Timeline

Feb 28, 2016:

11:36 PM Changeset in webkit [197315] by Carlos Garcia Campos

• 9 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197306 - Reduce uses of PassRefPtr in indexeddb
​https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

• Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

• Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

• Modules/indexeddb/IDBKeyData.h:
• Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::IDBKeyRange):
(WebCore::IDBKeyRange::only):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

• Modules/indexeddb/IDBKeyRangeData.h:
• Modules/indexeddb/IDBServerConnection.h:
• Modules/indexeddb/legacy/IDBCallbacks.h:
• Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

• Modules/indexeddb/legacy/IDBCursorBackend.h:
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

• Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

• Modules/indexeddb/legacy/LegacyCursor.h:
• Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

• Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

• Modules/indexeddb/legacy/LegacyRequest.h:
• inspector/InspectorIndexedDBAgent.cpp:

11:36 PM Changeset in webkit [197314] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197246 - Unreviewed. Fix GTK+ clean build.

Add missing header include.

• WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

11:35 PM Changeset in webkit [197313] by Carlos Garcia Campos

• 11 edits
  3 adds in releases/WebKitGTK/webkit-2.12

Merge r197231 - Modern IDB: New database versions are never committed to SQLite.
<rdar://problem/24860952> and ​https://bugs.webkit.org/show_bug.cgi?id=154741

Modern IDB: If a database handle is not open, files are not actually deleted from disk
​https://bugs.webkit.org/show_bug.cgi?id=154756

Reviewed by Alex Christensen.

Source/WebCore:

Tested by API test "IndexedDBPersistence"

• Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually

set the new version on disk.

• Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
(WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.

This is necessary to both read the current database version, and to actually delete the file on disk.

(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently

deleted database info" from the version returned by deleteBackingStore.

• Modules/indexeddb/server/UniqueIDBDatabase.h:

Source/WebKit2:

Add WK2 SPI to force termination of the database process.

• UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _terminateDatabaseProcess]):

• UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess):

• UIProcess/WebProcessPool.h:

Tools:

This also happens to test the previously untested fix for ​http://trac.webkit.org/changeset/197190

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-1.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-2.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence.mm: Added.

(-[IndexedDBNavigationDelegate webView:didFinishNavigation:]):
(-[IndexedDBMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST):

11:35 PM Changeset in webkit [197312] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197190 - Modern IDB: Using existing database info from SQLite backing store is busted.
<rdar://problem/24848143> and ​https://bugs.webkit.org/show_bug.cgi?id=154735

Reviewed by Alex Christensen.

No new tests.

Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
read in the existing IDBDatabaseInfo.

Our automated infrastructure currently has no way of testing this.

• Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::openDatabase):

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on

the IndexRecords table here; *every* time we open a SQLite backing store.

(WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.

• Modules/indexeddb/shared/IDBDatabaseInfo.cpp:

(WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

11:35 PM Changeset in webkit [197311] by Carlos Garcia Campos

• 40 edits
  71 deletes in releases/WebKitGTK/webkit-2.12/Source

Merge r197131 - Remove LegacyIDB.
​https://bugs.webkit.org/show_bug.cgi?id=150854

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (No change in behavior).

• CMakeLists.txt:
• Modules/indexeddb/DOMWindowIndexedDatabase.cpp:

(WebCore::DOMWindowIndexedDatabase::indexedDB):

• Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
• Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
• Modules/indexeddb/IDBFactory.h:
• Modules/indexeddb/IDBIndex.h:
• Modules/indexeddb/IDBIndexMetadata.h: Removed.
• Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
• Modules/indexeddb/IDBOperation.h: Removed.
• Modules/indexeddb/IDBServerConnection.h: Removed.
• Modules/indexeddb/IDBTransaction.h:
• Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:

(WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):

• Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
• Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
• Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
• Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
• Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
• Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
• Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
• Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
• Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
• Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
• Modules/indexeddb/legacy/LegacyAny.h: Removed.
• Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
• Modules/indexeddb/legacy/LegacyCursor.h: Removed.
• Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
• Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
• Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
• Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
• Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
• Modules/indexeddb/legacy/LegacyFactory.h: Removed.
• Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
• Modules/indexeddb/legacy/LegacyIndex.h: Removed.
• Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
• Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
• Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
• Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
• Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
• Modules/indexeddb/legacy/LegacyRequest.h: Removed.
• Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
• Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
• Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
• Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
• Modules/indexeddb/server/SQLiteIDBCursor.cpp:

(WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
(WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
(WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

• Modules/indexeddb/server/SQLiteIDBCursor.h:
• Modules/indexeddb/shared/IDBIndexInfo.h:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/IDBBindingUtilities.cpp:

(WebCore::generateIndexKeysForValue): Deleted.

• bindings/js/IDBBindingUtilities.h:
• bindings/js/JSMainThreadExecState.cpp:

(WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.

• inspector/InspectorIndexedDBAgent.cpp:
• loader/EmptyClients.cpp:
• page/DatabaseProvider.cpp:

(WebCore::DatabaseProvider::idbFactoryBackend): Deleted.

• page/DatabaseProvider.h:
• platform/CrossThreadCopier.cpp:

(WebCore::IDBDatabaseMetadata>::copy): Deleted.
(WebCore::IDBIndexMetadata>::copy): Deleted.
(WebCore::IDBObjectStoreMetadata>::copy): Deleted.

• platform/CrossThreadCopier.h:

Source/WebKit:

• Storage/WebDatabaseProvider.cpp:

(WebDatabaseProvider::createIDBFactoryBackend): Deleted.

• Storage/WebDatabaseProvider.h:

Source/WebKit2:

• CMakeLists.txt:
• DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateLegacyUniqueIDBDatabase): Deleted.
(WebKit::DatabaseProcess::removeLegacyUniqueIDBDatabase): Deleted.

• DatabaseProcess/DatabaseProcess.h:
• DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didClose):
(WebKit::DatabaseToWebProcessConnection::didReceiveMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::establishIDBConnection): Deleted.
(WebKit::DatabaseToWebProcessConnection::removeDatabaseProcessIDBConnection): Deleted.

• DatabaseProcess/DatabaseToWebProcessConnection.h:
• DatabaseProcess/DatabaseToWebProcessConnection.messages.in:
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp: Removed.
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h: Removed.
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.messages.in: Removed.
• DatabaseProcess/IndexedDB/IDBIdentifier.h: Removed.
• DatabaseProcess/IndexedDB/IDBSerialization.cpp: Removed.
• DatabaseProcess/IndexedDB/IDBSerialization.h: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.cpp: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.h: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.cpp: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.h: Removed.
• DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h: Removed.
• DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.h: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.h: Removed.
• DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h: Removed.
• DerivedSources.make:
• Shared/WebCrossThreadCopier.cpp:

(WebCore::LegacyUniqueIDBDatabaseIdentifier>::copy): Deleted.
(WebCore::IDBIdentifier>::copy): Deleted.

• Shared/WebCrossThreadCopier.h:
• WebKit2.xcodeproj/project.pbxproj:
• WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp: Removed.
• WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.h: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.cpp: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.h: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.messages.in: Removed.
• WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::createIDBFactoryBackend): Deleted.

• WebProcess/Databases/WebDatabaseProvider.h:
• WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage): Deleted.
(WebKit::WebToDatabaseProcessConnection::registerWebIDBServerConnection): Deleted.
(WebKit::WebToDatabaseProcessConnection::removeWebIDBServerConnection): Deleted.

• WebProcess/Databases/WebToDatabaseProcessConnection.h:
• WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

11:33 PM Changeset in webkit [197310] by Carlos Garcia Campos

• 10 edits
  1 add
  78 deletes in releases/WebKitGTK/webkit-2.12

Merge r197122 - Modern IDB: WebKit 2 IPC layer.
​https://bugs.webkit.org/show_bug.cgi?id=153808

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by over 1,000 existing tests).

• Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
(WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

Source/WebKit2:

• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad): This ASSERT fires on most WK2 tests. Alex said remove it.

• WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::putOrAdd): Properly encode the overwrite flag.

• WebProcess/Databases/WebDatabaseProvider.h: Enable Modern IDB.

LayoutTests:

• Consolidate all test failures to the platform agnostic TestExpectations file.
• Remove all existing WK2-specific results.
• Add one new WK2-specific result.
• Skip two WK2-only failures.

• TestExpectations:
• platform/mac-wk1/TestExpectations:
• platform/mac-wk2/TestExpectations:
• platform/wk2/TestExpectations:
• platform/wk2/imported/w3c/indexeddb/abort-in-initial-upgradeneeded-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor-advance-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index9-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_objectstore5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index6-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index8-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_invalid-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_objectstore6-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_delete_index4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_delete_objectstore4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbdatabase_close2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbdatabase_deleteObjectStore4-not_reused-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbfactory_deleteDatabase3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbfactory_open12-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex-multientry-big-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_get3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_get7-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_getKey7-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_openCursor2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_openKeyCursor3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_add4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex4-deleteIndex-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex6-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex7-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_put4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbtransaction_abort-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbversionchangeevent-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-constrainterror-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-overflow-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/transaction-requestqueue-expected.txt: Removed.
• platform/wk2/storage/indexeddb/aborted-versionchange-closes-expected.txt: Removed.
• platform/wk2/storage/indexeddb/bad-keypath-expected.txt: Removed.
• platform/wk2/storage/indexeddb/basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/clear-expected.txt: Removed.
• platform/wk2/storage/indexeddb/create-and-remove-object-store-expected.txt: Removed.
• platform/wk2/storage/indexeddb/create-objectstore-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-continue-dir-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-continue-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-finished-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursors-expected.txt: Removed.
• platform/wk2/storage/indexeddb/database-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/deleteIndex-bug110792-expected.txt: Removed.
• platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Added.
• platform/wk2/storage/indexeddb/index-count-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-abort-in-initial-upgradeneeded-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-close-in-oncomplete-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-close-in-upgradeneeded-expected.txt: Removed.
• platform/wk2/storage/indexeddb/invalid-keys-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-delete-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-inline-and-passed-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-put-no-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-put-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-type-array-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keypath-arrays-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keypath-edges-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keyrange-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/bad-keypath-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/clear-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/create-objectstore-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/cursors-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-delete-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-inline-and-passed-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-put-no-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-put-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/readonly-transactions-expected.txt: Removed.
• platform/wk2/storage/indexeddb/object-lookups-in-versionchange-expected.txt: Removed.
• platform/wk2/storage/indexeddb/objectstore-count-expected.txt: Removed.
• platform/wk2/storage/indexeddb/open-cursor-expected.txt: Removed.
• platform/wk2/storage/indexeddb/readonly-transactions-expected.txt: Removed.
• platform/wk2/storage/indexeddb/request-result-cache-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-abort-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-active-flag-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-after-close-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-read-only-expected.txt: Removed.
• platform/wk2/storage/indexeddb/version-change-exclusive-expected.txt: Removed.

10:57 PM Changeset in webkit [197309] by Carlos Garcia Campos

• 22 edits
  1 copy
  1 add in releases/WebKitGTK/webkit-2.12

Merge r197118 - CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
​https://bugs.webkit.org/show_bug.cgi?id=154522
<rdar://problem/24762078>

Reviewed by Brent Fulgham.

Source/WebCore:

Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
of the Content Security Policy Level 3 spec., <​https://w3c.github.io/webappsec-csp/> (24 February 2016).
Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
of whether ENABLE(CSP_NEXT) is enabled.

Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

• WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
• dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
• dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
to support attributes statusCode and columnNumebr.

• dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
and send a violation report (if applicable).

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served
document per section Reporting of the Content Security Policy 2.0 spec, <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.
Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.

• TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

so that we run them.

• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
building with ENABLE(CSP_NEXT) disabled.

• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
• js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
• platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.

9:26 PM Changeset in webkit [197308] by akling@apple.com

• 7 edits in trunk/Source/JavaScriptCore

Make JSFunction.name allocation fully lazy.
<​https://webkit.org/b/154806>

Reviewed by Saam Barati.

We were reifying the "name" field on functions lazily, but created the string
value itself up front. This patch gets rid of the up-front allocation,
saving us a JSString allocation per function in most cases.

• builtins/BuiltinExecutables.cpp:

(JSC::createExecutableInternal):

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::visitChildren):

• bytecode/UnlinkedFunctionExecutable.h:
• runtime/CodeCache.cpp:

(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

• runtime/Executable.h:
• runtime/JSFunction.cpp:

(JSC::JSFunction::reifyName):

8:36 PM Changeset in webkit [197307] by Chris Dumez

• 4 edits in trunk

Parse HTMLOLElement.start as per the HTML spec
​https://bugs.webkit.org/show_bug.cgi?id=154802

Reviewed by Andreas Kling.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-grouping-expected.txt:

Source/WebCore:

Parse HTMLOLElement.start as per the HTML spec:

• ​https://html.spec.whatwg.org/multipage/semantics.html#dom-ol-start
• ​https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-integers

No new tests, already covered by existing test.

• html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

5:57 PM Changeset in webkit [197306] by Gyuyoung Kim

• 9 edits in trunk/Source/WebCore

Reduce uses of PassRefPtr in indexeddb
​https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

• Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

• Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

• Modules/indexeddb/IDBKeyData.h:
• Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::IDBKeyRange):
(WebCore::IDBKeyRange::only):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

• Modules/indexeddb/IDBKeyRangeData.h:
• Modules/indexeddb/IDBServerConnection.h:
• Modules/indexeddb/legacy/IDBCallbacks.h:
• Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

• Modules/indexeddb/legacy/IDBCursorBackend.h:
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

• Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

• Modules/indexeddb/legacy/LegacyCursor.h:
• Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

• Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

• Modules/indexeddb/legacy/LegacyRequest.h:
• inspector/InspectorIndexedDBAgent.cpp:

5:44 PM Changeset in webkit [197305] by akling@apple.com

• 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r197303): 4 jsc tests failing on bots.

Unreviewed follow-up fix.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
can still get called with !m_rareData, in case the type profiler is active but this
particular code block doesn't have type profiler data. Handle it gracefully.

4:32 PM Changeset in webkit [197304] by weinig@apple.com

• 24 edits
  1 add
  1 delete in trunk

Reimplement WKPageGroup in terms of WKUserContentController
​https://bugs.webkit.org/show_bug.cgi?id=154804

Reviewed by Dan Bernstein.

Source/WebKit2:

Instead of having both WebPageGroup and WebUserContentControllerProxy both keep track
of user scripts and user stylesheets, give WebPageGroup a WebUserContentControllerProxy
and let it take care of things. This allows us to remove a ton of duplicate code, and
provides a convenient way for clients currently using PageGroup based user content insertion
to start using UserContentController, since they can now be used at the same time.

When using WKPageConfigurationRef, the rule is:

• If you don't set a WKUserContentControllerRef, the one from the WKPageGroupRef will be used.
• If you do set a WKUserContentControllerRef, it will be used, and the one from the WKPageGroupRef will do nothing for that web view.

• DerivedSources.make:

Remove WebPageGroupProxy. It no longer is a MessageReceiver.

• Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::encode):
(WebKit::WebPageGroupData::decode):

• Shared/WebPageGroupData.h:

Stop encoding/decoding user content, instead just encode the identifier to the UserContentController.

• UIProcess/API/C/WKPageGroup.cpp:

(WKPageGroupGetUserContentController):

• UIProcess/API/C/WKPageGroup.h:

Add getter for the underlying WKUserContentControllerRef.

• UIProcess/API/cpp/WKRetainPtr.h:

(WebKit::retainWK):
Add retainWK() helper to match RetainPtr's retainPtr() helper.

• UIProcess/WebPageGroup.cpp:

(WebKit::WebPageGroup::WebPageGroup):
(WebKit::WebPageGroup::userContentController):
(WebKit::WebPageGroup::addUserStyleSheet):
(WebKit::WebPageGroup::addUserScript):
(WebKit::WebPageGroup::removeAllUserStyleSheets):
(WebKit::WebPageGroup::removeAllUserScripts):
(WebKit::WebPageGroup::removeAllUserContent):
(WebKit::WebPageGroup::addUserContentExtension):
(WebKit::WebPageGroup::removeUserContentExtension):
(WebKit::WebPageGroup::removeAllUserContentExtensions):

• UIProcess/WebPageGroup.h:

Pass through to the WebUserContentControllerProxy.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::WebPageProxy):
(WebKit::WebPageProxy::finishInitializingWebPageAfterProcessLaunch):
(WebKit::WebPageProxy::creationParameters):

• UIProcess/WebPageProxy.h:

WebPageProxies always have a WebUserContentControllerProxy now, so it can go in a Ref and
a few branches can be removed.

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::createWebPage):
If a UserContentController is not passed in, use the one from the PageGroup.

• WebKit2.xcodeproj/project.pbxproj:

Remove files.

• WebProcess/InjectedBundle/InjectedBundle.cpp:

Add some #includes that are now needed.

• WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::getOrCreate):

• WebProcess/UserContent/WebUserContentController.h:

Modernize WebUserContentController::getOrCreate to return a Ref.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage):
(WebKit::m_shouldDispatchFakeMouseMoveEvents):
(WebKit::WebPage::addUserScript):
(WebKit::WebPage::addUserStyleSheet):
(WebKit::WebPage::removeAllUserContent):

• WebProcess/WebPage/WebPage.h:

Store the WebUserContentController in Ref, remove unnecessary branches/asserts.

• WebProcess/WebPage/WebPageGroupProxy.cpp:

(WebKit::WebPageGroupProxy::WebPageGroupProxy):
(WebKit::WebPageGroupProxy::~WebPageGroupProxy):
(WebKit::WebPageGroupProxy::userContentController):
(WebKit::WebPageGroupProxy::addUserStyleSheet): Deleted.
(WebKit::WebPageGroupProxy::addUserScript): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserStyleSheets): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserScripts): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContent): Deleted.
(WebKit::WebPageGroupProxy::addUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContentExtensions): Deleted.

• WebProcess/WebPage/WebPageGroupProxy.h:

Store a WebUserContentController in a Ref, remove now unnecessary message handling functions.

• WebProcess/WebPage/WebPageGroupProxy.messages.in:

Removed.

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::didReceiveMessage):
Remove routing to WebPageGroupProxy, which is no longer a MessageReceiver.

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2/PageGroup.cpp: Added.

2:21 PM Changeset in webkit [197303] by akling@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Shrink UnlinkedCodeBlock a bit.
<​https://webkit.org/b/154797>

Reviewed by Anders Carlsson.

Move profiler-related members of UnlinkedCodeBlock into its RareData
structure, saving 40 bytes, and then reorder the other members of
UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.

The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::vm):
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::addRegExp):
(JSC::UnlinkedCodeBlock::addConstant):
(JSC::UnlinkedCodeBlock::addFunctionDecl):
(JSC::UnlinkedCodeBlock::addFunctionExpr):
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
(JSC::UnlinkedCodeBlock::vm): Deleted.

1:56 PM Changeset in webkit [197302] by weinig@apple.com

• 17 edits in trunk

Source/WebKit2:
Bind _WKUserStyleSheets to _WKUserContentWorlds to allow for grouping of user content by associating to a world
​https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

Treat _WKUserStyleSheets like WKUserScripts and allow them to be bound to a _WKUserContentWorld.
The immediate benefit of this is allowing a client to bind a set of user content (scripts and stylesheets
for now) to a world and have them easily remove all user content associated with that world easily.

• Shared/API/APIArray.h:

Add helpers removeAllMatching and removeAllOfTypeMatching.

• UIProcess/API/APIUserStyleSheet.h:

Add API::UserContentWorld member.

• UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _removeAllUserScriptsAssociatedWithUserContentWorld:]):
(-[WKUserContentController _removeAllUserStyleSheetsAssociatedWithUserContentWorld:]):

• UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:

Add _removeAllUserScriptsAssociatedWithUserContentWorld and _removeAllUserStyleSheetsAssociatedWithUserContentWorld.

• UIProcess/API/Cocoa/WKUserScript.mm:

(-[WKUserScript _initWithSource:injectionTime:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
(toStringVector): Deleted.

• UIProcess/API/Cocoa/_WKUserContentWorldInternal.h:

(API::toStringVector):
Move toStringVector to a location where it can be shared.

• UIProcess/API/Cocoa/_WKUserStyleSheet.h:
• UIProcess/API/Cocoa/_WKUserStyleSheet.mm:

(-[_WKUserStyleSheet initWithSource:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
Add new initializer which has a world to be bound to. While here, match WKUserScript and add support for the
legacy whitelist and blacklists.

• UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::removeProcess):
(WebKit::WebUserContentControllerProxy::addUserContentWorldUse):
(WebKit::WebUserContentControllerProxy::shouldSendRemoveUserContentWorldsMessage):
(WebKit::WebUserContentControllerProxy::removeUserContentWorldUses):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):

• UIProcess/UserContent/WebUserContentControllerProxy.h:

Refactor to share the code which decides whether to send AddUserContentWorlds/RemoveUserContentWorlds
messages.

• WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::addUserContentWorlds):
(WebKit::WebUserContentController::removeUserContentWorlds):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):
(WebKit::WebUserContentController::addUserStyleSheets):
(WebKit::WebUserContentController::removeUserStyleSheet):
(WebKit::WebUserContentController::removeAllUserStyleSheets):

• WebProcess/UserContent/WebUserContentController.h:
• WebProcess/UserContent/WebUserContentController.messages.in:

Add support for binding stylesheets to worlds and allow removing all the scripts/stylesheets from a
set of worlds at once by passing Vectors of world identifiers in the remove messages.

Tools:
Bind _WKUserStyleSheets to WKUserContentWorlds to allow for grouping of user content by associating to a world
​https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

• TestWebKitAPI/Tests/WebKit2Cocoa/UserContentController.mm:

Add tests for removing _WKUserStyleSheets and WKUserScripts

1:00 PM Changeset in webkit [197301] by timothy_horton@apple.com

• 5 edits in trunk

Switch to application/vnd.apple.folder for <attachment> folder special-case
​https://bugs.webkit.org/show_bug.cgi?id=154786
<rdar://problem/24416632>

Reviewed by Anders Carlsson.

Source/WebCore:

No new tests, adjusted an existing test to cover this.

• rendering/RenderThemeMac.mm:

(WebCore::iconForAttachment):
Add a second folder MIME type.

LayoutTests:

• fast/attachment/attachment-folder-icon-expected.html:
• fast/attachment/attachment-folder-icon.html:

12:42 PM Changeset in webkit [197300] by timothy_horton@apple.com

• 3 edits
  2 adds in trunk

Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
​https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.

LayoutTests:

• fast/css/variables/avoid-matched-property-cache-expected.html: Added.
• fast/css/variables/avoid-matched-property-cache.html: Added.

Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.

12:34 PM Changeset in webkit [197299] by fpizlo@apple.com

• 10 edits in trunk/Source/JavaScriptCore

FTL should lower its abstract heaps to B3 heap ranges
​https://bugs.webkit.org/show_bug.cgi?id=154782

Reviewed by Saam Barati.

The FTL can describe the abstract heaps (points-to sets) that a memory operation will
affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
notion - the HeapRange. That's what this patch fixes.

B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
affects by specifying a heap range: a begin...end pair that says that the operation
affects all abstract heaps H such that begin <= H < end.

This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:

• A heap's end is greater than its begin.
• A heap's begin is greater than or equal to its parent's begin.
• A heap's end is less than or equal to its parent's end.

This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
went for the iterative traversal, which is a splendid algorithm, but it's totally
unnecessary here since we tightly control the height of the heap hierarchy.

Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
generate new ones for field names and constant indices we encounter, we can't actually
decorate the B3 instructions we create in lowering until all lowering is done. Adding a
new abstract heap to the hierarchy after ranges were already computed would require
updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
patch solves that problem by recording the associations between abstract heaps and their
intended roles in the generated IR, and then decorating all of the relevant B3 values
after we compute the ranges of the hierarchy after lowering.

This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
speed-up on any benchmark. That's not too surprising. We already have very precise CSE
in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
already been getting the big ones even without alias analysis.

Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.

• b3/B3HeapRange.h:

(JSC::B3::HeapRange::HeapRange):

• ftl/FTLAbstractHeap.cpp:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::changeParent):
(JSC::FTL::AbstractHeap::compute):
(JSC::FTL::AbstractHeap::shallowDump):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractHeap::deepDump):
(JSC::FTL::AbstractHeap::badRangeError):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::atSlow):
(JSC::FTL::IndexedAbstractHeap::initialize):
(JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
(JSC::FTL::AbstractField::dump): Deleted.

• ftl/FTLAbstractHeap.h:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::isInitialized):
(JSC::FTL::AbstractHeap::initialize):
(JSC::FTL::AbstractHeap::parent):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::AbstractHeap::range):
(JSC::FTL::AbstractHeap::offset):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::IndexedAbstractHeap::at):
(JSC::FTL::IndexedAbstractHeap::operator[]):
(JSC::FTL::IndexedAbstractHeap::returnInitialized):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
(JSC::FTL::AbstractHeap::changeParent): Deleted.
(JSC::FTL::AbstractField::AbstractField): Deleted.
(JSC::FTL::AbstractField::initialize): Deleted.
(JSC::FTL::AbstractField::offset): Deleted.

• ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::decorateMemory):
(JSC::FTL::AbstractHeapRepository::decorateCCallRead):
(JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
(JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):

• ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

• ftl/FTLOutput.cpp:

(JSC::FTL::Output::load):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::store):
(JSC::FTL::Output::store32As8):
(JSC::FTL::Output::store32As16):
(JSC::FTL::Output::baseIndex):

• ftl/FTLOutput.h:

(JSC::FTL::Output::address):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::load32):
(JSC::FTL::Output::load64):
(JSC::FTL::Output::loadPtr):
(JSC::FTL::Output::loadDouble):
(JSC::FTL::Output::store32):
(JSC::FTL::Output::store64):
(JSC::FTL::Output::storePtr):
(JSC::FTL::Output::storeDouble):
(JSC::FTL::Output::ascribeRange):
(JSC::FTL::Output::nonNegative32):
(JSC::FTL::Output::load32NonNegative):
(JSC::FTL::Output::equal):
(JSC::FTL::Output::notEqual):

• ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):

12:12 PM Changeset in webkit [197298] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
​https://bugs.webkit.org/show_bug.cgi?id=154794

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

No new tests needed.

• svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.

12:11 PM Changeset in webkit [197297] by commit-queue@webkit.org

• 2 edits in trunk

[cmake] Allow using FindGLIB in case glib is optional dependency.
​https://bugs.webkit.org/show_bug.cgi?id=154796

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

FindGLIB caused internal CMake error in case GLIBCONFIG_INCLUDE_DIR is
not defined.

• Source/cmake/FindGLIB.cmake:

11:14 AM Changeset in webkit [197296] by gskachkov@gmail.com

• 18 edits
  10 adds in trunk

[ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function. ​https://bugs.webkit.org/show_bug.cgi?id=153981

Small improvements

10:40 AM Changeset in webkit [197295] by sbarati@apple.com

• 7 edits in trunk/Source/JavaScriptCore

ProxyObject.GetOwnProperty is partially broken because it doesn't propagate information back to the slot
​https://bugs.webkit.org/show_bug.cgi?id=154768

Reviewed by Ryosuke Niwa.

This fixes a big bug with ProxyObject.GetOwnProperty:
​http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
We weren't correctly propagating the result of this operation to the
out PropertySlot& parameter. This patch fixes that and adds tests.

• runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetOwnPropertyDescriptor):
I added a missing exception check after object allocation
because I saw that it was missing while reading the code.

• runtime/PropertyDescriptor.cpp:

(JSC::PropertyDescriptor::setUndefined):
(JSC::PropertyDescriptor::slowGetterSetter):
(JSC::PropertyDescriptor::getter):

• runtime/PropertyDescriptor.h:

(JSC::PropertyDescriptor::attributes):
(JSC::PropertyDescriptor::value):

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):

• tests/es6.yaml:
• tests/stress/proxy-get-own-property.js:

(let.handler.getOwnPropertyDescriptor):
(set get let.handler.return):
(set get let.handler.getOwnPropertyDescriptor):
(set get let):
(set get let.a):
(let.b):
(let.setter):
(let.getter):

6:57 AM Changeset in webkit [197294] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r179776 - ASSERT repaintContainer->hasLayer() in WebCore::RenderObject::repaintUsingContainer
​https://bugs.webkit.org/show_bug.cgi?id=140750

Reviewed by Simon Fraser.

There's a short period of time when RenderObject::layer() still returns a valid pointer
even though we already cleared the hasLayer() flag.
Do not use the layer as repaint container in such cases.

Source/WebCore:

Test: compositing/repaint-container-assertion-when-toggling-compositing.html

• rendering/RenderObject.cpp:

(WebCore::RenderObject::enclosingLayer):

LayoutTests:

• compositing/repaint-container-assertion-when-toggling-compositing-expected.txt: Added.
• compositing/repaint-container-assertion-when-toggling-compositing.html: Added.

6:56 AM Changeset in webkit [197293] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r178363 - Element::normalizeAttributes() needs to handle arbitrary JS executing between loop iterations.
<​https://webkit.org/b/140379>
<rdar://problem/19446901>

Reviewed by Benjamin Poulain.

Source/WebCore:

Since DOM mutation events may arise below the call to Node::normalize(),
have the loop in Element::normalizeAttributes() make a copy of the Attr nodes
beforehand, to guard against mutations.

Based on a patch by Chris "Chris Dumez" Dumez.

Test: fast/dom/Element/normalize-crash2.html

• dom/Element.cpp:

(WebCore::Element::normalizeAttributes):

LayoutTests:

• fast/dom/Element/normalize-crash2-expected.txt: Added.
• fast/dom/Element/normalize-crash2.html: Added.

6:46 AM Changeset in webkit [197292] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r178311 - Out of bounds read in IdentifierArena::makeIdentifier
​https://bugs.webkit.org/show_bug.cgi?id=140376

Patch by Alexey Proskuryakov.

Reviewed and ChangeLogged by Geoffrey Garen.

No test, since this is a small past-the-end read, which is very
difficult to turn into a reproducible failing test -- and existing tests
crash reliably using ASan.

• parser/ParserArena.h:

(JSC::IdentifierArena::makeIdentifier):
(JSC::IdentifierArena::makeIdentifierLCharFromUChar): Check for a
zero-length string input, like we do in the literal parser, since it is
not valid to dereference characters in a zero-length string.

A zero-length string is allowed in JavaScript -- for example, "".

6:34 AM Changeset in webkit [197291] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r179750 - REGRESSION(r179706): Caused memory corruption on some tests (Requested by _ap_ on #webkit).
​https://bugs.webkit.org/show_bug.cgi?id=141324

Reviewed by Alexey Proskuryakov.

No new tests. This is caught by existing tests under ASAN, and I don't know how to reproduce
it without ASAN.

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Give up
and just always invalidate the next line. It's too hard to come up
with the condition that catches all needed cases, doesn't itself
cause a crash, and isn't overzealous. And we do this for the
previous line anyway. Also clean up the code a bit since it
confusingly reuses a variable, and declares it uninitialized, for
no good reason.

6:34 AM Changeset in webkit [197290] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r179706 - Crash due to failing to dirty a removed text node's line box
​https://bugs.webkit.org/show_bug.cgi?id=136544

Reviewed by David Hyatt.
Source/WebCore:

Test: fast/text/remove-text-node-linebox-not-dirty-crash.html

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.

LayoutTests:

• fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt: Added.
• fast/text/remove-text-node-linebox-not-dirty-crash.html: Added.

6:23 AM Changeset in webkit [197289] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4

Merge r180128 - Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
​https://bugs.webkit.org/show_bug.cgi?id=141552.

Reviewed by Darin Adler.

Source/WebCore:

Tests: LayoutTests/svg/dom/SVGLengthList-basics.xhtml: This test is modified to
include a new test case.

• svg/properties/SVGListPropertyTearOff.h: Commit the removal of the replacing item

before trying to detach the wrapper of the item which going to be replaced.

LayoutTests:

• svg/dom/SVGLengthList-basics-expected.txt:
• svg/dom/SVGLengthList-basics.xhtml: Add a new test case to this test. Have a

reference to an SVGLength in an SVGLengthList and then replace this SVGLength
with another one which comes before it in the SVGLengthList.

6:01 AM Changeset in webkit [197288] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4

Merge r182284 - Clean up access checks in JSHistoryCustom.cpp
​https://bugs.webkit.org/show_bug.cgi?id=143227

Reviewed by Sam Weinig.

Source/WebCore:

• bindings/js/JSHistoryCustom.cpp:

(WebCore::JSHistory::putDelegate):
(WebCore::JSHistory::deleteProperty):
(WebCore::JSHistory::deletePropertyByIndex):
(WebCore::JSHistory::getOwnPropertyNames):
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):

LayoutTests:

• http/tests/security/cross-frame-access-call-expected.txt:
• http/tests/security/cross-frame-access-call.html:

6:00 AM Changeset in webkit [197287] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r173046 - Scrollbar corner can be drawn outside containing frame
​https://bugs.webkit.org/show_bug.cgi?id=133131
<rdar://problem/16382769>

Reviewed by Simon Fraser.

Source/WebCore:

Merged from Blink (patch by Levi Weintraub):
<​https://src.chromium.org/viewvc/blink?revision=170625&view=revision>

Fixes an issue where the scroll corner may be painted outside the rectangle of
its associated frame by setting a clip rectangle before painting the scroll bar(s)
and scroll corner.

Test: scrollbars/custom-scrollbars-paint-outside-iframe.html

• platform/ScrollView.cpp:

(WebCore::ScrollView::paint):

LayoutTests:

Add DRT test that was derived from the test included in
<​https://src.chromium.org/viewvc/blink?revision=170625&view=revision>.

• scrollbars/custom-scrollbars-paint-outside-iframe-expected.html: Added.
• scrollbars/custom-scrollbars-paint-outside-iframe.html: Added.

5:50 AM Changeset in webkit [197286] by Carlos Garcia Campos

• 5 edits
  12 adds in releases/WebKitGTK/webkit-2.4

Merge r186663 - Fetching Content Security Policy report URL should respect same origin policy
​https://bugs.webkit.org/show_bug.cgi?id=146754
<rdar://problem/18860259>

Reviewed by Brady Eidson.

Inspired by Blink r149791 (by Mike West <​mkwst@chromium.org>):
<​https://src.chromium.org/viewvc/blink?revision=149791&view=revision>

Source/WebCore:

As per <​http://www.w3.org/TR/2015/CR-CSP2-20150219/#send-violation-reports>, fetching the
Content Security Policy report URL should include cookies if and only if the origin of
the protected resource is equal to the origin of the report URL.

Tests: http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html

• loader/PingLoader.cpp:

(WebCore::PingLoader::sendViolationReport):

LayoutTests:

Added additional tests for private browsing mode.

• http/tests/cookies/resources/setCookies.cgi:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html: Added.
• http/tests/security/contentSecurityPolicy/resources/save-report.php:
• platform/wk2/TestExpectations: Skip private browsing mode tests in WebKit2 until we fix <​https://bugs.webkit.org/show_bug.cgi?id=115274>.

5:44 AM Changeset in webkit [197285] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r186666 - Plugin create can end up destroying its renderer.
​https://bugs.webkit.org/show_bug.cgi?id=146824
rdar://problem/18921429

Reviewed by Andreas Kling.

Plugins can run arbitrary code during initialization. If the plugin
happens to destroy the associated node, its renderer becomes invalid.
This patch checks whether the renderer survived the createPlugin() call.
(This WeakPtr pattern is also used in RenderWidget to avoid dangling pointers.)

Speculative fix. Not reproducible.

• loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::loadPlugin):

5:42 AM Changeset in webkit [197284] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r188014 - Crash when removing children of a MathMLSelectElement
​https://bugs.webkit.org/show_bug.cgi?id=147704
<rdar://problem/21940321>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When MathMLSelectElement::childrenChanged() is called after its
children have been removed, MathMLSelectElement calls
updateSelectedChild() which accesses m_selectedChild. However,
in this case, m_selectedChild is the previously selected child
and it may be destroyed as this point if it was removed. To avoid
this problem, MathMLSelectElement now keep a strong ref to the
currently selected element.

Test: mathml/maction-removeChild.html

• mathml/MathMLSelectElement.h:

LayoutTests:

Add layout test that reproduces the crash under guardmalloc.

• mathml/maction-removeChild-expected.txt: Added.
• mathml/maction-removeChild.html: Added.

5:29 AM Changeset in webkit [197283] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r184965 - Crash under ICU with ASAN during editing/selection/move-by-word-visually-crash-test-5.html
​https://bugs.webkit.org/show_bug.cgi?id=145429
<rdar://problem/20992218>

Reviewed by Alexey Proskuryakov.

WebKit uses some strings which contain the lower 8-bits of UTF-16 (thereby saving space). However,
ICU doesn't understand this encoding. When we want to use ICU functions with strings in this encoding,
we create a UTextProvider which converts our encoded strings to UTF-16 for ICU, one chunk at a time.
This object contains a vtable which we populate to perform the conversion.

The WebKit function which actually returns the UTF-16 chunks has two relevant arguments: an index into
the encoded string which ICU is requesting, and a direction from that index which ICU is interested
in. This function populates a "chunk" which is characterized by a pointer to a buffer, the length of
the populated data in the buffer, and an offset into the chunk which represents the index that the
requested character was put into.

When ICU requests data going backward, we fill in the chunk accordingly, with the requested character
all the way at the end. We then set the offset equal to the length of the buffer. However, this length
value is stale from the previous time the function ran. Therefore, ICU was reading the wrong index in
the chunk when expecting the requested character.

Covered by editing/selection/move-by-word-visually-crash-test-5.html.

• platform/text/icu/UTextProviderLatin1.cpp:

(WebCore::uTextLatin1Access):

5:27 AM Changeset in webkit [197282] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r185003 - WebSQL default functions can bypass authorizer.
<rdar://problem/21048994> and ​https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Sam Weinig and Alexey Proskuryakov.

No new tests yet.

• platform/sql/SQLiteDatabase.cpp:

(WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions.
(WebCore::SQLiteDatabase::open):
(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that

take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted.

• platform/sql/SQLiteDatabase.h:

Review feedback followup for r185003.
​https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Darin Adler.

• platform/sql/SQLiteDatabase.cpp:

(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): static const one thing, c++-style cast another.

5:23 AM Changeset in webkit [197281] by Carlos Garcia Campos

• 6 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r185392 - feComposite filter does not clip the paint rect to its effect rect when the operator is 'in' or 'atop'
​https://bugs.webkit.org/show_bug.cgi?id=137856

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2015-06-09
Reviewed by Darin Adler.

Source/WebCore:

There was bug in calculating the absolutePaintRect of the feComposite filter
when the operator is equal to 'in' or 'atop'. The absolutePaintRect was set
to the absolutePaintRect of the background FilterEffect which is correct.
What was missing is clipping this rectangle to the maxEffectRect of the
filter which we do for other operators.

Tests: svg/filters/feComposite-background-rect-control-operators.svg

• platform/graphics/IntRect.h:

(WebCore::operator-=):
(WebCore::operator-): Add new operators to IntRect.

• platform/graphics/filters/FEComposite.cpp:

(WebCore::FEComposite::determineAbsolutePaintRect): Make sure the filter
absolutePaintRect is clipped to maxEffectRect for all operators.

(WebCore::FEComposite::platformApplySoftware): Code clean-up.

• platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::determineAbsolutePaintRect): Move the clipping
part to a separate function.

(WebCore::FilterEffect::clipAbsolutePaintRect): Clip the absolutePaintRect
to the maxEffectRect of the filter.

• platform/graphics/filters/FilterEffect.h:

LayoutTests:

• svg/filters/feComposite-background-rect-control-operators-expected.svg: Added.
• svg/filters/feComposite-background-rect-control-operators.svg: Added.

Ensure the painting rect of the feComposite filter with operator 'in' or
'atop' is clipped to its bounding rectangle

4:47 AM Changeset in webkit [197280] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r185572 - RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
​https://bugs.webkit.org/show_bug.cgi?id=145988
rdar://problem/20959137

Reviewed by David Hyatt.

This patch ensures that we find the right first inline box so that we can dirty the
the appropriate line boxes.
With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.

Source/WebCore:

Test: fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html

• rendering/RenderInline.cpp:

(WebCore::RenderInline::culledInlineFirstLineBox):
(WebCore::RenderInline::culledInlineLastLineBox):

• rendering/RootInlineBox.cpp:

(WebCore::RootInlineBox::setLineBreakInfo): Deleted. Remove misleading assert and comment.

LayoutTests:

• fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt: Added.
• fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html: Added.

4:34 AM Changeset in webkit [197279] by Carlos Garcia Campos

• 8 edits
  8 adds in releases/WebKitGTK/webkit-2.4

Merge r185769 - Various assertion failures occur when executing script in the midst of DOM insertion
​https://bugs.webkit.org/show_bug.cgi?id=132482

Reviewed by Darin Adler.

Source/WebCore:

Prior to this change, when an element containing a <script> child was inserted into a document, the script was
executed in ScriptElement::insertedInto(). That script can access nodes that follow it in the newly-inserted
hierarchy but are not yet fully inserted, leading to at least the following problems:

• The script could remove a node that is not yet marked as in the document.
• The script could remove a named <map> that has yet to be added to TreeScope::m_imageMapsByName.
• The script could remove a form control that has yet to be added to FormController::m_formElementsWithState.

These scenarios all result in assertion failures. This change ensures that each node in the newly-inserted
hierarchy is fully inserted before executing any scripts.

Tests: fast/dom/element-removed-while-inserting-parent-crash.html

fast/dom/named-map-removed-while-inserting-parent-crash.html
fast/forms/form-control-removed-while-inserting-parent-crash.html
svg/dom/element-removed-while-inserting-parent-crash.html

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::shouldNotifySubtreeInsertions): Renamed from insertedInto().
Returned true in the case where insertedInto() would've called prepareScript().
(WebCore::ScriptElement::didNotifySubtreeInsertions): Called prepareScript().
(WebCore::ScriptElement::insertedInto): Renamed to shouldNotifySubtreeInsertions().

• dom/ScriptElement.h:
• html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::insertedInto): If shouldNotifySubtreeInsertions() is true, returned InsertionShouldCallDidNotifySubtreeInsertions.
Otherwise, returned InsertionDone.
(WebCore::HTMLScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

• html/HTMLScriptElement.h:
• svg/SVGScriptElement.cpp:

(WebCore::SVGScriptElement::insertedInto): Did the same as HTMLScriptElement::insertedInto().
(WebCore::SVGScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

• svg/SVGScriptElement.h:

LayoutTests:

Wrote named-map-removed-while-inserting-parent-crash.html by reducing the test case attached to bug 132482.
The remaining tests were taken from blink r132482.

• fast/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/dom/element-removed-while-inserting-parent-crash.html: Added.
• fast/dom/named-map-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/dom/named-map-removed-while-inserting-parent-crash.html: Added.
• fast/forms/form-control-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/forms/form-control-removed-while-inserting-parent-crash.html: Added.
• svg/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
• svg/dom/element-removed-while-inserting-parent-crash.html: Added.

3:55 AM Changeset in webkit [197278] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r182918 - Media element can manipulate DOM during Document destruction.
rdar://problem/20553898 and ​https://bugs.webkit.org/show_bug.cgi?id=143780

Patch by Brady Eidson <​beidson@apple.com> on 2015-04-16
Reviewed by Jer Noble.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::configureMediaControls): Bail if the element has no active document.

3:48 AM Changeset in webkit [197277] by Carlos Garcia Campos

• 3 edits
  3 adds in releases/WebKitGTK/webkit-2.4

Merge r183275 - Made Object.prototype.proto native getter and setter check that this object not null or undefined
​https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):

LayoutTests:
Added tests to ensure that Object.prototype.proto native getter and setter do not coerce undefined to this
​https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

• js/script-tests/sloppy-getter-setter-global-object.js: Added.
• js/sloppy-getter-setter-global-object-expected.txt: Added.
• js/sloppy-getter-setter-global-object.html: Added.

3:45 AM Changeset in webkit [197276] by Carlos Garcia Campos

• 5 edits
  9 adds in releases/WebKitGTK/webkit-2.4

Merge r183280,r183672 - Origin header is preserved on cross-origin redirects.
​https://bugs.webkit.org/show_bug.cgi?id=144157.

Reviewed by Sam Weinig.

Source/WebCore:

Tests: http/tests/security/cors-post-redirect-301.html

http/tests/security/cors-post-redirect-302.html
http/tests/security/cors-post-redirect-307.html
http/tests/security/cors-post-redirect-308.html

• platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::ResourceHandle::willSendRequest): Always clear any origin header for cross-origin redirects.

• platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::willSendRequest): Ditto.

LayoutTests:

• http/tests/security/cors-post-redirect-301-expected.txt: Added.
• http/tests/security/cors-post-redirect-301.html: Added.
• http/tests/security/cors-post-redirect-302-expected.txt: Added.
• http/tests/security/cors-post-redirect-302.html: Added.
• http/tests/security/cors-post-redirect-307-expected.txt: Added.
• http/tests/security/cors-post-redirect-307.html: Added.
• http/tests/security/cors-post-redirect-308-expected.txt: Added.
• http/tests/security/cors-post-redirect-308.html: Added.
• http/tests/security/resources/cors-post-redirect-target.php: Added.

[GTK] New CORS tests from r183280 fail on WebKitGTK+
​https://bugs.webkit.org/show_bug.cgi?id=144469

Reviewed by Sergio Villar Senin.

No new tests. This causes failing tests to pass.

• platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::doRedirect): Clear the origin header on cross-origin redirects.

3:43 AM Changeset in webkit [197275] by Carlos Garcia Campos

• 6 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r183436 - Form control may be associated with the wrong HTML Form element after form id change
​https://bugs.webkit.org/show_bug.cgi?id=133456
<rdar://problem/17095055>

Reviewed by Andy Estes.

Source/WebCore:

Fixes an issue where a form control may be associated with the wrong HTML Form element
after the id of the HTML Form element associated with the form control is changed when
there is more than one HTML Form element with the same id in the document. Specifically,
a form control that has an HTML form attribute value X will always be associated with
some HTML Form element f where f.id = X regardless of whether f.id is subsequently
changed.

Tests: fast/forms/change-form-id-to-be-unique-then-submit-form.html

fast/forms/change-form-id-to-be-unique.html

• dom/Element.cpp:

(WebCore::Element::attributeChanged): Notify observers when the id of an element changed.
(WebCore::Element::updateId): Added parameter NotifyObservers (defaults to NotifyObservers::Yes),
as to whether we should notify observers of the id change.
(WebCore::Element::updateIdForTreeScope): Ditto.
(WebCore::Element::willModifyAttribute): Do not notify observers of the id change immediately. As
indicated by the name of this method, we plan to modify the DOM attribute id of the element, but
we have not actually modified it when this method is called. Instead we will notify observers
in Element::attributeChanged(), which is called after the DOM attribute id is modified.
(WebCore::Element::cloneAttributesFromElement): Ditto.

• dom/Element.h: Defined enum class NotifyObservers.
• dom/TreeScope.cpp:

(WebCore::TreeScope::addElementById): Added boolean parameter notifyObservers (defaults to true)
as to whether we should dispatch a notification to all observers.
(WebCore::TreeScope::removeElementById): Ditto.

• dom/TreeScope.h:

LayoutTests:

Add tests to ensure that we associate the correct HTML Form element with a
<select> after changing the id of its associated HTML form element.

• fast/forms/change-form-id-to-be-unique-expected.txt: Added.
• fast/forms/change-form-id-to-be-unique-then-submit-form-expected.txt: Added.
• fast/forms/change-form-id-to-be-unique-then-submit-form.html: Added.
• fast/forms/change-form-id-to-be-unique.html: Added.

3:42 AM Changeset in webkit [197274] by Carlos Garcia Campos

• 13 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Element::attributeChanged shouldn't do any work when attribute value didn't change
​https://bugs.webkit.org/show_bug.cgi?id=129467

Reviewed by Geoffrey Garen.

Exit early in childrenChanged when the attribute value didn't change.

• dom/Attr.cpp:

(WebCore::Attr::setValue):
(WebCore::Attr::childrenChanged):

• dom/Element.cpp:

(WebCore::Element::setAttributeInternal):
(WebCore::Element::attributeChanged):
(WebCore::Element::parserSetAttributes):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::didAddAttribute):
(WebCore::Element::didModifyAttribute):
(WebCore::Element::didRemoveAttribute):
(WebCore::Element::cloneAttributesFromElement):

• dom/Element.h:
• dom/StyledElement.cpp:

(WebCore::StyledElement::attributeChanged):

• dom/StyledElement.h:
• html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::updateType):

• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::attributeChanged):

• mathml/MathMLElement.h:
• mathml/MathMLSelectElement.cpp:

(WebCore::MathMLSelectElement::attributeChanged):

• mathml/MathMLSelectElement.h:
• svg/SVGElement.cpp:

(WebCore::SVGElement::attributeChanged):

• svg/SVGElement.h:

3:01 AM Changeset in webkit [197273] by Carlos Garcia Campos

• 5 edits
  3 adds in releases/WebKitGTK/webkit-2.4

Merge r183649 - Javascript using WebSQL can create their own WebKit info table.
<rdar://problem/20688792> and ​https://bugs.webkit.org/show_bug.cgi?id=144466

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/websql/alter-to-info-table.html

• Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::DatabaseBackendBase::databaseInfoTableName): Return the info table name.
(WebCore::fullyQualifiedInfoTableName): Append "main." to the info table name.
(WebCore::DatabaseBackendBase::DatabaseBackendBase): Use the fully qualified name.
(WebCore::DatabaseBackendBase::performOpenAndVerify): Ditto.
(WebCore::DatabaseBackendBase::getVersionFromDatabase): Ditto.
(WebCore::DatabaseBackendBase::setVersionInDatabase): Ditto.

LayoutTests:

• storage/websql/alter-to-info-table-expected.txt: Added.
• storage/websql/alter-to-info-table.html: Added.
• storage/websql/alter-to-info-table.js: Added.

Build fix after r183646 for less enlightened platforms.

Unreviewed.

• Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::fullyQualifiedInfoTableName): Windows doesn’t have stpcpy :(

2:52 AM Changeset in webkit [197272] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r182067 - FEMorphology::platformApplyGeneric() should bail out if the radius is less than or equal to zero.
​https://bugs.webkit.org/show_bug.cgi?id=142885.

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2015-03-27
Reviewed by Dean Jackson.

Source/WebCore:

FEMorphology class implementation code clean up.

Tests: svg/filters/feMorphology-radius-cases.svg

• platform/graphics/filters/FEMorphology.cpp:

(WebCore::shouldSupersedeExtremum): Reuse code instead of repeating it and
use < and > instead of =< and >=.

(WebCore::pixelArrayIndex): Returns the array index of a pixel in an image
buffer, given: position(x, y), image width and the color channel.

(WebCore::columnExtremum): Returns the extremum of a column of pixels.

(WebCore::kernelExtremum): Returns the extremum of a filter kernel.

(WebCore::FEMorphology::platformApplyGeneric): Apply some code clean-up.
The kernel size should be equal to radius of the filter. The extra pixel
was causing the resulted image to be asymmetric in some cases.

(WebCore::FEMorphology::platformApplyDegenerate):
(WebCore::FEMorphology::platformApplySoftware): After applying scaling, we
still need to check the resulted radius is negative (overflow case) or less
than one (zero radius case) and treat these cases differently.

(WebCore::FEMorphology::morphologyOperator): Deleted.
(WebCore::FEMorphology::radiusX): Deleted.
(WebCore::FEMorphology::radiusY): Deleted.

• platform/graphics/filters/FEMorphology.h:

(WebCore::FEMorphology::morphologyOperator):
(WebCore::FEMorphology::radiusX):
(WebCore::FEMorphology::radiusY):
Move a single line functions from the source file to the header file.

LayoutTests:

• svg/filters/feMorphology-radius-cases-expected.svg: Added.
• svg/filters/feMorphology-radius-cases.svg: Added.

Test different cases for radius of the feMorphology filter. There are three
cases for the radius:

1. radius < 0: This is an error case, the source image should not be rendered.
2. radius = 0: This case is treated as if the filter never exists.
3. radius > 0: If the scaled radius is > 0, the filter is applied.

2:44 AM Changeset in webkit [197271] by Carlos Garcia Campos

• 3 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r182750 - Canvas drawImage() has a security hole when the image isn't yet fully loaded.
​https://bugs.webkit.org/show_bug.cgi?id=58681.

Reviewed by Darin Adler.

Source/WebCore:

There is a race condition which may happen if an image from a different
origin is drawn on a canvas before it finishes loading. The check to taint
the canvas comes before drawing it. This check returns false if the image
is not completely loaded because we check the URL of the resource response.
If after this check and before the drawing, the image finishes loading, the
canvas will not be tainted but the image will be drawn.

The fix is to move the check to taint the canvas after drawing the image.
The only problem with this solution is basically the opposite of this bug:
we will become stricter than before with images which are from a different
origin and before they finish loading. The image has not finished loading,
so we do not draw it. Before we check for tainting, the image finishes
loading. So we decide to taint the canvas even the image is not drawn.

But this should not be a security issue anymore. I personally do not know
if it is even a correctness issue or not.

Test: http/tests/canvas/canvas-tainted-after-draw-image.html

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawImage):

LayoutTests:

This test confirms when we load an image from a different origin and try
drawing it on a canvas, the canvas is tainted if the image is completely
loaded and drawn. Otherwise the image is not drawn.

• http/tests/canvas/canvas-tainted-after-draw-image-expected.txt: Added.
• http/tests/canvas/canvas-tainted-after-draw-image.html: Added.
• http/tests/canvas/resources: Added.
• http/tests/canvas/resources/100x100-lime-rect.svg: Added.

Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
following ​http://trac.webkit.org/changeset/182750.

Reviewed by Daniel Bates.

• http/tests/canvas/canvas-tainted-after-draw-image-expected.txt:
• http/tests/canvas/canvas-tainted-after-draw-image.html:

Set window.jsTestIsAsync true and call finishJSTest() to make the test
asynchronous, so the "TEST COMPLETE" message will be output after all the
test messages. Also delete the synchronous tests for data url image and
same-domain image since they can't be reliably tested.

2:37 AM Changeset in webkit [197270] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r183398 - Crashes under IDBDatabase::closeConnection
​https://bugs.webkit.org/show_bug.cgi?id=141745

Reviewed by Alexey Proskuryakov.

• Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::~IDBDatabase): Do the work of close/closeConnection without
actually calling those functions.
(WebCore::IDBDatabase::closeConnection): Protect the database so it's not destroyed
in the middle of this function's execution.

2:35 AM Changeset in webkit [197269] by Carlos Garcia Campos

• 6 edits in releases/WebKitGTK/webkit-2.4/Source

Merge r180548 - EventHandler references deleted Scrollbar
​https://bugs.webkit.org/show_bug.cgi?id=141931
<rdar://problem/19915210>

Reviewed by Tim Horton.

Tested by scrollbars/overflow-custom-scrollbar-crash.html

Update the EventHandler class to use a WeakPtr to reference the
last used Scrollbar, rather than retaining the Scrollbar and
artificially extending its life. This keeps the EventHandler
state in proper sync with the state of the render tree, and
avoids cases where we have destroyed a ScrollableArea (and
Scrollbar) but are still sending messages to a fake zombie
version of the element.

• page/EventHandler.cpp:

(WebCore::EventHandler::clear):
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::updateMouseEventTargetNode):
(WebCore::EventHandler::updateLastScrollbarUnderMouse):

• page/EventHandler.h:
• platform/Scrollbar.cpp:

(WebCore::Scrollbar::Scrollbar): Initialize WeakPtrFactory.

• platform/Scrollbar.h:

(WebCore::Scrollbar::createWeakPtr): Added,

2:01 AM Changeset in webkit [197268] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r181565 - URLs visited during private browsing show up in WebpageIcons.db
rdar://problem/11254910 and ​https://bugs.webkit.org/show_bug.cgi?id=142733

Patch by Sam Weinig. Reviewed by Brady Eidson.

• loader/icon/IconController.cpp:

(WebCore::IconController::startLoader): Bail early here if the page is using an ephemeral session.
(WebCore::IconController::continueLoadWithDecision): Instead of here.

1:51 AM Changeset in webkit [197267] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r182051 - Inline continuation code should not take anonymous containing wrapper granted.
​https://bugs.webkit.org/show_bug.cgi?id=133312

Reviewed by Dave Hyatt.

It's wrong to assume that when RenderInline is part of an inline continuation, its containing block
is an anonymous wrapper and its sibling might be a block level renderer.
When the inline continuation is no longer needed, for example when the block level renderer that initiated the continuation
is detached from the render tree, the inline renderes still continue to form continuation.(however they no longer require
anonymous wrappers)

Source/WebCore:

Test: fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html

• rendering/RenderInline.cpp:

(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

• fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt: Added.
• fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html: Added.

1:37 AM Changeset in webkit [197266] by Carlos Garcia Campos

• 4 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r177165 - InstancedArray crashes attempting to draw out of bounds
​https://bugs.webkit.org/show_bug.cgi?id=139521
Source/WebCore:

Reviewed by Simon Fraser.

We were not doing index validation correctly for instancing.

Test: fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html

• html/canvas/WebGLRenderingContext.cpp:

(WebCore::WebGLRenderingContext::validateVertexAttributes): We need to check
the number of instances drawn against the amount of instance data that has
been provided, taking into account the number of repeats (the divisor).
(WebCore::WebGLRenderingContext::drawArrays): Added some whitespace to make it more clear.
(WebCore::WebGLRenderingContext::validateDrawElements): This needs to take a primcount
parameter so that it can correctly validate the call (when used from drawElementsInstanced).
(WebCore::WebGLRenderingContext::drawElements): New signature to validate.
(WebCore::WebGLRenderingContext::drawArraysInstanced): Rearrange this a bit. The
primcount validation is already being done by the validateDrawArrays call. Also, there
was a bogus UNUSED_PARAM hanging around.
(WebCore::WebGLRenderingContext::drawElementsInstanced): Similar rearrangement. Use
the primcount parameter.

• html/canvas/WebGLRenderingContext.h:

LayoutTests:

<rdar://problem/17540398>

Reviewed by Simon Fraser.

This is a copy of the official webgl/1.0.3 test.

• platform/mac-mountainlion/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added. This extension is not available on Mountain Lion.
• fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added.
• fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html: Added.
• fast/canvas/webgl/resources/out-of-bounds-test.js: Added.

(OutOfBoundsTest):

12:01 AM Changeset in webkit [197265] by Nikita Vasilyev

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: DataGrid's resizers aren't horizontally centered
​https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>

Reviewed by Timothy Hatcher.

• UserInterface/Views/DataGrid.css:

(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.

Feb 27, 2016:

7:33 PM Changeset in webkit [197264] by Sukolsak Sakshuwong

• 1 edit
  1 delete in trunk/LayoutTests

Removing ios-simulator baseline for js/number-toLocaleString.html
​https://bugs.webkit.org/show_bug.cgi?id=154524

Reviewed by Darin Adler.

The default locale issue has been fixed in r197261.
Infinity.toLocaleString() should return "∞" as expected.

• platform/ios-simulator/js/number-toLocaleString-expected.txt: Removed.

4:50 PM Changeset in webkit [197263] by Chris Dumez

• 10 edits in trunk

Prevent cross-origin access to Location.assign() / Location.reload()
​https://bugs.webkit.org/show_bug.cgi?id=154779

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:

• ​https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

Firefox and Chrome already prevent this but WebKit allowed it.

No new tests, already covered by existing tests.

• bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.

LayoutTests:

Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().

• http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
• http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
• http/tests/security/cross-frame-access-location-get-expected.txt:
• http/tests/security/cross-frame-access-location-get-override-expected.txt:
• http/tests/security/cross-frame-access-location-get-override.html:
• http/tests/security/cross-frame-access-location-get.html:
• http/tests/security/xss-DENIED-defineProperty-expected.txt:

4:40 PM Changeset in webkit [197262] by ap@apple.com

• 2 edits in trunk/Tools

Silence leaks under TextCodecICU::registerCodecs
​https://bugs.webkit.org/show_bug.cgi?id=154737

Reviewed by Darin Adler.

• Scripts/webkitpy/port/leakdetector.py:

(LeakDetector._callstacks_to_exclude_from_leaks):

4:36 PM Changeset in webkit [197261] by commit-queue@webkit.org

• 20 edits in trunk

Intl.Collator uses POSIX locale (detected by js/intl-collator.html on iOS Simulator)
​https://bugs.webkit.org/show_bug.cgi?id=152448

Patch by Andy VanWagoner <​thetalecrafter@gmail.com> on 2016-02-27
Reviewed by Darin Adler.

Source/JavaScriptCore:

Add defaultLanguage to the globalObjectMethodTable and use it for the
default locale in Intl object initializations. Fall back to ICU default
locale only if the defaultLanguage function is null, or returns an
empty string.

• jsc.cpp:
• runtime/IntlCollator.cpp:

(JSC::IntlCollator::initializeCollator):

• runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::initializeDateTimeFormat):

• runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::initializeNumberFormat):

• runtime/IntlObject.cpp:

(JSC::defaultLocale):
(JSC::lookupMatcher):
(JSC::bestFitMatcher):
(JSC::resolveLocale):

• runtime/IntlObject.h:
• runtime/JSGlobalObject.cpp:
• runtime/JSGlobalObject.h:
• runtime/StringPrototype.cpp:

(JSC::toLocaleCase):

Source/WebCore:

Pass defaultLanguage from Language.h to the globalObjectMethodTable to
ensure Intl objects can be initialized with the correct default locale.

• bindings/js/JSDOMWindowBase.cpp:
• bindings/js/JSWorkerGlobalScopeBase.cpp:

LayoutTests:

Add tests for default locale in test runner to be en-US.

• js/intl-collator-expected.txt:
• js/intl-datetimeformat-expected.txt:
• js/intl-numberformat-expected.txt:
• js/script-tests/intl-collator.js:
• js/script-tests/intl-datetimeformat.js:
• js/script-tests/intl-numberformat.js:

4:35 PM Changeset in webkit [197260] by Chris Dumez

• 9 edits in trunk

Align HTMLMarqueeElement.scrollAmount / scrollDelay with the specification
​https://bugs.webkit.org/show_bug.cgi?id=154781

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-obsolete-expected.txt:

Source/WebCore:

Align HTMLMarqueeElement.scrollAmount / scrollDelay with the
specification:

• ​https://www.w3.org/TR/html5/obsolete.html#the-marquee-element-0

In particular:

• The attributes should have unsigned long type
• We should not throw for negative values
• Values should be in the range [0, 2147483647] as per:
• ​https://html.spec.whatwg.org/multipage/infrastructure.html#reflect

No new tests, already covered by existing tests.

• html/HTMLMarqueeElement.cpp:

(WebCore::HTMLMarqueeElement::scrollAmount):
(WebCore::HTMLMarqueeElement::setScrollAmount):
(WebCore::HTMLMarqueeElement::scrollDelay):
(WebCore::HTMLMarqueeElement::setScrollDelay):
(WebCore::HTMLMarqueeElement::loop): Deleted.

• html/HTMLMarqueeElement.h:
• html/HTMLMarqueeElement.idl:

LayoutTests:

Update existing test to reflect the behavior changes.

• fast/html/marquee-element-expected.txt:
• fast/html/marquee-element.html:

1:05 PM Changeset in webkit [197259] by commit-queue@webkit.org

• 24 edits in trunk/Source

Unreviewed, rolling out r197204, r197207, r197211, r197217,
r197218, and r197219.
​https://bugs.webkit.org/show_bug.cgi?id=154780

Caused crashes in WebVideoFullscreenManagerProxy (Requested by
ap on #webkit).

Reverted changesets:

"Add support for playbackControlsManager"
​https://bugs.webkit.org/show_bug.cgi?id=154742
​http://trac.webkit.org/changeset/197204

"Attempted build fix."
​http://trac.webkit.org/changeset/197207

"Attempted build fix."
​http://trac.webkit.org/changeset/197211

"Attempted 32-bit build fix."
​http://trac.webkit.org/changeset/197217

"Another 32-bit build fix."
​http://trac.webkit.org/changeset/197218

"32-bit!!!"
​http://trac.webkit.org/changeset/197219

12:20 PM Changeset in webkit [197258] by ap@apple.com

• 2 edits in trunk/LayoutTests

Mark failing reftests as such, now that we detect reftest failures.

• platform/ios-simulator/TestExpectations:

12:01 PM Changeset in webkit [197257] by ap@apple.com

• 2 edits in trunk/LayoutTests

REGRESSION(r195795): [WK2] fast/text/crash-complex-text-surrogate.html is flakey
​https://bugs.webkit.org/show_bug.cgi?id=154709

The test has been made made non-flaky, but it also needs new results.

• platform/mac/fast/text/crash-complex-text-surrogate-expected.txt:

11:57 AM WebKitGTK/2.10.x edited by Michael Catanzaro

Propose r196467 as it could probably be used to workaround Red Hat #1311519 (diff)

11:28 AM Changeset in webkit [197256] by oliver@apple.com

• 2 edits in trunk/Source/JavaScriptCore

CLoop build fix.

10:30 AM Changeset in webkit [197255] by Chris Dumez

• 2 edits in trunk/Source/WebCore

Optimize parseHTMLInteger()
​https://bugs.webkit.org/show_bug.cgi?id=154772

Reviewed by Ryosuke Niwa.

Optimize parseHTMLInteger() a bit now that it is used a lot more and
that it has decent API test coverage. In particular, we now:

• Avoid using a StringBuilder for the digits.
• Get rid of a is8Bit() branch.
• Only traverse the input string once.

• html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger): Deleted.

9:49 AM Changeset in webkit [197254] by akling@apple.com

• 4 edits in trunk/Source/WebCore

[iOS] Discard decoded image data on top-level navigation.
<​https://webkit.org/b/154776>

Reviewed by Anders Carlsson.

Add a mechanism that destroys decoded data for all CachedImages and invoke it
when performing a top-level navigation on iOS.

This substantially reduces the ImageIO contribution to our peak memory footprint.

It would be even better if we could mark these images volatile during the transition
but we currently don't have framework support for such machinations.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

• loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::forEachResource):
(WebCore::MemoryCache::destroyDecodedDataForAllImages):

• loader/cache/MemoryCache.h:

7:10 AM Changeset in webkit [197253] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r196364 - [GTK] Toggle buttons are blurry with GTK+ 3.19
​https://bugs.webkit.org/show_bug.cgi?id=154007

Reviewed by Michael Catanzaro.

Use min-width/min-height style properties when GTK+ >= 3.19.7 to
get the size of toggle buttons.

• rendering/RenderThemeGtk.cpp:

(WebCore::setToggleSize):
(WebCore::paintToggle):

7:09 AM Changeset in webkit [197252] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r194847 - [GTK] Cleanup RenderThemeGtk
​https://bugs.webkit.org/show_bug.cgi?id=152888

Reviewed by Michael Catanzaro.

Use a common path for GTK+ 3.19 and previous versions, simplifying
the code and removing a lot of ifdefs.

• createStyleContext() now receives a theme part enum value, and an optional parent GtkStyleContext. It encapsulates all the differences between GTK+ 3.19 and previous version leaving the rendering code common and free of ifdefs.
• Stock icons support have been removed, simplifying the code that now always renders symbolic icons, updating the colors depending on the current state.
• Media button and colors have been removed, because they are unused now that we render the media controls with CSS.
• ComboBox separators support has also been removed. In GTK+ 3.19 combo boxes no longer have separators and most of the GTK+ themes don't use the either, so it's better to simple not render them anymore in WebKit either.
• Code to paint caps lock indicator has been removed too, since caps lock indicator is now shadow dom and automatically rendered by WebCore.

• rendering/RenderThemeGtk.cpp:

(WebCore::createStyleContext):
(WebCore::loadThemedIcon):
(WebCore::gtkIconStateFlags):
(WebCore::RenderThemeGtk::adjustRepaintRect):
(WebCore::setToggleSize):
(WebCore::paintToggle):
(WebCore::RenderThemeGtk::setCheckboxSize):
(WebCore::RenderThemeGtk::paintCheckbox):
(WebCore::RenderThemeGtk::setRadioSize):
(WebCore::RenderThemeGtk::paintRadio):
(WebCore::RenderThemeGtk::paintButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::popupInternalPaddingLeft):
(WebCore::RenderThemeGtk::popupInternalPaddingRight):
(WebCore::RenderThemeGtk::popupInternalPaddingTop):
(WebCore::RenderThemeGtk::popupInternalPaddingBottom):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::adjustSearchFieldIconStyle):
(WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationPartStyle):
(WebCore::paintIcon):
(WebCore::paintEntryIcon):
(WebCore::RenderThemeGtk::paintSearchFieldResultsDecorationPart):
(WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
(WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
(WebCore::RenderThemeGtk::shouldHaveCapsLockIndicator):
(WebCore::RenderThemeGtk::paintSliderTrack):
(WebCore::RenderThemeGtk::paintSliderThumb):
(WebCore::RenderThemeGtk::adjustSliderThumbSize):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
(WebCore::paintSpinArrowButton):
(WebCore::RenderThemeGtk::paintInnerSpinButton):
(WebCore::styleColor):
(WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
(WebCore::RenderThemeGtk::systemColor):
(WebCore::RenderThemeGtk::paintMediaButton):
(WebCore::RenderThemeGtk::paintMediaFullscreenButton):
(WebCore::RenderThemeGtk::paintMediaMuteButton):
(WebCore::RenderThemeGtk::paintMediaPlayButton):
(WebCore::RenderThemeGtk::paintMediaSeekBackButton):
(WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
(WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):

• rendering/RenderThemeGtk.h:

7:09 AM Changeset in webkit [197251] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r194377 - [GTK] Everything broken in GTK+ 3.19
​https://bugs.webkit.org/show_bug.cgi?id=150550

Reviewed by Carlos Garcia Campos.

Port RenderThemeGtk and ScrollbarThemeGtk to use CSS nodes. This makes it possible to render
stuff with modern GTK+.

No new tests. We already have tons of tests for this functionality, but we're running them
with GTK+ 3.16, so they cannot have detected this breakage. These fixes require unreleased
GTK+, and GTK+ rendering is currently in a state of flux; once things settle down, we can
consider upgrading the GTK+ used for our layout tests.

• platform/gtk/GRefPtrGtk.cpp:

(WTF::refGPtr):
(WTF::derefGPtr):

• platform/gtk/GRefPtrGtk.h:
• platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::themeChanged):
(WebCore::ScrollbarThemeGtk::updateThemeProperties):
(WebCore::orientationStyleClass):
(WebCore::applyScrollbarStyleContextClasses):
(WebCore::ScrollbarThemeGtk::paintTrackBackground):
(WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paintButton):

• rendering/RenderThemeGtk.cpp:

(WebCore::createStyleContext):
(WebCore::setToggleSize):
(WebCore::paintToggle):
(WebCore::RenderThemeGtk::paintButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::applySliderStyleContextClasses):
(WebCore::RenderThemeGtk::paintSliderTrack):
(WebCore::RenderThemeGtk::paintSliderThumb):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::paintSpinArrowButton):
(WebCore::styleColor):

7:09 AM Changeset in webkit [197250] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r173110, r193896 - [GTK] ScrollbarThemeGtk should not depend on RenderThemeGtk
​https://bugs.webkit.org/show_bug.cgi?id=136338

Reviewed by Philippe Normand.

Remove the dependency by creating the GtkStyleContext for the
scrollbars in ScrollbarThemeGtk.

• platform/gtk/RenderThemeGtk.cpp:

(WebCore::gtkStyleChangedCallback): Call ScrollbarThemeGtk::themeChanged().
(WebCore::getStyleContext): Remove the scrollbar style context support.

• platform/gtk/RenderThemeGtk.h: Remove gtkScrollbarStyle().
• platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarStyleContext::ScrollbarStyleContext): Helper
class to create the global GtkStyleContext for scrollbars.
(WebCore::ScrollbarStyleContext::~ScrollbarStyleContext):
(WebCore::ScrollbarStyleContext::context):
(WebCore::gtkScrollbarStyleContext):
(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Remove m_context initialization.
(WebCore::ScrollbarThemeGtk::themeChanged): Invalidate the
GtkStylecontext and call updateThemeProperties().
(WebCore::ScrollbarThemeGtk::updateThemeProperties): Use the
global style context.
(WebCore::ScrollbarThemeGtk::paintTrackBackground): Ditto.
(WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Ditto.
(WebCore::ScrollbarThemeGtk::paintThumb): Ditto.
(WebCore::ScrollbarThemeGtk::paintButton): Ditto.

• platform/gtk/ScrollbarThemeGtk.h:

[GTK] RenderThemeGtk::platformActiveSelectionBackgroundColor, et. al. should not clobber state of cached GtkStyleContexts
​https://bugs.webkit.org/show_bug.cgi?id=151533

Reviewed by Carlos Garcia Campos.

Remove the style context cache to simplify the code, drastically reduce the number of
expensive save/restore operations performed on style contexts, and avoid unwanted
side-effects in RenderThemeGtk::styleColor. This is also a speculative fix for improper
button rendering with certain custom themes, and a simplification that will make it easier
to fix bug #150550.

This change does have performance implications, which I intend to check on the perf bot
after landing to ensure that removing the cache does not have a significant negative impact
on performance; I have no clue whether this will be a net performance win or loss. However,
this is a bit tricky, because the bot is running GTK+ 3.16, whereas I expect save/restore
might be much more expensive in GTK+ 3.20, and I do not want to make performance decisions
except based on the latest GTK+ due to large changes in the implementation of

7:08 AM Changeset in webkit [197249] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r192724 - [GTK] Off-by-one error in getStyleContext()
​https://bugs.webkit.org/show_bug.cgi?id=151524

Reviewed by Carlos Garcia Campos.

GtkWidgetPath* path = gtk_widget_path_new();
gtk_widget_path_append_type(path, widgetType);
...
gtk_widget_path_iter_add_class(path, 0, GTK_STYLE_CLASS_BUTTON);
gtk_widget_path_iter_add_class(path, 1, "text-button");

Only one widget type was appended to the widget path, so the maximum valid index is 0. This
code means to add both style classes to the first widget type in the widget path, so the
second call should use index 0 rather than index 1.

This caused no bug in practice, because when the index is invalid,
gtk_widget_path_iter_add_class() automatically changes the index to the last valid position
in the widget path -- in this case, 0. This is routinely done with -1 as a convention for
specifying the last position in the widget path.

• rendering/RenderThemeGtk.cpp:

(WebCore::getStyleContext):

7:08 AM Changeset in webkit [197248] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r192723 - [GTK] Warning spam from GtkStyleContext
​https://bugs.webkit.org/show_bug.cgi?id=151520

Reviewed by Carlos Garcia Campos.

Audit every use of gtk_style_context_get_* to fix compatibility with GTK+ 3.19. Some of
these were already fine and are only changed for clarity.

Company: gtk_style_context_get() (and _get_padding/border/color()) should only ever be

called with the same state as gtk_style_context_get_state()

Company: usually that's a simple replacing of the old state (like in the trace you posted)
Company: sometimes it requires calling gtk_style_context_set_sate() with the right state

first

Company: and in very rare cases it needs a gtk_style_context_save() before the set_state(),

too

• platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::adjustRectAccordingToMargin):

• rendering/RenderThemeGtk.cpp:

(gtk_css_section_print):
(WebCore::getStyleContext):
(WebCore::RenderThemeGtk::initMediaColors):
(WebCore::renderButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::spinButtonArrowSize):
(WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
(WebCore::styleColor):

7:02 AM Changeset in webkit [197247] by Carlos Garcia Campos

• 3 edits
  5 adds in releases/WebKitGTK/webkit-2.4

Merge r190662 - [GTK] Progress bar is broken on recent GTK+
​https://bugs.webkit.org/show_bug.cgi?id=149831

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The gtk progress bar has been broken after bumping up to Gtk+-3.16. This is because
the way of rendering progress bar changed after gtk+-3.13.7. See more
​https://mail.gnome.org/archives/commits-list/2014-August/msg03865.html
gtk_render_activity is no longer valid to paint a progress bar on a newer gtk+.
It should be done with gtk_render_background and gtk_render_frame.

Test: fast/dom/HTMLProgressElement/native-progress-bar.html

• rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::paintProgressBar):

LayoutTests:

• fast/dom/HTMLProgressElement/native-progress-bar.html: Added.
• platform/gtk/fast/dom/HTMLProgressElement/native-progress-bar-expected.png: Added.
• platform/gtk/fast/dom/HTMLProgressElement/native-progress-bar-expected.txt: Added.
• platform/mac/fast/dom/HTMLProgressElement/native-progress-bar-expected.png: Added.
• platform/mac/fast/dom/HTMLProgressElement/native-progress-bar-expected.txt: Added.