Timeline

Feb 29, 2016:

11:39 PM Changeset in webkit [197390] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebKit2

ThreadedCompositor: clean up composition-specific resources before shutting down the thread
​https://bugs.webkit.org/show_bug.cgi?id=154793

Reviewed by Carlos Garcia Campos.

• Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:

(WebKit::ThreadedCompositor::runCompositingThread): Before concluding the
compositing thread run, clean up all the resources that were allocated at
the start, and in the reverse order. Specifically, we now also deallocate
the CoordinatedGraphicsScene and the SimpleViewportController objects. This
way these are not deallocated on the main thread when the ThreadedCompositor
destructor would otherwise clean them up.

11:37 PM Changeset in webkit [197389] by Chris Dumez

• 13 edits in trunk

Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
​https://bugs.webkit.org/show_bug.cgi?id=154845

Reviewed by Ryosuke Niwa.

Source/WebCore:

Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use
WTF::Optional.

• dom/Element.cpp:

(WebCore::Element::getIntegralAttribute):
(WebCore::Element::getUnsignedIntegralAttribute):
(WebCore::Element::setUnsignedIntegralAttribute): Deleted.

• html/HTMLElement.cpp:

(WebCore::HTMLElement::parseBorderWidthAttribute):
(WebCore::HTMLElement::parseAttribute):

• html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::parseMaxLengthAttribute):

• html/HTMLInputElement.h:
• html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

• html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::maxLength):

• html/ImageInputType.cpp:

(WebCore::ImageInputType::height):
(WebCore::ImageInputType::width):

• html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):

• html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):

• svg/SVGElement.cpp:

(WebCore::SVGElement::parseAttribute):

Tools:

Update API tests accordingly.

• TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp:

(TestWebKitAPI::testParseHTMLInteger):
(TestWebKitAPI::parseHTMLIntegerFails):
(TestWebKitAPI::testParseHTMLNonNegativeInteger):
(TestWebKitAPI::parseHTMLNonNegativeIntegerFails):
(TestWebKitAPI::TEST): Deleted.

11:36 PM Changeset in webkit [197388] by zandobersek@gmail.com

• 3 edits in trunk/Source/WebKit2

ThreadSafeCoordinatedSurface: remove the unused private create() static method
​https://bugs.webkit.org/show_bug.cgi?id=154792

Reviewed by Carlos Garcia Campos.

Remove the static ThreadSafeCoordinatedSurface::create() method that accepted
a std::unique_ptr<ImageBuffer> object as its third parameter. This was not used
anywhere.

• Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.cpp:

(WebKit::ThreadSafeCoordinatedSurface::create): Deleted.

• Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.h:

11:32 PM Changeset in webkit [197387] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebCore

TextureMapperGL: simplify TransformationMatrix copies in draw(), beginClip()
​https://bugs.webkit.org/show_bug.cgi?id=154791

Reviewed by Carlos Garcia Campos.

In both functions, the passed-in model-view matrix is first copied, multiplied
against a rect-to-rect TransformationMatrix, and then assigned into a local
TransformationMatrix variable, which causes another copy due to the multiply()
function returning a reference to the modified object.

To avoid the last copy, first copy the model-view matrix into a local variable,
and multiply the rect-to-rect TransformationMatrix into the new object afterwards.

• platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGL::draw):
(WebCore::TextureMapperGL::beginClip):

11:31 PM Changeset in webkit [197386] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebCore

ImageBufferCairo should support OpenGL ES 2 configurations
​https://bugs.webkit.org/show_bug.cgi?id=154790

Reviewed by Carlos Garcia Campos.

When building with OpenGL ES 2 and with accelerated 2D canvas support,
the GLES2 header should be included instead of the OpenGLShims.h header.

The glTexParameterf() calls targeting GL_TEXTURE_WRAP_S and
GL_TEXTURE_WRAP_T parameters should use the GL_CLAMP_TO_EDGE value.
GL_CLAMP isn't available in OpenGL ES 2 and was dropped in OpenGL 3.

• platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBufferData::createCairoGLSurface):

11:30 PM Changeset in webkit [197385] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebCore

TextureMapperGL: beginPainting() should handle the PaintingMirrored value in PaintFlags
​https://bugs.webkit.org/show_bug.cgi?id=154789

Reviewed by Carlos Garcia Campos.

• platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGL::beginPainting): The ClipStack should be reset with
a Y-axis mode that corresponds to the presence of the PaintingMirrored value in
the passed-in PaintFlags argument. If present, the default Y-axis mode should be
used, and the inverted Y-axis otherwise.

11:28 PM Changeset in webkit [197384] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebCore

CoordinatedGraphicsLayer should override the inherited TextureMapperPlatformLayer::Client methods
​https://bugs.webkit.org/show_bug.cgi?id=154788

Reviewed by Carlos Garcia Campos.

• platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

Add the override specifiers for the two methods that are inherited
from the TextureMapperPlatformLayer::Client interface.

7:48 PM Changeset in webkit [197383] by Yusuke Suzuki

• 3 edits
  1 add in trunk/Source/JavaScriptCore

[JSC] Private symbols should not be trapped by proxy handler
​https://bugs.webkit.org/show_bug.cgi?id=154817

Reviewed by Mark Lam.

Since the runtime has some assumptions on the properties associated with the private symbols, ES6 Proxy should not trap these property operations.
For example, in ArrayIteratorPrototype.js

var itemKind = this.@arrayIterationKind;
if (itemKind === @undefined)

throw new @TypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");

Here, we assume that only the array iterator has the @arrayIterationKind property that value is non-undefined.
But If we implement Proxy with the get handler, that returns a non-undefined value for every operations, we accidentally assumes that the given value is an array iterator.

To avoid these situation, we perform the default operations onto property operations with private symbols.

• runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::deleteProperty):
(JSC::ProxyObject::deletePropertyByIndex):

• tests/stress/proxy-basic.js:
• tests/stress/proxy-with-private-symbols.js: Added.

(assert):
(let.handler.getOwnPropertyDescriptor):

7:42 PM Changeset in webkit [197382] by Simon Fraser

• 25 edits in trunk

Remove the experimental feature of antialiased font dilation
​https://bugs.webkit.org/show_bug.cgi?id=154843

Reviewed by Zalan Bujtas.
Source/WebCore:

Remove the "antialiased font dilation" code path, and related prefs.

• page/Settings.cpp:

(WebCore::Settings::Settings): Deleted.
(WebCore::Settings::setAntialiasedFontDilationEnabled): Deleted.

• page/Settings.h:

(WebCore::Settings::antialiasedFontDilationEnabled): Deleted.

• platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::setAntialiasedFontDilationEnabled): Deleted.
(WebCore::FontCascade::antialiasedFontDilationEnabled): Deleted.

• platform/graphics/FontCascade.h:
• platform/graphics/GraphicsContext.cpp:

(WebCore::GraphicsContextStateChange::changesFromState): Deleted.
(WebCore::GraphicsContextStateChange::accumulate): Deleted.
(WebCore::GraphicsContextStateChange::apply): Deleted.
(WebCore::GraphicsContextStateChange::dump): Deleted.
(WebCore::GraphicsContext::setAntialiasedFontDilationEnabled): Deleted.

• platform/graphics/GraphicsContext.h:

(WebCore::GraphicsContextState::GraphicsContextState): Deleted.
(WebCore::GraphicsContext::antialiasedFontDilationEnabled): Deleted.

• platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

(PlatformCALayer::drawLayerContents): Deleted.

• platform/graphics/cocoa/FontCascadeCocoa.mm:

(WebCore::dilationSizeForTextColor): Deleted.
(WebCore::FontCascade::drawGlyphs): Deleted.

• platform/graphics/displaylists/DisplayList.cpp:

(WebCore::DisplayList::DisplayList::shouldDumpForFlags): Deleted.

Source/WebKit/mac:

Remove the "antialiased font dilation" code path, and related prefs.

• WebView/WebPreferenceKeysPrivate.h:
• WebView/WebPreferences.mm:

(+[WebPreferences initialize]): Deleted.
(-[WebPreferences setAntialiasedFontDilationEnabled:]): Deleted.
(-[WebPreferences antialiasedFontDilationEnabled]): Deleted.

• WebView/WebPreferencesPrivate.h:
• WebView/WebView.mm:

(-[WebView _preferencesChanged:]): Deleted.

Source/WebKit2:

Remove the "antialiased font dilation" code path, and related prefs.

• Shared/WebPreferencesDefinitions.h:
• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAntialiasedFontDilationEnabled):
(WKPreferencesGetAntialiasedFontDilationEnabled):

• UIProcess/API/C/WKPreferencesRefPrivate.h:
• UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _antialiasedFontDilationEnabled]): Deleted.
(-[WKPreferences _setAntialiasedFontDilationEnabled:]): Deleted.

• UIProcess/API/Cocoa/WKPreferencesPrivate.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences): Deleted.

Tools:

Remove the "antialiased font dilation" code path, and related prefs.

• DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues): Deleted.

• WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues): Deleted.

7:18 PM Changeset in webkit [197381] by fpizlo@apple.com

• 3 edits in trunk/Source/JavaScriptCore

regress/script-tests/double-pollution-putbyoffset.js.ftl-eager timed out because of a lock ordering deadlock involving InferredType and CodeBlock
​https://bugs.webkit.org/show_bug.cgi?id=154841

Reviewed by Benjamin Poulain.

Here's the deadlock:

Main thread:

1) Change an InferredType. This acquires InferredType::m_lock.
2) Fire watchpoint set. This triggers CodeBlock invalidation, which acquires

CodeBlock::m_lock.

DFG thread:

1) Iterate over the information in a CodeBlock. This acquires CodeBlock::m_lock.
2) Ask an InferredType for its descriptor(). This acquires InferredType::m_lock.

I think that the DFG thread's ordering should be legal, because the best logic for lock
hierarchies is that locks that protect the largest set of stuff should be acquired first.

This means that the main thread shouldn't be holding the InferredType::m_lock when firing
watchpoint sets. That's what this patch ensures.

At the time of writing, this test was deadlocking for me on trunk 100% of the time. With
this change I cannot get it to deadlock.

• runtime/InferredType.cpp:

(JSC::InferredType::willStoreValueSlow):
(JSC::InferredType::makeTopSlow):
(JSC::InferredType::set):
(JSC::InferredType::removeStructure):
(JSC::InferredType::InferredStructureWatchpoint::fireInternal):

• runtime/InferredType.h:

6:30 PM Changeset in webkit [197380] by Yusuke Suzuki

• 46 edits
  8 adds in trunk

[DFG][FTL][B3] Support floor and ceil
​https://bugs.webkit.org/show_bug.cgi?id=154683

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch implements and fixes the following things.

1. Implement Ceil and Floor in DFG, FTL and B3

x86 SSE 4.2 and ARM64 have round instructions that can directly perform Ceil or Floor.
This patch leverages this functionality. We introduce ArithFloor and ArithCeil.
During DFG phase, these nodes attempt to convert itself to Identity (in Fixup phase).
As the same to ArithRound, it tracks arith rounding mode.
And if these nodes are required to emit machine codes, we emit rounding machine code
if it is supported in the current machine. For example, in x86, we emit round.

This Floor functionality is nice for @toInteger in builtin.
That is used for Array.prototype.{forEach, map, every, some, reduce...}
And according to the benchmark results, Kraken audio-oscillator is slightly improved
due to its frequent Math.round and Math.floor calls.

2. Implement Floor in B3 and Air

As the same to Ceil in B3, we add a new B3 IR and Air opcode, Floor.
This Floor is leveraged to implement ArithFloor in DFG.

3. Fix ArithRound operation

Currently, we used cvtsd2si (in x86) to convert double value to int32.
And we also used this to implement Math.round, like, cvtsd2si(value + 0.5).
However, this implementation is not correct. Because cvtsd2si is not floor operation.
It is trucate operation. This is OK for positive numbers. But NG for negative numbers.
For example, the current implementation accidentally rounds -0.6 to -0.0. This should be -1.0.
Using Ceil and Floor instructions, we implement correct ArithRound.

• assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM::ceilDouble):
(JSC::MacroAssemblerARM::floorDouble):
(JSC::MacroAssemblerARM::supportsFloatingPointCeil): Deleted.

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM64::floorFloat):
(JSC::MacroAssemblerARM64::supportsFloatingPointCeil): Deleted.

• assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::supportsFloatingPointRounding):
(JSC::MacroAssemblerARMv7::ceilDouble):
(JSC::MacroAssemblerARMv7::floorDouble):
(JSC::MacroAssemblerARMv7::supportsFloatingPointCeil): Deleted.

• assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::ceilDouble):
(JSC::MacroAssemblerMIPS::floorDouble):
(JSC::MacroAssemblerMIPS::supportsFloatingPointRounding):
(JSC::MacroAssemblerMIPS::supportsFloatingPointCeil): Deleted.

• assembler/MacroAssemblerSH4.h:

(JSC::MacroAssemblerSH4::supportsFloatingPointRounding):
(JSC::MacroAssemblerSH4::ceilDouble):
(JSC::MacroAssemblerSH4::floorDouble):
(JSC::MacroAssemblerSH4::supportsFloatingPointCeil): Deleted.

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::floorDouble):
(JSC::MacroAssemblerX86Common::floorFloat):
(JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
(JSC::MacroAssemblerX86Common::supportsFloatingPointCeil): Deleted.

• b3/B3ConstDoubleValue.cpp:

(JSC::B3::ConstDoubleValue::floorConstant):

• b3/B3ConstDoubleValue.h:
• b3/B3ConstFloatValue.cpp:

(JSC::B3::ConstFloatValue::floorConstant):

• b3/B3ConstFloatValue.h:
• b3/B3LowerMacrosAfterOptimizations.cpp:
• b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

• b3/B3Opcode.cpp:

(WTF::printInternal):

• b3/B3Opcode.h:
• b3/B3ReduceDoubleToFloat.cpp:
• b3/B3ReduceStrength.cpp:
• b3/B3Validate.cpp:
• b3/B3Value.cpp:

(JSC::B3::Value::floorConstant):
(JSC::B3::Value::isRounded):
(JSC::B3::Value::effects):
(JSC::B3::Value::key):
(JSC::B3::Value::typeFor):

• b3/B3Value.h:
• b3/air/AirFixPartialRegisterStalls.cpp:
• b3/air/AirOpcode.opcodes:
• b3/testb3.cpp:

(JSC::B3::testFloorCeilArg):
(JSC::B3::testFloorArg):
(JSC::B3::testFloorImm):
(JSC::B3::testFloorMem):
(JSC::B3::testFloorFloorArg):
(JSC::B3::testCeilFloorArg):
(JSC::B3::testFloorIToD64):
(JSC::B3::testFloorIToD32):
(JSC::B3::testFloorArgWithUselessDoubleConversion):
(JSC::B3::testFloorArgWithEffectfulDoubleConversion):
(JSC::B3::run):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGArithMode.cpp:

(WTF::printInternal):

• dfg/DFGArithMode.h:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGGraph.h:

(JSC::DFG::Graph::roundShouldSpeculateInt32):

• dfg/DFGNode.h:

(JSC::DFG::Node::arithNodeFlags):
(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::hasArithRoundingMode):

• dfg/DFGNodeType.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithRounding):
(JSC::DFG::SpeculativeJIT::compileArithRound): Deleted.

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
(JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
(JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):

• ftl/FTLOutput.h:

(JSC::FTL::Output::doubleFloor):

• jit/ThunkGenerators.cpp:

(JSC::ceilThunkGenerator):

• tests/stress/math-ceil-arith-rounding-mode.js: Added.

(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):

• tests/stress/math-ceil-basics.js: Added.

(mathCeilOnIntegers):
(mathCeilOnDoubles):
(mathCeilOnBooleans):
(uselessMathCeil):
(mathCeilWithOverflow):
(mathCeilConsumedAsDouble):
(mathCeilDoesNotCareAboutMinusZero):
(mathCeilNoArguments):
(mathCeilTooManyArguments):
(testMathCeilOnConstants):
(mathCeilStructTransition):
(Math.ceil):

• tests/stress/math-floor-arith-rounding-mode.js: Added.

(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):

• tests/stress/math-floor-basics.js: Added.

(mathFloorOnIntegers):
(mathFloorOnDoubles):
(mathFloorOnBooleans):
(uselessMathFloor):
(mathFloorWithOverflow):
(mathFloorConsumedAsDouble):
(mathFloorDoesNotCareAboutMinusZero):
(mathFloorNoArguments):
(mathFloorTooManyArguments):
(testMathFloorOnConstants):
(mathFloorStructTransition):
(Math.floor):

• tests/stress/math-round-should-not-use-truncate.js: Added.

(mathRoundDoesNotCareAboutMinusZero):

• tests/stress/math-rounding-infinity.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):

• tests/stress/math-rounding-nan.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):

• tests/stress/math-rounding-negative-zero.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):
(testRoundNonNegativeZero):
(testRoundNonNegativeZero2):

Websites/webkit.org:

• docs/b3/intermediate-representation.html:

6:07 PM Changeset in webkit [197379] by commit-queue@webkit.org

• 29 edits in trunk/Source/JavaScriptCore

Add new MethodTable method to get an estimated size for a cell
​https://bugs.webkit.org/show_bug.cgi?id=154838

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-29
Reviewed by Filip Pizlo.

The new class method estimatedSize(JSCell*) estimates the size for a single cell.
As the name implies, this is meant to be an approximation. It is more important
that big objects report a large size, then to get perfect size information for
all objects in the heap.

Base implementation (JSCell):

• returns the MarkedBlock bucket size for this cell.
• This gets us the object size include inline storage. Basically a better sizeof.

Subclasses with "Extra Memory Cost":

• Any class that reports extra memory (reportExtraMemoryVisited) should include that in the estimated size.
• E.g. CodeBlock, JSGenericTypedArrayView, WeakMapData, etc.

Subclasses with "Copied Space" storage:

• Any class with data in copied space (copyBackingStore) should include that in the estimated size.
• E.g. JSObject, JSGenericTypedArrayView, JSMap, JSSet, DirectArguments, etc.

Add reportExtraMemoryVisited for UnlinkedCodeBlock's compressed unlinked
instructions because this can be larger than 1kb, which is significant.

This has one special case for RegExp generated bytecode / JIT code, which
does not currently fall into the extra memory cost or copied space storage.
In practice I haven't seen this grow to a significant cost.

• runtime/ClassInfo.h:

Add the new estimatedSize method to the table.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::visitChildren):
(JSC::UnlinkedCodeBlock::estimatedSize):
(JSC::UnlinkedCodeBlock::setInstructions):

• bytecode/UnlinkedCodeBlock.h:

Report an extra memory cost for unlinked code blocks like
we do for linked code blocks.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::estimatedSize):

• bytecode/CodeBlock.h:
• bytecode/UnlinkedInstructionStream.cpp:

(JSC::UnlinkedInstructionStream::sizeInBytes):

• bytecode/UnlinkedInstructionStream.h:
• runtime/DirectArguments.cpp:

(JSC::DirectArguments::estimatedSize):

• runtime/DirectArguments.h:
• runtime/JSCell.cpp:

(JSC::JSCell::estimatedSizeInBytes):
(JSC::JSCell::estimatedSize):

• runtime/JSCell.h:
• runtime/JSGenericTypedArrayView.h:
• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):

• runtime/JSMap.cpp:

(JSC::JSMap::estimatedSize):

• runtime/JSMap.h:
• runtime/JSObject.cpp:

(JSC::JSObject::visitButterfly):

• runtime/JSObject.h:
• runtime/JSSet.cpp:

(JSC::JSSet::estimatedSize):

• runtime/JSSet.h:
• runtime/JSString.cpp:

(JSC::JSString::estimatedSize):

• runtime/JSString.h:
• runtime/MapData.h:

(JSC::MapDataImpl::capacityInBytes):

• runtime/WeakMapData.cpp:

(JSC::WeakMapData::estimatedSize):
(JSC::WeakMapData::visitChildren):

• runtime/WeakMapData.h:

Implement estimated size following the pattern of reporting
extra visited size, or copy space memory.

• runtime/RegExp.cpp:

(JSC::RegExp::estimatedSize):

• runtime/RegExp.h:
• yarr/YarrInterpreter.h:

(JSC::Yarr::ByteDisjunction::estimatedSizeInBytes):
(JSC::Yarr::BytecodePattern::estimatedSizeInBytes):

• yarr/YarrJIT.h:

(JSC::Yarr::YarrCodeBlock::size):
Include generated bytecode / JITCode to a RegExp's size.

5:36 PM Changeset in webkit [197378] by Ryan Haddad

• 3 edits in trunk/LayoutTests

Marking webgl/1.0.2/conformance/extensions/get-extension.html as flaky on mac, removing wk1 specific flakiness expectation.
​https://bugs.webkit.org/show_bug.cgi?id=152506

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:
• platform/mac/TestExpectations:

5:16 PM Changeset in webkit [197377] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Marking storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange.html as flaky on mac
​https://bugs.webkit.org/show_bug.cgi?id=154748

Unreviewed test gardening.

• platform/mac/TestExpectations:

4:54 PM Changeset in webkit [197376] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Re-enable passing fast/multicol/newmulticol tests on ios-simulator

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations:

4:44 PM Changeset in webkit [197375] by jer.noble@apple.com

• 7 edits
  9 adds in trunk/Source/WebCore

Refactor CoreVideo API access into their own classes so code can be re-used.
​https://bugs.webkit.org/show_bug.cgi?id=154544

Reviewed by Eric Carlson.

In order for common CoreVideo code paths to be re-used in other classes, pull those paths
out of MediaPlayerPrivateAVFoundationObjC and into re-usable clasess.

• WebCore.xcodeproj/project.pbxproj:
• platform/cf/CoreMediaSoftLink.cpp:
• platform/cf/CoreMediaSoftLink.h:
• platform/cocoa/CoreVideoSoftLink.cpp: Added.
• platform/cocoa/CoreVideoSoftLink.h: Added.
• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
(WebCore::MediaPlayerPrivateAVFoundationObjC::copyVideoTextureToPlatformTexture):
(WebCore::CVPixelBufferGetBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseInfoCallback): Deleted.
(WebCore::createImageFromPixelBuffer): Deleted.
(WebCore::enumToStringMap): Deleted.

• platform/graphics/cv/PixelBufferConformerCV.cpp: Added.

(WebCore::PixelBufferConformerCV::PixelBufferConformerCV):
(WebCore::CVPixelBufferGetBytePointerCallback):
(WebCore::CVPixelBufferReleaseBytePointerCallback):
(WebCore::CVPixelBufferReleaseInfoCallback):
(WebCore::PixelBufferConformerCV::createImageFromPixelBuffer):

• platform/graphics/cv/PixelBufferConformerCV.h: Added.
• platform/graphics/cv/TextureCacheCV.h: Added.

(WebCore::TextureCacheCV::context):

• platform/graphics/cv/TextureCacheCV.mm: Added.

(WebCore::TextureCacheCV::create):
(WebCore::TextureCacheCV::TextureCacheCV):
(WebCore::TextureCacheCV::textureFromImage):

• platform/graphics/cv/VideoTextureCopierCV.cpp: Added.

(WebCore::VideoTextureCopierCV::VideoTextureCopierCV):
(WebCore::VideoTextureCopierCV::~VideoTextureCopierCV):
(WebCore::enumToStringMap):
(WebCore::VideoTextureCopierCV::copyVideoTextureToPlatformTexture):

• platform/graphics/cv/VideoTextureCopierCV.h: Added.

(WebCore::VideoTextureCopierCV::context):

• platform/mediastream/mac/AVVideoCaptureSource.mm: Move SOFT_LINK declarations into CoreVideoSoftLink.h/cpp.

4:39 PM Changeset in webkit [197374] by fpizlo@apple.com

• 2 edits in trunk/Source/JavaScriptCore

SpeculatedType should be easier to edit
​https://bugs.webkit.org/show_bug.cgi?id=154840

Reviewed by Mark Lam.

We used to specify the bitmasks in SpeculatedType.h using hex codes. This used to work
great because we didn't have so many masks and you could use the mask to visually see
which ones overlapped. It also made it easy to visualize subset relationships.

But now we have a lot of masks with a lot of confusing overlaps, and it's no longer
possible to just see their relationship by looking at hex codes. Worse, the use of hex
codes makes it super annoying to move the bits around. For example, right now we have two
bits free, but if we wanted to reclaim them by editing the old hex masks, it would be a
nightmare.

So this patch replaces the hex masks with shift expressions (1u << 15 for example) and it
makes any derived masks (i.e. masks that are the bit-or of other masks) be expressed using
an or expression (SpecFoo | SpecBar | SpecBaz for example).

This makes it easier to see the relationships and it makes it easier to take bits for new
types.

• bytecode/SpeculatedType.h:

4:08 PM Changeset in webkit [197373] by beidson@apple.com

• 4 edits in trunk/Tools

Fix timing flakiness in test I added in ​http://trac.webkit.org/changeset/197372

Unreviewed.

• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html:
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html:
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm:

(TEST): Sometimes a third message from the first html file was leaking through. The message is expected

so we should always wait for it and make sure we got it.

3:13 PM Changeset in webkit [197372] by beidson@apple.com

• 9 edits
  3 adds in trunk

Modern IDB: WebKit 2 IPC layer easily confused about multiple web processes being connected.
​https://bugs.webkit.org/show_bug.cgi?id=154837

Reviewed by Alex Christensen.

Source/WebKit2:

The crux of the bug is that WebProcesses cannot assign themselves server-unique identifiers...
The server must do that for them.

A once-per-session-per-WebProcess sync message and a few updates to connection management fix this.

• DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage):
(WebKit::generateConnectionToServerIdentifier):
(WebKit::DatabaseToWebProcessConnection::establishIDBConnectionToServer):

• DatabaseProcess/DatabaseToWebProcessConnection.h:
• DatabaseProcess/DatabaseToWebProcessConnection.messages.in:

• WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer):
(WebKit::generateConnectionToServerIdentifier): Deleted.

• WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage):
(WebKit::WebToDatabaseProcessConnection::idbConnectionToServerForSession):

• WebProcess/Databases/WebToDatabaseProcessConnection.h:

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm: Added.

3:06 PM Changeset in webkit [197371] by commit-queue@webkit.org

• 8 edits in trunk/Source/WebInspectorUI

Web Inspector: Add direct number inputs to Bezier editor
​https://bugs.webkit.org/show_bug.cgi?id=154809
<rdar://problem/24881465>

Patch by Devin Rousso <Devin Rousso> on 2016-02-29
Reviewed by Timothy Hatcher.

• UserInterface/Base/Main.js:

(WebInspector._updateWindowKeydownListener):
Now only adds the shared event listener when the first keydown listener
is added via WebInspector.addWindowKeydownListener

• UserInterface/Controllers/CodeMirrorBezierEditingController.js:

(WebInspector.CodeMirrorBezierEditingController.prototype.popoverDidDismiss):

• UserInterface/Controllers/CodeMirrorEditingController.js:

(WebInspector.CodeMirrorEditingController.prototype.popoverDidDismiss):
(WebInspector.CodeMirrorEditingController.prototype.didDismissPopover):
Added function that is called when the popover is dismissed so that
removing event listeners is possible.

• UserInterface/Views/BezierEditor.css:

(.bezier-editor):
(.bezier-editor > .number-input-container):
(.bezier-editor > .number-input-container > input):

• UserInterface/Views/BezierEditor.js:

(WebInspector.BezierEditor.createControl):
(WebInspector.BezierEditor.createBezierInput):
(WebInspector.BezierEditor):
Added usage of Element.prototype.createChild for ease of readability.
Also added input elements for manually changing the values of each bezier
point's x and y values.

(WebInspector.BezierEditor.prototype.set bezier):
(WebInspector.BezierEditor.prototype.removeListeners):
(WebInspector.BezierEditor.prototype._handleMousedown):
(WebInspector.BezierEditor.prototype._updateBezier):
(WebInspector.BezierEditor.prototype._updateBezierPreview):
(WebInspector.BezierEditor.prototype._triggerPreviewAnimation):
(WebInspector.BezierEditor.prototype._handleNumberInputInput):
(WebInspector.BezierEditor.prototype._handleNumberInputKeydown):
(WebInspector.BezierEditor.prototype._changeBezierForInput):
Refactored code to make it more reusable, as well as adding event listeners
to the newly created inputs, including value chaning from the arrow keys.

• UserInterface/Views/CSSStyleDeclarationTextEditor.js:

(WebInspector.CSSStyleDeclarationTextEditor.prototype.didDismissPopover): Deleted.
Removed unused code.

• UserInterface/Views/InlineSwatch.js:

(WebInspector.InlineSwatch):
(WebInspector.InlineSwatch.prototype.didDismissPopover):
Removes any global event listeners added by the current editor if able.

(WebInspector.InlineSwatch.prototype._swatchElementClicked):
Now saves the current editor object as a member variable.

2:45 PM Changeset in webkit [197370] by keith_miller@apple.com

• 3 edits in trunk/Source/JavaScriptCore

OverridesHasInstance constant folding is wrong
​https://bugs.webkit.org/show_bug.cgi?id=154833

Reviewed by Filip Pizlo.

The current implementation of OverridesHasInstance constant folding
is incorrect. Since it relies on OSR exit information it has been
moved to the StrengthReductionPhase. Normally, such an optimazation would be
put in FixupPhase, however, there are a number of cases where we don't
determine an edge of OverridesHasInstance is a constant until after fixup.
Performing the optimization during StrengthReductionPhase means we can defer
our decision until later.

In the future we should consider creating a version of this optimization
that does not depend on OSR exit information and move the optimization back
to ConstantFoldingPhase.

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.

• dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

2:41 PM Changeset in webkit [197369] by Ryan Haddad

• 1 edit
  1 delete in trunk/LayoutTests

Removing unnecessary ios-simulator-wk2 expectation file.

Unreviewed test gardening.

• platform/ios-simulator-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt: Removed.

2:37 PM Changeset in webkit [197368] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html after r197355

Unreviewed test gardening.

• platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

2:37 PM Changeset in webkit [197367] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-embedded.html for ios-simulator after r197237

Unreviewed test gardening.

• platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:

2:33 PM Changeset in webkit [197366] by fpizlo@apple.com

• 5 edits
  6 adds in trunk

B3 should have global store elimination
​https://bugs.webkit.org/show_bug.cgi?id=154658

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

Implements fairly comprehensive global store elimination:

1) If you store the result of a load with no interference in between, remove the store.

2) If you store the same thing you stored previously, remove the store.

3) If you store something that you either loaded previously or stored previously along

arbitrarily many paths, remove the store.

4) If you store to something that is stored to again in the future with no interference in

between, remove the store.

Rule (4) is super relevant to FTL since the DFG does not eliminate redundant PutStructures.
A constructor that produces a large object will have many redundant stores to the same base
pointer, offset, and heap range, with no code to observe that heap raneg in between.

This doesn't have a decisive effect on major benchmarks, but it's an enormous win for
microbenchmarks:

• 30% faster to construct an object with many fields.

• 5x faster to do many stores to a global variable.

The compile time cost should be very small. Although the optimization is global, it aborts as
soon as it sees anything that would confound store elimination. For rules (1)-(3), we
piggy-back the existing load elimination, which gives up on interfering stores. For rule (4),
we search forward through the current block and then globally a block at a time (skipping
block contents thanks to summary data), which could be expensive. But rule (4) aborts as soon
as it sees a read, write, or end block (Return or Oops). Any Check will claim to read TOP. Any
Patchpoint that results from an InvalidationPoint will claim to read TOP, as will any
Patchpoints for ICs. Those are usually sprinkled all over the program.

In other words, this optimization rarely kicks in. When it does kick in, it makes programs run
faster. When it doesn't kick in, it's usually O(1) because there are reasons for aborting all
over a "normal" program so the search will halt almost immediately. This of course raises the
question: how much more in compile time do we pay when the optimization does kick in? The
optimization kicks in the most for the microbenchmarks I wrote for this patch. Amazingly, the
effect of the optimization a wash for compile time: whatever cost we pay doing the O(n^{2)
searches is balanced by the massive reduction in work in the backend. On one of the two
microbenchmarks, overall compile time actually shrank with this optimization even though CSE
itself cost more. That's not too surprising - the backend costs much more per instruction, so
things that remove instructions before we get to the backend tend to be a good idea.}

We could consider adding a more aggressive version of this in the future, which could sink
stores into checks. That could be crazy fun: ​https://bugs.webkit.org/show_bug.cgi?id=152162#c3

But mainly, I'm adding this optimization because it was super fun to implement during the
WebAssembly CG summit.

• b3/B3EliminateCommonSubexpressions.cpp:
• b3/B3MemoryValue.h:
• b3/B3SuccessorCollection.h:

(JSC::B3::SuccessorCollection::begin):
(JSC::B3::SuccessorCollection::end):
(JSC::B3::SuccessorCollection::const_iterator::const_iterator):
(JSC::B3::SuccessorCollection::const_iterator::operator*):
(JSC::B3::SuccessorCollection::const_iterator::operator++):
(JSC::B3::SuccessorCollection::const_iterator::operator==):
(JSC::B3::SuccessorCollection::const_iterator::operator!=):

LayoutTests:

These two benchmarks both speed up significantly with this change.

• js/regress/build-large-object-expected.txt: Added.
• js/regress/build-large-object.html: Added.
• js/regress/many-repeat-stores-expected.txt: Added.
• js/regress/many-repeat-stores.html: Added.
• js/regress/script-tests/build-large-object.js: Added.
• js/regress/script-tests/many-repeat-stores.js: Added.

2:14 PM Changeset in webkit [197365] by fpizlo@apple.com

• 9 edits
  1 add in trunk/Source/JavaScriptCore

Make it cheap to #include "JITOperations.h"
​https://bugs.webkit.org/show_bug.cgi?id=154836

Reviewed by Mark Lam.

Prior to this change, this header included the whole world even though it did't have any
definitions. This patch turns almost all of the includes into forward declarations. Right
now this header is very cheap to include.

• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
• JavaScriptCore.xcodeproj/project.pbxproj:
• dfg/DFGSpeculativeJIT.h:
• jit/JITOperations.cpp:
• jit/JITOperations.h:
• jit/Repatch.h:
• runtime/CommonSlowPaths.h:

(JSC::encodeResult): Deleted.
(JSC::decodeResult): Deleted.

• runtime/SlowPathReturnType.h: Added.

(JSC::encodeResult):
(JSC::decodeResult):

1:32 PM Changeset in webkit [197364] by Chris Dumez

• 3 edits in trunk/Source/WebCore

Use WTF::Optional for HTMLOListElement::m_start
​https://bugs.webkit.org/show_bug.cgi?id=154824

Reviewed by Andreas Kling.

Use WTF::Optional for HTMLOListElement::m_start.

• html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

• html/HTMLOListElement.h:

1:14 PM Changeset in webkit [197363] by jdiggs@igalia.com

• 2 edits
  1 add in trunk/Tools

[GTK][jhbuild] GLib build fails with GCC 6.0
​https://bugs.webkit.org/show_bug.cgi?id=154825

Use the upstream work-around. ​https://bugzilla.gnome.org/show_bug.cgi?id=761550

Reviewed by Csaba Osztrogonác.

• gtk/jhbuild.modules: Apply upstream path.
• gtk/patches/gdate-suppress-string-format-literal-warning.patch: Added.

12:46 PM Changeset in webkit [197362] by achristensen@apple.com

• 5 edits in trunk/Source/WebKit2

Don't call NetworkProcess::singleton from WebProcess when using NetworkSession
​https://bugs.webkit.org/show_bug.cgi?id=154829

Reviewed by Anders Carlsson.

We were calling NetworkProcess::singleton when making the default session in the
WebProcess, which caused bad things to happen. We also were never clearing the
credentials in the WebProcess between tests because it used to always call
NetworkProcess::singleton, which caused flaky tests.

This fixes repeatable crashes in http/tests/media/media-document-referer.html and
http/tests/media/media-document.html when using NetworkSession.

• NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::NetworkProcess):
(WebKit::NetworkProcess::~NetworkProcess):

• NetworkProcess/NetworkSession.h:
• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForType):
(WebKit::globalCustomProtocolManager):
(WebKit::NetworkSession::setCustomProtocolManager):
(WebKit::NetworkSession::defaultSession):

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::clearCachedCredentials):

11:35 AM Changeset in webkit [197361] by fpizlo@apple.com

• 2 edits in trunk/Tools

We've been running Octane/regexp all wrong in run-jsc-benchmarks
​https://bugs.webkit.org/show_bug.cgi?id=154827

Reviewed by Andreas Kling.

Octane v.2 and JetStream v.1.1 run this benchmark with warmup. This script was running
it without warmup. This patches fixes this by making this script run it with warmup.

This fix shows that my last patch, which added FTL support for regexp, was actually a 3%
speed-up on Octane/regexp, not a slow-down as the ChangeLog claimed.

It discovered this bug because for each Octane test that I want to debug, I usually make
a standalone .js file that contains the whole test along with a miniharness - usually
a plain loop - that runs it almost like it would for real but with whatever hacks I'm
using for debugging. When I wrote such a thing for regexp, I used a ~20 iteration warmup
to match the one second of warmup that this benchmark gets in Octane. To my surprise,
this quite faithful regexp runner did not see the regression that run-jsc-benchmarks
saw. That's when I found out that run-jsc-benchmarks was running it wrong.

The reason for the no-warmup slow-down is that the FTL is actually fairly expensive to
run on some of these very large functions in the regexp benchmark. I don't think we can
do anything about that, and I'd argue that the speed-up we see after the compilation is
done suggests that it was worth it.

• Scripts/run-jsc-benchmarks:

11:32 AM WebKitIDL edited by Chris Dumez

(diff)

11:31 AM WebKitIDL edited by Chris Dumez

[TreatNullAs=EmptyString] (diff)

10:55 AM Changeset in webkit [197360] by barraclough@apple.com

• 16 edits in trunk

RefCounter<T>::Event -> RefCounterEvent
​https://bugs.webkit.org/show_bug.cgi?id=154767

Reviewed by Darin Adler.

RefCounter<T>::Event is kinda verbose to use, and there is no need for this
to be specific to a particular typeof RefCounter. Move the enum class up to
the top level & rename to RefCounterEvent.

Source/WebCore:

• page/PageThrottler.cpp:

(WebCore::PageThrottler::PageThrottler):
(WebCore::m_audiblePluginHysteresis):
(WebCore::m_mediaActivityCounter):
(WebCore::m_pageLoadActivityCounter):

• platform/VNodeTracker.cpp:

(WebCore::VNodeTracker::singleton):
(WebCore::VNodeTracker::VNodeTracker):
(WebCore::m_lastWarningTime):

Source/WebKit2:

Also remove UserObservablePageToken - this is vestigial & not really offering
anything over just using UserObservablePageCounter::Token directly.

• UIProcess/Plugins/PluginProcessManager.cpp:

(WebKit::PluginProcessManager::PluginProcessManager):

• UIProcess/Plugins/PluginProcessManager.h:
• UIProcess/Plugins/mac/PluginProcessManagerMac.mm:

(WebKit::PluginProcessManager::updateProcessSuppressionDisabled):

• UIProcess/ProcessThrottler.cpp:

(WebKit::ProcessThrottler::ProcessThrottler):
(WebKit::m_backgroundCounter):
(WebKit::m_suspendMessageCount):

• UIProcess/ProcessThrottler.h:
• UIProcess/WebPageProxy.h:
• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::WebProcessPool):
(WebKit::m_processSuppressionDisabledForPageCounter):
(WebKit::m_hiddenPageThrottlingAutoIncreasesCounter):

• UIProcess/WebProcessPool.h:

Source/WTF:

• wtf/RefCounter.h:

(WTF::RefCounter<T>::Count::ref):
(WTF::RefCounter<T>::Count::deref):

Tools:

• TestWebKitAPI/Tests/WTF/RefCounter.cpp:

(TestWebKitAPI::TEST):

10:51 AM Changeset in webkit [197359] by youenn.fablet@crf.canon.fr

• 3 edits in trunk/LayoutTests

streams/pipe-to.html flaky on mac-wk1 debug
​https://bugs.webkit.org/show_bug.cgi?id=154687

Reviewed by Darin Adler.

• TestExpectations: Marking streams/pipe-to.html as slow.
• streams/pipe-to.html: Increasing the timeout value.

10:33 AM Changeset in webkit [197358] by Csaba Osztrogonác

• 5 edits
  1 delete in trunk/Tools

Remove more LLVM related cruft
​https://bugs.webkit.org/show_bug.cgi?id=154821

Reviewed by Darin Adler.

• Scripts/build-jsc:
• Scripts/build-webkit:
• Scripts/copy-webkitlibraries-to-product-directory:
• Scripts/export-llvm-build: Removed.
• Scripts/run-jsc-stress-tests:

10:05 AM Changeset in webkit [197357] by fpizlo@apple.com

• 8 edits
  2 adds in trunk/Source/JavaScriptCore

FTL should be able to run everything in Octane/regexp
​https://bugs.webkit.org/show_bug.cgi?id=154266

Reviewed by Saam Barati.

Adds FTL support for NewRegexp, RegExpTest, and RegExpExec. I couldn't figure out how to
make the RegExpExec peephole optimization work in FTL. This optimizations shouldn't be a
DFG backend optimization anyway - if we need this optimization then it should be a
strength reduction rule over IR. That way, it can be shared by all backends.

I measured whether removing that optimization had any effect on performance separately
from measuring the performance of this patch. Removing that optimization did not change
our score on any benchmarks.

This patch does have an overall negative effect on the Octane/regexp score. This is
presumably because tiering up to the FTL has no value to the code in the regexp test. Or
maybe it's something else. No matter - the overall effect on the Octane score is not
statistically significant and we don't want this kind of coverage blocked by the fact
that adding coverage hurts a benchmark.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGNode.h:

(JSC::DFG::Node::setIndexingType):
(JSC::DFG::Node::hasRegexpIndex):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNotifyWrite):
(JSC::DFG::SpeculativeJIT::compileIsObjectOrNull):
(JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):

• tests/stress/ftl-regexp-exec.js: Added.
• tests/stress/ftl-regexp-test.js: Added.

9:54 AM Changeset in webkit [197356] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Unreviewed. Fix the build with GTK+ < 3.19.

• platform/gtk/ScrollbarThemeGtk3.cpp:

(WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paintButton):

9:36 AM Changeset in webkit [197355] by Chris Dumez

• 4 edits in trunk

Use HTML parsing rules for textarea.maxLength
​https://bugs.webkit.org/show_bug.cgi?id=154805

Reviewed by Andreas Kling.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-forms-expected.txt:

Source/WebCore:

Use HTML parsing rules for textarea.maxLength:

• ​https://html.spec.whatwg.org/multipage/forms.html#dom-textarea-maxlength
• ​https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

No new tests, already covered by existing test.

• html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::maxLength):

9:32 AM Changeset in webkit [197354] by Chris Dumez

• 6 edits in trunk

Align td.rowSpan / td.colSpan with the specification
​https://bugs.webkit.org/show_bug.cgi?id=154803

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Align td.rowSpan / td.colSpan with the specification:

• ​https://html.spec.whatwg.org/multipage/tables.html#htmltablecellelement
• ​https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-colspan
• ​https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-rowspan

In particular, the following changes were made:

• Change type from 'long' to 'unsigned long'.
• Use HTML rules for parsing unsigned integers:
  • ​https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers
• Use 1 as default value when the input value is out of range instead of 0 when setting.
• rowspan is still clamped to [1, 8190] internally but we now expose the unclamped value to JS as this is an internal restriction. The same is done for a colSpan value of 0, we expose 0 to the Web but clamp to 1 internally.

No new tests, already covered by existing test.

• html/HTMLTableCellElement.cpp:

(WebCore::HTMLTableCellElement::colSpan):
(WebCore::HTMLTableCellElement::rowSpan):
(WebCore::HTMLTableCellElement::rowSpanForBindings):
(WebCore::HTMLTableCellElement::setColSpan):
(WebCore::HTMLTableCellElement::setRowSpanForBindings):
(WebCore::HTMLTableCellElement::axis): Deleted.
(WebCore::HTMLTableCellElement::headers): Deleted.

• html/HTMLTableCellElement.h:
• html/HTMLTableCellElement.idl:

9:28 AM Changeset in webkit [197353] by Chris Dumez

• 39 edits in trunk/Source/WebCore

[Web IDL] Add support for [TreatNullAs=EmptyString] and use it
​https://bugs.webkit.org/show_bug.cgi?id=154654

Reviewed by Darin Adler.

Add support for [TreatNullAs=EmptyString] standard Web IDL extended
attribute:

• ​http://heycam.github.io/webidl/#TreatNullAs

This replaces the WebKit-specific [TreatNullAs=NullString] IDL
extended attribute. Instead of passing a null String() to the
implementation, emptyString() is passed.

This patch does not cause any web-exposed behavior change. For
case where switching from NullString to EmptyString would change
the behavior (or require changes to the implementation), the old
IDL attribute was kept. However, it was renamed to
[TreatNullAs=LegacyNullString] to discourage its use in new code.
Eventually, this legacy IDL attribute should go away entirely.

[TreatNullAs=EmptyString] should only be used when it is present
in the corresponding specification. Note that there are a lot of
places where we use [TreatNullAs=EmptyString] in our IDL where it
does not match the specification. I have added FIXME comments for
those so we can clean them up later.

No new tests, no web-exposed behavior change.

• Modules/mediastream/RTCPeerConnection.idl:

No behavior change because this is not implemented.

• bindings/js/JSDOMBinding.cpp:

(WebCore::valueToStringTreatingNullAsEmptyString):

• bindings/js/JSDOMBinding.h:

Add new function to convert a JSValue into a String while treating
null as the empty string.

• bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):

• bindings/scripts/IDLAttributes.txt:
• Add support for [TreatNullAs=EmptyString].
• Rename NullString to LegacyNullString to discourage its use.

• bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
• bindings/scripts/test/GObject/WebKitDOMTestObj.h:
• bindings/scripts/test/JS/JSTestObj.cpp:
• bindings/scripts/test/ObjC/DOMTestObj.h:
• bindings/scripts/test/ObjC/DOMTestObj.mm:
• bindings/scripts/test/TestObj.idl:

Add bindings tests coverage for [TreatNullAs=EmptyString].

• css/CSSStyleDeclaration.idl:
• dom/CharacterData.idl:
• dom/DOMImplementation.idl:
• dom/Document.idl:
• dom/Element.idl:
• dom/ShadowRoot.idl:
• html/HTMLOutputElement.idl:
• html/HTMLScriptElement.idl:
• html/URLUtils.idl:
• svg/SVGAngle.idl:
• svg/SVGLength.idl:

Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString].
There is not behavior change because the implementation does
not distinguish the null string from the empty string.

• html/HTMLBaseElement.idl:
• html/HTMLButtonElement.idl:
• html/HTMLFormElement.idl:
• html/HTMLMediaElement.idl:
• html/HTMLSelectElement.idl:
• svg/SVGElement.idl:
• svg/SVGScriptElement.idl:

Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString],
no behavior change.

• html/HTMLDocument.idl:
• dir and *Color: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
• designMode: Drop [TreatNullAs=NullString] as per the specification:
  • ​https://html.spec.whatwg.org/multipage/dom.html#the-document-object null now gets converted to "null" instead of the null String but this does not change behavior because the implementation only recognizes "on" / "off" / others. So we still end up using inherit mode when set to null.

• html/HTMLElement.idl:
• Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString] for innerText / outerText. Does not change behavior because the implementation does not distinguishes.
• Drop [TreatNullAs=NullString] from contentEditable to match the spec:
  • ​https://html.spec.whatwg.org/multipage/interaction.html#elementcontenteditable This does not change behavior because the implementation will the a SyntaxError wether a null String or the string "null" is passed.

• html/HTMLFrameElement.idl:

Drop [TreatNullAs=NullString] from location attribute. This does not
change behavior because the attribute is using a custom setter.

• html/HTMLInputElement.idl:
• formEnctype / formMethod / autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
• value: Rename [TreatNullAs=NullString] to Rename [TreatNullAs=EmptyString], which does not change behavior because the implementation does not distinguish. Also drop the extended attribute for non-JS bindings as it has no impact.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setMediaGroup):
Drop redundant group.isNull() check as group.isEmpty() already checks for null.

• html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::setText):
Drop useless .impl() call as we have a String and the method requires a String
as input.

• html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::setValueCommon):
Use emptyString() instead of "" as it is slightly more efficient.

• html/HTMLTextAreaElement.idl:
• value: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
• autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].

• html/canvas/CanvasRenderingContext2D.idl:
• globalCompositeOperation / repetitionType: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
• lineCap / lineJoin: Drop the [TreatNullAs=NullString] to match the spec:
  • ​https://html.spec.whatwg.org/multipage/scripting.html#canvaspathdrawingstyles There is no behavior change because those are string enumerations and the value is not recognized either way (String() or String("null")).
• shadowColor: Drop the [TreatNullAs=NullString] to match the spec:
  • ​https://html.spec.whatwg.org/multipage/scripting.html#canvasshadowstyles No behavior change because this is not a valid color either way.

7:03 AM Changeset in webkit [197352] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit2

Fixed compilation with !ENABLE(DATABASE_PROCESS).
​https://bugs.webkit.org/show_bug.cgi?id=154813

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess): Added missing #if
guard.

7:01 AM Changeset in webkit [197351] by commit-queue@webkit.org

• 4 edits in trunk

[GTK] Touch slider test fails due to assertion in webkitWebViewBaseTouchEvent()
​https://bugs.webkit.org/show_bug.cgi?id=153829

Patch by Adrien Plazas <​aplazas@igalia.com> on 2016-02-29
Reviewed by Carlos Garcia Campos.

Source/WebKit2:

Once a touch event sequence is identified as a gesture, remove it
from the list of handled touch events.

• UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseTouchEvent):

LayoutTests:

• platform/gtk/TestExpectations:

Remove now passing tests from the expected failures.

6:59 AM Changeset in webkit [197350] by commit-queue@webkit.org

• 2 edits in trunk

[cmake] Allow using FindGLIB in case glib is optional dependency.
​https://bugs.webkit.org/show_bug.cgi?id=154796

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.

FindGLIB caused internal CMake error in case glibconfig.h is not
found.

• Source/cmake/FindGLIB.cmake:

5:32 AM Changeset in webkit [197349] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197303 - Shrink UnlinkedCodeBlock a bit."

This reverts commit 200002afed4ac67e3cff10bfa9d7e32d879c9a1f.

5:32 AM Changeset in webkit [197348] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots."

This reverts commit 497aed24c9437e5d994322493011412097672fab.

5:01 AM Changeset in webkit [197347] by youenn.fablet@crf.canon.fr

• 6 edits in trunk/Source/WebCore

Refactor FetchBody constructors
​https://bugs.webkit.org/show_bug.cgi?id=154721

Reviewed by Sam Weinig and Darin Adler.

Covered by existing tests.

• Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::extract): Renamed from "fromJSValue"
(WebCore::FetchBody::extractFromBody): Renamed from "fromRequestBody" and making use of move constructor.

• Modules/fetch/FetchBody.h:

(WebCore::FetchBody::FetchBody): Making default constructor public and removing empty static method.

• Modules/fetch/FetchRequest.cpp:

(WebCore::buildBody):

• Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::error):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::initializeWith):

• Modules/fetch/FetchResponse.h:

(WebCore::FetchResponse::create):

3:47 AM Changeset in webkit [197346] by Csaba Osztrogonác

• 2 edits in trunk/Source/WebKit2

[Mac][cmake] Unreviewed buildfix after r197177. Just for fun.

• PlatformMac.cmake:

3:45 AM Changeset in webkit [197345] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots.

Unreviewed follow-up fix.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
can still get called with !m_rareData, in case the type profiler is active but this
particular code block doesn't have type profiler data. Handle it gracefully.

3:45 AM Changeset in webkit [197344] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197303 - Shrink UnlinkedCodeBlock a bit.
<​https://webkit.org/b/154797>

Reviewed by Anders Carlsson.

Move profiler-related members of UnlinkedCodeBlock into its RareData
structure, saving 40 bytes, and then reorder the other members of
UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.

The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::vm):
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::addRegExp):
(JSC::UnlinkedCodeBlock::addConstant):
(JSC::UnlinkedCodeBlock::addFunctionDecl):
(JSC::UnlinkedCodeBlock::addFunctionExpr):
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
(JSC::UnlinkedCodeBlock::vm): Deleted.

3:31 AM Changeset in webkit [197343] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.12

Merge r197300 - Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
​https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.

LayoutTests:

• fast/css/variables/avoid-matched-property-cache-expected.html: Added.
• fast/css/variables/avoid-matched-property-cache.html: Added.

Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.

3:30 AM Changeset in webkit [197342] by Carlos Garcia Campos

• 10 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197299 - FTL should lower its abstract heaps to B3 heap ranges
​https://bugs.webkit.org/show_bug.cgi?id=154782

Reviewed by Saam Barati.

The FTL can describe the abstract heaps (points-to sets) that a memory operation will
affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
notion - the HeapRange. That's what this patch fixes.

B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
affects by specifying a heap range: a begin...end pair that says that the operation
affects all abstract heaps H such that begin <= H < end.

This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:

• A heap's end is greater than its begin.
• A heap's begin is greater than or equal to its parent's begin.
• A heap's end is less than or equal to its parent's end.

This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
went for the iterative traversal, which is a splendid algorithm, but it's totally
unnecessary here since we tightly control the height of the heap hierarchy.

Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
generate new ones for field names and constant indices we encounter, we can't actually
decorate the B3 instructions we create in lowering until all lowering is done. Adding a
new abstract heap to the hierarchy after ranges were already computed would require
updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
patch solves that problem by recording the associations between abstract heaps and their
intended roles in the generated IR, and then decorating all of the relevant B3 values
after we compute the ranges of the hierarchy after lowering.

This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
speed-up on any benchmark. That's not too surprising. We already have very precise CSE
in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
already been getting the big ones even without alias analysis.

Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.

• b3/B3HeapRange.h:

(JSC::B3::HeapRange::HeapRange):

• ftl/FTLAbstractHeap.cpp:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::changeParent):
(JSC::FTL::AbstractHeap::compute):
(JSC::FTL::AbstractHeap::shallowDump):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractHeap::deepDump):
(JSC::FTL::AbstractHeap::badRangeError):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::atSlow):
(JSC::FTL::IndexedAbstractHeap::initialize):
(JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
(JSC::FTL::AbstractField::dump): Deleted.

• ftl/FTLAbstractHeap.h:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::isInitialized):
(JSC::FTL::AbstractHeap::initialize):
(JSC::FTL::AbstractHeap::parent):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::AbstractHeap::range):
(JSC::FTL::AbstractHeap::offset):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::IndexedAbstractHeap::at):
(JSC::FTL::IndexedAbstractHeap::operator[]):
(JSC::FTL::IndexedAbstractHeap::returnInitialized):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
(JSC::FTL::AbstractHeap::changeParent): Deleted.
(JSC::FTL::AbstractField::AbstractField): Deleted.
(JSC::FTL::AbstractField::initialize): Deleted.
(JSC::FTL::AbstractField::offset): Deleted.

• ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::decorateMemory):
(JSC::FTL::AbstractHeapRepository::decorateCCallRead):
(JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
(JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):

• ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

• ftl/FTLOutput.cpp:

(JSC::FTL::Output::load):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::store):
(JSC::FTL::Output::store32As8):
(JSC::FTL::Output::store32As16):
(JSC::FTL::Output::baseIndex):

• ftl/FTLOutput.h:

(JSC::FTL::Output::address):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::load32):
(JSC::FTL::Output::load64):
(JSC::FTL::Output::loadPtr):
(JSC::FTL::Output::loadDouble):
(JSC::FTL::Output::store32):
(JSC::FTL::Output::store64):
(JSC::FTL::Output::storePtr):
(JSC::FTL::Output::storeDouble):
(JSC::FTL::Output::ascribeRange):
(JSC::FTL::Output::nonNegative32):
(JSC::FTL::Output::load32NonNegative):
(JSC::FTL::Output::equal):
(JSC::FTL::Output::notEqual):

• ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):

3:21 AM Changeset in webkit [197341] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197298 - SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
​https://bugs.webkit.org/show_bug.cgi?id=154794

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

No new tests needed.

• svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.

3:20 AM Changeset in webkit [197340] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197265 - Web Inspector: DataGrid's resizers aren't horizontally centered
​https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>

Reviewed by Timothy Hatcher.

• UserInterface/Views/DataGrid.css:

(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.

3:19 AM Changeset in webkit [197339] by Carlos Garcia Campos

• 10 edits in releases/WebKitGTK/webkit-2.12

Merge r197263 - Prevent cross-origin access to Location.assign() / Location.reload()
​https://bugs.webkit.org/show_bug.cgi?id=154779

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:

• ​https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

Firefox and Chrome already prevent this but WebKit allowed it.

No new tests, already covered by existing tests.

• bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.

LayoutTests:

Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().

• http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
• http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
• http/tests/security/cross-frame-access-location-get-expected.txt:
• http/tests/security/cross-frame-access-location-get-override-expected.txt:
• http/tests/security/cross-frame-access-location-get-override.html:
• http/tests/security/cross-frame-access-location-get.html:
• http/tests/security/xss-DENIED-defineProperty-expected.txt:

3:17 AM Changeset in webkit [197338] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197256 - CLoop build fix.

3:16 AM Changeset in webkit [197337] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197245 - Web Inspector: Increase clickable area of the console prompt
​https://bugs.webkit.org/show_bug.cgi?id=154719
<rdar://problem/24854538>

Reviewed by Timothy Hatcher.

Clicking on the area around CodeMirror element now moves
focus to the console prompt.

• UserInterface/Views/QuickConsole.js:

(WebInspector.QuickConsole.prototype._handleMouseDown):
Only capture mousedown events on .quick-console.
Don't capture clicks on CodeMirror.

• UserInterface/Views/QuickConsole.css:

(.quick-console > .console-prompt):
(.quick-console > .console-prompt > .CodeMirror):
Make sure .console-prompt is never an event.target for _handleMouseDown.

3:16 AM Changeset in webkit [197336] by Carlos Garcia Campos

• 8 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r197244 - Network cache: old pages returned by disk cache on history navigation after session is restored
​https://bugs.webkit.org/show_bug.cgi?id=153230

Reviewed by Chris Dumez.

Source/WebCore:

Add a flag to HistoryItem to mark them as restored from session
and use it from the FrameLoader to not change the policy request
when navigating to a history item that was restored from session,
except for iOS port.

• history/HistoryItem.h:

(WebCore::HistoryItem::setWasRestoredFromSession):
(WebCore::HistoryItem::wasRestoredFromSession):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadDifferentDocumentItem):

Source/WebKit2:

Since r181734, the network cache never revalidates resources for
history navigation. This is good for the memory cache, but in the
case of disk cache, we might end up with outdated pages when
restoring the session. When restoring the session happens because
of an API request (we also restore the session when recovering
from a web process crash), we should revalidate back forward list
requests in the disk cache if needed. This will only happen the
first time they are loaded after a session restore. After a web process
crash, resources will be used uncondionally from the disk cache.

• WebProcess/WebPage/WebBackForwardListProxy.cpp:

(WebKit::WebBackForwardListProxy::addItemFromUIProcess): Use Ref&&
instead of PassRefPtr.

• WebProcess/WebPage/WebBackForwardListProxy.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WePage::WebPage): Call restoreSessionInternal passing
No as restoredByAPIRequest parameter.
(WebKit::WebPage::restoreSessionInternal): Set restoredFromSession
flag to the created HistoryItem if the item was restored from
session by an API request.
(WebKit::WebPage::restoreSession): Call restoreSessionInternal
passing Yes as restoredByAPIRequest parameter.

• WebProcess/WebPage/WebPage.h:

3:14 AM Changeset in webkit [197335] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197242 - REGRESSION (r196741): Web Inspector: Bottom section of Layers sidebar is 1px shorter than the console prompt
​https://bugs.webkit.org/show_bug.cgi?id=154773
<rdar://problem/24873345>

Reviewed by Timothy Hatcher.

• UserInterface/Views/LayerTreeDetailsSidebarPanel.css:

(.sidebar > .panel.details.layer-tree > .content):
(.panel.details.layer-tree .bottom-bar):

3:13 AM Changeset in webkit [197334] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197236 - [GTK] Fix order of parameters in gtkdoc for webkit_web_view_get_snapshot

Unreviewed.

• UIProcess/API/gtk/WebKitWebView.cpp:

3:12 AM Changeset in webkit [197333] by Carlos Garcia Campos

• 10 edits
  1 delete in releases/WebKitGTK/webkit-2.12/Source

Merge r197226 - Remove the on demand executable allocator
​https://bugs.webkit.org/show_bug.cgi?id=154749

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Remove all the DemandExecutable code and executable allocator ifdefs.

• CMakeLists.txt:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
• JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
• JavaScriptCore.xcodeproj/project.pbxproj:
• jit/ExecutableAllocator.cpp: Removed.

(JSC::DemandExecutableAllocator::DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::~DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::bytesCommittedByAllocactors): Deleted.
(JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::allocateNewSpace): Deleted.
(JSC::DemandExecutableAllocator::notifyNeedPage): Deleted.
(JSC::DemandExecutableAllocator::notifyPageIsFree): Deleted.
(JSC::DemandExecutableAllocator::allocators): Deleted.
(JSC::DemandExecutableAllocator::allocatorsMutex): Deleted.
(JSC::ExecutableAllocator::initializeAllocator): Deleted.
(JSC::ExecutableAllocator::ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::~ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::isValid): Deleted.
(JSC::ExecutableAllocator::underMemoryPressure): Deleted.
(JSC::ExecutableAllocator::memoryPressureMultiplier): Deleted.
(JSC::ExecutableAllocator::allocate): Deleted.
(JSC::ExecutableAllocator::committedByteCount): Deleted.
(JSC::ExecutableAllocator::dumpProfile): Deleted.
(JSC::ExecutableAllocator::getLock): Deleted.
(JSC::ExecutableAllocator::isValidExecutableMemory): Deleted.
(JSC::ExecutableAllocator::reprotectRegion): Deleted.

• jit/ExecutableAllocator.h:
• jit/ExecutableAllocatorFixedVMPool.cpp:
• jit/JITStubRoutine.h:

(JSC::JITStubRoutine::canPerformRangeFilter): Deleted.
(JSC::JITStubRoutine::filteringStartAddress): Deleted.
(JSC::JITStubRoutine::filteringExtentSize): Deleted.

Source/WTF:

Remove the DeamndExecutableAllocator compile flags.

• wtf/Platform.h:

2:40 AM Changeset in webkit [197332] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197210 - Reduce direct callers of Structure::findStructuresAndMapForMaterialization
​https://bugs.webkit.org/show_bug.cgi?id=154751

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-26
Reviewed by Mark Lam.

• runtime/Structure.cpp:

(JSC::Structure::toStructureShape):
This property name iteration is identical to Structure::forEachPropertyConcurrently.
Share the code and reduce callers to the subtle findStructuresAndMapForMaterialization.

2:33 AM Changeset in webkit [197331] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197196 - Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
​https://bugs.webkit.org/show_bug.cgi?id=154743

Reviewed by Mark Lam.

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

2:26 AM Changeset in webkit [197330] by Carlos Garcia Campos

• 4 edits
  1 add
  6 deletes in releases/WebKitGTK/webkit-2.12

Merge r197194 - <g> wrapping <symbol> causes display of hidden <symbol>
​https://bugs.webkit.org/show_bug.cgi?id=154576

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2016-02-26
Reviewed by Darin Adler.
Source/WebCore:

The SVGSymbolElement is allowed in the shadow tree of an SVGUseElement
only if it subtree root element. Any descendant SVGSymbolElement should
be removed from the subtree because it is a hidden container. If the cloned
subtree includes an SVGUseElement which references an SVGSymbolElement,
the same rule will be applied to the descendant SVGUseElement. The goal
is to remove all the descendant SVGSymbolElements from the cloned target
because these SVGSymbolElements will be expanded to SVGSVGElements and
hence become visible.

• svg/SVGUseElement.cpp:

(WebCore::disassociateAndRemoveClones): A helper function which removes
cloned SVGElements and their subtrees from their parents and disassociate
them from their originals.

(WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().

(WebCore::removeSymbolElementsFromSubtree): Removes all the descendant
SVGSymbolElements from the cloned subtree. It does not remove the root
element itself if it is an SVGSymbolElement because this one will be
expanded to an SVGSVGElement which is exactly what we need.

(WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
to remove the descendant SVGSymbolElements from the cloned subtree before
appending it to the container shadow root.

LayoutTests:

Ensure the <symbol> element is not displayed when it's wrapped in a <g>
element and this <g> element is referenced by a <use> element.

• platform/gtk/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
• platform/gtk/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
• platform/ios-simulator/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
• platform/mac/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
• platform/mac/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
• platform/win/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
• svg/custom/use-on-g-containing-symbol-expected.svg: Added.
• svg/custom/use-on-g-containing-symbol.svg:

The original test was wrong. It had the following definition:

"<g id='symbol'><symbol>...</symbol></g>"

And it was expecting to have the symbol drawn if the <g> element was
referenced like that

"<use xlink:href='#symbol'/>"

FireFox does not render anything for this <use> element which is correct.
With this patch, this test failed so it had to be modified to test the right
behavior. Also it is now converted to a ref test.

2:23 AM Changeset in webkit [197329] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197186 - [JSC] Add32(Imm, Tmp, Tmp) does not ZDef the destination if Imm is zero
​https://bugs.webkit.org/show_bug.cgi?id=154704

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-02-26
Reviewed by Geoffrey Garen.

If the Imm is zero, we should still zero the top bits
to match the definition in AirOpcodes.

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::add32):

• b3/testb3.cpp:

2:08 AM Changeset in webkit [197328] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197180 - Cache::traverse should pass the record info to its traversal handler
​https://bugs.webkit.org/show_bug.cgi?id=154695

Reviewed by Antti Koivisto.

• NetworkProcess/NetworkProcess.cpp:

(WebKit::fetchDiskCacheEntries):
(WebKit::clearDiskCacheEntries):

• NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::traverse):

• NetworkProcess/cache/NetworkCache.h:

2:06 AM Changeset in webkit [197327] by commit-queue@webkit.org

• 2 edits in trunk

Unreviewed, rolling out r197297.
​https://bugs.webkit.org/show_bug.cgi?id=154810

This change broke build of GTK from scratch (Requested by
annulen on #webkit).

Reverted changeset:

"[cmake] Allow using FindGLIB in case glib is optional
dependency."
​https://bugs.webkit.org/show_bug.cgi?id=154796
​http://trac.webkit.org/changeset/197297

2:03 AM Changeset in webkit [197326] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197169 - Web Inspector: Option-clicking on the a CSS property sometimes doesn't work
​https://bugs.webkit.org/show_bug.cgi?id=154384
<rdar://problem/24714755>

Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.

It seems as though there were race conditions between CodeMirror's event
and the native mousemove such that if CodeMirror fired second, the current
candidate was cleared, and would not reset itself until the cursor was
moved, at which point the same issue could happen. To fix this, the current
candidate is no longer cleared by CodeMirror's event and is instead only
modified by the native mouse-events.

• UserInterface/Controllers/CodeMirrorTokenTrackingController.js:

(WebInspector.CodeMirrorTokenTrackingController.prototype._hidePopover):

2:02 AM Changeset in webkit [197325] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197164 - [DFG] Drop unnecessary proved type branch in ToPrimitive
​https://bugs.webkit.org/show_bug.cgi?id=154716

Reviewed by Geoffrey Garen.

This branching based on the proved types is unnecessary because this is already handled in constant folding phase.
In fact, the DFGSpeculativeJIT64.cpp case is already removed in r164243.
This patch removes the remaining JIT32_64 case.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

2:02 AM Changeset in webkit [197324] by Carlos Garcia Campos

• 8 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197159 - [JSC] Be aggressive with OSR Entry to FTL if the DFG function was only used for OSR Entry itself
​https://bugs.webkit.org/show_bug.cgi?id=154575

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-02-25
Reviewed by Filip Pizlo.

I noticed that imaging-gaussian-blur spends most of its
samples in DFG code despite executing most of the loop
iterations in FTL.

On this particular test, the main function is only entered
once and have a very heavy loop there. What happens is DFG
starts by compiling the full function in FTL. That takes about
8 to 10 milliseconds during which the DFG code makes very little
progress. The calls to triggerOSREntryNow() try to OSR Enter
for a while then finally start compiling something. By the time
the function is ready, we have wasted a lot of time in DFG code.

What this patch does is set a flag when a DFG function is entered.
If we try to triggerOSREntryNow() and the flag was never set,
we start compiling both the full function and the one for OSR Entry.

• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntryExecutionFlag):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

• dfg/DFGJITCompiler.h:
• dfg/DFGOperations.cpp:
• dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan): Deleted.

• dfg/DFGPlan.h:
• dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):

1:53 AM Changeset in webkit [197323] by Carlos Garcia Campos

• 2 edits
  1 add in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197155 - [JSC] Temporal Dead Zone checks on "this" are eliminated when doing OSR Entry to FTL
​https://bugs.webkit.org/show_bug.cgi?id=154664

Reviewed by Saam Barati.

When doing OSR Enter into a constructor, we lose the information
that this may have been set to empty by a previously executed block.

All the code just assumed the type for a FlushedJS value and thus
not an empty value. It was then okay to eliminate the TDZ checks.

In this patch, the values on root entry now assume they may be empty.
As a result, the SetArgument() for "this" has "empty" as possible
type and the TDZ checks are no longer eliminated.

• dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::initialize):

[JSC] Add the test for r197155
​https://bugs.webkit.org/show_bug.cgi?id=154715

Reviewed by Mark Lam.

Silly me. I forgot the test in the latest patch update.

• tests/stress/class-syntax-tdz-osr-entry-in-loop.js: Added.

1:45 AM Changeset in webkit [197322] by Carlos Garcia Campos

• 14 edits
  34 deletes in releases/WebKitGTK/webkit-2.12

Merge r197142 - CSP: Remove SecurityPolicy script interface
​https://bugs.webkit.org/show_bug.cgi?id=154694
<rdar://problem/24846482>

Reviewed by Andy Estes.

Source/WebCore:

Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
enabled when building with ENABLE(CSP_NEXT) (disabled by default).

For completeness, the SecurityPolicy interface was removed from the Content Security Policy 1.1 spec.
in <​https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a> (12/26/2013).

• CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
• DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
• DerivedSources.make: Remove file DOMSecurityPolicy.idl.
• PlatformGTK.cmake: Ditto.
• PlatformMac.cmake: Ditto.
• WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
• bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
• dom/Document.cpp:

(WebCore::Document::securityPolicy): Deleted.

• dom/Document.h:
• dom/Document.idl: Remove attribute securityPolicy.
• page/DOMSecurityPolicy.cpp: Removed.
• page/DOMSecurityPolicy.h: Removed.
• page/DOMSecurityPolicy.idl: Removed.

LayoutTests:

Remove SecurityPolicy tests and update platform-specific expected results as needed.

• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi-expected.txt: Removed.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html: Removed.
• http/tests/security/contentSecurityPolicy/resources/securitypolicy-tests-base.js: Removed.
• platform/gtk/js/dom/global-constructors-attributes-expected.txt: Update expected result as needed.
• platform/win/js/dom/global-constructors-attributes-expected.txt: Ditto.

1:27 AM Changeset in webkit [197321] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197141 - Don't clear the weak JSString cache on memory pressure.
<​https://webkit.org/b/154693>

Reviewed by Antti Koivisto.

This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
still alive anyway. This way we keep the ability to deduplicate common strings.

• platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.

1:25 AM Changeset in webkit [197320] by Carlos Garcia Campos

• 4 edits
  1 delete in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r197138 - Unreviewed test gardening.

Fix a test flake where order doesn't matter.

• platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Removed.
• storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt:
• storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-private-expected.txt:
• storage/indexeddb/resources/deletedatabase-delayed-by-open-and-versionchange.js:

(prepareDatabase.request.onblocked):
(onOpenSuccess):

1:25 AM Changeset in webkit [197319] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197134 - [JSC] Remove a useless "Move" in the lowering of Select
​https://bugs.webkit.org/show_bug.cgi?id=154670

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-02-25
Reviewed by Geoffrey Garen.

I left the Move instruction when creating the aliasing form
of Select.

On ARM64, that meant a useless move for any case that can't
be coalesced.

On x86, that meant an extra constraint on child2, making it
stupidly hard to alias child1.

• b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createSelect): Deleted.

1:15 AM Changeset in webkit [197318] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197125 - REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
​https://bugs.webkit.org/show_bug.cgi?id=154331

Reviewed by Darin Adler.

This is not an actual regression. The bug did exist before r196268 but
the whole document was leaking once an SVGAnimatedProperty was created
so there was no way to produce this bug. After fixing the leak, one crash
and one assert got uncovered. Both of them happen because of the fact:
"if an SVGAnimatedProperty is not referenced it will be deleted."

• svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::lookupOrCreateDWrapper):
The code in this function was assuming that the wrapper will be created
only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
is called. Before making this single call, lookupOrCreateDWrapper() was
building an initial SVGPathSegList from byte stream. But now
SVGAnimatedProperty::lookupWrapper() can return false even after creating
the SVGAnimatedProperty because it was deleted later. Calling
buildSVGPathSegListFromByteStream() more than once was causing
SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
The fix is to build the initial SVGPathSegList only once which should happen
when m_pathSegList.value.isEmpty().

(WebCore::SVGPathElement::animatedPropertyWillBeDeleted):

• svg/SVGPathElement.h:
• svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:

(WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
SVGPathElement is assuming the following equivalence relation:
m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
created but nothing sets m_pathSegList.shouldSynchronize back to false.
This was not a problem when the SVGAnimatedProperty was leaking but after
ensuring it is deleted when it is not referenced this equivalence relation
becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
to crash when we check m_pathSegList.shouldSynchronize and if it is true we
assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
when the associated SVGAnimatedProperty is deleted.

1:13 AM Changeset in webkit [197317] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12

Merge r197123 - HashMap::ensure() should return an AddResult like all the other add-like functions.
​https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

While adopting HashMap::ensure(), I found it was useful in some circumstances to know
if the value was added or not. While I could discern this information by setting a bool
in the passed in lambda, it seemed clearer and more idiomatic to just have ensure return
an AddResult like all the other add-like functions do.

• wtf/HashMap.h:

Change return type of HashMap::ensure() to be an AddResult.

Tools:
HashMap::ensure() should return an AddResult like all the other add-like functions
​https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

• TestWebKitAPI/Tests/WTF/HashMap.cpp:

(TestWebKitAPI::TEST):
Update tests to use/test the new AddResult result.

12:36 AM Changeset in webkit [197316] by Antti Koivisto

• 3 edits
  2 adds in trunk

::slotted doesn't work in nested shadow trees
​https://bugs.webkit.org/show_bug.cgi?id=154765
<rdar://problem/24870995>

Reviewed by Ryosuke Niwa.

Source/WebCore:

See ​https://github.com/w3c/webcomponents/issues/331#issuecomment-189191593

Test: fast/shadow-dom/css-scoping-shadow-slotted-nested.html

• css/ElementRuleCollector.cpp:

(WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

Collect ::slotted rules from all the nested shadow trees instead of just the host's.

LayoutTests:

• fast/shadow-dom/css-scoping-shadow-slotted-nested-expected.html: Added.
• fast/shadow-dom/css-scoping-shadow-slotted-nested.html: Added.

Feb 28, 2016:

11:36 PM Changeset in webkit [197315] by Carlos Garcia Campos

• 9 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197306 - Reduce uses of PassRefPtr in indexeddb
​https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

• Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

• Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

• Modules/indexeddb/IDBKeyData.h:
• Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::IDBKeyRange):
(WebCore::IDBKeyRange::only):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

• Modules/indexeddb/IDBKeyRangeData.h:
• Modules/indexeddb/IDBServerConnection.h:
• Modules/indexeddb/legacy/IDBCallbacks.h:
• Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

• Modules/indexeddb/legacy/IDBCursorBackend.h:
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

• Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

• Modules/indexeddb/legacy/LegacyCursor.h:
• Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

• Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

• Modules/indexeddb/legacy/LegacyRequest.h:
• inspector/InspectorIndexedDBAgent.cpp:

11:36 PM Changeset in webkit [197314] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197246 - Unreviewed. Fix GTK+ clean build.

Add missing header include.

• WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

11:35 PM Changeset in webkit [197313] by Carlos Garcia Campos

• 11 edits
  3 adds in releases/WebKitGTK/webkit-2.12

Merge r197231 - Modern IDB: New database versions are never committed to SQLite.
<rdar://problem/24860952> and ​https://bugs.webkit.org/show_bug.cgi?id=154741

Modern IDB: If a database handle is not open, files are not actually deleted from disk
​https://bugs.webkit.org/show_bug.cgi?id=154756

Reviewed by Alex Christensen.

Source/WebCore:

Tested by API test "IndexedDBPersistence"

• Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually

set the new version on disk.

• Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
(WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.

This is necessary to both read the current database version, and to actually delete the file on disk.

(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently

deleted database info" from the version returned by deleteBackingStore.

• Modules/indexeddb/server/UniqueIDBDatabase.h:

Source/WebKit2:

Add WK2 SPI to force termination of the database process.

• UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _terminateDatabaseProcess]):

• UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess):

• UIProcess/WebProcessPool.h:

Tools:

This also happens to test the previously untested fix for ​http://trac.webkit.org/changeset/197190

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-1.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-2.html: Added.
• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence.mm: Added.

(-[IndexedDBNavigationDelegate webView:didFinishNavigation:]):
(-[IndexedDBMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST):

11:35 PM Changeset in webkit [197312] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197190 - Modern IDB: Using existing database info from SQLite backing store is busted.
<rdar://problem/24848143> and ​https://bugs.webkit.org/show_bug.cgi?id=154735

Reviewed by Alex Christensen.

No new tests.

Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
read in the existing IDBDatabaseInfo.

Our automated infrastructure currently has no way of testing this.

• Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::openDatabase):

• Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on

the IndexRecords table here; *every* time we open a SQLite backing store.

(WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.

• Modules/indexeddb/shared/IDBDatabaseInfo.cpp:

(WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

11:35 PM Changeset in webkit [197311] by Carlos Garcia Campos

• 40 edits
  71 deletes in releases/WebKitGTK/webkit-2.12/Source

Merge r197131 - Remove LegacyIDB.
​https://bugs.webkit.org/show_bug.cgi?id=150854

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (No change in behavior).

• CMakeLists.txt:
• Modules/indexeddb/DOMWindowIndexedDatabase.cpp:

(WebCore::DOMWindowIndexedDatabase::indexedDB):

• Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
• Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
• Modules/indexeddb/IDBFactory.h:
• Modules/indexeddb/IDBIndex.h:
• Modules/indexeddb/IDBIndexMetadata.h: Removed.
• Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
• Modules/indexeddb/IDBOperation.h: Removed.
• Modules/indexeddb/IDBServerConnection.h: Removed.
• Modules/indexeddb/IDBTransaction.h:
• Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:

(WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):

• Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
• Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
• Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
• Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
• Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
• Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
• Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
• Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
• Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
• Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
• Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
• Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
• Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
• Modules/indexeddb/legacy/LegacyAny.h: Removed.
• Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
• Modules/indexeddb/legacy/LegacyCursor.h: Removed.
• Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
• Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
• Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
• Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
• Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
• Modules/indexeddb/legacy/LegacyFactory.h: Removed.
• Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
• Modules/indexeddb/legacy/LegacyIndex.h: Removed.
• Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
• Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
• Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
• Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
• Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
• Modules/indexeddb/legacy/LegacyRequest.h: Removed.
• Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
• Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
• Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
• Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
• Modules/indexeddb/server/SQLiteIDBCursor.cpp:

(WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
(WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
(WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

• Modules/indexeddb/server/SQLiteIDBCursor.h:
• Modules/indexeddb/shared/IDBIndexInfo.h:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/IDBBindingUtilities.cpp:

(WebCore::generateIndexKeysForValue): Deleted.

• bindings/js/IDBBindingUtilities.h:
• bindings/js/JSMainThreadExecState.cpp:

(WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.

• inspector/InspectorIndexedDBAgent.cpp:
• loader/EmptyClients.cpp:
• page/DatabaseProvider.cpp:

(WebCore::DatabaseProvider::idbFactoryBackend): Deleted.

• page/DatabaseProvider.h:
• platform/CrossThreadCopier.cpp:

(WebCore::IDBDatabaseMetadata>::copy): Deleted.
(WebCore::IDBIndexMetadata>::copy): Deleted.
(WebCore::IDBObjectStoreMetadata>::copy): Deleted.

• platform/CrossThreadCopier.h:

Source/WebKit:

• Storage/WebDatabaseProvider.cpp:

(WebDatabaseProvider::createIDBFactoryBackend): Deleted.

• Storage/WebDatabaseProvider.h:

Source/WebKit2:

• CMakeLists.txt:
• DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateLegacyUniqueIDBDatabase): Deleted.
(WebKit::DatabaseProcess::removeLegacyUniqueIDBDatabase): Deleted.

• DatabaseProcess/DatabaseProcess.h:
• DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didClose):
(WebKit::DatabaseToWebProcessConnection::didReceiveMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::establishIDBConnection): Deleted.
(WebKit::DatabaseToWebProcessConnection::removeDatabaseProcessIDBConnection): Deleted.

• DatabaseProcess/DatabaseToWebProcessConnection.h:
• DatabaseProcess/DatabaseToWebProcessConnection.messages.in:
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp: Removed.
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h: Removed.
• DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.messages.in: Removed.
• DatabaseProcess/IndexedDB/IDBIdentifier.h: Removed.
• DatabaseProcess/IndexedDB/IDBSerialization.cpp: Removed.
• DatabaseProcess/IndexedDB/IDBSerialization.h: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.cpp: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.h: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.cpp: Removed.
• DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.h: Removed.
• DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h: Removed.
• DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.h: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.h: Removed.
• DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp: Removed.
• DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h: Removed.
• DerivedSources.make:
• Shared/WebCrossThreadCopier.cpp:

(WebCore::LegacyUniqueIDBDatabaseIdentifier>::copy): Deleted.
(WebCore::IDBIdentifier>::copy): Deleted.

• Shared/WebCrossThreadCopier.h:
• WebKit2.xcodeproj/project.pbxproj:
• WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp: Removed.
• WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.h: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.cpp: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.h: Removed.
• WebProcess/Databases/IndexedDB/WebIDBServerConnection.messages.in: Removed.
• WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::createIDBFactoryBackend): Deleted.

• WebProcess/Databases/WebDatabaseProvider.h:
• WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage): Deleted.
(WebKit::WebToDatabaseProcessConnection::registerWebIDBServerConnection): Deleted.
(WebKit::WebToDatabaseProcessConnection::removeWebIDBServerConnection): Deleted.

• WebProcess/Databases/WebToDatabaseProcessConnection.h:
• WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

11:33 PM Changeset in webkit [197310] by Carlos Garcia Campos

• 10 edits
  1 add
  78 deletes in releases/WebKitGTK/webkit-2.12

Merge r197122 - Modern IDB: WebKit 2 IPC layer.
​https://bugs.webkit.org/show_bug.cgi?id=153808

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by over 1,000 existing tests).

• Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
(WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

Source/WebKit2:

• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad): This ASSERT fires on most WK2 tests. Alex said remove it.

• WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::putOrAdd): Properly encode the overwrite flag.

• WebProcess/Databases/WebDatabaseProvider.h: Enable Modern IDB.

LayoutTests:

• Consolidate all test failures to the platform agnostic TestExpectations file.
• Remove all existing WK2-specific results.
• Add one new WK2-specific result.
• Skip two WK2-only failures.

• TestExpectations:
• platform/mac-wk1/TestExpectations:
• platform/mac-wk2/TestExpectations:
• platform/wk2/TestExpectations:
• platform/wk2/imported/w3c/indexeddb/abort-in-initial-upgradeneeded-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor-advance-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index9-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_advance_objectstore5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index5-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index6-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index8-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_invalid-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_continue_objectstore6-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_delete_index4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbcursor_delete_objectstore4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbdatabase_close2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbdatabase_deleteObjectStore4-not_reused-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbfactory_deleteDatabase3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbfactory_open12-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex-multientry-big-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_get3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_get7-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_getKey7-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_openCursor2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbindex_openKeyCursor3-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_add4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex2-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex4-deleteIndex-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex6-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex7-event_order-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbobjectstore_put4-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbtransaction_abort-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/idbversionchangeevent-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-constrainterror-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/keygenerator-overflow-expected.txt: Removed.
• platform/wk2/imported/w3c/indexeddb/transaction-requestqueue-expected.txt: Removed.
• platform/wk2/storage/indexeddb/aborted-versionchange-closes-expected.txt: Removed.
• platform/wk2/storage/indexeddb/bad-keypath-expected.txt: Removed.
• platform/wk2/storage/indexeddb/basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/clear-expected.txt: Removed.
• platform/wk2/storage/indexeddb/create-and-remove-object-store-expected.txt: Removed.
• platform/wk2/storage/indexeddb/create-objectstore-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-continue-dir-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-continue-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursor-finished-expected.txt: Removed.
• platform/wk2/storage/indexeddb/cursors-expected.txt: Removed.
• platform/wk2/storage/indexeddb/database-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/deleteIndex-bug110792-expected.txt: Removed.
• platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Added.
• platform/wk2/storage/indexeddb/index-count-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-abort-in-initial-upgradeneeded-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-close-in-oncomplete-expected.txt: Removed.
• platform/wk2/storage/indexeddb/intversion-close-in-upgradeneeded-expected.txt: Removed.
• platform/wk2/storage/indexeddb/invalid-keys-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-delete-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-inline-and-passed-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-put-no-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-requirements-put-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/key-type-array-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keypath-arrays-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keypath-edges-expected.txt: Removed.
• platform/wk2/storage/indexeddb/keyrange-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/bad-keypath-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/clear-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/create-objectstore-basics-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/cursors-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-delete-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-inline-and-passed-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-put-no-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/key-requirements-put-null-key-expected.txt: Removed.
• platform/wk2/storage/indexeddb/mozilla/readonly-transactions-expected.txt: Removed.
• platform/wk2/storage/indexeddb/object-lookups-in-versionchange-expected.txt: Removed.
• platform/wk2/storage/indexeddb/objectstore-count-expected.txt: Removed.
• platform/wk2/storage/indexeddb/open-cursor-expected.txt: Removed.
• platform/wk2/storage/indexeddb/readonly-transactions-expected.txt: Removed.
• platform/wk2/storage/indexeddb/request-result-cache-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-abort-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-active-flag-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-after-close-expected.txt: Removed.
• platform/wk2/storage/indexeddb/transaction-read-only-expected.txt: Removed.
• platform/wk2/storage/indexeddb/version-change-exclusive-expected.txt: Removed.

10:57 PM Changeset in webkit [197309] by Carlos Garcia Campos

• 22 edits
  1 copy
  1 add in releases/WebKitGTK/webkit-2.12

Merge r197118 - CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
​https://bugs.webkit.org/show_bug.cgi?id=154522
<rdar://problem/24762078>

Reviewed by Brent Fulgham.

Source/WebCore:

Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
of the Content Security Policy Level 3 spec., <​https://w3c.github.io/webappsec-csp/> (24 February 2016).
Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
of whether ENABLE(CSP_NEXT) is enabled.

Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

• WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
• dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
• dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
to support attributes statusCode and columnNumebr.

• dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
and send a violation report (if applicable).

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served
document per section Reporting of the Content Security Policy 2.0 spec, <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.
Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.

• TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

so that we run them.

• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
building with ENABLE(CSP_NEXT) disabled.

• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
• js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
• platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
• platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.

9:26 PM Changeset in webkit [197308] by akling@apple.com

• 7 edits in trunk/Source/JavaScriptCore

Make JSFunction.name allocation fully lazy.
<​https://webkit.org/b/154806>

Reviewed by Saam Barati.

We were reifying the "name" field on functions lazily, but created the string
value itself up front. This patch gets rid of the up-front allocation,
saving us a JSString allocation per function in most cases.

• builtins/BuiltinExecutables.cpp:

(JSC::createExecutableInternal):

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::visitChildren):

• bytecode/UnlinkedFunctionExecutable.h:
• runtime/CodeCache.cpp:

(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

• runtime/Executable.h:
• runtime/JSFunction.cpp:

(JSC::JSFunction::reifyName):

8:36 PM Changeset in webkit [197307] by Chris Dumez

• 4 edits in trunk

Parse HTMLOLElement.start as per the HTML spec
​https://bugs.webkit.org/show_bug.cgi?id=154802

Reviewed by Andreas Kling.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-grouping-expected.txt:

Source/WebCore:

Parse HTMLOLElement.start as per the HTML spec:

• ​https://html.spec.whatwg.org/multipage/semantics.html#dom-ol-start
• ​https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-integers

No new tests, already covered by existing test.

• html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

5:57 PM Changeset in webkit [197306] by Gyuyoung Kim

• 9 edits in trunk/Source/WebCore

Reduce uses of PassRefPtr in indexeddb
​https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

• Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

• Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

• Modules/indexeddb/IDBKeyData.h:
• Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::IDBKeyRange):
(WebCore::IDBKeyRange::only):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

• Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

• Modules/indexeddb/IDBKeyRangeData.h:
• Modules/indexeddb/IDBServerConnection.h:
• Modules/indexeddb/legacy/IDBCallbacks.h:
• Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

• Modules/indexeddb/legacy/IDBCursorBackend.h:
• Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

• Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

• Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

• Modules/indexeddb/legacy/LegacyCursor.h:
• Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

• Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

• Modules/indexeddb/legacy/LegacyRequest.h:
• inspector/InspectorIndexedDBAgent.cpp:

5:44 PM Changeset in webkit [197305] by akling@apple.com

• 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r197303): 4 jsc tests failing on bots.

Unreviewed follow-up fix.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
can still get called with !m_rareData, in case the type profiler is active but this
particular code block doesn't have type profiler data. Handle it gracefully.

4:32 PM Changeset in webkit [197304] by weinig@apple.com

• 24 edits
  1 add
  1 delete in trunk

Reimplement WKPageGroup in terms of WKUserContentController
​https://bugs.webkit.org/show_bug.cgi?id=154804

Reviewed by Dan Bernstein.

Source/WebKit2:

Instead of having both WebPageGroup and WebUserContentControllerProxy both keep track
of user scripts and user stylesheets, give WebPageGroup a WebUserContentControllerProxy
and let it take care of things. This allows us to remove a ton of duplicate code, and
provides a convenient way for clients currently using PageGroup based user content insertion
to start using UserContentController, since they can now be used at the same time.

When using WKPageConfigurationRef, the rule is:

• If you don't set a WKUserContentControllerRef, the one from the WKPageGroupRef will be used.
• If you do set a WKUserContentControllerRef, it will be used, and the one from the WKPageGroupRef will do nothing for that web view.

• DerivedSources.make:

Remove WebPageGroupProxy. It no longer is a MessageReceiver.

• Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::encode):
(WebKit::WebPageGroupData::decode):

• Shared/WebPageGroupData.h:

Stop encoding/decoding user content, instead just encode the identifier to the UserContentController.

• UIProcess/API/C/WKPageGroup.cpp:

(WKPageGroupGetUserContentController):

• UIProcess/API/C/WKPageGroup.h:

Add getter for the underlying WKUserContentControllerRef.

• UIProcess/API/cpp/WKRetainPtr.h:

(WebKit::retainWK):
Add retainWK() helper to match RetainPtr's retainPtr() helper.

• UIProcess/WebPageGroup.cpp:

(WebKit::WebPageGroup::WebPageGroup):
(WebKit::WebPageGroup::userContentController):
(WebKit::WebPageGroup::addUserStyleSheet):
(WebKit::WebPageGroup::addUserScript):
(WebKit::WebPageGroup::removeAllUserStyleSheets):
(WebKit::WebPageGroup::removeAllUserScripts):
(WebKit::WebPageGroup::removeAllUserContent):
(WebKit::WebPageGroup::addUserContentExtension):
(WebKit::WebPageGroup::removeUserContentExtension):
(WebKit::WebPageGroup::removeAllUserContentExtensions):

• UIProcess/WebPageGroup.h:

Pass through to the WebUserContentControllerProxy.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::WebPageProxy):
(WebKit::WebPageProxy::finishInitializingWebPageAfterProcessLaunch):
(WebKit::WebPageProxy::creationParameters):

• UIProcess/WebPageProxy.h:

WebPageProxies always have a WebUserContentControllerProxy now, so it can go in a Ref and
a few branches can be removed.

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::createWebPage):
If a UserContentController is not passed in, use the one from the PageGroup.

• WebKit2.xcodeproj/project.pbxproj:

Remove files.

• WebProcess/InjectedBundle/InjectedBundle.cpp:

Add some #includes that are now needed.

• WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::getOrCreate):

• WebProcess/UserContent/WebUserContentController.h:

Modernize WebUserContentController::getOrCreate to return a Ref.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage):
(WebKit::m_shouldDispatchFakeMouseMoveEvents):
(WebKit::WebPage::addUserScript):
(WebKit::WebPage::addUserStyleSheet):
(WebKit::WebPage::removeAllUserContent):

• WebProcess/WebPage/WebPage.h:

Store the WebUserContentController in Ref, remove unnecessary branches/asserts.

• WebProcess/WebPage/WebPageGroupProxy.cpp:

(WebKit::WebPageGroupProxy::WebPageGroupProxy):
(WebKit::WebPageGroupProxy::~WebPageGroupProxy):
(WebKit::WebPageGroupProxy::userContentController):
(WebKit::WebPageGroupProxy::addUserStyleSheet): Deleted.
(WebKit::WebPageGroupProxy::addUserScript): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserStyleSheets): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserScripts): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContent): Deleted.
(WebKit::WebPageGroupProxy::addUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContentExtensions): Deleted.

• WebProcess/WebPage/WebPageGroupProxy.h:

Store a WebUserContentController in a Ref, remove now unnecessary message handling functions.

• WebProcess/WebPage/WebPageGroupProxy.messages.in:

Removed.

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::didReceiveMessage):
Remove routing to WebPageGroupProxy, which is no longer a MessageReceiver.

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit2/PageGroup.cpp: Added.

2:21 PM Changeset in webkit [197303] by akling@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Shrink UnlinkedCodeBlock a bit.
<​https://webkit.org/b/154797>

Reviewed by Anders Carlsson.

Move profiler-related members of UnlinkedCodeBlock into its RareData
structure, saving 40 bytes, and then reorder the other members of
UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.

The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::vm):
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::addRegExp):
(JSC::UnlinkedCodeBlock::addConstant):
(JSC::UnlinkedCodeBlock::addFunctionDecl):
(JSC::UnlinkedCodeBlock::addFunctionExpr):
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
(JSC::UnlinkedCodeBlock::vm): Deleted.

1:56 PM Changeset in webkit [197302] by weinig@apple.com

• 17 edits in trunk

Source/WebKit2:
Bind _WKUserStyleSheets to _WKUserContentWorlds to allow for grouping of user content by associating to a world
​https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

Treat _WKUserStyleSheets like WKUserScripts and allow them to be bound to a _WKUserContentWorld.
The immediate benefit of this is allowing a client to bind a set of user content (scripts and stylesheets
for now) to a world and have them easily remove all user content associated with that world easily.

• Shared/API/APIArray.h:

Add helpers removeAllMatching and removeAllOfTypeMatching.

• UIProcess/API/APIUserStyleSheet.h:

Add API::UserContentWorld member.

• UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _removeAllUserScriptsAssociatedWithUserContentWorld:]):
(-[WKUserContentController _removeAllUserStyleSheetsAssociatedWithUserContentWorld:]):

• UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:

Add _removeAllUserScriptsAssociatedWithUserContentWorld and _removeAllUserStyleSheetsAssociatedWithUserContentWorld.

• UIProcess/API/Cocoa/WKUserScript.mm:

(-[WKUserScript _initWithSource:injectionTime:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
(toStringVector): Deleted.

• UIProcess/API/Cocoa/_WKUserContentWorldInternal.h:

(API::toStringVector):
Move toStringVector to a location where it can be shared.

• UIProcess/API/Cocoa/_WKUserStyleSheet.h:
• UIProcess/API/Cocoa/_WKUserStyleSheet.mm:

(-[_WKUserStyleSheet initWithSource:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
Add new initializer which has a world to be bound to. While here, match WKUserScript and add support for the
legacy whitelist and blacklists.

• UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::removeProcess):
(WebKit::WebUserContentControllerProxy::addUserContentWorldUse):
(WebKit::WebUserContentControllerProxy::shouldSendRemoveUserContentWorldsMessage):
(WebKit::WebUserContentControllerProxy::removeUserContentWorldUses):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):

• UIProcess/UserContent/WebUserContentControllerProxy.h:

Refactor to share the code which decides whether to send AddUserContentWorlds/RemoveUserContentWorlds
messages.

• WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::addUserContentWorlds):
(WebKit::WebUserContentController::removeUserContentWorlds):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):
(WebKit::WebUserContentController::addUserStyleSheets):
(WebKit::WebUserContentController::removeUserStyleSheet):
(WebKit::WebUserContentController::removeAllUserStyleSheets):

• WebProcess/UserContent/WebUserContentController.h:
• WebProcess/UserContent/WebUserContentController.messages.in:

Add support for binding stylesheets to worlds and allow removing all the scripts/stylesheets from a
set of worlds at once by passing Vectors of world identifiers in the remove messages.

Tools:
Bind _WKUserStyleSheets to WKUserContentWorlds to allow for grouping of user content by associating to a world
​https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

• TestWebKitAPI/Tests/WebKit2Cocoa/UserContentController.mm:

Add tests for removing _WKUserStyleSheets and WKUserScripts

1:00 PM Changeset in webkit [197301] by timothy_horton@apple.com

• 5 edits in trunk

Switch to application/vnd.apple.folder for <attachment> folder special-case
​https://bugs.webkit.org/show_bug.cgi?id=154786
<rdar://problem/24416632>

Reviewed by Anders Carlsson.

Source/WebCore:

No new tests, adjusted an existing test to cover this.

• rendering/RenderThemeMac.mm:

(WebCore::iconForAttachment):
Add a second folder MIME type.

LayoutTests:

• fast/attachment/attachment-folder-icon-expected.html:
• fast/attachment/attachment-folder-icon.html:

12:42 PM Changeset in webkit [197300] by timothy_horton@apple.com

• 3 edits
  2 adds in trunk

Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
​https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.

LayoutTests:

• fast/css/variables/avoid-matched-property-cache-expected.html: Added.
• fast/css/variables/avoid-matched-property-cache.html: Added.

Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.

12:34 PM Changeset in webkit [197299] by fpizlo@apple.com

• 10 edits in trunk/Source/JavaScriptCore

FTL should lower its abstract heaps to B3 heap ranges
​https://bugs.webkit.org/show_bug.cgi?id=154782

Reviewed by Saam Barati.

The FTL can describe the abstract heaps (points-to sets) that a memory operation will
affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
notion - the HeapRange. That's what this patch fixes.

B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
affects by specifying a heap range: a begin...end pair that says that the operation
affects all abstract heaps H such that begin <= H < end.

This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:

• A heap's end is greater than its begin.
• A heap's begin is greater than or equal to its parent's begin.
• A heap's end is less than or equal to its parent's end.

This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
went for the iterative traversal, which is a splendid algorithm, but it's totally
unnecessary here since we tightly control the height of the heap hierarchy.

Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
generate new ones for field names and constant indices we encounter, we can't actually
decorate the B3 instructions we create in lowering until all lowering is done. Adding a
new abstract heap to the hierarchy after ranges were already computed would require
updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
patch solves that problem by recording the associations between abstract heaps and their
intended roles in the generated IR, and then decorating all of the relevant B3 values
after we compute the ranges of the hierarchy after lowering.

This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
speed-up on any benchmark. That's not too surprising. We already have very precise CSE
in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
already been getting the big ones even without alias analysis.

Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.

• b3/B3HeapRange.h:

(JSC::B3::HeapRange::HeapRange):

• ftl/FTLAbstractHeap.cpp:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::changeParent):
(JSC::FTL::AbstractHeap::compute):
(JSC::FTL::AbstractHeap::shallowDump):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractHeap::deepDump):
(JSC::FTL::AbstractHeap::badRangeError):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::atSlow):
(JSC::FTL::IndexedAbstractHeap::initialize):
(JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
(JSC::FTL::AbstractField::dump): Deleted.

• ftl/FTLAbstractHeap.h:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::isInitialized):
(JSC::FTL::AbstractHeap::initialize):
(JSC::FTL::AbstractHeap::parent):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::AbstractHeap::range):
(JSC::FTL::AbstractHeap::offset):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::IndexedAbstractHeap::at):
(JSC::FTL::IndexedAbstractHeap::operator[]):
(JSC::FTL::IndexedAbstractHeap::returnInitialized):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
(JSC::FTL::AbstractHeap::changeParent): Deleted.
(JSC::FTL::AbstractField::AbstractField): Deleted.
(JSC::FTL::AbstractField::initialize): Deleted.
(JSC::FTL::AbstractField::offset): Deleted.

• ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::decorateMemory):
(JSC::FTL::AbstractHeapRepository::decorateCCallRead):
(JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
(JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):

• ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

• ftl/FTLOutput.cpp:

(JSC::FTL::Output::load):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::store):
(JSC::FTL::Output::store32As8):
(JSC::FTL::Output::store32As16):
(JSC::FTL::Output::baseIndex):

• ftl/FTLOutput.h:

(JSC::FTL::Output::address):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::load32):
(JSC::FTL::Output::load64):
(JSC::FTL::Output::loadPtr):
(JSC::FTL::Output::loadDouble):
(JSC::FTL::Output::store32):
(JSC::FTL::Output::store64):
(JSC::FTL::Output::storePtr):
(JSC::FTL::Output::storeDouble):
(JSC::FTL::Output::ascribeRange):
(JSC::FTL::Output::nonNegative32):
(JSC::FTL::Output::load32NonNegative):
(JSC::FTL::Output::equal):
(JSC::FTL::Output::notEqual):

• ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):

12:12 PM Changeset in webkit [197298] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
​https://bugs.webkit.org/show_bug.cgi?id=154794

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

No new tests needed.

• svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.

12:11 PM Changeset in webkit [197297] by commit-queue@webkit.org

• 2 edits in trunk

[cmake] Allow using FindGLIB in case glib is optional dependency.
​https://bugs.webkit.org/show_bug.cgi?id=154796

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

FindGLIB caused internal CMake error in case GLIBCONFIG_INCLUDE_DIR is
not defined.

• Source/cmake/FindGLIB.cmake:

11:14 AM Changeset in webkit [197296] by gskachkov@gmail.com

• 18 edits
  10 adds in trunk

[ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function. ​https://bugs.webkit.org/show_bug.cgi?id=153981

Small improvements

10:40 AM Changeset in webkit [197295] by sbarati@apple.com

• 7 edits in trunk/Source/JavaScriptCore

ProxyObject.GetOwnProperty is partially broken because it doesn't propagate information back to the slot
​https://bugs.webkit.org/show_bug.cgi?id=154768

Reviewed by Ryosuke Niwa.

This fixes a big bug with ProxyObject.GetOwnProperty:
​http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
We weren't correctly propagating the result of this operation to the
out PropertySlot& parameter. This patch fixes that and adds tests.

• runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetOwnPropertyDescriptor):
I added a missing exception check after object allocation
because I saw that it was missing while reading the code.

• runtime/PropertyDescriptor.cpp:

(JSC::PropertyDescriptor::setUndefined):
(JSC::PropertyDescriptor::slowGetterSetter):
(JSC::PropertyDescriptor::getter):

• runtime/PropertyDescriptor.h:

(JSC::PropertyDescriptor::attributes):
(JSC::PropertyDescriptor::value):

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):

• tests/es6.yaml:
• tests/stress/proxy-get-own-property.js:

(let.handler.getOwnPropertyDescriptor):
(set get let.handler.return):
(set get let.handler.getOwnPropertyDescriptor):
(set get let):
(set get let.a):
(let.b):
(let.setter):
(let.getter):

6:57 AM Changeset in webkit [197294] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r179776 - ASSERT repaintContainer->hasLayer() in WebCore::RenderObject::repaintUsingContainer
​https://bugs.webkit.org/show_bug.cgi?id=140750

Reviewed by Simon Fraser.

There's a short period of time when RenderObject::layer() still returns a valid pointer
even though we already cleared the hasLayer() flag.
Do not use the layer as repaint container in such cases.

Source/WebCore:

Test: compositing/repaint-container-assertion-when-toggling-compositing.html

• rendering/RenderObject.cpp:

(WebCore::RenderObject::enclosingLayer):

LayoutTests:

• compositing/repaint-container-assertion-when-toggling-compositing-expected.txt: Added.
• compositing/repaint-container-assertion-when-toggling-compositing.html: Added.

6:56 AM Changeset in webkit [197293] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r178363 - Element::normalizeAttributes() needs to handle arbitrary JS executing between loop iterations.
<​https://webkit.org/b/140379>
<rdar://problem/19446901>

Reviewed by Benjamin Poulain.

Source/WebCore:

Since DOM mutation events may arise below the call to Node::normalize(),
have the loop in Element::normalizeAttributes() make a copy of the Attr nodes
beforehand, to guard against mutations.

Based on a patch by Chris "Chris Dumez" Dumez.

Test: fast/dom/Element/normalize-crash2.html

• dom/Element.cpp:

(WebCore::Element::normalizeAttributes):

LayoutTests:

• fast/dom/Element/normalize-crash2-expected.txt: Added.
• fast/dom/Element/normalize-crash2.html: Added.

6:46 AM Changeset in webkit [197292] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r178311 - Out of bounds read in IdentifierArena::makeIdentifier
​https://bugs.webkit.org/show_bug.cgi?id=140376

Patch by Alexey Proskuryakov.

Reviewed and ChangeLogged by Geoffrey Garen.

No test, since this is a small past-the-end read, which is very
difficult to turn into a reproducible failing test -- and existing tests
crash reliably using ASan.

• parser/ParserArena.h:

(JSC::IdentifierArena::makeIdentifier):
(JSC::IdentifierArena::makeIdentifierLCharFromUChar): Check for a
zero-length string input, like we do in the literal parser, since it is
not valid to dereference characters in a zero-length string.

A zero-length string is allowed in JavaScript -- for example, "".

6:34 AM Changeset in webkit [197291] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r179750 - REGRESSION(r179706): Caused memory corruption on some tests (Requested by _ap_ on #webkit).
​https://bugs.webkit.org/show_bug.cgi?id=141324

Reviewed by Alexey Proskuryakov.

No new tests. This is caught by existing tests under ASAN, and I don't know how to reproduce
it without ASAN.

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Give up
and just always invalidate the next line. It's too hard to come up
with the condition that catches all needed cases, doesn't itself
cause a crash, and isn't overzealous. And we do this for the
previous line anyway. Also clean up the code a bit since it
confusingly reuses a variable, and declares it uninitialized, for
no good reason.

6:34 AM Changeset in webkit [197290] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r179706 - Crash due to failing to dirty a removed text node's line box
​https://bugs.webkit.org/show_bug.cgi?id=136544

Reviewed by David Hyatt.
Source/WebCore:

Test: fast/text/remove-text-node-linebox-not-dirty-crash.html

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.

LayoutTests:

• fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt: Added.
• fast/text/remove-text-node-linebox-not-dirty-crash.html: Added.

6:23 AM Changeset in webkit [197289] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4

Merge r180128 - Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
​https://bugs.webkit.org/show_bug.cgi?id=141552.

Reviewed by Darin Adler.

Source/WebCore:

Tests: LayoutTests/svg/dom/SVGLengthList-basics.xhtml: This test is modified to
include a new test case.

• svg/properties/SVGListPropertyTearOff.h: Commit the removal of the replacing item

before trying to detach the wrapper of the item which going to be replaced.

LayoutTests:

• svg/dom/SVGLengthList-basics-expected.txt:
• svg/dom/SVGLengthList-basics.xhtml: Add a new test case to this test. Have a

reference to an SVGLength in an SVGLengthList and then replace this SVGLength
with another one which comes before it in the SVGLengthList.

6:01 AM Changeset in webkit [197288] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.4

Merge r182284 - Clean up access checks in JSHistoryCustom.cpp
​https://bugs.webkit.org/show_bug.cgi?id=143227

Reviewed by Sam Weinig.

Source/WebCore:

• bindings/js/JSHistoryCustom.cpp:

(WebCore::JSHistory::putDelegate):
(WebCore::JSHistory::deleteProperty):
(WebCore::JSHistory::deletePropertyByIndex):
(WebCore::JSHistory::getOwnPropertyNames):
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):

LayoutTests:

• http/tests/security/cross-frame-access-call-expected.txt:
• http/tests/security/cross-frame-access-call.html:

6:00 AM Changeset in webkit [197287] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r173046 - Scrollbar corner can be drawn outside containing frame
​https://bugs.webkit.org/show_bug.cgi?id=133131
<rdar://problem/16382769>

Reviewed by Simon Fraser.

Source/WebCore:

Merged from Blink (patch by Levi Weintraub):
<​https://src.chromium.org/viewvc/blink?revision=170625&view=revision>

Fixes an issue where the scroll corner may be painted outside the rectangle of
its associated frame by setting a clip rectangle before painting the scroll bar(s)
and scroll corner.

Test: scrollbars/custom-scrollbars-paint-outside-iframe.html

• platform/ScrollView.cpp:

(WebCore::ScrollView::paint):

LayoutTests:

Add DRT test that was derived from the test included in
<​https://src.chromium.org/viewvc/blink?revision=170625&view=revision>.

• scrollbars/custom-scrollbars-paint-outside-iframe-expected.html: Added.
• scrollbars/custom-scrollbars-paint-outside-iframe.html: Added.

5:50 AM Changeset in webkit [197286] by Carlos Garcia Campos

• 5 edits
  12 adds in releases/WebKitGTK/webkit-2.4

Merge r186663 - Fetching Content Security Policy report URL should respect same origin policy
​https://bugs.webkit.org/show_bug.cgi?id=146754
<rdar://problem/18860259>

Reviewed by Brady Eidson.

Inspired by Blink r149791 (by Mike West <​mkwst@chromium.org>):
<​https://src.chromium.org/viewvc/blink?revision=149791&view=revision>

Source/WebCore:

As per <​http://www.w3.org/TR/2015/CR-CSP2-20150219/#send-violation-reports>, fetching the
Content Security Policy report URL should include cookies if and only if the origin of
the protected resource is equal to the origin of the report URL.

Tests: http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html

• loader/PingLoader.cpp:

(WebCore::PingLoader::sendViolationReport):

LayoutTests:

Added additional tests for private browsing mode.

• http/tests/cookies/resources/setCookies.cgi:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html: Added.
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html: Added.
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html: Added.
• http/tests/security/contentSecurityPolicy/resources/save-report.php:
• platform/wk2/TestExpectations: Skip private browsing mode tests in WebKit2 until we fix <​https://bugs.webkit.org/show_bug.cgi?id=115274>.

5:44 AM Changeset in webkit [197285] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r186666 - Plugin create can end up destroying its renderer.
​https://bugs.webkit.org/show_bug.cgi?id=146824
rdar://problem/18921429

Reviewed by Andreas Kling.

Plugins can run arbitrary code during initialization. If the plugin
happens to destroy the associated node, its renderer becomes invalid.
This patch checks whether the renderer survived the createPlugin() call.
(This WeakPtr pattern is also used in RenderWidget to avoid dangling pointers.)

Speculative fix. Not reproducible.

• loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::loadPlugin):

5:42 AM Changeset in webkit [197284] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r188014 - Crash when removing children of a MathMLSelectElement
​https://bugs.webkit.org/show_bug.cgi?id=147704
<rdar://problem/21940321>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When MathMLSelectElement::childrenChanged() is called after its
children have been removed, MathMLSelectElement calls
updateSelectedChild() which accesses m_selectedChild. However,
in this case, m_selectedChild is the previously selected child
and it may be destroyed as this point if it was removed. To avoid
this problem, MathMLSelectElement now keep a strong ref to the
currently selected element.

Test: mathml/maction-removeChild.html

• mathml/MathMLSelectElement.h:

LayoutTests:

Add layout test that reproduces the crash under guardmalloc.

• mathml/maction-removeChild-expected.txt: Added.
• mathml/maction-removeChild.html: Added.

5:29 AM Changeset in webkit [197283] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r184965 - Crash under ICU with ASAN during editing/selection/move-by-word-visually-crash-test-5.html
​https://bugs.webkit.org/show_bug.cgi?id=145429
<rdar://problem/20992218>

Reviewed by Alexey Proskuryakov.

WebKit uses some strings which contain the lower 8-bits of UTF-16 (thereby saving space). However,
ICU doesn't understand this encoding. When we want to use ICU functions with strings in this encoding,
we create a UTextProvider which converts our encoded strings to UTF-16 for ICU, one chunk at a time.
This object contains a vtable which we populate to perform the conversion.

The WebKit function which actually returns the UTF-16 chunks has two relevant arguments: an index into
the encoded string which ICU is requesting, and a direction from that index which ICU is interested
in. This function populates a "chunk" which is characterized by a pointer to a buffer, the length of
the populated data in the buffer, and an offset into the chunk which represents the index that the
requested character was put into.

When ICU requests data going backward, we fill in the chunk accordingly, with the requested character
all the way at the end. We then set the offset equal to the length of the buffer. However, this length
value is stale from the previous time the function ran. Therefore, ICU was reading the wrong index in
the chunk when expecting the requested character.

Covered by editing/selection/move-by-word-visually-crash-test-5.html.

• platform/text/icu/UTextProviderLatin1.cpp:

(WebCore::uTextLatin1Access):

5:27 AM Changeset in webkit [197282] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r185003 - WebSQL default functions can bypass authorizer.
<rdar://problem/21048994> and ​https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Sam Weinig and Alexey Proskuryakov.

No new tests yet.

• platform/sql/SQLiteDatabase.cpp:

(WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions.
(WebCore::SQLiteDatabase::open):
(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that

take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted.

• platform/sql/SQLiteDatabase.h:

Review feedback followup for r185003.
​https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Darin Adler.

• platform/sql/SQLiteDatabase.cpp:

(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): static const one thing, c++-style cast another.

5:23 AM Changeset in webkit [197281] by Carlos Garcia Campos

• 6 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r185392 - feComposite filter does not clip the paint rect to its effect rect when the operator is 'in' or 'atop'
​https://bugs.webkit.org/show_bug.cgi?id=137856

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2015-06-09
Reviewed by Darin Adler.

Source/WebCore:

There was bug in calculating the absolutePaintRect of the feComposite filter
when the operator is equal to 'in' or 'atop'. The absolutePaintRect was set
to the absolutePaintRect of the background FilterEffect which is correct.
What was missing is clipping this rectangle to the maxEffectRect of the
filter which we do for other operators.

Tests: svg/filters/feComposite-background-rect-control-operators.svg

• platform/graphics/IntRect.h:

(WebCore::operator-=):
(WebCore::operator-): Add new operators to IntRect.

• platform/graphics/filters/FEComposite.cpp:

(WebCore::FEComposite::determineAbsolutePaintRect): Make sure the filter
absolutePaintRect is clipped to maxEffectRect for all operators.

(WebCore::FEComposite::platformApplySoftware): Code clean-up.

• platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::determineAbsolutePaintRect): Move the clipping
part to a separate function.

(WebCore::FilterEffect::clipAbsolutePaintRect): Clip the absolutePaintRect
to the maxEffectRect of the filter.

• platform/graphics/filters/FilterEffect.h:

LayoutTests:

• svg/filters/feComposite-background-rect-control-operators-expected.svg: Added.
• svg/filters/feComposite-background-rect-control-operators.svg: Added.

Ensure the painting rect of the feComposite filter with operator 'in' or
'atop' is clipped to its bounding rectangle

4:47 AM Changeset in webkit [197280] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r185572 - RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
​https://bugs.webkit.org/show_bug.cgi?id=145988
rdar://problem/20959137

Reviewed by David Hyatt.

This patch ensures that we find the right first inline box so that we can dirty the
the appropriate line boxes.
With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.

Source/WebCore:

Test: fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html

• rendering/RenderInline.cpp:

(WebCore::RenderInline::culledInlineFirstLineBox):
(WebCore::RenderInline::culledInlineLastLineBox):

• rendering/RootInlineBox.cpp:

(WebCore::RootInlineBox::setLineBreakInfo): Deleted. Remove misleading assert and comment.

LayoutTests:

• fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt: Added.
• fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html: Added.

4:34 AM Changeset in webkit [197279] by Carlos Garcia Campos

• 8 edits
  8 adds in releases/WebKitGTK/webkit-2.4

Merge r185769 - Various assertion failures occur when executing script in the midst of DOM insertion
​https://bugs.webkit.org/show_bug.cgi?id=132482

Reviewed by Darin Adler.

Source/WebCore:

Prior to this change, when an element containing a <script> child was inserted into a document, the script was
executed in ScriptElement::insertedInto(). That script can access nodes that follow it in the newly-inserted
hierarchy but are not yet fully inserted, leading to at least the following problems:

• The script could remove a node that is not yet marked as in the document.
• The script could remove a named <map> that has yet to be added to TreeScope::m_imageMapsByName.
• The script could remove a form control that has yet to be added to FormController::m_formElementsWithState.

These scenarios all result in assertion failures. This change ensures that each node in the newly-inserted
hierarchy is fully inserted before executing any scripts.

Tests: fast/dom/element-removed-while-inserting-parent-crash.html

fast/dom/named-map-removed-while-inserting-parent-crash.html
fast/forms/form-control-removed-while-inserting-parent-crash.html
svg/dom/element-removed-while-inserting-parent-crash.html

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::shouldNotifySubtreeInsertions): Renamed from insertedInto().
Returned true in the case where insertedInto() would've called prepareScript().
(WebCore::ScriptElement::didNotifySubtreeInsertions): Called prepareScript().
(WebCore::ScriptElement::insertedInto): Renamed to shouldNotifySubtreeInsertions().

• dom/ScriptElement.h:
• html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::insertedInto): If shouldNotifySubtreeInsertions() is true, returned InsertionShouldCallDidNotifySubtreeInsertions.
Otherwise, returned InsertionDone.
(WebCore::HTMLScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

• html/HTMLScriptElement.h:
• svg/SVGScriptElement.cpp:

(WebCore::SVGScriptElement::insertedInto): Did the same as HTMLScriptElement::insertedInto().
(WebCore::SVGScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

• svg/SVGScriptElement.h:

LayoutTests:

Wrote named-map-removed-while-inserting-parent-crash.html by reducing the test case attached to bug 132482.
The remaining tests were taken from blink r132482.

• fast/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/dom/element-removed-while-inserting-parent-crash.html: Added.
• fast/dom/named-map-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/dom/named-map-removed-while-inserting-parent-crash.html: Added.
• fast/forms/form-control-removed-while-inserting-parent-crash-expected.txt: Added.
• fast/forms/form-control-removed-while-inserting-parent-crash.html: Added.
• svg/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
• svg/dom/element-removed-while-inserting-parent-crash.html: Added.

3:55 AM Changeset in webkit [197278] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r182918 - Media element can manipulate DOM during Document destruction.
rdar://problem/20553898 and ​https://bugs.webkit.org/show_bug.cgi?id=143780

Patch by Brady Eidson <​beidson@apple.com> on 2015-04-16
Reviewed by Jer Noble.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::configureMediaControls): Bail if the element has no active document.

3:48 AM Changeset in webkit [197277] by Carlos Garcia Campos

• 3 edits
  3 adds in releases/WebKitGTK/webkit-2.4

Merge r183275 - Made Object.prototype.proto native getter and setter check that this object not null or undefined
​https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):

LayoutTests:
Added tests to ensure that Object.prototype.proto native getter and setter do not coerce undefined to this
​https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

• js/script-tests/sloppy-getter-setter-global-object.js: Added.
• js/sloppy-getter-setter-global-object-expected.txt: Added.
• js/sloppy-getter-setter-global-object.html: Added.

3:45 AM Changeset in webkit [197276] by Carlos Garcia Campos

• 5 edits
  9 adds in releases/WebKitGTK/webkit-2.4

Merge r183280,r183672 - Origin header is preserved on cross-origin redirects.
​https://bugs.webkit.org/show_bug.cgi?id=144157.

Reviewed by Sam Weinig.

Source/WebCore:

Tests: http/tests/security/cors-post-redirect-301.html

http/tests/security/cors-post-redirect-302.html
http/tests/security/cors-post-redirect-307.html
http/tests/security/cors-post-redirect-308.html

• platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::ResourceHandle::willSendRequest): Always clear any origin header for cross-origin redirects.

• platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::willSendRequest): Ditto.

LayoutTests:

• http/tests/security/cors-post-redirect-301-expected.txt: Added.
• http/tests/security/cors-post-redirect-301.html: Added.
• http/tests/security/cors-post-redirect-302-expected.txt: Added.
• http/tests/security/cors-post-redirect-302.html: Added.
• http/tests/security/cors-post-redirect-307-expected.txt: Added.
• http/tests/security/cors-post-redirect-307.html: Added.
• http/tests/security/cors-post-redirect-308-expected.txt: Added.
• http/tests/security/cors-post-redirect-308.html: Added.
• http/tests/security/resources/cors-post-redirect-target.php: Added.

[GTK] New CORS tests from r183280 fail on WebKitGTK+
​https://bugs.webkit.org/show_bug.cgi?id=144469

Reviewed by Sergio Villar Senin.

No new tests. This causes failing tests to pass.

• platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::doRedirect): Clear the origin header on cross-origin redirects.

3:43 AM Changeset in webkit [197275] by Carlos Garcia Campos

• 6 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r183436 - Form control may be associated with the wrong HTML Form element after form id change
​https://bugs.webkit.org/show_bug.cgi?id=133456
<rdar://problem/17095055>

Reviewed by Andy Estes.

Source/WebCore:

Fixes an issue where a form control may be associated with the wrong HTML Form element
after the id of the HTML Form element associated with the form control is changed when
there is more than one HTML Form element with the same id in the document. Specifically,
a form control that has an HTML form attribute value X will always be associated with
some HTML Form element f where f.id = X regardless of whether f.id is subsequently
changed.

Tests: fast/forms/change-form-id-to-be-unique-then-submit-form.html

fast/forms/change-form-id-to-be-unique.html

• dom/Element.cpp:

(WebCore::Element::attributeChanged): Notify observers when the id of an element changed.
(WebCore::Element::updateId): Added parameter NotifyObservers (defaults to NotifyObservers::Yes),
as to whether we should notify observers of the id change.
(WebCore::Element::updateIdForTreeScope): Ditto.
(WebCore::Element::willModifyAttribute): Do not notify observers of the id change immediately. As
indicated by the name of this method, we plan to modify the DOM attribute id of the element, but
we have not actually modified it when this method is called. Instead we will notify observers
in Element::attributeChanged(), which is called after the DOM attribute id is modified.
(WebCore::Element::cloneAttributesFromElement): Ditto.

• dom/Element.h: Defined enum class NotifyObservers.
• dom/TreeScope.cpp:

(WebCore::TreeScope::addElementById): Added boolean parameter notifyObservers (defaults to true)
as to whether we should dispatch a notification to all observers.
(WebCore::TreeScope::removeElementById): Ditto.

• dom/TreeScope.h:

LayoutTests:

Add tests to ensure that we associate the correct HTML Form element with a
<select> after changing the id of its associated HTML form element.

• fast/forms/change-form-id-to-be-unique-expected.txt: Added.
• fast/forms/change-form-id-to-be-unique-then-submit-form-expected.txt: Added.
• fast/forms/change-form-id-to-be-unique-then-submit-form.html: Added.
• fast/forms/change-form-id-to-be-unique.html: Added.

3:42 AM Changeset in webkit [197274] by Carlos Garcia Campos

• 13 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Element::attributeChanged shouldn't do any work when attribute value didn't change
​https://bugs.webkit.org/show_bug.cgi?id=129467

Reviewed by Geoffrey Garen.

Exit early in childrenChanged when the attribute value didn't change.

• dom/Attr.cpp:

(WebCore::Attr::setValue):
(WebCore::Attr::childrenChanged):

• dom/Element.cpp:

(WebCore::Element::setAttributeInternal):
(WebCore::Element::attributeChanged):
(WebCore::Element::parserSetAttributes):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::didAddAttribute):
(WebCore::Element::didModifyAttribute):
(WebCore::Element::didRemoveAttribute):
(WebCore::Element::cloneAttributesFromElement):

• dom/Element.h:
• dom/StyledElement.cpp:

(WebCore::StyledElement::attributeChanged):

• dom/StyledElement.h:
• html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::updateType):

• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::attributeChanged):

• mathml/MathMLElement.h:
• mathml/MathMLSelectElement.cpp:

(WebCore::MathMLSelectElement::attributeChanged):

• mathml/MathMLSelectElement.h:
• svg/SVGElement.cpp:

(WebCore::SVGElement::attributeChanged):

• svg/SVGElement.h:

3:01 AM Changeset in webkit [197273] by Carlos Garcia Campos

• 5 edits
  3 adds in releases/WebKitGTK/webkit-2.4

Merge r183649 - Javascript using WebSQL can create their own WebKit info table.
<rdar://problem/20688792> and ​https://bugs.webkit.org/show_bug.cgi?id=144466

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/websql/alter-to-info-table.html

• Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::DatabaseBackendBase::databaseInfoTableName): Return the info table name.
(WebCore::fullyQualifiedInfoTableName): Append "main." to the info table name.
(WebCore::DatabaseBackendBase::DatabaseBackendBase): Use the fully qualified name.
(WebCore::DatabaseBackendBase::performOpenAndVerify): Ditto.
(WebCore::DatabaseBackendBase::getVersionFromDatabase): Ditto.
(WebCore::DatabaseBackendBase::setVersionInDatabase): Ditto.

LayoutTests:

• storage/websql/alter-to-info-table-expected.txt: Added.
• storage/websql/alter-to-info-table.html: Added.
• storage/websql/alter-to-info-table.js: Added.

Build fix after r183646 for less enlightened platforms.

Unreviewed.

• Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::fullyQualifiedInfoTableName): Windows doesn’t have stpcpy :(

2:52 AM Changeset in webkit [197272] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r182067 - FEMorphology::platformApplyGeneric() should bail out if the radius is less than or equal to zero.
​https://bugs.webkit.org/show_bug.cgi?id=142885.

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2015-03-27
Reviewed by Dean Jackson.

Source/WebCore:

FEMorphology class implementation code clean up.

Tests: svg/filters/feMorphology-radius-cases.svg

• platform/graphics/filters/FEMorphology.cpp:

(WebCore::shouldSupersedeExtremum): Reuse code instead of repeating it and
use < and > instead of =< and >=.

(WebCore::pixelArrayIndex): Returns the array index of a pixel in an image
buffer, given: position(x, y), image width and the color channel.

(WebCore::columnExtremum): Returns the extremum of a column of pixels.

(WebCore::kernelExtremum): Returns the extremum of a filter kernel.

(WebCore::FEMorphology::platformApplyGeneric): Apply some code clean-up.
The kernel size should be equal to radius of the filter. The extra pixel
was causing the resulted image to be asymmetric in some cases.

(WebCore::FEMorphology::platformApplyDegenerate):
(WebCore::FEMorphology::platformApplySoftware): After applying scaling, we
still need to check the resulted radius is negative (overflow case) or less
than one (zero radius case) and treat these cases differently.

(WebCore::FEMorphology::morphologyOperator): Deleted.
(WebCore::FEMorphology::radiusX): Deleted.
(WebCore::FEMorphology::radiusY): Deleted.

• platform/graphics/filters/FEMorphology.h:

(WebCore::FEMorphology::morphologyOperator):
(WebCore::FEMorphology::radiusX):
(WebCore::FEMorphology::radiusY):
Move a single line functions from the source file to the header file.

LayoutTests:

• svg/filters/feMorphology-radius-cases-expected.svg: Added.
• svg/filters/feMorphology-radius-cases.svg: Added.

Test different cases for radius of the feMorphology filter. There are three
cases for the radius:

1. radius < 0: This is an error case, the source image should not be rendered.
2. radius = 0: This case is treated as if the filter never exists.
3. radius > 0: If the scaled radius is > 0, the filter is applied.

2:44 AM Changeset in webkit [197271] by Carlos Garcia Campos

• 3 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r182750 - Canvas drawImage() has a security hole when the image isn't yet fully loaded.
​https://bugs.webkit.org/show_bug.cgi?id=58681.

Reviewed by Darin Adler.

Source/WebCore:

There is a race condition which may happen if an image from a different
origin is drawn on a canvas before it finishes loading. The check to taint
the canvas comes before drawing it. This check returns false if the image
is not completely loaded because we check the URL of the resource response.
If after this check and before the drawing, the image finishes loading, the
canvas will not be tainted but the image will be drawn.

The fix is to move the check to taint the canvas after drawing the image.
The only problem with this solution is basically the opposite of this bug:
we will become stricter than before with images which are from a different
origin and before they finish loading. The image has not finished loading,
so we do not draw it. Before we check for tainting, the image finishes
loading. So we decide to taint the canvas even the image is not drawn.

But this should not be a security issue anymore. I personally do not know
if it is even a correctness issue or not.

Test: http/tests/canvas/canvas-tainted-after-draw-image.html

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawImage):

LayoutTests:

This test confirms when we load an image from a different origin and try
drawing it on a canvas, the canvas is tainted if the image is completely
loaded and drawn. Otherwise the image is not drawn.

• http/tests/canvas/canvas-tainted-after-draw-image-expected.txt: Added.
• http/tests/canvas/canvas-tainted-after-draw-image.html: Added.
• http/tests/canvas/resources: Added.
• http/tests/canvas/resources/100x100-lime-rect.svg: Added.

Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
following ​http://trac.webkit.org/changeset/182750.

Reviewed by Daniel Bates.

• http/tests/canvas/canvas-tainted-after-draw-image-expected.txt:
• http/tests/canvas/canvas-tainted-after-draw-image.html:

Set window.jsTestIsAsync true and call finishJSTest() to make the test
asynchronous, so the "TEST COMPLETE" message will be output after all the
test messages. Also delete the synchronous tests for data url image and
same-domain image since they can't be reliably tested.

2:37 AM Changeset in webkit [197270] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r183398 - Crashes under IDBDatabase::closeConnection
​https://bugs.webkit.org/show_bug.cgi?id=141745

Reviewed by Alexey Proskuryakov.

• Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::~IDBDatabase): Do the work of close/closeConnection without
actually calling those functions.
(WebCore::IDBDatabase::closeConnection): Protect the database so it's not destroyed
in the middle of this function's execution.

2:35 AM Changeset in webkit [197269] by Carlos Garcia Campos

• 6 edits in releases/WebKitGTK/webkit-2.4/Source

Merge r180548 - EventHandler references deleted Scrollbar
​https://bugs.webkit.org/show_bug.cgi?id=141931
<rdar://problem/19915210>

Reviewed by Tim Horton.

Tested by scrollbars/overflow-custom-scrollbar-crash.html

Update the EventHandler class to use a WeakPtr to reference the
last used Scrollbar, rather than retaining the Scrollbar and
artificially extending its life. This keeps the EventHandler
state in proper sync with the state of the render tree, and
avoids cases where we have destroyed a ScrollableArea (and
Scrollbar) but are still sending messages to a fake zombie
version of the element.

• page/EventHandler.cpp:

(WebCore::EventHandler::clear):
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::updateMouseEventTargetNode):
(WebCore::EventHandler::updateLastScrollbarUnderMouse):

• page/EventHandler.h:
• platform/Scrollbar.cpp:

(WebCore::Scrollbar::Scrollbar): Initialize WeakPtrFactory.

• platform/Scrollbar.h:

(WebCore::Scrollbar::createWeakPtr): Added,

2:01 AM Changeset in webkit [197268] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r181565 - URLs visited during private browsing show up in WebpageIcons.db
rdar://problem/11254910 and ​https://bugs.webkit.org/show_bug.cgi?id=142733

Patch by Sam Weinig. Reviewed by Brady Eidson.

• loader/icon/IconController.cpp:

(WebCore::IconController::startLoader): Bail early here if the page is using an ephemeral session.
(WebCore::IconController::continueLoadWithDecision): Instead of here.

1:51 AM Changeset in webkit [197267] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.4

Merge r182051 - Inline continuation code should not take anonymous containing wrapper granted.
​https://bugs.webkit.org/show_bug.cgi?id=133312

Reviewed by Dave Hyatt.

It's wrong to assume that when RenderInline is part of an inline continuation, its containing block
is an anonymous wrapper and its sibling might be a block level renderer.
When the inline continuation is no longer needed, for example when the block level renderer that initiated the continuation
is detached from the render tree, the inline renderes still continue to form continuation.(however they no longer require
anonymous wrappers)

Source/WebCore:

Test: fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html

• rendering/RenderInline.cpp:

(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

• fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt: Added.
• fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html: Added.

1:37 AM Changeset in webkit [197266] by Carlos Garcia Campos

• 4 edits
  4 adds in releases/WebKitGTK/webkit-2.4

Merge r177165 - InstancedArray crashes attempting to draw out of bounds
​https://bugs.webkit.org/show_bug.cgi?id=139521
Source/WebCore:

Reviewed by Simon Fraser.

We were not doing index validation correctly for instancing.

Test: fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html

• html/canvas/WebGLRenderingContext.cpp:

(WebCore::WebGLRenderingContext::validateVertexAttributes): We need to check
the number of instances drawn against the amount of instance data that has
been provided, taking into account the number of repeats (the divisor).
(WebCore::WebGLRenderingContext::drawArrays): Added some whitespace to make it more clear.
(WebCore::WebGLRenderingContext::validateDrawElements): This needs to take a primcount
parameter so that it can correctly validate the call (when used from drawElementsInstanced).
(WebCore::WebGLRenderingContext::drawElements): New signature to validate.
(WebCore::WebGLRenderingContext::drawArraysInstanced): Rearrange this a bit. The
primcount validation is already being done by the validateDrawArrays call. Also, there
was a bogus UNUSED_PARAM hanging around.
(WebCore::WebGLRenderingContext::drawElementsInstanced): Similar rearrangement. Use
the primcount parameter.

• html/canvas/WebGLRenderingContext.h:

LayoutTests:

<rdar://problem/17540398>

Reviewed by Simon Fraser.

This is a copy of the official webgl/1.0.3 test.

• platform/mac-mountainlion/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added. This extension is not available on Mountain Lion.
• fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added.
• fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html: Added.
• fast/canvas/webgl/resources/out-of-bounds-test.js: Added.

(OutOfBoundsTest):

12:01 AM Changeset in webkit [197265] by Nikita Vasilyev

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: DataGrid's resizers aren't horizontally centered
​https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>

Reviewed by Timothy Hatcher.

• UserInterface/Views/DataGrid.css:

(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.