):
Calculates the necessary subtractions from the given width value based on
the margins and size of sibling elements.
- UserInterface/Views/VisualStyleDetailsPanel.js:
(WebInspector.VisualStyleDetailsPanel.prototype._updateProperties):
(WebInspector.VisualStyleDetailsPanel.prototype._populateFontSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateBackgroundStyleSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateBoxShadowSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateTransitionSection):
Added another list to each group which, if set, will pass the current
sidebar width to all contained property editors.
- UserInterface/Views/VisualStylePropertyEditor.js:
(WebInspector.VisualStylePropertyEditor.prototype.update):
Somewhat unrelated (r196146), but added another check to ensure that the
CSS property exists before checking to see if it has an invalid value.
- 11:42 AM Changeset in webkit [196265] by
-
- 5 edits in trunk/Source
[GTK] WebKitWebView should send crossing events to the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=153740
Reviewed by Michael Catanzaro.
Source/WebCore:
Update the target element under the mouse also when only updating
scrollbars, so that if the mouse enters the page when the window
is not active, the scroll animator is notified that the mouse
entered the scrollable area.
- page/EventHandler.cpp:
(WebCore::EventHandler::handleMouseMoveEvent): Call
updateMouseEventTargetNode() before early returning in case of
only updating scrollbars.
Source/WebKit2:
We don't currently handle crossing events in the web view
(enter/leave). That's why if you hover a scrollbar and leave the
window, the scrollbar is still rendered as hovered.
- Shared/gtk/WebEventFactory.cpp:
(WebKit::buttonForEvent): Handle the case of GDK_ENTER_NOTIFY and
GDK_LEAVE_NOTIFY events.
(WebKit::WebEventFactory::createWebMouseEvent): Ditto.
- UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseRealize): Add GDK_ENTER_NOTIFY_MASK and
GDK_LEAVE_NOTIFY_MASK flags to the web view event mask.
(webkitWebViewBaseCrossingNotifyEvent): Handle enter/leave notify
events by generating a mouse move event, ensuring the double to
int conversion will not cause any problem.
(webkit_web_view_base_class_init): Add an implementation for
enter_notify_event and leave_notify_event.
- 11:41 AM Changeset in webkit [196264] by
-
- 2 edits in trunk/Source/WebKit2
Infinite loop when processing mouse events synchronously
https://bugs.webkit.org/show_bug.cgi?id=153995
Reviewed by Darin Adler.
This happened with WTR in the GTK+ port after landing patch in bug
#153740. The thing is that WTR forces events handling IPC messages
to be synchronous. When a drag and drop operation is in progress,
the web process ignores mouse move events and replies with
DidReceiveEvent signal. The DidReceiveEvent message handler in
WebPageProxy checks if we have a m_nextMouseMoveEvent and handles
it, but when all this happens synchronously the
m_nextMouseMoveEvent is the current one because we haven't
returned yet from handleMouseEvent(). We need to invalidate the
m_nextMouseMoveEvent before calling handleMouseEvent().
- UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didReceiveEvent):
- 11:33 AM Changeset in webkit [196263] by
-
- 3 edits in trunk/Source/WebCore
PiP and external playback are mutually exclusive.
https://bugs.webkit.org/show_bug.cgi?id=153988
rdar://problem/24108661
Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.
Adding isPlayingOnSecondScreen to isPlayingOnExternalScreen allows AVKit to disable PiP
when appropriate. Testing video fullscreen mode in updateDisableExternalPlayback allows us to
turn-off external playback when entering picture-in-picture.
- platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):
- platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(-[WebAVPlayerController isPlayingOnExternalScreen]):
(+[WebAVPlayerController keyPathsForValuesAffectingPlayingOnExternalScreen]):
- 11:31 AM Changeset in webkit [196262] by
-
- 4 edits in trunk/LayoutTests
IndexedDB: No test covers cursor.delete() setting the source of the request to the cursor.
https://bugs.webkit.org/show_bug.cgi?id=153992
Reviewed by Jer Noble.
- storage/indexeddb/cursor-delete-expected.txt:
- storage/indexeddb/cursor-delete-private-expected.txt:
- storage/indexeddb/resources/cursor-delete.js:
- 11:29 AM Changeset in webkit [196261] by
-
- 10 edits in trunk
[ES6] Arrow function syntax. Using 'super' in arrow function that declared out of the class should lead to Syntax error
https://bugs.webkit.org/show_bug.cgi?id=150893
Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2016-02-08
Reviewed by Saam Barati.
Source/JavaScriptCore:
'super' and 'super()' inside of the arrow function should lead to syntax error if they are used
out of the class context or they wrapped by ordinary function. Now JSC returns ReferenceError but
should return SyntaxError according to the following specs:
http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions-static-semantics-early-errors
and http://www.ecma-international.org/ecma-262/6.0/#sec-arrow-function-definitions-runtime-semantics-evaluation
Curren patch implemented only one case when super/super() are used inside of the arrow function
Case when super/super() are used within the eval:
class A {}
class B extends A {
costructor() { eval("super()");}
}
is not part of this patch and will be implemented in this issue https://bugs.webkit.org/show_bug.cgi?id=153864.
The same for case when eval with super/super() is invoked in arrow function will be
implemented in issue https://bugs.webkit.org/show_bug.cgi?id=153977.
- parser/Parser.cpp:
(JSC::Parser<LexerType>::parseFunctionInfo):
- parser/Parser.h:
(JSC::Scope::Scope):
(JSC::Scope::setExpectedSuperBinding):
(JSC::Scope::expectedSuperBinding):
(JSC::Scope::setConstructorKind):
(JSC::Scope::constructorKind):
(JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):
- tests/stress/arrowfunction-lexical-bind-supercall-4.js:
- tests/stress/arrowfunction-lexical-bind-superproperty.js:
LayoutTests:
Adding tests for using of the 'super' inside of the arrow function
- js/arrowfunction-superproperty-expected.txt:
- js/arrowfunction-syntax-errors-expected.txt:
- js/script-tests/arrowfunction-superproperty.js:
- js/script-tests/arrowfunction-syntax-errors.js:
- 11:27 AM Changeset in webkit [196260] by
-
- 2 edits in trunk/Source/WebKit2
Remove weak from WKAirPlayRoutePicker.mm to fix build warning.
https://bugs.webkit.org/show_bug.cgi?id=153985
rdar://problem/24485348
Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Darin Adler.
Remove weak since it is only available when using ARC.
- UIProcess/ios/forms/WKAirPlayRoutePicker.mm:
- 10:58 AM Changeset in webkit [196259] by
-
- 4 edits in trunk/Source/WTF
Make sure that locking code that relies on module boundaries for compiler fences uses NEVER_INLINE
https://bugs.webkit.org/show_bug.cgi?id=153972
Reviewed by Andreas Kling.
When this code was written, we assumed that module boundaries were compiler fences. That might
not be the case if we ever do LTO.
- wtf/Lock.cpp:
(WTF::LockBase::lockSlow):
(WTF::LockBase::unlockSlow):
- wtf/ParkingLot.cpp:
(WTF::ParkingLot::parkConditionally):
(WTF::ParkingLot::unparkOne):
(WTF::ParkingLot::unparkAll):
(WTF::ParkingLot::forEach):
- wtf/WordLock.cpp:
(WTF::WordLock::lockSlow):
(WTF::WordLock::unlockSlow):
- 10:52 AM Changeset in webkit [196258] by
-
- 2 edits in trunk/Source/JavaScriptCore
Parser should detect error before calls to parseAssignmentExpression()
https://bugs.webkit.org/show_bug.cgi?id=153975
rdar://problem/24291231
Reviewed by Saam Barati.
Fixes a very hard-to-create situation that an internal test picked up.
- parser/Parser.cpp:
(JSC::Parser<LexerType>::parseVariableDeclarationList):
(JSC::Parser<LexerType>::parseAssignmentExpression):
- 10:43 AM Changeset in webkit [196257] by
-
- 2 edits in trunk/Source/WebKit2
[GTK] Fix crash when creating webview with g_object_new
https://bugs.webkit.org/show_bug.cgi?id=153989
Patch by Danilo Cesar Lemes de Paula <danilo.cesar@collabora.co.uk> on 2016-02-08
Reviewed by Carlos Garcia Campos.
g_object_new(WEBKIT_TYPE_WEB_VIEW, NULL) crashes webkit
as _WebKitWebViewBasePrivate constructor requires a mainloop, but
webkit is only initialized when a context is created (which
doesn't happen with a direct call to g_object_new).
- UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkit_web_view_base_class_init):
- 10:28 AM Changeset in webkit [196256] by
-
- 5 edits in trunk/Source
Unreviewed, rolling out r196253.
https://bugs.webkit.org/show_bug.cgi?id=153990
Caused several crashes in GTK+ bots (Requested by KaL on
#webkit).
Reverted changeset:
"[GTK] WebKitWebView should send crossing events to the
WebProcess"
https://bugs.webkit.org/show_bug.cgi?id=153740
http://trac.webkit.org/changeset/196253
- 10:23 AM Changeset in webkit [196255] by
-
- 2 edits in trunk/Source/WebInspectorUI
Web Inspector: WebInspector.Setting should have a "reset" method
https://bugs.webkit.org/show_bug.cgi?id=153971
<rdar://problem/24544101>
Reviewed by Brian Burg.
Currently UI needing to restore a setting to its default must retain a copy
of the default value. This should be a basic operation of WebInspector.Setting.
- UserInterface/Base/Setting.js:
(WebInspector.Setting):
(WebInspector.Setting.prototype.reset):
Sets value to a copy of the default.
- 9:06 AM Changeset in webkit [196254] by
-
- 2 edits in trunk/Source/WebCore
WebAVPlayerController should implement currentTimeWithinEndTimes.
https://bugs.webkit.org/show_bug.cgi?id=153983
rdar://problem/22864621
Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.
Implement currentTimeWithinEndTimes in terms of seekToTime and AVTiming. This is a trivial
implementation becuase AVPlayer start and end times aren't used.
- platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(-[WebAVPlayerController currentTimeWithinEndTimes]):
(-[WebAVPlayerController setCurrentTimeWithinEndTimes:]):
(+[WebAVPlayerController keyPathsForValuesAffectingCurrentTimeWithinEndTimes]):
- 8:59 AM Changeset in webkit [196253] by
-
- 5 edits in trunk/Source
[GTK] WebKitWebView should send crossing events to the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=153740
Reviewed by Michael Catanzaro.
Source/WebCore:
Update the target element under the mouse also when only updating
scrollbars, so that if the mouse enters the page when the window
is not active, the scroll animator is notified that the mouse
entered the scrollable area.
- page/EventHandler.cpp:
(WebCore::EventHandler::handleMouseMoveEvent): Call
updateMouseEventTargetNode() before early returning in case of
only updating scrollbars.
Source/WebKit2:
We don't currently handle crossing events in the web view
(enter/leave). That's why if you hover a scrollbar and leave the
window, the scrollbar is still rendered as hovered.
- Shared/gtk/WebEventFactory.cpp:
(WebKit::buttonForEvent): Handle the case of GDK_ENTER_NOTIFY and
GDK_LEAVE_NOTIFY events.
(WebKit::WebEventFactory::createWebMouseEvent): Ditto.
- UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseRealize): Add GDK_ENTER_NOTIFY_MASK and
GDK_LEAVE_NOTIFY_MASK flags to the web view event mask.
(webkitWebViewBaseCrossingNotifyEvent): Handle enter/leave notify
events by generating a mouse move event, ensuring the double to
int conversion will not cause any problem.
(webkit_web_view_base_class_init): Add an implementation for
enter_notify_event and leave_notify_event.
- 8:46 AM Changeset in webkit [196252] by
-
- 3 edits in trunk/Source/WebCore
WebVideoFullscreenInterface should handle video resizing.
https://bugs.webkit.org/show_bug.cgi?id=153982
rdar://problem/22031249
Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.
Video fullscreen can be initiated before video dimension are available.
Protect against an initial width or height of zero and observe resize events
to update once video dimensions become available or change.
- platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
(WebVideoFullscreenModelVideoElement::updateForEventName):
(WebVideoFullscreenModelVideoElement::observedEventNames):
- platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(-[WebAVPlayerLayer layoutSublayers]):
(-[WebAVPlayerLayer videoRect]):
(WebVideoFullscreenInterfaceAVKit::setVideoDimensions):
- 8:25 AM Changeset in webkit [196251] by
-
- 3 edits in trunk/Source/JavaScriptCore
Visiting a WeakBlock should report bytes visited, since we reported them allocated.
<https://webkit.org/b/153978>
Reviewed by Darin Adler.
When creating a WeakBlock, we tell Heap that we've allocated 1 KB (WeakBlock::blockSize)
of memory. Consequently, when visiting a WeakBlock, we should also report 1 KB of memory
visited. Otherwise Heap will think that those 1 KB already went away.
This was causing us to underestimate heap size, which affects collection scheduling.
- heap/SlotVisitor.h:
(JSC::SlotVisitor::reportMemoryVisited):
- heap/WeakBlock.cpp:
(JSC::WeakBlock::visit):
- 5:43 AM Changeset in webkit [196250] by
-
- 2 edits in trunk/LayoutTests
Timeouts in tests because of non implemented UIScriptController::singleTapAtPoint()
https://bugs.webkit.org/show_bug.cgi?id=153833
Unreviewed.
Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-08
- platform/gtk/TestExpectations:
- 5:41 AM Changeset in webkit [196249] by
-
- 2 edits in trunk/Source/WebCore
Indent inline box test fails due to assertion in VisibleSelection::selectionFromContentsOfNode()
https://bugs.webkit.org/show_bug.cgi?id=153824
Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-08
Reviewed by Michael Catanzaro.
- editing/markup.cpp:
(WebCore::highestAncestorToWrapMarkup):
Feb 7, 2016:
- 7:22 PM Changeset in webkit [196248] by
-
- 2 edits in trunk/Source/WebCore
Remove unused enum ScrollbarOverlayState.
Rubber-stamped by Dan Bernstein.
- platform/ScrollTypes.h:
- 7:20 PM Changeset in webkit [196247] by
-
- 3 edits in trunk/Source/WebCore
Remove unnecessary respondsToSelector checks for methods that exist on all supported platforms
https://bugs.webkit.org/show_bug.cgi?id=153970
Reviewed by Dan Bernstein.
-[NSScrollerImp mouseEnteredScroller], -[NSScrollerImp expansionTransitionProgress],
-[NSScrollerImpPair contentAreaScrolledInDirection:], and -[NSScrollerImp setExpanded:]
are now available on all supported OS's. No need to check for them.
- platform/mac/ScrollAnimatorMac.mm:
(macScrollbarTheme):
(-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
(WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
(WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
(WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
(WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):
(supportsUIStateTransitionProgress): Deleted.
(supportsExpansionTransitionProgress): Deleted.
(supportsContentAreaScrolledInDirection): Deleted.
- platform/mac/ScrollbarThemeMac.mm:
(+[WebScrollbarPrefsObserver appearancePrefsChanged:]):
(+[WebScrollbarPrefsObserver behaviorPrefsChanged:]):
(WebCore::ScrollbarThemeMac::scrollbarThickness):
- 7:01 PM Changeset in webkit [196246] by
-
- 8 edits1 add in trunk/Source/WebCore
Use modern SPI header idiom for NSScrollerImp and NSScrollerImpPair
https://bugs.webkit.org/show_bug.cgi?id=153969
Reviewed by Dan Bernstein.
- WebCore.xcodeproj/project.pbxproj:
Add new file NSScrollerImpSPI.h
- page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
Use new include of NSScrollerImpSPI.h.
- platform/ScrollbarThemeComposite.h:
Define ScrollbarPainter more precisely as NSScrollerImp * now that the type is available to us.
- platform/mac/NSScrollerImpDetails.h:
Remove NSObject category based SPI usage with the modern one NSScrollerImpSPI.h
- platform/mac/NSScrollerImpDetails.mm:
(WebCore::recommendedScrollerStyle):
Simplify recommendedScrollerStyle() now that all OS's we ship on have +[NSScroller preferredScrollerStyle].
- platform/mac/ScrollAnimatorMac.mm:
(supportsUIStateTransitionProgress):
(supportsExpansionTransitionProgress):
(supportsContentAreaScrolledInDirection):
Stop using NSClassFromString now that we can reference the classes explicitly.
(-[WebScrollbarPainterControllerDelegate invalidate]):
(-[WebScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:setContentAreaNeedsDisplayInRect:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
(-[WebScrollbarPainterDelegate layer]):
(-[WebScrollbarPainterDelegate mouseLocationInScrollerForScrollerImp:]):
(-[WebScrollbarPainterDelegate convertRectToLayer:]):
(-[WebScrollbarPainterDelegate shouldUseLayerPerPartForScrollerImp:]):
(-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
(WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
(WebCore::ScrollAnimatorMac::lockOverlayScrollbarStateToHidden):
(WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
(WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
(WebCore::ScrollAnimatorMac::updateScrollerStyle):
Add proper conforming to protocols and replace ids with proper types.
- platform/mac/ScrollbarThemeMac.mm:
(WebCore::supportsExpandedScrollbars):
(WebCore::ScrollbarThemeMac::registerScrollbar):
(WebCore::ScrollbarThemeMac::scrollbarThickness):
(WebCore::ScrollbarThemeMac::setUpContentShadowLayer):
Stop using NSClassFromString now that we can reference the classes explicitly.
- platform/spi/mac/NSScrollerImpSPI.h: Added.
- 5:34 PM Changeset in webkit [196245] by
-
- 6 edits in trunk
[GTK][EFL] Enable SamplingProfiler
https://bugs.webkit.org/show_bug.cgi?id=153638
Reviewed by Michael Catanzaro.
.:
Enable SamplingProfiler in GTK and EFL.
And added option to CMake to switch this from the build command.
- Source/cmake/OptionsEfl.cmake:
- Source/cmake/OptionsGTK.cmake:
- Source/cmake/WebKitFeatures.cmake:
Source/WTF:
- wtf/Platform.h:
- 4:33 PM Changeset in webkit [196244] by
-
- 145 edits2 adds in trunk
Outline does not clip when ancestor has overflow: hidden and requires layer.
https://bugs.webkit.org/show_bug.cgi?id=153901
Now that outline is part of visual overflow, we no longer need the special outline cliprect.
PaintPhaseChildOutlines drawing will switch to foreground cliprect. It ensures proper overflow clipping
at parent level. PaintPhaseSelfOutline drawing will start using the visual overflow inflated background cliprect.
With this change, outline will be using the same cliprects as the other visual overflow properties (box-shadow etc).
Reviewed by David Hyatt.
Source/WebCore:
Test: fast/repaint/outline-with-overflow-hidden-ancestor.html
- rendering/LayerFragment.h:
(WebCore::LayerFragment::setRects):
(WebCore::LayerFragment::moveBy): Deleted.
(WebCore::LayerFragment::intersect): Deleted.
- rendering/RenderLayer.cpp:
(WebCore::RenderLayer::collectFragments):
(WebCore::RenderLayer::paintOutlineForFragments):
(WebCore::RenderLayer::calculateClipRects):
(WebCore::RenderLayer::paintForegroundForFragments): Deleted.
- rendering/RenderLayer.h:
- rendering/RenderTreeAsText.cpp:
(WebCore::write):
(WebCore::writeLayers):
LayoutTests:
- compositing/geometry/limit-layer-bounds-overflow-repaint-expected.txt:
- compositing/masks/mask-of-clipped-layer-expected.txt:
- css2.1/20110323/abspos-non-replaced-width-margin-000-expected.txt:
- css2.1/20110323/abspos-replaced-width-margin-000-expected.txt:
- css3/blending/blend-mode-isolation-turn-off-self-painting-layer2-expected.txt:
- css3/blending/blend-mode-isolation-turn-on-self-painting-layer-expected.txt:
- fast/block/positioning/negative-rel-position-expected.txt:
- fast/dynamic/staticY-expected.txt:
- fast/inline/absolute-positioned-block-in-centred-block-expected.txt:
- fast/multicol/flipped-blocks-border-after-expected.txt:
- fast/multicol/pagination-h-horizontal-bt-expected.txt:
- fast/multicol/pagination-h-horizontal-tb-expected.txt:
- fast/multicol/pagination-h-vertical-rl-expected.txt:
- fast/multicol/pagination-v-horizontal-bt-expected.txt:
- fast/multicol/pagination-v-vertical-lr-expected.txt:
- fast/multicol/pagination-v-vertical-rl-expected.txt:
- fast/multicol/pagination/LeftToRight-tb-hittest-expected.txt:
- fast/multicol/pagination/RightToLeft-rl-hittest-expected.txt:
- fast/multicol/progression-reverse-expected.txt:
- fast/multicol/vertical-rl/rules-with-border-before-expected.txt:
- fast/overflow/overflow-update-transform-expected.txt:
- fast/overflow/position-relative-expected.txt:
- fast/repaint/focus-ring-expected.txt:
- fast/repaint/focus-ring-repaint.html:
- fast/repaint/outline-with-overflow-hidden-ancestor-expected.html: Added.
- fast/repaint/outline-with-overflow-hidden-ancestor.html: Added.
- fast/table/overflow-table-collapsed-borders-cell-painting-expected.txt:
- fast/table/overflow-table-collapsed-borders-cell-painting-table-self-painting-layer-expected.txt:
- fast/table/overflow-table-collapsed-borders-section-layer-painting-expected.txt:
- fast/table/overflow-table-collapsed-borders-section-layer-table-self-painting-layer-expected.txt:
- fast/table/overflow-table-collapsed-borders-section-self-painting-layer-painting-expected.txt:
- fast/table/overflow-table-collapsed-borders-section-self-painting-layer-table-self-painting-layer-expected.txt:
- platform/mac/compositing/geometry/clipping-foreground-expected.txt:
- platform/mac/compositing/geometry/root-layer-update-expected.txt:
- platform/mac/compositing/overflow/ancestor-overflow-expected.txt:
- platform/mac/compositing/overflow/nested-scrolling-expected.txt:
- platform/mac/compositing/overflow/overflow-scroll-expected.txt:
- platform/mac/compositing/overflow/parent-overflow-expected.txt:
- platform/mac/compositing/overflow/scrollbar-painting-expected.txt:
- platform/mac/compositing/reflections/nested-reflection-on-overflow-expected.txt:
- platform/mac/compositing/sibling-positioning-expected.txt:
- platform/mac/css3/blending/blend-mode-overflow-expected.txt:
- platform/mac/css3/unicode-bidi-isolate-basic-expected.txt:
- platform/mac/fast/block/float/overhanging-tall-block-expected.txt:
- platform/mac/fast/block/positioning/auto/vertical-rl/007-expected.txt:
- platform/mac/fast/block/positioning/vertical-rl/fixed-positioning-expected.txt:
- platform/mac/fast/borders/border-antialiasing-expected.txt:
- platform/mac/fast/clip/001-expected.txt:
- platform/mac/fast/clip/013-expected.txt:
- platform/mac/fast/clip/014-expected.txt:
- platform/mac/fast/clip/016-expected.txt:
- platform/mac/fast/clip/outline-overflowClip-expected.txt:
- platform/mac/fast/css/clip-zooming-expected.txt:
- platform/mac/fast/forms/validation-message-appearance-expected.txt:
- platform/mac/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt:
- platform/mac/fast/line-grid/line-grid-inside-columns-expected.txt:
- platform/mac/fast/line-grid/line-grid-into-columns-expected.txt:
- platform/mac/fast/lists/scrolled-marker-paint-expected.txt:
- platform/mac/fast/multicol/client-rects-expected.txt:
- platform/mac/fast/multicol/column-break-with-balancing-expected.txt:
- platform/mac/fast/multicol/column-rules-expected.txt:
- platform/mac/fast/multicol/column-rules-stacking-expected.txt:
- platform/mac/fast/multicol/columns-shorthand-parsing-expected.txt:
- platform/mac/fast/multicol/float-paginate-complex-expected.txt:
- platform/mac/fast/multicol/float-paginate-empty-lines-expected.txt:
- platform/mac/fast/multicol/float-paginate-expected.txt:
- platform/mac/fast/multicol/layers-in-multicol-expected.txt:
- platform/mac/fast/multicol/layers-split-across-columns-expected.txt:
- platform/mac/fast/multicol/max-height-columns-block-expected.txt:
- platform/mac/fast/multicol/nested-columns-expected.txt:
- platform/mac/fast/multicol/newmulticol/client-rects-expected.txt:
- platform/mac/fast/multicol/overflow-across-columns-expected.txt:
- platform/mac/fast/multicol/overflow-across-columns-percent-height-expected.txt:
- platform/mac/fast/multicol/overflow-unsplittable-expected.txt:
- platform/mac/fast/multicol/paginate-block-replaced-expected.txt:
- platform/mac/fast/multicol/pagination/BottomToTop-bt-expected.txt:
- platform/mac/fast/multicol/pagination/BottomToTop-lr-expected.txt:
- platform/mac/fast/multicol/pagination/BottomToTop-rl-expected.txt:
- platform/mac/fast/multicol/pagination/BottomToTop-tb-expected.txt:
- platform/mac/fast/multicol/pagination/LeftToRight-bt-expected.txt:
- platform/mac/fast/multicol/pagination/LeftToRight-rl-expected.txt:
- platform/mac/fast/multicol/pagination/LeftToRight-tb-expected.txt:
- platform/mac/fast/multicol/pagination/RightToLeft-bt-expected.txt:
- platform/mac/fast/multicol/pagination/RightToLeft-lr-expected.txt:
- platform/mac/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt:
- platform/mac/fast/multicol/pagination/RightToLeft-rl-expected.txt:
- platform/mac/fast/multicol/pagination/RightToLeft-tb-expected.txt:
- platform/mac/fast/multicol/pagination/TopToBottom-bt-expected.txt:
- platform/mac/fast/multicol/pagination/TopToBottom-lr-expected.txt:
- platform/mac/fast/multicol/pagination/TopToBottom-rl-expected.txt:
- platform/mac/fast/multicol/positive-leading-expected.txt:
- platform/mac/fast/multicol/scrolling-column-rules-expected.txt:
- platform/mac/fast/multicol/scrolling-overflow-expected.txt:
- platform/mac/fast/multicol/span/anonymous-style-inheritance-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-child-complex-splitting-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-child-generated-content-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-child-property-removal-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-columns-child-dynamic-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-columns-child-expected.txt:
- platform/mac/fast/multicol/span/span-as-immediate-columns-child-removal-expected.txt:
- platform/mac/fast/multicol/span/span-as-nested-columns-child-dynamic-expected.txt:
- platform/mac/fast/multicol/span/span-as-nested-columns-child-expected.txt:
- platform/mac/fast/multicol/span/span-margin-collapsing-expected.txt:
- platform/mac/fast/multicol/table-vertical-align-expected.txt:
- platform/mac/fast/multicol/tall-image-behavior-expected.txt:
- platform/mac/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt:
- platform/mac/fast/multicol/vertical-lr/column-rules-expected.txt:
- platform/mac/fast/multicol/vertical-lr/float-multicol-expected.txt:
- platform/mac/fast/multicol/vertical-lr/float-paginate-complex-expected.txt:
- platform/mac/fast/multicol/vertical-lr/float-paginate-expected.txt:
- platform/mac/fast/multicol/vertical-lr/nested-columns-expected.txt:
- platform/mac/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt:
- platform/mac/fast/multicol/vertical-rl/column-rules-expected.txt:
- platform/mac/fast/multicol/vertical-rl/float-multicol-expected.txt:
- platform/mac/fast/multicol/vertical-rl/float-paginate-complex-expected.txt:
- platform/mac/fast/multicol/vertical-rl/float-paginate-expected.txt:
- platform/mac/fast/multicol/vertical-rl/nested-columns-expected.txt:
- platform/mac/fast/overflow/clip-rects-fixed-ancestor-expected.txt:
- platform/mac/fast/overflow/float-in-relpositioned-expected.txt:
- platform/mac/fast/overflow/overflow-auto-position-absolute-expected.txt:
- platform/mac/fast/overflow/overflow-rtl-expected.txt:
- platform/mac/fast/overflow/paged-x-div-expected.txt:
- platform/mac/fast/overflow/paged-x-div-with-column-gap-expected.txt:
- platform/mac/fast/overflow/paged-x-on-root-expected.txt:
- platform/mac/fast/overflow/paged-x-with-column-gap-expected.txt:
- platform/mac/fast/overflow/paged-y-div-expected.txt:
- platform/mac/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:
- platform/mac/fast/regions/repaint/region-painting-via-layout-expected.txt:
- platform/mac/fast/repaint/box-shadow-h-expected.txt:
- platform/mac/fast/repaint/box-shadow-v-expected.txt:
- platform/mac/fast/repaint/layer-outline-expected.txt:
- platform/mac/fast/repaint/layer-outline-horizontal-expected.txt:
- platform/mac/fast/table/edge-offsets-expected.txt:
- platform/mac/fast/transforms/overflow-with-transform-expected.txt:
- platform/mac/fast/transforms/rotated-transform-affects-scrolling-1-expected.txt:
- platform/mac/fast/transforms/rotated-transform-affects-scrolling-2-expected.txt:
- platform/mac/fast/writing-mode/Kusa-Makura-background-canvas-expected.txt:
- platform/mac/printing/single-line-must-not-be-split-into-two-pages-expected.txt:
- platform/mac/scrollbars/scrollbars-on-positioned-content-expected.txt:
- platform/mac/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.txt:
- platform/mac/svg/custom/image-rescale-clip-expected.txt:
- svg/overflow/overflow-on-foreignObject-expected.txt:
- 3:16 PM Changeset in webkit [196243] by
-
- 3 edits3 adds in trunk
Source/JavaScriptCore:
Follow up patch to: [ES6] bound functions .name property should be "bound " + the target function's name
https://bugs.webkit.org/show_bug.cgi?id=153796
Reviewed by Darin Adler.
This follow-up patch addresses some comments/suggestions by
Ryosuke, Darin, and Joe. It simplifies JSBoundFunction::toStringName
and adds some tests for bound names.
- runtime/JSBoundFunction.cpp:
(JSC::hasInstanceBoundFunction):
(JSC::JSBoundFunction::create):
(JSC::JSBoundFunction::toStringName):
LayoutTests:
[ES6] bound functions .name property should be "bound " + the target function's name
https://bugs.webkit.org/show_bug.cgi?id=153796
Reviewed by Darin Adler.
- js/bound-function-name-expected.txt: Added.
- js/bound-function-name.html: Added.
- js/script-tests/bound-function-name.js: Added.
(assert):
(assert.foo):
(bar):
- 2:26 PM Changeset in webkit [196242] by
-
- 26 edits6 adds in trunk
CSP: Allow Web Workers initiated from an isolated world to bypass the main world Content Security Policy
https://bugs.webkit.org/show_bug.cgi?id=153622
<rdar://problem/24400023>
Source/WebCore:
Reviewed by Gavin Barraclough.
Fixes an issue where Web Workers initiated from an isolated world (say, a Safari Content Script Extension)
would be subject to the Content Security Policy of the page.
Currently code in an isolated world that does not execute in a Web Worker is exempt from the CSP of
the page. However, code that runs inside a Web Worker that was initiated from an isolated world is
subject to the CSP of the page. Instead, such Web Worker code should also be exempt from the CSP of
the page.
Tests: http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html
- Modules/websockets/WebSocket.cpp:
(WebCore::WebSocket::connect): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.
- bindings/js/ScriptController.cpp:
(WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy): Deleted; moved logic from here...
- bindings/js/ScriptController.h:
- dom/Document.cpp:
(WebCore::Document::shouldBypassMainWorldContentSecurityPolicy): ...to here.
- dom/Document.h:
- dom/ScriptExecutionContext.h:
(WebCore::ScriptExecutionContext::shouldBypassMainWorldContentSecurityPolicy): Added; defaults to false -
do not bypass the main world Content Security Policy.
- page/EventSource.cpp:
(WebCore::EventSource::create): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.
- page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::shouldBypassMainWorldContentSecurityPolicy): Deleted.
- page/csp/ContentSecurityPolicy.h:
- workers/AbstractWorker.cpp:
(WebCore::AbstractWorker::resolveURL): Bypass the main world Content Security Policy if applicable.
Added FIXME comment to enforce the child-src directive of the document's CSP (as opposed to the script-src
directive) on the worker's script URL. Also, scriptExecutionContext()->contentSecurityPolicy() should
always be non-null just as we expect scriptExecutionContext()->securityOrigin() to be non-null. Assert
this invariant to catch cases where a ScriptExecutionContext is not properly initialized.
- workers/DedicatedWorkerGlobalScope.cpp:
(WebCore::DedicatedWorkerGlobalScope::create): Modified to take boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy and only apply the Content Security
Policy headers when shouldBypassMainWorldContentSecurityPolicy is false.
(WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.
- workers/DedicatedWorkerGlobalScope.h:
- workers/DedicatedWorkerThread.cpp:
(WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
(WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.
- workers/DedicatedWorkerThread.h:
- workers/Worker.cpp:
(WebCore::Worker::create): Store whether we should bypass the main world Content Security Policy so
that we can pass it to WorkerMessagingProxy::startWorkerGlobalScope() in Worker::notifyFinished().
We need to store this decision here as opposed to determining it at any later time (say, in Worker::notifyFinished())
because it is dependent on the current JavaScript program stack at the time this function is invoked.
(WebCore::Worker::notifyFinished): Pass whether to bypass the main world Content Security Policy.
- workers/Worker.h:
- workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::WorkerGlobalScope): Modified to take a boolean as to whether to bypass the
main world Content Security Policy and store it in a member field. Also, always instantiate a Content
Security Policy object as our current code assumes that one is always created.
- workers/WorkerGlobalScope.h:
- workers/WorkerGlobalScopeProxy.h:
- workers/WorkerMessagingProxy.cpp:
(WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.
- workers/WorkerMessagingProxy.h:
- workers/WorkerThread.cpp:
(WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Modified to take a boolean argument as to
whether to bypass the main world Content Security Policy and store it in a member field.
(WebCore::WorkerThread::WorkerThread): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.
(WebCore::WorkerThread::workerThread): Ditto.
- workers/WorkerThread.h:
- xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::open): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.
LayoutTests:
Reviewed by Gavin Barraclough and Andy Estes.
Add tests to ensure that a Web Worker initiated from an isolated world can bypass the main world
Content Security Policy.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker-expected.txt: Added.
- http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html: Added.
- 11:25 AM Changeset in webkit [196241] by
-
- 4 edits in trunk
[cmake] Move LLVM detection for LLVMDisassembler to OptionsCommon.cmake
https://bugs.webkit.org/show_bug.cgi?id=153961
Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-07
Reviewed by Michael Catanzaro.
- Source/cmake/OptionsCommon.cmake:
- Source/cmake/OptionsEfl.cmake:
- Source/cmake/OptionsGTK.cmake:
- 11:03 AM Changeset in webkit [196240] by
-
- 4 edits in trunk/Source/JavaScriptCore
String.match should defend against matches that would crash the VM
https://bugs.webkit.org/show_bug.cgi?id=153964
rdar://problem/24301119
Reviewed by Saam Barati.
This fixes a crash in an internal test case.
- runtime/ArgList.cpp:
(JSC::MarkedArgumentBuffer::slowAppend): Use best practices to ensure that the size we
compute makes sense. Crash if it stops making sense, since most users of this API assume
that they are creating something small enough to fit on the stack.
- runtime/ArgList.h:
(JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::size):
(JSC::MarkedArgumentBuffer::operator new): Deleted. These were ineffective. According to the
debugger, we were still calling system malloc. So, I changed the code to use fastMalloc()
directly.
(JSC::MarkedArgumentBuffer::operator delete): Deleted.
- runtime/StringPrototype.cpp:
(JSC::stringProtoFuncMatch): Explicitly defend against absurd sizes. Of course, it's still
possible to crash the VM on OOME. That's sort of always been the philosophy of JSC - we
don't guarantee that you'll get a nice-looking error whenever you run out of memory,
since in a GC'd environment you can't really guarantee those things. But, if you have a
match that obvious won't fit in memory, then reporting an error is useful in case this is
a developer experimenting with a buggy regexp.
- 10:44 AM Changeset in webkit [196239] by
-
- 21 edits in trunk/Source
[Cocoa] Replace has_include guards around inclusion of Apple-internal-SDK headers with USE(APPLE_INTERNAL_SDK)
https://bugs.webkit.org/show_bug.cgi?id=153963
Reviewed by Sam Weinig.
Source/JavaScriptCore:
- inspector/remote/RemoteInspectorXPCConnection.mm:
Source/WebCore:
- accessibility/mac/AXObjectCacheMac.mm:
- crypto/CommonCryptoUtilities.cpp:
- crypto/CommonCryptoUtilities.h:
- editing/mac/TextUndoInsertionMarkupMac.h:
- editing/mac/TextUndoInsertionMarkupMac.mm:
- platform/cocoa/TelephoneNumberDetectorCocoa.cpp:
- platform/graphics/cg/ImageSourceCG.cpp:
- platform/graphics/mac/PDFDocumentImageMac.mm:
- platform/network/ios/NetworkStateNotifierIOS.mm:
- platform/network/mac/BlobDataFileReferenceMac.mm:
- platform/network/mac/ResourceHandleMac.mm:
- rendering/RenderThemeMac.mm:
Source/WebKit/mac:
- WebView/WebPDFView.mm:
Source/WTF:
- wtf/SystemTracing.h:
- wtf/WTFThreadData.h:
- wtf/spi/darwin/CommonCryptoSPI.h:
- 2:09 AM Changeset in webkit [196238] by
-
- 4 edits in trunk
REGRESSION(r195661): [GTK] Scrollbar tests crashing after overlay scrollbar groundwork
https://bugs.webkit.org/show_bug.cgi?id=153695
Reviewed by Michael Catanzaro.
Source/WebCore:
The problem is that ScrollAnimation objects are not destroyed by
the ScrollAnimator destructor, because I forgot to add a virtual
destructor for ScrollAnimation in r195661.
- platform/ScrollAnimation.h:
(WebCore::ScrollAnimation::~ScrollAnimation):
LayoutTests:
- platform/gtk/TestExpectations:
