Timeline

Mar 10, 2016:

11:52 PM Changeset in webkit [198001] by keith_miller@apple.com

• 1 edit in trunk/Source/JavaScriptCore/ChangeLog

Unreviewed, fix Changelog. git merged poorly.

11:13 PM Changeset in webkit [198000] by keith_miller@apple.com

• 2 edits in trunk/Source/JavaScriptCore

[ES6] Make RegExp.prototype.toString spec compliant
​https://bugs.webkit.org/show_bug.cgi?id=155341

Patch by Saam barati <​sbarati@apple.com> on 2016-03-10
Reviewed by Filip Pizlo.

Before we were directly calling into the flagsString
function. Instead, we must get the "flags" property
of the thisObject. This will usually call into the flags
getter, but not always. Specifically, you can you a Proxy
to observe this behavior.

• runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncToString):
(JSC::regExpProtoGetterGlobal):

• tests/es6.yaml:
• tests/es6/Proxy_internal_get_calls_RegExp.prototype.toString.js: Added.

(test.get var):
(test.):

• tests/stress/regexp-prototype-tostring.js: Added.

(assert):
(test):
(test.get var):
(test.):
(let.handler.get switch):
(let.handler):
(get test):
(test.get RegExp):

11:10 PM Changeset in webkit [197999] by sbarati@apple.com

• 5 edits
  2 adds in trunk

[ES6] Make RegExp.prototype.toString spec compliant
​https://bugs.webkit.org/show_bug.cgi?id=155341

Reviewed by Filip Pizlo.

Before we were directly calling into the flagsString
function. Instead, we must get the "flags" property
of the thisObject. This will usually call into the flags
getter, but not always. Specifically, you can you a Proxy
to observe this behavior.

• runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncToString):
(JSC::regExpProtoGetterGlobal):

• tests/es6.yaml:
• tests/es6/Proxy_internal_get_calls_RegExp.prototype.toString.js: Added.

(test.get var):
(test.):

• tests/stress/regexp-prototype-tostring.js: Added.

(assert):
(test):
(test.get var):
(test.):
(let.handler.get switch):
(let.handler):
(get test):
(test.get RegExp):

11:05 PM Changeset in webkit [197998] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore

[GTK] Fix rendering of slider input elements
​https://bugs.webkit.org/show_bug.cgi?id=155296

Reviewed by Michael Catanzaro.

Use the new gadgets for newer GTK+ and improve a bit the rendering
for previous versions to better match GTK+.

• rendering/RenderThemeGtk.cpp:

(WebCore::createStyleContext): Add ScaleContents and
ScaleHighlight parts that are only used with GTK+ 3.19.
(WebCore::RenderThemeGtk::paintSliderTrack): Use a smaller trough,
centered in the given rectangle to better match GTK+. Also render
the hightlight gadget with GTK+ 3.19.
(WebCore::RenderThemeGtk::paintSliderThumb): Also create the style
context for contents gadget.
(WebCore::RenderThemeGtk::adjustSliderThumbSize): Take into
account the slider border when calculating the slider thumb size.

10:59 PM Changeset in webkit [197997] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore

[GTK] Scrollbars are broken once again with current GTK+ master
​https://bugs.webkit.org/show_bug.cgi?id=155292

Reviewed by Michael Catanzaro.

Most of the trough theming properties have been moved to the
scrollbar, and a new gadget "contents" has been added between the
scrollbar and its children.

• platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::getOrCreateStyleContext): Add
left/bottom style classes to ensure the scrollbars border is taken
into account and rendered.
(WebCore::ScrollbarThemeGtk::paintTrackBackground): Also create
style context for contents gadget.
(WebCore::ScrollbarThemeGtk::paintThumb): Ditto.
(WebCore::ScrollbarThemeGtk::paintButton): Ditto.
(WebCore::ScrollbarThemeGtk::scrollbarThickness): Take the
scrollbar border into account.
(WebCore::ScrollbarThemeGtk::buttonSize): Also create style
context for contents gadget.
(WebCore::ScrollbarThemeGtk::getStepperSpacing): Ditto.
(WebCore::ScrollbarThemeGtk::minimumThumbLength): Ditto.
(WebCore::ScrollbarThemeGtk::thumbFatness): Ditto.
(WebCore::ScrollbarThemeGtk::getTroughBorder): Take the scrollbar
border into account.

10:47 PM Changeset in webkit [197996] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit2

REGRESSION (r197986): Don't try to link to undefined $(WEBKIT_SYSTEM_INTERFACE_LIBRARY)

Follow-up build fix for:

AX: Force allow user zoom
<​https://bugs.webkit.org/show_bug.cgi?id=155056>

Fixes the following build failure:

ld: library not found for -l-lAccessibility
clang: error: linker command failed with exit code 1 (use -v to see invocation)

• Configurations/WebKit.xcconfig: Remove

"-l$(WEBKIT_SYSTEM_INTERFACE_LIBRARY)" from OTHER_LDFLAGS since
that macro is not defined, and there is no need to link to
libWebKitSystemInterface.a.

10:12 PM Changeset in webkit [197995] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebCore

REGRESSION (r197983): Build fails due to missing inline method

Attempt to fix the following build failure:

Undefined symbols for architecture arm64:

"JSC::GenericTypedArrayView<JSC::Uint8ClampedAdaptor>::createUninitialized(unsigned int)", referenced from:

WebCore::ImageBufferData::getData(WebCore::IntRect const&, WebCore::IntSize const&, bool, bool, float) const in ImageBufferDataCG.o

• platform/graphics/cg/ImageBufferDataCG.cpp: Include some

headers to match FEGaussianBlur.cpp and FilterEffect.cpp.

10:04 PM Changeset in webkit [197994] by commit-queue@webkit.org

• 5 edits
  1 add in trunk/Source/JavaScriptCore

[JSC] Add register reuse for ArithAdd of an Int32 and constant in DFG
​https://bugs.webkit.org/show_bug.cgi?id=155164

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-10
Reviewed by Geoffrey Garen.

Every "inc" in loop was looking like this:

move rX, rY
inc rY
jo 0x230f4a200580

This patch add register Reuse to that case to remove
the extra "move".

• dfg/DFGOSRExit.h:

(JSC::DFG::SpeculationRecovery::SpeculationRecovery):
(JSC::DFG::SpeculationRecovery::immediate):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithAdd):

• tests/stress/arith-add-with-constant-overflow.js: Added.

(opaqueAdd):

9:09 PM Changeset in webkit [197993] by timothy_horton@apple.com

• 5 edits in trunk/Source/WebCore

Try to fix the iOS 9 build.

• editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::detectContentInRange):

• platform/cocoa/DataDetectorsCoreSoftLink.h:
• platform/cocoa/DataDetectorsCoreSoftLink.mm:
• platform/spi/cocoa/DataDetectorsCoreSPI.h:

9:01 PM Changeset in webkit [197992] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebCore

REGRESSION (r197976): Build failure due to missing DDOptionalSource.h header

Follow-up fix for:

Expose additional WKDataDetectorTypes.
<​https://bugs.webkit.org/show_bug.cgi?id=155331>

• platform/spi/cocoa/DataDetectorsCoreSPI.h: Protect

DDOptionalSource.h with version check.

8:52 PM Changeset in webkit [197991] by achristensen@apple.com

• 2 edits in trunk/Source/WebCore

Fix Windows build after r197986.

• accessibility/AccessibilityObject.h:

8:50 PM Changeset in webkit [197990] by jer.noble@apple.com

• 17 edits in trunk/Source

Set AVURLAssetUsesNoPersistentCacheKey on AVAsset to match caching policy.
​https://bugs.webkit.org/show_bug.cgi?id=155117
rdar://problem/6802240

Patch by Jeremy Jones <​jeremyj@apple.com> on 2016-03-10
Reviewed by Simon Fraser.

Source/WebCore:

No new tests because no new functionality was added.

This will prevent persistent media caches when webkit is using in memory caching.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerShouldUsePersistentCache): Added.

• html/HTMLMediaElement.h: Declare mediaPlayerShouldUsePersistentCache().
• page/ChromeClient.h: Declare mediaPlayerShouldUsePersistentCache().
• platform/graphics/MediaPlayer.h:

(WebCore::MediaPlayerClient::mediaPlayerShouldUsePersistentCache): Added.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Set property on AVAssetOptions.

Source/WebKit/mac:

Implement mediaShouldUsePersistentCache to disable media caching when NSURLCache is disabled.

• WebCoreSupport/WebChromeClient.h:
• WebCoreSupport/WebChromeClient.mm:

(WebChromeClient::mediaShouldUsePersistentCache): Added.

Source/WebKit2:

Make AVAsset AVURLAssetUsesNoPersistentCacheKey match !m_websiteDataStore->isPersistent()
This will prevent persistent media caches when webkit is using in-memory caching.

• Shared/WebPageCreationParameters.cpp: Add mediaShouldUsePersistentCache.

(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):

• Shared/WebPageCreationParameters.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters): Add mediaShouldUsePersistentCache.

• WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::mediaShouldUsePersistentCache): Added.

• WebProcess/WebCoreSupport/WebChromeClient.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::m_mediaUsesPersistentCache): Added.

• WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::mediaShouldUsePersistentCache): Added.

8:25 PM Changeset in webkit [197989] by jer.noble@apple.com

• 3 edits in trunk

CRASH at WebCore::RenderView::updateVisibleViewportRect
​https://bugs.webkit.org/show_bug.cgi?id=155209
<rdar://problem/23997530>

Reviewed by Simon Fraser.

Source/WebCore:

Test: media/video-crash-invisible-autoplay-display-none.html

Between the time when the video element's renderer is created and destroyed, we may have unset the
InvisibleAutoplayNotPermitted restriction. So rather than check for that restriction before
unregistering for the "visible in viewport" notification, unregister only if the renderer
was previously registered.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::willDetachRenderers):

LayoutTests:

(These files were mistakenly landed in a previous commit:)

• media/video-crash-invisible-autoplay-display-none-expected.txt: Added.
• media/video-crash-invisible-autoplay-display-none.html: Added.

8:16 PM Changeset in webkit [197988] by jer.noble@apple.com

• 2 edits in trunk/Source/WebKit/win

Unreviewed build fix after r197953; correct the settings added in r197953.

• WebView.cpp:

(WebView::notifyPreferencesChanged):

8:03 PM Changeset in webkit [197987] by Alan Bujtas

• 8 edits in trunk

Simple line layout: Add text-align: justify support.
​https://bugs.webkit.org/show_bug.cgi?id=155006

Reviewed by Antti Koivisto.

Source/WebCore:

This patch enables text-align: justify; for simple line layout (only latin text for now).
It speeds up/reduced memory consumption for justified text.

PerformanceTests/Layout/line-layout-simple.html
before text-align: justify support -> mean: 86.20513022288704 runs/s
after -> mean: 96.73972475626084 runs/s

Covered by existing text-align: justify tests.

• rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::canUseForFontAndText):
(WebCore::SimpleLineLayout::LineState::expansionOpportunityCount):
(WebCore::SimpleLineLayout::LineState::expansionOportunity):
(WebCore::SimpleLineLayout::expansionBehavior):
(WebCore::SimpleLineLayout::justifyRuns):
(WebCore::SimpleLineLayout::closeLineEndingAndAdjustRuns):
(WebCore::SimpleLineLayout::createTextRuns):
(WebCore::SimpleLineLayout::printReason):
(WebCore::SimpleLineLayout::canUseForStyle): Deleted.

• rendering/SimpleLineLayout.h:
• rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::paintFlow):

• rendering/SimpleLineLayoutResolver.h:

(WebCore::SimpleLineLayout::RunResolver::Run::expansion):
(WebCore::SimpleLineLayout::RunResolver::Run::expansionBehavior):

LayoutTests:

Rebaseline based on simple line layout output.

• fast/text/whitespace/023-expected.txt:
• platform/mac/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt:

7:57 PM Changeset in webkit [197986] by n_wang@apple.com

• 19 edits
  2 adds in trunk

AX: Force allow user zoom
​https://bugs.webkit.org/show_bug.cgi?id=155056

Reviewed by Simon Fraser.

Source/WebCore:

Override the maximum/minimum scale factor when forceAlwaysUserScalable is true.

Test: fast/viewport/ios/force-always-user-scalable.html

• Configurations/WebCoreTestSupport.xcconfig:
• page/ViewportConfiguration.cpp:

(WebCore::ViewportConfiguration::minimumScale):

• page/ViewportConfiguration.h:

(WebCore::ViewportConfiguration::maximumScale):

• testing/Internals.cpp:

(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::Internals):
(WebCore::Internals::composedTreeAsText):
(WebCore::Internals::setViewportForceAlwaysUserScalable):

• testing/Internals.h:
• testing/Internals.idl:

Source/WebKit2:

Linked libAccessibility library so that we can observe the accessibility
setting change for the force always user scalable feature.

• Configurations/WebKit.xcconfig:
• UIProcess/API/Cocoa/WKWebView.mm:

(shouldAllowPictureInPictureMediaPlayback):
(forceAlwaysUserScalableChangedCallback):
(-[WKWebView _initializeWithConfiguration:]):
(-[WKWebView dealloc]):
(-[WKWebView _navigationGestureDidEnd]):
(-[WKWebView _updateForceAlwaysUserScalable]):

• UIProcess/API/Cocoa/WKWebViewInternal.h:
• UIProcess/WebPageProxy.h:
• UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::setViewportConfigurationMinimumLayoutSize):
(WebKit::WebPageProxy::updateForceAlwaysUserScalable):
(WebKit::WebPageProxy::setMaximumUnobscuredSize):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:
• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::disableInspectorNodeSearch):
(WebKit::WebPage::updateForceAlwaysUserScalable):
(WebKit::innerFrameQuad):

LayoutTests:

• fast/viewport/ios/force-always-user-scalable-expected.txt: Added.
• fast/viewport/ios/force-always-user-scalable.html: Added.
• platform/ios-simulator-wk2/TestExpectations:

7:52 PM Changeset in webkit [197985] by keith_miller@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Unreviewed, build fix for r197983, hopefully.

• API/WebKitAvailability.h:

6:58 PM Changeset in webkit [197984] by jiewen_tan@apple.com

• 3 edits
  3 adds in trunk

WebKit should not be redirected to an invalid URL
​https://bugs.webkit.org/show_bug.cgi?id=155263
<rdar://problem/22820172>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/navigation/redirect-to-invalid-url.html

• loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal):

LayoutTests:

• http/tests/navigation/redirect-to-invalid-url-expected.txt: Added.
• http/tests/navigation/redirect-to-invalid-url.html: Added.
• http/tests/navigation/resources/redirect-to-invalid-url-frame.php: Added.

6:46 PM Changeset in webkit [197983] by keith_miller@apple.com

• 15 edits
  1 copy
  5 adds in trunk/Source/JavaScriptCore

Typed Arrays have no public facing API
​https://bugs.webkit.org/show_bug.cgi?id=120112

Reviewed by Geoffrey Garen.

This patch adds a new C-API (an Obj-C API will follow in the future) for Typed Arrays. The API has two sets of
functions. One for Typed Arrays and another for Array Buffers. This API is intended to reflect the use of Typed
Array objects in JS code. There is a method for each of the core TypedArray and Array Buffer methods.
Originally, we were planning on using a separate non-JS object as the backing store instead of a JS Array Buffer
but we decide to defer that idea since there was no good CF/NS API that met all the constraints we needed
(Discussed further below). We also wanted to want until Shared Array Buffers had reached a more finished state
to see what impact they might have on an API.

The API has the following Typed Array construction methods:
1) Create with length (the backing buffer is zero initialized). -- JSObjectMakeTypedArray
2) Create with an existing pointer and a destructor. -- JSObjectMakeTypedArrayFromBytesNoCopy
3) Create with an Array Buffer object. -- JSObjectMakeTypedArrayFromArrayBuffer
4) Create with an Array Buffer object with a given offset and length. -- JSObjectMakeTypedArrayFromArrayBufferWithOffset

The API has the following functions on Typed Array JSObjectRefs:
5) Get access to a temporary void* of the backing store's data. -- JSObjectGetTypedArrayBytesPtr
6) Get the length of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayLength
7) Get the byte length of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayByteLength
8) Get the byte offset of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayByteOffset
9) Get a Typed Array object's Array Buffer backing store. -- JSObjectGetTypedArrayBuffer

The API has the following Array Buffer construction method:
10) Create with an existing pointer and a destructor. -- JSObjectMakeArrayBufferWithBytesNoCopy

The API has the following functions on Array Buffer JSObjectRefs:
11) Get access to a temporary void* of the backing store's data. -- JSObjectGetArrayBufferBytesPtr
12) Get the byte length of an Array Buffer object (returns 0 if it is not an Array Buffer object). -- JSObjectGetArrayBufferByteLength

The API adds the following new typedefs and enumerations:
13) A typedef representing the function pointer type used to deallocate byte pointers provided to constructors. -- JSTypedArrayByesDeallocator
14) An enumeration indicating the Typed Array API type of a JSValueRef. -- JSTypedArrayType

Finally, The API has the following function to get Typed Array Types:
15) Get the Typed Array type of a JS value. -- JSValueGetTypedArrayType

There are a couple of things to note about these functions. Calling JSObjectGetTypedArrayBytesPtr (5) or
JSObjectGetArrayBufferBytesPtr (12) will pin and lock the ArrayBuffer's data for the remaining lifetime of that
ArrayBuffer. This is because, currently, we do not have finalizers for our Array Buffers or Typed Arrays with a
backing ArrayBuffer and adding one would likely incur a non-trivial cost to GC. Also, we do not have a direct
way to make a Typed Array from a pointer with an offset as we do not expect using offsets to be a common use
case of the API.

While it would have been nice to integrate our backing store with CFData or one of its subclasses, it is not
possible to force a CFData/CFMutableData to be both writable and have a fixed size/backing store pointer.
NSData is not writable and CFMutableData can have a fixed pointer if it is allocated with a non-zero capacity
but there is no way for us to force an existing CFMutableData into this state.

• API/APIUtils.h: Copied from Source/JavaScriptCore/runtime/ArrayBuffer.cpp.

(handleExceptionIfNeeded):
(setException):

• API/JSBase.h:
• API/JSObjectRef.cpp:

(handleExceptionIfNeeded): Deleted.

• API/JSTypedArray.cpp: Added.

(toJSTypedArrayType):
(toTypedArrayType):
(createTypedArray):
(JSValueGetTypedArrayType):
(JSObjectMakeTypedArray):
(JSObjectMakeTypedArrayWithBytesNoCopy):
(JSObjectMakeTypedArrayWithArrayBuffer):
(JSObjectMakeTypedArrayWithArrayBufferAndOffset):
(JSObjectGetTypedArrayBytesPtr):
(JSObjectGetTypedArrayLength):
(JSObjectGetTypedArrayByteLength):
(JSObjectGetTypedArrayByteOffset):
(JSObjectGetTypedArrayBuffer):
(JSObjectMakeArrayBufferWithBytesNoCopy):
(JSObjectGetArrayBufferBytesPtr):
(JSObjectGetArrayBufferByteLength):

• API/JSTypedArray.h: Added.
• API/JSValueRef.cpp:

(handleExceptionIfNeeded): Deleted.

• API/JSValueRef.h:
• API/JavaScript.h:
• API/WebKitAvailability.h:
• API/tests/TypedArrayCTest.cpp: Added.

(id):
(freePtr):
(assertEqualsAsNumber):
(testAccess):
(testConstructors):
(forEachTypedArrayType):
(testTypedArrayCAPI):

• API/tests/TypedArrayCTest.h: Added.
• API/tests/testapi.c:

(main):

• CMakeLists.txt:
• ForwardingHeaders/JavaScriptCore/JSTypedArray.h: Added.
• JavaScriptCore.xcodeproj/project.pbxproj:
• PlatformEfl.cmake:
• PlatformGTK.cmake:
• runtime/ArrayBuffer.cpp:

(JSC::ArrayBuffer::transfer):

• runtime/ArrayBuffer.h:

(JSC::arrayBufferDestructorNull):
(JSC::arrayBufferDestructorDefault):
(JSC::ArrayBufferContents::ArrayBufferContents):
(JSC::ArrayBufferContents::transfer):
(JSC::ArrayBuffer::createAdopted):
(JSC::ArrayBuffer::createFromBytes):
(JSC::ArrayBuffer::ArrayBuffer):
(JSC::ArrayBuffer::pinAndLock):
(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBufferContents::~ArrayBufferContents):

• shell/PlatformWin.cmake:

6:37 PM Changeset in webkit [197982] by n_wang@apple.com

• 14 edits
  2 adds in trunk

AX: Implement bounds/position and index related text marker functions using TextIterator
​https://bugs.webkit.org/show_bug.cgi?id=154976

Reviewed by Chris Fleizach.

Source/WebCore:

Implemented position and index related text marker calls with TextIterator. Also fixed some
VoiceOver navigation issues.

Test: accessibility/mac/text-marker-for-index.html

• accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::traverseToOffsetInRange):
(WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
(WebCore::AXObjectCache::shouldSkipBoundary):
(WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
(WebCore::AXObjectCache::startCharacterOffsetOfWord):
(WebCore::AXObjectCache::nextBoundary):
(WebCore::AXObjectCache::previousBoundary):
(WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
(WebCore::AXObjectCache::localCaretRectForCharacterOffset):
(WebCore::AXObjectCache::absoluteCaretBoundsForCharacterOffset):
(WebCore::AXObjectCache::characterOffsetForPoint):
(WebCore::AXObjectCache::characterOffsetForBounds):
(WebCore::AXObjectCache::endCharacterOffsetOfLine):
(WebCore::AXObjectCache::startCharacterOffsetOfLine):
(WebCore::AXObjectCache::characterOffsetForIndex):
(WebCore::AXObjectCache::indexForCharacterOffset):
(WebCore::AXObjectCache::rootAXEditableElement):

• accessibility/AXObjectCache.h:
• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::visiblePositionRangeForRange):
(WebCore::AccessibilityObject::rangeForPlainTextRange):
(WebCore::AccessibilityObject::lineRangeForPosition):

• accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::boundsForVisiblePositionRange):
(WebCore::AccessibilityObject::boundsForRange):
(WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
(WebCore::AccessibilityObject::doAXStringForRange):
(WebCore::AccessibilityObject::doAXBoundsForRange):
(WebCore::AccessibilityObject::doAXBoundsForRangeUsingCharacterOffset):

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::nodeIsTextControl):
(WebCore::AccessibilityRenderObject::boundsForRects):
(WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
(WebCore::AccessibilityRenderObject::boundsForRange):
(WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
(WebCore::AccessibilityRenderObject::doAXBoundsForRange):
(WebCore::AccessibilityRenderObject::doAXBoundsForRangeUsingCharacterOffset):
(WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):

• accessibility/AccessibilityRenderObject.h:
• accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper positionForTextMarker:]):
(-[WebAccessibilityObjectWrapper textMarkerRange]):
(-[WebAccessibilityObjectWrapper textMarkerRangeForSelection]):
(-[WebAccessibilityObjectWrapper textMarkerForPosition:]):
(-[WebAccessibilityObjectWrapper _stringForRange:attributed:]):
(-[WebAccessibilityObjectWrapper frameForTextMarkers:]):
(-[WebAccessibilityObjectWrapper textMarkerForPoint:]):
(-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):

• accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper doAXAttributedStringForRange:]):
(-[WebAccessibilityObjectWrapper _convertToNSRange:]):
(-[WebAccessibilityObjectWrapper _indexForTextMarker:]):
(-[WebAccessibilityObjectWrapper _textMarkerForIndex:]):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

• editing/htmlediting.cpp:

(WebCore::localCaretRectInRendererForCaretPainting):
(WebCore::localCaretRectInRendererForRect):

• editing/htmlediting.h:

LayoutTests:

• accessibility/mac/text-marker-for-index-expected.txt: Added.
• accessibility/mac/text-marker-for-index.html: Added.
• accessibility/mac/text-marker-word-nav-expected.txt:
• accessibility/mac/text-marker-word-nav.html:

5:49 PM Changeset in webkit [197981] by Simon Fraser

• 37 edits in trunk

Font antialiasing (smoothing) changes when elements are rendered into compositing layers
​https://bugs.webkit.org/show_bug.cgi?id=23364

Reviewed by Tim Horton.

Source/WebCore:

Improve the appearance of subpixel-antialiased ("smoothed") text in non-opaque layers
by opting in to a new CALayer backing store format.

GraphicsLayer now has setSupportsSmoothedFonts(), which is called by RenderLayerBacking
when the platform has support for the new feature. Ideally this would only be set when
we know a layer has smoothed text drawn into it, but, for now, enable this for all
layers. The right thing happens with opaque layers under the hood.

setSupportsSmoothedFonts() is turned into a PlatformCALayer contentsFormat flag, which
is ultimately passed to setBackingStoreFormat().

We also need to propagate this flag to TileController tiles.

• platform/graphics/GraphicsLayer.cpp:

(WebCore::GraphicsLayer::supportsSmoothedLayerText):
(WebCore::GraphicsLayer::setSmoothedLayerTextEnabled):
(WebCore::GraphicsLayer::smoothedLayerTextEnabled):
(WebCore::GraphicsLayer::GraphicsLayer):

• platform/graphics/GraphicsLayer.h:

(WebCore::GraphicsLayer::supportsSmoothedFonts):
(WebCore::GraphicsLayer::setSupportsSmoothedFonts):

• platform/graphics/TiledBacking.h:
• platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayer::supportsSmoothedLayerText):
(WebCore::GraphicsLayer::setSmoothedLayerTextEnabled):
(WebCore::GraphicsLayer::smoothedLayerTextEnabled):
(WebCore::GraphicsLayerCA::setSupportsSmoothedFonts):
(WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
(WebCore::GraphicsLayerCA::updateContentsFormat):

• platform/graphics/ca/GraphicsLayerCA.h:
• platform/graphics/ca/PlatformCALayer.cpp:

(WebCore::PlatformCALayer::drawRepaintIndicator): Give the number a "shadow" when
the contents format says we support smoothed fonts.

• platform/graphics/ca/PlatformCALayer.h:
• platform/graphics/ca/TileController.cpp:

(WebCore::TileController::setTileContentsFormatFlags):
(WebCore::TileController::createTileLayer):

• platform/graphics/ca/TileController.h:
• platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::updateTileLayerProperties):

• platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
• platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

(WebCore::setBackingStoreFormat):
(PlatformCALayerCocoa::commonInit):
(PlatformCALayerCocoa::setContentsFormat):
(PlatformCALayer::drawLayerContents): Previously, we turned off font smoothing in
non-opaque layers to improve text appearance. We no longer need to do that when
the contents format has "SmoothedFonts".

• platform/graphics/ca/win/PlatformCALayerWin.cpp:

(PlatformCALayerWin::setContentsFormat):
(PlatformCALayerWin::contentsFormat):

• platform/graphics/ca/win/PlatformCALayerWin.h:
• platform/ios/LegacyTileGridTile.mm:

(WebCore::setBackingStoreFormat):
(WebCore::LegacyTileGridTile::LegacyTileGridTile):

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::createGraphicsLayer):

Source/WebKit/mac:

Allow internal clients to turn off smoothed layer text, so that WebKitTestRunner
can disable it.

• WebView/WebView.mm:

(+[WebView _setSmoothedLayerTextEnabled:]):
(+[WebView _smoothedLayerTextEnabled]):

• WebView/WebViewPrivate.h:

Source/WebKit2:

Send the ContentsFormat to the UI process (but nothing happens to it there yet).

Allow internal clients to turn off smoothed layer text, so that WebKitTestRunner
can disable it.

• Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::WebProcessCreationParameters):
(WebKit::WebProcessCreationParameters::encode):
(WebKit::WebProcessCreationParameters::decode):

• Shared/WebProcessCreationParameters.h:
• Shared/mac/RemoteLayerTreeTransaction.h:
• Shared/mac/RemoteLayerTreeTransaction.mm:

(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):

• UIProcess/API/C/WKContext.cpp:

(WKContextEnableSmoothedLayerText):

• UIProcess/API/C/WKContextPrivate.h:
• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::createNewWebProcess):
(WebKit::WebProcessPool::enableSmoothedLayerText):
(WebKit::WebProcessPool::WebProcessPool): Deleted.

• UIProcess/WebProcessPool.h:
• WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:

(WebKit::PlatformCALayerRemote::setContentsFormat):
(WebKit::PlatformCALayerRemote::contentsFormat):

• WebProcess/WebPage/mac/PlatformCALayerRemote.h:
• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess):
(WebKit::WebProcess::enableSmoothedLayerText):

• WebProcess/WebProcess.h:
• WebProcess/WebProcess.messages.in:

Tools:

Turn off smoothed layer text because it affects many layout test results.

• DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebViewToConsistentStateBeforeTesting):

• WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetStateToConsistentValues):

5:46 PM Changeset in webkit [197980] by Ryan Haddad

• 3 edits in trunk/Source/WebCore

Unreviewed, rolling out r197922.
​https://bugs.webkit.org/show_bug.cgi?id=155340

This change broke storage/websql tests on ios-simulator.
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"WebKit should adopt journal_mode=wal for all SQLite
databases."
​https://bugs.webkit.org/show_bug.cgi?id=133496
​http://trac.webkit.org/changeset/197922

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-03-10

5:41 PM Changeset in webkit [197979] by mmaxfield@apple.com

• 3 edits in trunk/LayoutTests

[Cocoa] Test gardening after r197933
<rdar://problem/25091368>

Unreviewed.

• fast/text/woff2-expected.html:
• fast/text/woff2.html:

5:34 PM Changeset in webkit [197978] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebCore

Fix the build again.

• editing/cocoa/DataDetection.mm:

(WebCore::constructURLStringForResult):

5:32 PM Changeset in webkit [197977] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebCore

Fix the build.

• editing/cocoa/DataDetection.mm:

5:06 PM Changeset in webkit [197976] by enrica@apple.com

• 9 edits in trunk/Source

Expose additional WKDataDetectorTypes.
​https://bugs.webkit.org/show_bug.cgi?id=155331
rdar://problem/24175813

Reviewed by Tim Horton.

Source/WebCore:

Adding support for additional data detector types (tracking
numbers, flight information and spotlight suggestions).

• editing/cocoa/DataDetection.h:
• editing/cocoa/DataDetection.mm:

(WebCore::constructURLStringForResult):
(WebCore::DataDetection::detectContentInRange):

• platform/cocoa/DataDetectorsCoreSoftLink.h:
• platform/cocoa/DataDetectorsCoreSoftLink.mm:
• platform/spi/cocoa/DataDetectorsCoreSPI.h:

Source/WebKit2:

Adding API to enable data detection of tracking numbers,
flight number and spotlight suggestions.

• UIProcess/API/Cocoa/WKWebView.mm:

(fromWKDataDetectorTypes):

• UIProcess/API/Cocoa/WKWebViewConfiguration.h:

5:03 PM Changeset in webkit [197975] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebInspectorUI

Web Inspector: color swatch and border are misaligned in Visual Styles sidebar
​https://bugs.webkit.org/show_bug.cgi?id=154471

Patch by Daniel Strokis <​dstrokis@icloud.com> on 2016-03-10
Reviewed by Timothy Hatcher.

Color swatches in the Visual Styles sidebar now have only their left corners rounded (thanks to Matt Baker for the idea).

• UserInterface/Views/InlineSwatch.css:

(.inline-swatch > span):
(.inline-swatch): Deleted.

• UserInterface/Views/VisualStyleColorPicker.css:

(.visual-style-property-container.input-color-picker > .visual-style-property-value-container > .inline-swatch.color):

4:49 PM Changeset in webkit [197974] by Matt Baker

• 14 edits
  1 delete in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: remove navigation sidebar
​https://bugs.webkit.org/show_bug.cgi?id=153036
<rdar://problem/24195627>

Reviewed by Timothy Hatcher.

Removed TimelineView methods used by the sidebar to setup the content tree
outline and handle tree element events, which are no longer used. Tree elements
are no longer created by TimelineViews as records are processed.

• UserInterface/Main.html:

Removed files.

• UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView):
Removed tree outline event listeners and data grid parameter.
(WebInspector.LayoutTimelineView.prototype._processPendingRecords):
(WebInspector.LayoutTimelineView.prototype._dataGridFiltersDidChange):
(WebInspector.LayoutTimelineView.prototype._hoveredOrSelectedRecord):
Get record from data grid node instead of tree element.
(WebInspector.LayoutTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.LayoutTimelineView.prototype._mouseOverTreeOutline): Deleted.
(WebInspector.LayoutTimelineView.prototype._mouseLeaveTreeOutline): Deleted.
No longer needed, highlighting performed by data grid event handlers.

• UserInterface/Views/MemoryTimelineView.js:

(WebInspector.MemoryTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
No longer needed.

• UserInterface/Views/NavigationSidebarPanel.js:

(WebInspector.NavigationSidebarPanel.prototype._updateFilter): Deleted.
Removed hack which was specific to TimelineSidebarPanel.

• UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
Removed sidebar styles and tree outline data grid parameter.
(WebInspector.NetworkTimelineView.prototype._processPendingRecords):
(WebInspector.NetworkTimelineView.prototype._dataGridFiltersDidChange):
(WebInspector.NetworkTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.NetworkTimelineView.prototype.treeElementSelected): Deleted.
No longer needed.

• UserInterface/Views/OverviewTimelineView.js:

(WebInspector.OverviewTimelineView):
(WebInspector.OverviewTimelineView.prototype.get selectionPathComponents):
(WebInspector.OverviewTimelineView.prototype.dataGridNodePathComponentSelected):
Create path components from the grid selection. This should have been
included in ​https://webkit.org/b/154954.

(WebInspector.OverviewTimelineView.prototype._compareDataGridNodesByStartTime.getStartTime):
(WebInspector.OverviewTimelineView.prototype._compareDataGridNodesByStartTime):
(WebInspector.OverviewTimelineView.prototype._insertDataGridNode):
(WebInspector.OverviewTimelineView.prototype._addResourceToDataGridIfNeeded):
(WebInspector.OverviewTimelineView.prototype._addSourceCodeTimeline):
Refactored to accept grid nodes instead of tree elements.

(WebInspector.OverviewTimelineView.prototype._processPendingRepresentedObjects):
(WebInspector.OverviewTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.OverviewTimelineView.prototype.shown):
(WebInspector.OverviewTimelineView.prototype.treeElementPathComponentSelected): Deleted.
(WebInspector.OverviewTimelineView.prototype._compareTreeElementsByDetails): Deleted.
Not used anywhere.

(WebInspector.OverviewTimelineView.prototype._compareTreeElementsByStartTime.getStartTime): Deleted.
(WebInspector.OverviewTimelineView.prototype._compareTreeElementsByStartTime): Deleted.
(WebInspector.OverviewTimelineView.prototype._insertTreeElement): Deleted.
(WebInspector.OverviewTimelineView.prototype._addResourceToTreeIfNeeded): Deleted.
Reimplemented as _compareDataGridNodesByStartTime, _insertDataGridNode and _addResourceToDataGridIfNeeded.

• UserInterface/Views/RenderingFrameTimelineView.js:

(WebInspector.RenderingFrameTimelineView):
Removed sidebar styles and tree outline data grid parameter.

(WebInspector.RenderingFrameTimelineView.prototype.get selectionPathComponents):
(WebInspector.RenderingFrameTimelineView.prototype.dataGridNodePathComponentSelected):
Create path components from the grid selection. This should have been
included in ​https://webkit.org/b/154954.

(WebInspector.RenderingFrameTimelineView.prototype._processPendingRecords):
(WebInspector.RenderingFrameTimelineView.prototype._scopeBarSelectionDidChange):
(WebInspector.RenderingFrameTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype.treeElementDeselected): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype.treeElementSelected): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype.treeElementPathComponentSelected): Deleted.

• UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView):
Don't hold reference to extraArguments, just pass to subviews.

• UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView):
Removed sidebar styles and tree outline data grid parameter.
(WebInspector.ScriptDetailsTimelineView.prototype._processPendingRecords):
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridFiltersDidChange):
(WebInspector.ScriptDetailsTimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype.treeElementSelected): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype.dataGridNodeForTreeElement): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype.populateProfileNodeTreeElement): Deleted.

• UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid.prototype.addRowInSortOrder):
Fixed failure when treeElement and parentTreeElementOrDataGridNode are both null.

• UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
Removed extraArguments and sidebar panel references.
(WebInspector.TimelineRecordingContentView.prototype.contentBrowserTreeElementForRepresentedObject):
Use icon style from the tab, instead of the sidebar.
(WebInspector.TimelineRecordingContentView.prototype._currentContentViewDidChange):
Removed updates to the sidebar.
(WebInspector.TimelineRecordingContentView.prototype._pathComponentSelected):
(WebInspector.TimelineRecordingContentView.prototype._updateTimes):
(WebInspector.TimelineRecordingContentView.prototype._instrumentAdded):
Removed sidebar reference when creating new TimelineViews.
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged):

• UserInterface/Views/TimelineSidebarPanel.css: Removed.

• UserInterface/Views/TimelineTabContentView.js:

(WebInspector.TimelineTabContentView):
Removed hidden sidebar FIXME.
(WebInspector.TimelineTabContentView.prototype._addRecording):
New location for sidebar style class constant StopwatchIconStyleClass.

• UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView):
(WebInspector.TimelineView.prototype.get navigationItems): Deleted.
(WebInspector.TimelineView.prototype.get navigationSidebarTreeOutline): Deleted.
(WebInspector.TimelineView.prototype.get navigationSidebarTreeOutlineLabel): Deleted.
(WebInspector.TimelineView.prototype.get timelineSidebarPanel): Deleted.
(WebInspector.TimelineView.prototype.treeElementPathComponentSelected): Deleted.
(WebInspector.TimelineView.prototype.treeElementDeselected): Deleted.
(WebInspector.TimelineView.prototype.treeElementSelected): Deleted.
(WebInspector.TimelineView.prototype._treeSelectionDidChange): Deleted.
Sidebar logic for panel and content tree outline removed.

4:47 PM Changeset in webkit [197973] by Beth Dakin

• 5 edits
  4 adds in trunk/Source/WebKit2

defaultActions in UIDelegate method
_webView:previewingViewControllerForElement:defaultActions: need to be
use-able by a client
​https://bugs.webkit.org/show_bug.cgi?id=155304
-and corresponding-
rdar://problem/24269296

Reviewed by Anders Carlsson.

This patch adds a new protocol, WKPreviewActionItem, which is a sub-protocol
of UIPreviewActionItem. The new protocol adds an identifier so that clients
can identify which of our default actions they want to use. In order for a
client to use our default action items, they need to return those actions in
their UIViewController's implementation of previewActionItems.

Change the defaultActions to NSArray <id <WKPreviewActionItem>> *

• UIProcess/API/Cocoa/WKUIDelegatePrivate.h:

This new file defines our sub-protocol and sub-class for WKPreviewActions.

• UIProcess/API/Cocoa/_WKPreviewAction.h: Added.
• UIProcess/API/Cocoa/_WKPreviewAction.mm: Added.

(+[_WKPreviewAction actionWithIdentifier:title:style:handler:]):

New BOOL _uiDelegateProvidedPreviewingViewController keeps track of whether
the client returned a view controller from
_webView:previewingViewControllerForElement:defaultActions:. If they did
return a view controller, then we should invoke
_webView:commitPreviewingViewController: at commit time. If they returned
nil, then they indicated that WebKit should continue with default previewing
behavior, so we will not invoke the UIDelegate’s commit method.

• UIProcess/ios/WKContentViewInteraction.h:
• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _registerPreview]):
(-[WKContentView _unregisterPreview]):
(-[WKContentView _interactionShouldBeginFromPreviewItemController:forPosition:]):

In order for our default actions to be useful, we have to create
_WKPreviewActions.
(-[WKContentView _presentedViewControllerForPreviewItemController:]):

Only invoke _webView:commitPreviewedViewController: if
_uiDelegateProvidedPreviewingViewController is YES.
(-[WKContentView _previewItemController:commitPreview:]):

• WebKit2.xcodeproj/project.pbxproj:

4:45 PM Changeset in webkit [197972] by dbates@webkit.org

• 69 edits
  13 adds in trunk

CSP: Implement frame-ancestors directive
​https://bugs.webkit.org/show_bug.cgi?id=154345
<rdar://problem/24702161>

Reviewed by Brent Fulgham.

Source/WebCore:

Add support for the Content Security Policy directive frame-ancestors per the Content Security
Policy 2.0 spec., <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Tests: http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-meta-element-ignored.html

http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored.html
http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https.html
http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin.html
http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https.html
http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin.html

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied): Extracted from DocumentLoader::responseReceived().
(WebCore::DocumentLoader::responseReceived): Extracted logic to cancel a load and dispatch a DOM Load
event at the frame owner into DocumentLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied().
Make use of this function when loading of the frame is blocked by either the Content Security Policy or
the X-Frame-Option policy. We explicitly instantiate a ContentSecurityPolicy object with a SecurityOrigin
and Frame instead of using ScriptExecutionContext m_frame->document() because m_frame->document() is not
in a stable state (for instance, Document::m_url has not been initialized) as we are in the process of
loading the underlying document data for it.

• loader/DocumentLoader.h:
• loader/FrameLoader.cpp:

(WebCore::FrameLoader::didBeginDocument): Pass ContentSecurityPolicy::ReportParsingErrors::No to silence
errors raised when parsing the Content Security Policy headers to avoid duplicate error messages. Any
parsing errors would have been raised when we parsed the Content Security Policy in DocumentLoader.

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Modified to take an optional pointer to a Frame (defaults
to nullptr). The specified Frame is used to support emitting console messages for violations/syntax errors and
send violation reports. We make use of this constructor variant in DocumentLoader to support emitting console
message and sending violation reports in the context of DocumentLoader where its associated Document is not in a
stable state and making use of a Frame seems less error prone.
(WebCore::ContentSecurityPolicy::didReceiveHeaders): Modified to take argument reportParsingErrors as
to whether to silence parsing errors when parsing the specified headers.
(WebCore::isAllowedByAllWithFrame): Helper function to query a ContentSecurityPolicyDirectiveList function
passing a Frame and URL for each Content Security Policy.
(WebCore::ContentSecurityPolicy::allowFrameAncestors): Calls WebCore::isAllowedByAllWithFrame().
(WebCore::ContentSecurityPolicy::reportViolation): Modified to support sending a violation report when
we have a Frame and no ScriptExecutionContext (such as when we are instantiated in DocumentLoader).
Additionally, we only will send a report if reporting is enabled (i.e. ContentSecurityPolicy::m_isReportingEnabled == true).
(WebCore::ContentSecurityPolicy::logToConsole): Modified to support logging a message to the console
we have a Frame and no ScriptExecutionContext. We also only allow logging if reporting is enabled.

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::checkFrameAncestors): Added.
(WebCore::ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation): Added.
(WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Added.
(WebCore::ContentSecurityPolicyDirectiveList::parse): Ignore the directive frame-ancestors when defined
in a policy given in an HTML meta element and report such use as invalid.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Parse the directive frame-ancestors.

• page/csp/ContentSecurityPolicyDirectiveList.h:
• page/csp/ContentSecurityPolicyResponseHeaders.h: Mark constructor "explicit".

LayoutTests:

Adds new tests to ensure we ignore directive frame-ancestors when defined a policy delivered
in an HTML meta element or in a report-only policy (i.e. delivered via HTTP header Content-
Security-Policy-Report-Only). Also adds new test to ensure that we send a violation report
when the directive frame-ancestors is violated.

Updated many existing tests and test results that unnecessarily depended on a DOM SecurityError
exception being thrown when accessing the content of a cross-origin frame. It is sufficient
and more direct to test directive frame-ancestors by dumping the contents of all children frames
on the page. We design the tests such that a child frame that was blocked by the frame-ancestors
directive is expected to have no content. A child frame that was allowed by the frame-ancestors
directive is expected to have content.

• TestExpectations: Mark frame-ancestors tests as PASS so that we run them.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-meta-element-ignored-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-meta-element-ignored.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-none-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-self-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-star-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-star-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-none-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-self-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-url-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-url-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-url-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-url-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-none-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-self-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-star-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-star-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-url-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-url-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-url-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-url-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-none-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-self-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-self-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-star-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-star-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-url-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-url-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-url-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-url-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-none-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-protocolless-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-protocolless-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-self-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-self-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-self-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-star-allow-crossorigin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-star-allow-crossorigin.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-star-allow-sameorigin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-star-allow-sameorigin.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-url-allow-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-url-allow.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-url-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-url-block.html:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin.html: Added.
• http/tests/security/contentSecurityPolicy/resources/echo-intertag.pl: Added.
• http/tests/security/contentSecurityPolicy/resources/frame-ancestors-test.js:

(done): Added.
(injectIFrame): Modified to make use of handleFrameEvent().
(handleFrameEvent): Added.
(iframeLoaded): Deleted.

• http/tests/security/contentSecurityPolicy/resources/frame-in-frame.pl:

4:44 PM Changeset in webkit [197971] by Joseph Pecoraro

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Enable Memory Timelines by default if supported
​https://bugs.webkit.org/show_bug.cgi?id=155333
<rdar://problem/25097319>

Reviewed by Timothy Hatcher.

• UserInterface/Controllers/TimelineManager.js:

(WebInspector.TimelineManager.defaultInstruments):

4:43 PM Changeset in webkit [197970] by sbarati@apple.com

• 7 edits
  1 add in trunk/Source/JavaScriptCore

[ES6] Instanceof isn't spec compliant when the RHS is a Proxy with a target that is a function
​https://bugs.webkit.org/show_bug.cgi?id=155329

Reviewed by Mark Lam.

We use type info flags on the structure to dictate whether or not
the RHS of an instanceof is a valid RHS (i.e, a function). The solution
to make Proxy a valid RHS when the Proxy's target is callable is to have
two different structures for ProxyObject: one for a non-callable target
and one for a callable target.

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::moduleRecordStructure):
(JSC::JSGlobalObject::moduleNamespaceObjectStructure):
(JSC::JSGlobalObject::proxyObjectStructure):
(JSC::JSGlobalObject::callableProxyObjectStructure):
(JSC::JSGlobalObject::proxyRevokeStructure):
(JSC::JSGlobalObject::wasmModuleStructure):

• runtime/ProxyConstructor.cpp:

(JSC::makeRevocableProxy):
(JSC::constructProxyObject):
(JSC::ProxyConstructor::getConstructData):

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::ProxyObject):
(JSC::ProxyObject::structureForTarget):
(JSC::ProxyObject::finishCreation):

• runtime/ProxyObject.h:

(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):

• tests/es6.yaml:
• tests/stress/proxy-instanceof.js: Added.

(assert):
(test):
(C):
(test.let.handler.get if):
(test.let.handler):

4:42 PM Changeset in webkit [197969] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

Add shouldNotBe to standalone test harness
​https://bugs.webkit.org/show_bug.cgi?id=155300

Patch by Andy VanWagoner <​andy@instructure.com> on 2016-03-10
Reviewed by Saam Barati.

Copy over the shouldNotBe function from js-test-pre. This fixes errors
introduced be new Intl tests.

• resources/standalone-pre.js:

(shouldNotBe):

4:34 PM Changeset in webkit [197968] by jer.noble@apple.com

• 16 edits in trunk/Source

Add WebCore, WebKit, & WebKit2 preference/setting to enable Main Content heuristic.
​https://bugs.webkit.org/show_bug.cgi?id=155326
<rdar://problem/25095408>

Reviewed by Beth Dakin.

Source/WebCore:

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::HTMLMediaElement): Set the OverrideUserGestureRequirementForMainContent if the new setting is enabled.

• page/Settings.in:

Source/WebKit/mac:

Add SPI to get and set the new preference.

• WebView/WebPreferenceKeysPrivate.h:
• WebView/WebPreferences.mm:

(-[WebPreferences overrideUserGestureRequirementForMainContent]):
(-[WebPreferences setOverrideUserGestureRequirementForMainContent:]):

• WebView/WebPreferencesPrivate.h:
• WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:

Add SPI to get and set the new preference.

• Shared/WebPreferencesDefinitions.h:
• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetMainContentUserGestureOverrideEnabled):
(WKPreferencesGetMainContentUserGestureOverrideEnabled):

• UIProcess/API/C/WKPreferencesRefPrivate.h:
• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration _mainContentUserGestureOverrideEnabled]):
(-[WKWebViewConfiguration _setMainContentUserGestureOverrideEnabled:]):

• UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

4:32 PM Changeset in webkit [197967] by Said Abou-Hallawa

• 8 edits in trunk/Source/WebCore

REGRESSION: GuardMallloc crash in SVGListPropertyTearOff<SVGPointList>::processIncomingListItemWrapper
​https://bugs.webkit.org/show_bug.cgi?id=154969

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2016-03-10
Reviewed by Darin Adler.

The life cycle of the SVGAnimatedPropertyTearOff::m_baseVal and m_animVal
was not correct. Like what was done in SVGAnimatedListPropertyTearOff,
m_baseVal and m_animVal have to be raw RefCounted pointers. When requested
through, SVGAnimatedPropertyTearOff::baseVal() and animVal() they are
encapsulated in a RefPtr to ensure they existence as long as they are
referenced. When the animated property object (which is stored in either
m_baseVal or m_animVal) is not referenced by anyone, it is going to be
deleted. In the destructor of their class, SVGAnimatedPropertyTearOff
will be notified of this deletion through propertyWillBeDeleted() to clean
its member m_baseVal or m_animVal.

• bindings/scripts/CodeGeneratorJS.pm:

(NativeToJSValue): Now all the SVG animated property return RefPtrs. In
addition to that, SVGViewSpec.transform also returns
RefPtr<SVGTransformListPropertyTearOff>.

• svg/properties/SVGAnimatedListPropertyTearOff.h:

(WebCore::SVGAnimatedListPropertyTearOff::animVal):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Change propertyWillBeDeleted() to be virtual and make it takes an SVGProperty*.
Rename m_animatingAnimVal to be m_animatedProperty. Add isAnimating() which
returns true if m_animatedProperty is not null. Use isAnimating() instead of
m_isAnimating because it's deleted from the base class.

• svg/properties/SVGAnimatedProperty.cpp:

(WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
(WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):

• svg/properties/SVGAnimatedProperty.h:

(WebCore::SVGAnimatedProperty::isAnimating):
(WebCore::SVGAnimatedProperty::propertyWillBeDeleted):
Delete m_isAnimating since its value can be deduced from the value of
m_animatedProperty in the derived class. Add propertyWillBeDeleted() and
isAnimating() as virtual functions with the default behavior.

• svg/properties/SVGAnimatedPropertyTearOff.h:

(WebCore::SVGAnimatedPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPropertyTearOff::animVal):
Like SVGAnimatedListPropertyTearOff::baseVal() and animVal() create the
value if it does not exist. Keep a raw RefCounted pointer but return a
RefPtr.

(WebCore::SVGAnimatedPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedPropertyTearOff::propertyWillBeDeleted):
Override virtual functions.

(WebCore::SVGAnimatedPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
Replace m_isAnimating with isAnimating(). Ensure that we get a new animated
property through animVal() and store it in a RefPtr to ensure it will not
go away while animating.

• svg/properties/SVGAnimatedStaticPropertyTearOff.h:

(WebCore::SVGAnimatedStaticPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedStaticPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):
Add isAnimating() and replace all the instances of m_isAnimating with calls
to isAnimating().

• svg/properties/SVGPropertyTearOff.h:

(WebCore::SVGPropertyTearOff::animatedProperty):
(WebCore::SVGPropertyTearOff::setAnimatedProperty):
(WebCore::SVGPropertyTearOff::contextElement):
(WebCore::SVGPropertyTearOff::SVGPropertyTearOff):
(WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
SVGPropertyTearOff is what SVGAnimatedPropertyTearOff creates for its
baseVal() and animVal() values. These values can be null anytime once
they are not referenced. The SVGAnimatedPropertyTearOff holds only raw
RefCounted pointer for them. So (1) SVGPropertyTearOff needs to hold a
RefPtr for its SVGAnimatedProperty and (2) it needs to notify its
SVGAnimatedProperty when it's deleted by calling propertyWillBeDeleted()
from the destructor. Also there is no need to get the contextElement()
and save it in class member, m_contextElement since it can be always be
retrieved from SVGAnimatedProperty::contextElement().

4:05 PM Changeset in webkit [197966] by Ryan Haddad

• 3 edits in trunk/LayoutTests

Rebaseline two inspector tests after r197954 changed the results.

Unreviewed test gardening.

• inspector/debugger/command-line-api-exception-expected.txt:
• platform/mac/inspector/model/remote-object-expected.txt:

3:54 PM Changeset in webkit [197965] by achristensen@apple.com

• 2 edits in trunk/Source/WebKit2

Remove firing assertion after r197865.
​https://bugs.webkit.org/show_bug.cgi?id=155137
rdar://problem/25096835

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveData:]):
This assertion was firing. I'm looking into why.

3:50 PM Changeset in webkit [197964] by jer.noble@apple.com

• 2 edits in trunk/Tools

Partial roll-out of r197953; test fails because encode/decode support of those properties were never added.

• TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST): Deleted.

3:48 PM Changeset in webkit [197963] by msaboff@apple.com

• 2 edits in trunk/Source/JavaScriptCore

[ES6] RegExp sticky flag should be ignored in String.match when global flag is given
​https://bugs.webkit.org/show_bug.cgi?id=155332

Reviewed by Saam Barati.

Removed logic from stringProtoFuncMatch that handles the case where both global and sticky flags are set.

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncMatch):

3:38 PM Changeset in webkit [197962] by msaboff@apple.com

• 7 edits
  3 adds
  10 deletes in trunk

[ES6] Allow RegExp constructor to take pattern from an existing RegExp with new flags
​https://bugs.webkit.org/show_bug.cgi?id=155315

Reviewed by Saam Barati.

Source/JavaScriptCore:

Changed to comply with section 21.2.3.1, step 5. Eliminated syntax error.

In the process, change to get the VM at the top of the function.

Updated tests accordingly.

• runtime/RegExpConstructor.cpp:

(JSC::constructRegExp):

• tests/es6.yaml: Changed miscellaneous_RegExp_constructor_can_alter_flags.js to normal.
• tests/mozilla/mozilla-tests.yaml: Disabled ecma_3/RegExp/15.10.4.1-5-n.js as it checks

for the old behavior of throwing a syntax error.

LayoutTests:

New and updated test for change.

• fast/regex/constructor-expected.txt:
• fast/regex/script-tests/constructor.js:

Changed test for new behavior.`

• js/regexp-old-regexp-new-flags-expected.txt: Added.
• js/regexp-old-regexp-new-flags.html: Added.
• js/script-tests/regexp-old-regexp-new-flags.js: Added.

New test.

• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.3/S15.10.3.1_A2_T1-expected.txt: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.3/S15.10.3.1_A2_T1.html: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.3/S15.10.3.1_A2_T2-expected.txt: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.3/S15.10.3.1_A2_T2.html: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A2_T1-expected.txt: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A2_T1.html: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A2_T2-expected.txt: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A2_T2.html: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A8_T8-expected.txt: Removed.
• sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.4/S15.10.4.1_A8_T8.html: Removed.

Removed obsolete tests.

3:18 PM Changeset in webkit [197961] by Matt Baker

• 8 edits
  3 adds in trunk/Source/WebInspectorUI

Web Inspector: Add "Quick Open" dialog to debugger and resources tabs
​https://bugs.webkit.org/show_bug.cgi?id=153028
<rdar://problem/24194239>

Reviewed by Timothy Hatcher.

• Localizations/en.lproj/localizedStrings.js:

New placeholder text for open resource dialog field.

• UserInterface/Base/Main.js:

(WebInspector.contentLoaded):
Keep a reference to the content element to use as global dialog parent,
and create keyboard shortcut for new dialog.

(WebInspector._showOpenResourceDialog):
Create dialog if needed, return if already visible.
(WebInspector.dialogWasDismissed):
Show represented object, if any, when dialog is dismissed.

• UserInterface/Main.html:

New files.

• UserInterface/Views/Dialog.js: Added.

Base class for modal dialog popovers. Implements basic setup and
teardown, and logic for validating and returning a represented object.

(WebInspector.Dialog):
(WebInspector.Dialog.prototype.get visible):
(WebInspector.Dialog.prototype.get delegate):
(WebInspector.Dialog.prototype.get representedObject):
(WebInspector.Dialog.prototype.present):
(WebInspector.Dialog.prototype.dismiss):
(WebInspector.Dialog.prototype.didPresetDialog):
(WebInspector.Dialog.prototype.representedObjectIsValid):

• UserInterface/Views/GoToLineDialog.js:

Subclass the Dialog base class.
(WebInspector.GoToLineDialog):
(WebInspector.GoToLineDialog.prototype.didPresentDialog):
Implement base class behavior hook. Replaces "present".
(WebInspector.GoToLineDialog.prototype._handleInputEvent):
(WebInspector.GoToLineDialog.prototype._handleKeydownEvent):
Line number validation handled by base class/delegate.
(WebInspector.GoToLineDialog.prototype._clear):
(WebInspector.GoToLineDialog.prototype.present): Deleted.
(WebInspector.GoToLineDialog.prototype.dismiss): Deleted.
No longer needed, handled by base class.

• UserInterface/Views/OpenResourceDialog.css: Added.

(.open-resource-dialog):
(.open-resource-dialog > .field):
(.open-resource-dialog > .field > input):
(.open-resource-dialog > .field > input::-webkit-input-placeholder):
(.open-resource-dialog > .field > img):
(.open-resource-dialog > .field > img:active):
(.open-resource-dialog.non-empty > .field > img):
(.open-resource-dialog > .tree-outline):
(.open-resource-dialog > .tree-outline .item):
(.open-resource-dialog > .tree-outline .item:first-child):
(.open-resource-dialog > .tree-outline .item.selected):
(.open-resource-dialog > .tree-outline .item.selected .subtitle):
Styles for "quick open" dialog.

• UserInterface/Views/OpenResourceDialog.js: Added.

New dialog type, based on the Quick Open dialog found in Xcode (and its
equivalent in most modern editors).

(WebInspector.OpenResourceDialog):
(WebInspector.OpenResourceDialog.prototype._populateResourceTreeOutline.createTreeElement):
(WebInspector.OpenResourceDialog.prototype._populateResourceTreeOutline):
Populate the auto-completion tree from the list of filtered resources.

(WebInspector.OpenResourceDialog.prototype.didPresentDialog):
Build resource list once, when the dialog is presented. Update the list
when resources are added/removed in a follow-up: ​https://webkit.org/b/155321.

(WebInspector.OpenResourceDialog.prototype._handleInputEvent):
(WebInspector.OpenResourceDialog.prototype._handleKeydownEvent):
Escape key: dismiss dialog if input is empty, otherwise clear input.
Enter key: dismiss dialog if object selected.
Key up/down: cycle through auto-completion tree items, if any.

(WebInspector.OpenResourceDialog.prototype._handleKeyupEvent):
(WebInspector.OpenResourceDialog.prototype._handleBlurEvent):
(WebInspector.OpenResourceDialog.prototype._handleMousedownEvent):
(WebInspector.OpenResourceDialog.prototype._handleClickEvent):
(WebInspector.OpenResourceDialog.prototype._clear):
(WebInspector.OpenResourceDialog.prototype._updateFilter):
Rebuild filter regular expressions and apply to all resources. Each
resource is given a weight based on the first matching filter. Filters
are ordered by relevancy, from most to least relevant. Filtered resources
are sorted based on weight. If no matches are found, the tree is hidden.

• UserInterface/Views/ResourceTreeElement.js:

(WebInspector.ResourceTreeElement.prototype.get filterableData):
make filterable resource data more fine-grained. Priority should be given
to the resource's name, before the complete URL.

• UserInterface/Views/SourceCodeTextEditor.js:

(WebInspector.SourceCodeTextEditor.prototype.showGoToLineDialog):
(WebInspector.SourceCodeTextEditor.prototype.dialogWasDismissed):
(WebInspector.SourceCodeTextEditor.prototype.goToLineDialogValueWasValidated): Deleted.
(WebInspector.SourceCodeTextEditor.prototype.goToLineDialogWasDismissed): Deleted.
Updated for new Dialog delegate behavior.

• UserInterface/Views/TreeOutline.css:

(.tree-outline.large .item .titles):
(.tree-outline.large .item .titles.no-subtitle): Deleted.
Styles for tree elements in "quick open" dialog auto-completion tree.

3:09 PM Changeset in webkit [197960] by sbarati@apple.com

• 3 edits
  1 add in trunk/Source/JavaScriptCore

[ES6] Make ToPropertyDescriptor spec compliant
​https://bugs.webkit.org/show_bug.cgi?id=155313

Reviewed by Mark Lam.

We were performing HasProperty(.) and Get(.) in the same operation.
This isn't valid according to the spec and it's user observable
behavior with Proxy. This patch fixes ToPropertyDescriptor to use
two distinct operations for HasProperty(.) and Get(.).

• runtime/ObjectConstructor.cpp:

(JSC::ownEnumerablePropertyKeys):
(JSC::toPropertyDescriptor):

• tests/es6.yaml:
• tests/stress/to-property-key-correctness.js: Added.

(assert):
(test):
(test.let.handler.has):
(arrayEq):
(let.handler.has):
(let.target):
(set get let):

3:02 PM Changeset in webkit [197959] by BJ Burg

• 2 edits in trunk/Source/JavaScriptCore

Web Inspector: report the underlying parser error message when JSON parsing fails
​https://bugs.webkit.org/show_bug.cgi?id=155303
<rdar://problem/25088939>

Reviewed by Timothy Hatcher.

• inspector/scripts/generate-inspector-protocol-bindings.py:

(generate_from_specification.load_specification):
Stringize the underlying error so we can see what it says.

2:58 PM Changeset in webkit [197958] by Matt Baker

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: TreeOutlineDataGridSynchronizer should be optional in TimelineDataGrid
​https://bugs.webkit.org/show_bug.cgi?id=155318
<rdar://problem/25091949>

Reviewed by Timothy Hatcher.

• UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid):
TreeOutline is optional, and if non-null a tree outline synchronizer is created.

(WebInspector.TimelineDataGrid.prototype.shown):
(WebInspector.TimelineDataGrid.prototype.treeElementForDataGridNode):
(WebInspector.TimelineDataGrid.prototype.dataGridNodeForTreeElement):
(WebInspector.TimelineDataGrid.prototype.treeElementMatchesActiveScopeFilters):
Safety checks for the synchronizer.

(WebInspector.TimelineDataGrid.prototype.addRowInSortOrder):
treeElement is now an optional parameter. If non-null, a tree synchronizer
should exist. The third parameter has been overloaded, to allow passing
a parent tree element or data grid node.

(WebInspector.TimelineDataGrid.prototype._refreshDirtyDataGridNodes):
(WebInspector.TimelineDataGrid.prototype._sort):
Safety checks for the synchronizer.

2:25 PM Changeset in webkit [197957] by Jon Davis

• 2 edits in trunk/Source/WebCore

Fixed broken link for "WebGL 2" on the Feature Status page
​https://bugs.webkit.org/show_bug.cgi?id=155235

Reviewed by Alex Christensen.

• features.json:

2:05 PM Changeset in webkit [197956] by mmaxfield@apple.com

• 22 edits
  5 adds in trunk

[OS X] Main frame scrollbars should appear on the left on RTL systems
​https://bugs.webkit.org/show_bug.cgi?id=155149

Reviewed by Simon Fraser.

Source/WebCore:

A helper function, ScrollableArea::systemLanguageIsRTL() is used to determine
if we should be in this new mode. Once we have determined we should be in
this new mode, there are some scattered places where the geometry math
needed to be updated.

Tests: fast/scrolling/rtl-scrollbars-simple.html

fast/scrolling/rtl-scrollbars.html

• page/scrolling/AsyncScrollingCoordinator.cpp:

(WebCore::AsyncScrollingCoordinator::requestScrollPositionUpdate):
(WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):

• page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):

• platform/mac/ScrollableAreaMac.mm:

(WebCore::ScrollableArea::systemLanguageIsRTL):

• platform/ScrollableArea.h:
• platform/ScrollView.cpp:

(WebCore::ScrollView::updateScrollbars):
(WebCore::ScrollView::scrollCornerRect):

• platform/mac/ScrollAnimatorMac.mm:

(WebCore::ScrollAnimator::scrollbarsAreRTL):

• platform/spi/mac/NSScrollerImpSPI.h:
• rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::positionForClipLayer):

Tools:

Setting the volatile default needs to be done early, so it is
plumbed through the injected bundle's initialization routine.

Control of RTL scrollbars is handled by putting the string
<!-- webkit-test-runner [ rtlScrollbars=true ] -->
on the first line of a test.

• WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm:

(WTR::shouldUseRTLScrollbars):
(WTR::InjectedBundle::platformInitialize):

• WebKitTestRunner/TestController.cpp:

(WTR::TestController::generatePageConfiguration):
(WTR::updateTestOptionsFromTestHeader):
(WTR::TestController::getInjectedBundleInitializationUserData):

• WebKitTestRunner/TestController.h:
• WebKitTestRunner/TestOptions.h:
• WebKitTestRunner/mac/PlatformWebViewMac.mm:

(WTR::PlatformWebView::viewSupportsOptions):

LayoutTests:

• fast/scrolling/rtl-scrollbars-expected.html: Added.
• fast/scrolling/rtl-scrollbars-simple-expected-mismatch.html: Added.
• fast/scrolling/rtl-scrollbars-simple.html: Added.
• fast/scrolling/rtl-scrollbars.html: Added.
• platform/mac-wk1/TestExpectations:
• platform/mac/TestExpectations:
• platform/efl/TestExpectations:
• platform/gtk/TestExpectations:
• platform/ios-simulator/TestExpectations:
• platform/win/TestExpectations:

1:41 PM Changeset in webkit [197955] by ggaren@apple.com

• 9 edits
  1 move in trunk/Source/bmalloc

bmalloc: Rename SmallPage to SmallRun
​https://bugs.webkit.org/show_bug.cgi?id=155320

Reviewed by Alex Christensen.

A page is a fixed-size set of lines.

A run is an variable-sized set of lines.

We want to start using runs because:

(a) we want to support varying the hardware page size by OS;

(b) we want to support allocations larger than our current page size.

• bmalloc.xcodeproj/project.pbxproj:
• bmalloc/Allocator.cpp:

(bmalloc::Allocator::reallocate):

• bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::initializeSmallRunMetadata):
(bmalloc::Heap::scavenge):
(bmalloc::Heap::scavengeSmallRuns):
(bmalloc::Heap::allocateSmallBumpRanges):
(bmalloc::Heap::allocateSmallRun):
(bmalloc::Heap::deallocateSmallLine):
(bmalloc::Heap::initializeLineMetadata): Deleted.
(bmalloc::Heap::scavengeSmallPages): Deleted.
(bmalloc::Heap::allocateSmallPage): Deleted.

• bmalloc/Heap.h:
• bmalloc/LineMetadata.h:
• bmalloc/SmallChunk.h:

(bmalloc::SmallChunk::begin):
(bmalloc::SmallChunk::end):
(bmalloc::SmallChunk::lines):
(bmalloc::SmallChunk::runs):
(bmalloc::SmallChunk::SmallChunk):
(bmalloc::SmallLine::end):
(bmalloc::SmallRun::get):
(bmalloc::SmallRun::begin):
(bmalloc::SmallRun::end):
(bmalloc::SmallChunk::pages): Deleted.
(bmalloc::SmallPage::get): Deleted.
(bmalloc::SmallPage::begin): Deleted.
(bmalloc::SmallPage::end): Deleted.

• bmalloc/SmallPage.h: Removed.
• bmalloc/SmallRun.h: Copied from Source/bmalloc/bmalloc/SmallPage.h.

(bmalloc::SmallRun::SmallRun):
(bmalloc::SmallRun::ref):
(bmalloc::SmallRun::deref):
(bmalloc::SmallPage::SmallPage): Deleted.
(bmalloc::SmallPage::ref): Deleted.
(bmalloc::SmallPage::deref): Deleted.

• bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::allocateSmallChunk):
(bmalloc::VMHeap::allocateLargeChunk):

• bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateSmallRun):
(bmalloc::VMHeap::allocateLargeObject):
(bmalloc::VMHeap::deallocateSmallRun):
(bmalloc::VMHeap::deallocateLargeObject):
(bmalloc::VMHeap::allocateSmallPage): Deleted.
(bmalloc::VMHeap::deallocateSmallPage): Deleted.

1:37 PM Changeset in webkit [197954] by Joseph Pecoraro

• 21 edits
  5 copies
  19 adds in trunk/Source

Web Inspector: JavaScript Heap Allocations Timeline
​https://bugs.webkit.org/show_bug.cgi?id=155287
<rdar://problem/25078088>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

• inspector/InjectedScriptSource.js:

(InjectedScript.prototype._describe):
(InjectedScript.prototype._nodeDescription):
Provide the nicer node preview more often.

Source/WebInspectorUI:

Initial JavaScript Heap Allocations Timeline includes:

• Snapshot markers in the timeline
• Initial/Periodic/End snapshots during recording
• Ability to manually take a snapshot
• View of all objects in a Snapshot and Diff between snapshots
  • Summary view - rough display of the size/count of large objects
  • Instances view - view each of the individual objects

• UserInterface/Main.html:
• UserInterface/Test.html:
• UserInterface/Images/Compare.svg: Added.
• UserInterface/Images/HeapSnapshot.svg: Added.
• UserInterface/Images/HeapSnapshotDiff.svg: Added.
• UserInterface/Images/HeapSnapshotInstances.svg: Added.
• UserInterface/Images/HeapSnapshotSummary.svg: Added.
• Localizations/en.lproj/localizedStrings.js:

New resources and strings.

• UserInterface/Controllers/TimelineManager.js:

(WebInspector.TimelineManager.prototype.heapTrackingStarted):
(WebInspector.TimelineManager.prototype.heapTrackingCompleted):
(WebInspector.TimelineManager.prototype.heapSnapshotAdded):

• UserInterface/Protocol/HeapObserver.js:

(WebInspector.HeapObserver.prototype.trackingStart):
(WebInspector.HeapObserver.prototype.trackingComplete):
(WebInspector.HeapObserver):
Add snapshot records to the active recording's timeline.

• UserInterface/Models/HeapAllocationsInstrument.js: Added.

(WebInspector.HeapAllocationsInstrument):
(WebInspector.HeapAllocationsInstrument.supported):
(WebInspector.HeapAllocationsInstrument.prototype.get timelineRecordType):
(WebInspector.HeapAllocationsInstrument.prototype.startInstrumentation):
(WebInspector.HeapAllocationsInstrument.prototype.stopInstrumentation):
(WebInspector.HeapAllocationsInstrument.prototype._takeHeapSnapshot):
Start, stop, and periodic snapshots.

• UserInterface/Models/HeapAllocationsTimelineRecord.js:

(WebInspector.HeapAllocationsTimelineRecord):
(WebInspector.HeapAllocationsTimelineRecord.prototype.get timestamp):
(WebInspector.HeapAllocationsTimelineRecord.prototype.get heapSnapshot):

• UserInterface/Models/TimelineRecord.js:
• UserInterface/Models/TimelineRecording.js:

(WebInspector.TimelineRecording):
(WebInspector.TimelineRecording.prototype.addRecord):

• UserInterface/Views/TimelineOverviewGraph.js:

(WebInspector.TimelineOverviewGraph.createForTimeline):

• UserInterface/Views/TimelineTabContentView.js:

(WebInspector.TimelineTabContentView.displayNameForTimeline):
(WebInspector.TimelineTabContentView.iconClassNameForTimeline):
(WebInspector.TimelineTabContentView.genericClassNameForTimeline):
(WebInspector.TimelineTabContentView.iconClassNameForRecord):
(WebInspector.TimelineTabContentView.displayNameForRecord):
New timeline and record type.

• UserInterface/Models/HeapSnapshotDiff.js: Added.

(WebInspector.HeapSnapshotDiff):
(WebInspector.HeapSnapshotDiff.prototype.get snapshot1):
(WebInspector.HeapSnapshotDiff.prototype.get snapshot2):
(WebInspector.HeapSnapshotDiff.prototype.get addedInstances):
(WebInspector.HeapSnapshotDiff.prototype.get removedInstances):
(WebInspector.HeapSnapshotDiff.prototype.get sizeDifference):
(WebInspector.HeapSnapshotDiff.prototype.get growth):
(WebInspector.HeapSnapshotDiff.prototype.snapshotForDiff):
Compare two snapshots and create a "diff snapshot" which is just
the newly added objects.

• UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.isViewable):
A HeapSnapshot creates a HeapSnapshotClusterView.

• UserInterface/Views/HeapAllocationsTimelineDataGridNode.js: Added.

(WebInspector.HeapAllocationsTimelineDataGridNode):
(WebInspector.HeapAllocationsTimelineDataGridNode.prototype.get record):
(WebInspector.HeapAllocationsTimelineDataGridNode.prototype.get data):
(WebInspector.HeapAllocationsTimelineDataGridNode.prototype.createCellContent):
(WebInspector.HeapAllocationsTimelineDataGridNode.prototype.markAsBaseline):
(WebInspector.HeapAllocationsTimelineDataGridNode.prototype.clearBaseline):

• UserInterface/Views/HeapAllocationsTimelineOverviewGraph.css: Copied from Source/WebInspectorUI/UserInterface/Protocol/HeapObserver.js.

(.timeline-overview-graph.heap-allocations):
(.timeline-overview-graph.heap-allocations > img.snapshot):

• UserInterface/Views/HeapAllocationsTimelineOverviewGraph.js: Added.

(WebInspector.HeapAllocationsTimelineOverviewGraph):
(WebInspector.HeapAllocationsTimelineOverviewGraph.prototype.reset):
(WebInspector.HeapAllocationsTimelineOverviewGraph.prototype.layout.xScale):
(WebInspector.HeapAllocationsTimelineOverviewGraph.prototype.layout):
(WebInspector.HeapAllocationsTimelineOverviewGraph.prototype._visibleRecords):
(WebInspector.HeapAllocationsTimelineOverviewGraph.prototype._heapAllocationTimelineRecordAdded):

• UserInterface/Views/HeapAllocationsTimelineView.css: Copied from Source/WebInspectorUI/UserInterface/Protocol/HeapObserver.js.

(.timeline-view.heap-allocations > .data-grid):
(.timeline-view.heap-allocations > .data-grid td .icon.heap-snapshot):
(.timeline-view.heap-allocations > .data-grid tr.baseline):
(.timeline-view.heap-allocations > .content-view-container):
(.timeline-view.heap-allocations > .content-view-container > .content-view):

• UserInterface/Views/HeapAllocationsTimelineView.js: Added.

(WebInspector.HeapAllocationsTimelineView):
(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotList):
(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotTimelineRecord):
(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotDiff):
(WebInspector.HeapAllocationsTimelineView.prototype.get navigationItems):
(WebInspector.HeapAllocationsTimelineView.prototype.get selectionPathComponents):
(WebInspector.HeapAllocationsTimelineView.prototype.get navigationSidebarTreeOutlineLabel):
(WebInspector.HeapAllocationsTimelineView.prototype.treeElementPathComponentSelected):
(WebInspector.HeapAllocationsTimelineView.prototype.userSelectedRecordFromOverview):
(WebInspector.HeapAllocationsTimelineView.prototype.closed):
(WebInspector.HeapAllocationsTimelineView.prototype.layout):
(WebInspector.HeapAllocationsTimelineView.prototype.reset):
(WebInspector.HeapAllocationsTimelineView.prototype._heapAllocationsTimelineRecordAdded):
(WebInspector.HeapAllocationsTimelineView.prototype._snapshotListPathComponentClicked):
(WebInspector.HeapAllocationsTimelineView.prototype._snapshotPathComponentSelected):
(WebInspector.HeapAllocationsTimelineView.prototype._currentContentViewDidChange):
(WebInspector.HeapAllocationsTimelineView.prototype._contentViewSelectionPathComponentDidChange):
(WebInspector.HeapAllocationsTimelineView.prototype._updateCompareHeapSnapshotButton):
(WebInspector.HeapAllocationsTimelineView.prototype._takeHeapSnapshotClicked):
(WebInspector.HeapAllocationsTimelineView.prototype._cancelSelectComparisonHeapSnapshots):
(WebInspector.HeapAllocationsTimelineView.prototype._compareHeapSnapshotsClicked):
(WebInspector.HeapAllocationsTimelineView.prototype._dataGridNodeSelected):

• UserInterface/Views/HeapSnapshotClassDataGridNode.js: Added.

(WebInspector.HeapSnapshotClassDataGridNode):
(WebInspector.HeapSnapshotClassDataGridNode.prototype.get data):
(WebInspector.HeapSnapshotClassDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotClassDataGridNode.prototype.sort):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._populate):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._fetchBatch):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._updateBatchedSort):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._updateBatchedChildren):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._removeFetchMoreDataGridNode):
(WebInspector.HeapSnapshotClassDataGridNode.prototype._appendFetchMoreDataGridNode):

• UserInterface/Views/HeapSnapshotClusterContentView.js: Added.

(WebInspector.HeapSnapshotClusterContentView.createPathComponent):
(WebInspector.HeapSnapshotClusterContentView):
(WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName):
(WebInspector.HeapSnapshotClusterContentView.prototype.get heapSnapshot):
(WebInspector.HeapSnapshotClusterContentView.prototype.get summaryContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype.get instancesContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype.get navigationItems):
(WebInspector.HeapSnapshotClusterContentView.prototype.get selectionPathComponents):
(WebInspector.HeapSnapshotClusterContentView.prototype.shown):
(WebInspector.HeapSnapshotClusterContentView.prototype.closed):
(WebInspector.HeapSnapshotClusterContentView.prototype.saveToCookie):
(WebInspector.HeapSnapshotClusterContentView.prototype.restoreFromCookie):
(WebInspector.HeapSnapshotClusterContentView.prototype.showSummary):
(WebInspector.HeapSnapshotClusterContentView.prototype.showInstances):
(WebInspector.HeapSnapshotClusterContentView.prototype._contentViewExtraArguments):
(WebInspector.HeapSnapshotClusterContentView.prototype._pathComponentForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._identifierForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._showContentViewForIdentifier):
(WebInspector.HeapSnapshotClusterContentView.prototype._pathComponentSelected):
(WebInspector.HeapSnapshotClusterContentView.prototype._toggleShowInternalObjectsSetting):
(WebInspector.HeapSnapshotClusterContentView.prototype._updateViewsForShowInternalObjectsSettingValue):
(WebInspector.HeapSnapshotClusterContentView.prototype._updateShowInternalObjectsButtonNavigationItem):

• UserInterface/Views/HeapSnapshotInstanceDataGridNode.js: Added.

(WebInspector.HeapSnapshotInstanceDataGridNode):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.get data):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.get selectable):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCells):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.sort):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._contextMenuHandler.):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._contextMenuHandler):

• UserInterface/Views/HeapSnapshotInstanceFetchMoreDataGridNode.js: Added.

(WebInspector.HeapSnapshotInstanceFetchMoreDataGridNode):
(WebInspector.HeapSnapshotInstanceFetchMoreDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotInstanceFetchMoreDataGridNode.prototype.sort):

• UserInterface/Views/HeapSnapshotInstancesContentView.css: Added.
• UserInterface/Views/HeapSnapshotInstancesContentView.js: Added.

(WebInspector.HeapSnapshotInstancesContentView):
(WebInspector.HeapSnapshotInstancesContentView.prototype.get showInternalObjects):
(WebInspector.HeapSnapshotInstancesContentView.prototype.set showInternalObjects):
(WebInspector.HeapSnapshotInstancesContentView.prototype._sortDataGrid):

• UserInterface/Views/HeapSnapshotInstancesDataGridTree.js: Added.

(WebInspector.HeapSnapshotInstancesDataGridTree):
(WebInspector.HeapSnapshotInstancesDataGridTree.buildSortComparator):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.get heapSnapshot):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.get includeInternalObjects):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.set includeInternalObjects):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.get children):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.appendChild):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.insertChild):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.removeChildren):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.set sortComparator):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.sort):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype._populateTopLevel):

• UserInterface/Views/HeapSnapshotSummaryContentView.css: Added.
• UserInterface/Views/HeapSnapshotSummaryContentView.js: Added.

(WebInspector.HeapSnapshotSummaryContentView.createChartContainer):
(WebInspector.HeapSnapshotSummaryContentView.appendLegendRow):
(WebInspector.HeapSnapshotSummaryContentView.appendEmptyMessage):
(WebInspector.HeapSnapshotSummaryContentView):
(WebInspector.HeapSnapshotSummaryContentView.prototype.layout):

• UserInterface/Views/PathComponentIcons.css:

(.heap-snapshot-summary-icon .icon):
(.heap-snapshot-instances-icon .icon):
(.snapshot-list-icon .icon):
(.snapshot-diff-icon .icon):
(body:not(.mac-platform, .windows-platform) .snapshot-diff-icon .icon):
(body:not(.mac-platform, .windows-platform) .call-trees-icon .icon): Deleted.

• UserInterface/Views/TextNavigationItem.css:

(.navigation-bar .item.text):

• UserInterface/Views/TextNavigationItem.js:

(WebInspector.TextNavigationItem):
(WebInspector.TextNavigationItem.prototype.get text):
(WebInspector.TextNavigationItem.prototype.set text):

• UserInterface/Views/TimelineIcons.css:

(.heap-snapshot-record .icon):

• UserInterface/Views/Variables.css:

(:root):
New views.

• UserInterface/Views/FormattedValue.js:

(WebInspector.FormattedValue.createElementForNodePreview):
(WebInspector.FormattedValue.createElementForFunctionWithName):
(WebInspector.FormattedValue.createObjectPreviewOrFormattedValueForObjectPreview):
Better display for a raw object preview.

• UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview):
(WebInspector.TimelineOverview.prototype.userSelectedRecord):

• UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
(WebInspector.TimelineRecordingContentView.prototype.timelineOverviewUserSelectedRecord):

• UserInterface/Views/TimelineRuler.js:

(WebInspector.TimelineRuler.prototype.set allowsTimeRangeSelection):
(WebInspector.TimelineRuler.prototype._handleClick):
(WebInspector.TimelineRuler.prototype._handleMouseDown):
(WebInspector.TimelineRuler.prototype._handleMouseMove):

• UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView.prototype.userSelectedRecordFromOverview):
Hook up a way for clicking in the TimelineOverview / TimelineRuler
to redispatch to an OverviewGraph element, and provide a patch for
the Overview -> RecordingContentView -> TimelineView for records.

1:35 PM Changeset in webkit [197953] by jer.noble@apple.com

• 49 edits
  4 adds in trunk

Add separate WK and WK2 preferences for requiring user gestures for video media, distinct from user gestures for media generally
​https://bugs.webkit.org/show_bug.cgi?id=155141

Reviewed by Beth Dakin.

Source/WebCore:

Rename RequireUserGestureForRateChange -> RequireUserGestureForVideoRateChange.
Rename Settings::requiresUserGestureForMediaPlayback -> Settings::videoPlaybackRequiresUserGesture.

Fix longstanding FIXME unifying our behavior restrictions between iOS and Mac.

• Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::constructCommon): Rename.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::HTMLMediaElement): Unify behavior restriction behavior.
(WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture): Rename.

• html/MediaElementSession.cpp:

(WebCore::restrictionName): Rename.
(WebCore::MediaElementSession::playbackPermitted): Rename.

• html/MediaElementSession.h:
• page/Settings.cpp:
• page/Settings.in:
• testing/Internals.cpp:

(WebCore::Internals::setMediaElementRestrictions): Rename.

Source/WebKit/mac:

Deprecate WebPreferences.mediaPlaybackRequiresUserGesture property in favor of .videoPlaybackRequiresUserGesture.

• WebView/WebPreferenceKeysPrivate.h:
• WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences mediaPlaybackRequiresUserGesture]):
(-[WebPreferences setMediaPlaybackRequiresUserGesture:]):
(-[WebPreferences videoPlaybackRequiresUserGesture]):
(-[WebPreferences setVideoPlaybackRequiresUserGesture:]):

• WebView/WebPreferencesPrivate.h:
• WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit/win:

• WebView.cpp:

(WebView::notifyPreferencesChanged):

Source/WebKit2:

Add a new preference, videoPlaybackRequiresUserGesture, distinct from mediaPlaybackRequiresUserGesture. Legacy clients of
mediaPlaybackRequiresUserGesture will still be able to use it normally, as setting that preference to true will effectively
set both audioPlaybackRequiresUserGesture and videoPlaybackRequiresUserGesture to true. Make these preferences all available
universally, rather than just on PLATFORM(IOS). This requires adding a definition for -setRequiresUserActionForMediaPlayback:
and -requiresUserActionForMediaPlayback on !PLATFORM(IOS).

• Shared/WebPreferencesDefinitions.h:
• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetVideoPlaybackRequiresUserGesture):
(WKPreferencesGetVideoPlaybackRequiresUserGesture):

• UIProcess/API/C/WKPreferencesRefPrivate.h:
• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):
(-[WKWebView _setObscuredInsets:]):

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration requiresUserActionForMediaPlayback]):
(-[WKWebViewConfiguration setRequiresUserActionForMediaPlayback:]):
(-[WKWebViewConfiguration allowsInlineMediaPlayback]):
(-[WKWebViewConfiguration setAllowsInlineMediaPlayback:]):
(-[WKWebViewConfiguration _requiresUserActionForVideoPlayback]):
(-[WKWebViewConfiguration _setRequiresUserActionForVideoPlayback:]):

• UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

Tools:

Set the default values for media preferences unconditionally, not just on PLATFORM(IOS). Set "video requires user gesture"
to sane defaults in addition to "audio requires user gesture" and (in the case of DumpREnderTree) instead of "media requires user gesture".

Add a new test of WK2 user gesture requirement preferences.

• DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues):

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit/ios/video-with-audio.html:
• TestWebKitAPI/Tests/WebKit/ios/video-without-audio.html:
• TestWebKitAPI/Tests/WebKit2Cocoa/RequiresUserActionForPlayback.mm: Added.

(-[RequiresUserActionForPlaybackNavigationDelegate webView:didFinishNavigation:]):
(-[RequiresUserActionForPlaybackMessageHandler userContentController:didReceiveScriptMessage:]):
(RequiresUserActionForPlaybackTest::SetUp):
(RequiresUserActionForPlaybackTest::createWebView):
(RequiresUserActionForPlaybackTest::testVideoWithAudio):
(RequiresUserActionForPlaybackTest::testVideoWithoutAudio):
(RequiresUserActionForPlaybackTest::testAudioOnly):
(TEST_F):

• TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST):

LayoutTests:

Update layout tests to reflect new restriction name.

• media/audio-playback-restriction-play-expected.txt:
• media/audio-playback-restriction-play.html:
• media/no-autoplay-with-user-gesture-requirement.html:
• media/video-load-require-user-gesture.html:
• media/video-play-require-user-gesture.html:
• media/video-crash-invisible-autoplay-display-none-expected.txt: Added.
• media/video-crash-invisible-autoplay-display-none.html: Added.
• media/video-main-content-allow-expected.txt:
• media/video-main-content-allow-then-deny-expected.txt:
• media/video-main-content-allow-then-deny.html:
• media/video-main-content-allow.html:
• media/video-main-content-deny-display-none-expected.txt:
• media/video-main-content-deny-display-none.html:
• media/video-main-content-deny-not-in-dom-expected.txt:
• media/video-main-content-deny-not-in-dom.html:
• media/video-main-content-deny-not-visible-expected.txt:
• media/video-main-content-deny-not-visible.html:
• media/video-main-content-deny-obscured-expected.txt:
• media/video-main-content-deny-obscured.html:
• media/video-main-content-deny-too-small-expected.txt:
• media/video-main-content-deny-too-small.html:

1:11 PM Changeset in webkit [197952] by rniwa@webkit.org

• 10 edits
  4 adds in trunk

Add :defined support
​https://bugs.webkit.org/show_bug.cgi?id=155108

Reviewed by Antti Koivisto.

Source/WebCore:

Added :defined pseudo class which applies to a successfully instantiated custom element or a builtin element.
A new node flag, isUnresolvedCustomElement, which was added in r197917 tracks un-upgraded / unresolved custom
elements for which :defined should not apply.

Tests: fast/custom-elements/defined-pseudo-class.html

fast/custom-elements/defined-rule.html

• bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::constructElement): Unset isUnresolvedCustomElement now that HTMLElement's
constructor sets isUnresolvedCustomElement.

• bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement): Set isUnresolvedCustomElement to true since :defined should never apply to
a custom element inside its constructor as HTMLElement constructor does not set the defined flag:
​https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor

• css/CSSSelector.cpp:

(WebCore::CSSSelector::selectorText): Added the support for serializing :defined.

• css/CSSSelector.h:

(PseudoClassType): Added PseudoClassDefined for :defined.

• css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne): Added the support for :defined.

• css/SelectorCheckerTestFunctions.h:

(WebCore::isDefinedElement): Added. Returns true for any builtin element and a custom element after a successful
construction / upgrades.

• css/SelectorPseudoClassAndCompatibilityElementMap.in: Added :defined.
• cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::addPseudoClassType): Added the support for :defined.

LayoutTests:

Added W3C style testharness.js tests and ref tests for :defined pseudo class.

• fast/custom-elements/defined-pseudo-class-expected.txt: Added.
• fast/custom-elements/defined-pseudo-class.html: Added.
• fast/custom-elements/defined-rule-expected.html: Added.
• fast/custom-elements/defined-rule.html: Added.

12:52 PM Changeset in webkit [197951] by ap@apple.com

• 2 edits in trunk/Source/WebKit/mac

Build fix for deprecated constant names.

• Carbon/CarbonWindowAdapter.mm:

(-[CarbonWindowAdapter initWithCarbonWindowRef:takingOwnership:disableOrdering:carbon:]):
(-[CarbonWindowAdapter sendSuperEvent:]):

12:46 PM Changeset in webkit [197950] by commit-queue@webkit.org

• 39 edits
  4 deletes in trunk/Source

Unreviewed, rolling out r197943.
​https://bugs.webkit.org/show_bug.cgi?id=155317

This change broke Windows, WinCairo, GTK and EFL builds
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"Add a baseURL parameter to _WKUserStyleSheet"
​https://bugs.webkit.org/show_bug.cgi?id=155219
​http://trac.webkit.org/changeset/197943

12:09 PM Changeset in webkit [197949] by bshafiei@apple.com

• 5 edits in branches/safari-601-branch/Source

Versioning.

12:06 PM Changeset in webkit [197948] by BJ Burg

• 3 edits in trunk/Tools

Web Inspector: should be able to run protocol and input generator scripts from any directory
​https://bugs.webkit.org/show_bug.cgi?id=155307

Reviewed by Joseph Pecoraro.

• Scripts/webkitpy/inspector/main.py:

(InspectorGeneratorTests.main):

• Scripts/webkitpy/replay/main.py:

(InputGeneratorTests.main):
Compute the current SCM based on the location of the script being executed, not
the $CWD which could be anything. There's rarely a good reason to use $CWD.

11:41 AM Changeset in webkit [197947] by sbarati@apple.com

• 6 edits
  1 add in trunk/Source/JavaScriptCore

Assignment to new.target should be an early error
​https://bugs.webkit.org/show_bug.cgi?id=151148

Reviewed by Mark Lam.

This patch makes it so that any form of assignment to new.target
is an early syntax error.

• parser/ASTBuilder.h:

(JSC::ASTBuilder::createNewTargetExpr):
(JSC::ASTBuilder::isNewTarget):
(JSC::ASTBuilder::createResolve):

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseAssignmentExpression):
(JSC::Parser<LexerType>::parseUnaryExpression):

• parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createThisExpr):
(JSC::SyntaxChecker::createSuperExpr):
(JSC::SyntaxChecker::createNewTargetExpr):
(JSC::SyntaxChecker::isNewTarget):
(JSC::SyntaxChecker::createResolve):
(JSC::SyntaxChecker::createObjectLiteral):

• tests/es6.yaml:
• tests/stress/new-target-syntax-errors.js: Added.

(shouldBeSyntaxError):
(shouldNotBeSyntaxError):

• tests/stress/new-target.js:

(Constructor):
(doWeirdThings):
(noAssign): Deleted.
(catch): Deleted.

11:26 AM Changeset in webkit [197946] by Lucas Forschler

• 2 edits in branches/safari-601-branch/Tools

<rdar://problem/25074204>
Unreviewed build fix attempt.

• Scripts/webkitdirs.pm:

(determineBaseProductDir):
(determineConfiguration):
(determineArchitecture):
(determineNumberOfCPUs):
(jscPath):
(visualStudioInstallDir):
(msBuildInstallDir):
(visualStudioVersion):
(determineConfigurationProductDir):
(productDir):
(executableProductDir):
(jscProductDir):
(configuration):
(determineGenerateDsym):
(hasIOSDevelopmentCertificate):
(argumentsForXcode):
(XcodeOptions):
(XcodeOptionString):
(determinePassedConfiguration):
(passedConfiguration):
(checkFrameworks):
(checkForArgumentAndRemoveFromArrayRef):
(prohibitUnknownPort):
(determinePortName):
(portName):
(isEfl):
(isGtk):
(isWinCairo):
(isWin64):
(determineIsWin64):
(determineIsWin64FromArchitecture):
(isCygwin):
(isARM):
(isX86_64):
(isCrossCompilation):
(isAppleMacWebKit):
(isAppleWinWebKit):
(iOSSimulatorDevicesPath):
(createiOSSimulatorDevice):
(willUseIOSDeviceSDK):
(willUseIOSSimulatorSDK):
(isIOSWebKit):
(determineNmPath):
(nmPath):
(splitVersionString):
(determineOSXVersion):
(osXVersion):
(determineIOSVersion):
(iosVersion):
(isWindowsNT):
(debugger):
(determineDebugger):
(appendToEnvironmentVariableList):
(prependToEnvironmentVariableList):
(setUpGuardMallocIfNeeded):
(launcherName):
(checkRequiredSystemConfig):
(determineWindowsSourceDir):
(setupAppleWinEnv):
(setupCygwinEnv):
(buildXCodeProject):
(buildVisualStudioProject):
(isCachedArgumentfileOutOfDate):
(wrapperPrefixIfNeeded):
(canUseNinja):
(canUseNinjaGenerator):
(canUseEclipseNinjaGenerator):
(cmakeGeneratedBuildfile):
(generateBuildSystemFromCMakeProject):
(buildCMakeGeneratedProject):
(cleanCMakeGeneratedProject):
(buildCMakeProjectOrExit):
(cmakeBasedPortName):
(determineIsCMakeBuild):
(isCMakeBuild):
(promptUser):
(setPathForRunningWebKitApp):
(printHelpAndExitForRunAndDebugWebKitAppIfNeeded):
(argumentsForRunAndDebugMacWebKitApp):
(setupMacWebKitEnvironment):
(setupIOSWebKitEnvironment):
(waitUntilIOSSimulatorDeviceIsInState):
(shutDownIOSSimulatorDevice):
(restartIOSSimulatorDevice):
(relaunchIOSSimulator):
(runIOSWebKitAppInSimulator):
(runIOSWebKitApp):
(execMacWebKitAppForDebugging):
(debugSafari):
(runSafari):
(runMiniBrowser):
(determineIsEfl): Deleted.
(determineIsGtk): Deleted.
(determineIsWinCairo): Deleted.
(willUseIOSDeviceSDKWhenBuilding): Deleted.
(willUseIOSSimulatorSDKWhenBuilding): Deleted.
(shouldTargetWebProcess): Deleted.
(determineShouldTargetWebProcess): Deleted.
(shouldUseXPCServiceForWebProcess): Deleted.
(determineShouldUseXPCServiceForWebProcess): Deleted.
(jhbuildWrapperPrefixIfNeeded): Deleted.
(canUseEclipse): Deleted.

10:39 AM Changeset in webkit [197945] by eric.carlson@apple.com

• 2 edits in trunk/Source/WebKit2

[MediaStream] push media stream state to the UI process
​https://bugs.webkit.org/show_bug.cgi?id=155281

Reviewed by Dean Jackson.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didCommitLoadForFrame): Don't clear m_mediaState, it is done in

WebPageProxy::resetState. This reverts a change added in r197929.

10:30 AM Changeset in webkit [197944] by dbates@webkit.org

• 23 edits in trunk

CSP: Implement support for script and style nonces
​https://bugs.webkit.org/show_bug.cgi?id=116508
<rdar://problem/24963980>

Reviewed by Brent Fulgham.

Source/WebCore:

Add support for script-src and style-src nonces as per sections Nonce usage for script elements
and Nonce usage for style elements of the Content Security Policy 2.0 spec., <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

• dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet): Check if the nonce for an HTML style element matches a known nonce.

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestScript): Check if the nonce for an HTML script element for an external JavaScript
script matches a known nonce. If it does then skip subsequent checks of the Content Security Policy when loading
the script.
(WebCore::ScriptElement::executeScript): Check if the nonce for an HTML script element for an inline JavaScript
script matches a known nonce.

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::process): Check if the nonce for an HTML link element matches a known nonce. If it does
then skip subsequent checks of the Content Security Policy when loading the stylesheet.

• html/HTMLScriptElement.idl: Unconditionally expose attribute nonce.
• html/HTMLStyleElement.idl: Ditto.
• page/csp/ContentSecurityPolicy.cpp:

(WebCore::isAllowedByAllWithNonce):
(WebCore::ContentSecurityPolicy::allowScriptWithNonce): Check if the nonce attribute value of a script element
matches a known nonce. This function delegates the check to ContentSecurityPolicyDirectiveList::allowScriptWithNonce().
(WebCore::ContentSecurityPolicy::allowStyleWithNonce): Check if the nonce attribute value of a style/link element
matches a known nonce. This function delegates the check to ContentSecurityPolicyDirectiveList::allowStyleWithNonce().

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::checkNonce): Checks if the directive allows the specified nonce.
(WebCore::ContentSecurityPolicyDirectiveList::allowScriptWithNonce): Check if the specified nonce is in
the source list of the script-src directive (if specified) or the source list of the default-src directive (if specified).
(WebCore::ContentSecurityPolicyDirectiveList::allowStyleWithNonce): Check if the specified nonce is in
the source list of the style-src directive (if specified) or the source list of the default-src directive (if specified).

• page/csp/ContentSecurityPolicyDirectiveList.h:
• page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::matches): Returns whether the specified nonce is in the HashSet of
nonces for the directive.
(WebCore::ContentSecurityPolicySourceList::parse): Modified to call ContentSecurityPolicySourceList::parseNonceSource()
to parse a nonce source expression.
(WebCore::isBase64Character): Moved function to be above function ContentSecurityPolicySourceList::parseNonceSource()
so that it can referenced from both ContentSecurityPolicySourceList::parseNonceSource() and ContentSecurityPolicySourceList::parseHashSource().
(WebCore::isNonceCharacter): Added. Matches Blink's definition of a valid nonce character. This definition differs
from the definition in the Content Security Policy Level 3 spec., <​https://w3c.github.io/webappsec-csp/> (29 February 2016).
(WebCore::ContentSecurityPolicySourceList::parseNonceSource): Parses a source expression for a nonce value.

• page/csp/ContentSecurityPolicySourceList.h:

(WebCore::ContentSecurityPolicySourceList::allowInline): We only allow inline scripts/stylesheets if
'unsafe-inline' was specified in the source list and the source list does not contain any hash sources
or nonce sources.

• page/csp/ContentSecurityPolicySourceListDirective.cpp:

(WebCore::ContentSecurityPolicySourceListDirective::allows): Checks if the specified nonce is in the source list.

• page/csp/ContentSecurityPolicySourceListDirective.h:

LayoutTests:

Update expected results due to differences between Blink and WebKit violation message formats.

Additionally mark script- and style- nonce tests as PASS in LayoutTests/TestExpectations so
that we run them.

• TestExpectations:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-and-scripthash-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-and-scripthash.html:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-basic-blocked-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-ignore-unsafeinline-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce-expected.txt: Also update result

to reflect that we consider "'n-" an invalid source expression (as expected).

• http/tests/security/contentSecurityPolicy/1.1/stylenonce-allowed-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/stylenonce-blocked-expected.txt:

10:24 AM Changeset in webkit [197943] by weinig@apple.com

• 39 edits
  4 adds in trunk/Source

Add a baseURL parameter to _WKUserStyleSheet
​https://bugs.webkit.org/show_bug.cgi?id=155219

Reviewed by Tim Horton.

Source/WebCore:

• Moves to a model for user content where instead of each page having a WebCore::UserContentController object, we have an abstract WebCore::UserContentProvider interface that can be implemented at the WebKit level. For now, legacy WebKit continues to use the old UserContentController, which implements WebCore::UserContentProvider, and WebKit2 implements its own implementation so it can store additional state.

• WebCore.xcodeproj/project.pbxproj:

Add new files.

• dom/ExtensionStyleSheets.cpp:

(WebCore::ExtensionStyleSheets::updateInjectedStyleSheetCache):
Switch to using forEachUserStyleSheet on the UserContentProvider.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadResource):
Remove null check now that we always have a UserContentProvider.

• loader/EmptyClients.cpp:

(WebCore::fillWithEmptyClients):

• loader/EmptyClients.h:

Add new EmptyClients.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadResourceSynchronously):
Remove null check now that we always have a UserContentProvider.

• loader/PingLoader.cpp:

(WebCore::processContentExtensionRulesForLoad):
Remove null check now that we always have a UserContentProvider.

• loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::willSendRequestInternal):
Remove null check now that we always have a UserContentProvider.

• loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestResource):
Remove null check now that we always have a UserContentProvider.

• page/DOMWindow.cpp:

(WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
Remove null checks now that we always have a UserContentProvider, and userMessageHandlerDescriptors
returns a reference.

(WebCore::DOMWindow::open):
Remove null check now that we always have a UserContentProvider.

• page/Frame.cpp:

(WebCore::Frame::injectUserScripts):
Simplify by lifting document check out of the main loop and using forEachUserScript.

• page/Page.cpp:

(WebCore::Page::Page):
(WebCore::Page::~Page):
(WebCore::Page::userContentProvider):
(WebCore::Page::setUserContentProvider):
(WebCore::Page::setUserContentController): Deleted.

• page/Page.h:

(WebCore::Page::userContentController): Deleted.

• page/PageConfiguration.h:

Store the UserContentProvider in a Ref, and require PageConfigurations to provide one. This
removes a bunch of null checks and simplifies the code.

• page/UserContentController.cpp:

(WebCore::UserContentController::~UserContentController):
(WebCore::UserContentController::forEachUserScript):
(WebCore::UserContentController::forEachUserStyleSheet):
(WebCore::UserContentController::addUserScript):
(WebCore::UserContentController::removeUserScript):
(WebCore::UserContentController::removeUserScripts):
(WebCore::UserContentController::addUserStyleSheet):
(WebCore::UserContentController::removeUserStyleSheet):
(WebCore::UserContentController::removeUserStyleSheets):
(WebCore::UserContentController::addUserMessageHandlerDescriptor):
(WebCore::UserContentController::removeUserMessageHandlerDescriptor):
(WebCore::UserContentController::addUserContentExtension):
(WebCore::UserContentController::removeUserContentExtension):
(WebCore::UserContentController::removeAllUserContentExtensions):
(WebCore::UserContentController::removeAllUserContent):
(WebCore::UserContentController::addPage): Deleted.
(WebCore::UserContentController::removePage): Deleted.
(WebCore::contentExtensionsEnabled): Deleted.
(WebCore::UserContentController::processContentExtensionRulesForLoad): Deleted.
(WebCore::UserContentController::actionsForResourceLoad): Deleted.

• page/UserContentController.h:

(WebCore::UserContentController::userScripts): Deleted.
(WebCore::UserContentController::userStyleSheets): Deleted.
(WebCore::UserContentController::userMessageHandlerDescriptors): Deleted.
Add inheritance from UserContentProvider and simplify things by removing unique_ptrs
that were holding the member variables. There is usually only one UserContentController
so having these in unique_ptrs doesn't make much sense.

• page/UserContentProvider.cpp: Added.

(WebCore::UserContentProvider::UserContentProvider):
(WebCore::UserContentProvider::~UserContentProvider):
(WebCore::UserContentProvider::addPage):
(WebCore::UserContentProvider::removePage):
(WebCore::UserContentProvider::invalidateInjectedStyleSheetCacheInAllFramesInAllPages):
(WebCore::contentExtensionsEnabled):
(WebCore::UserContentProvider::processContentExtensionRulesForLoad):
(WebCore::UserContentProvider::actionsForResourceLoad):

• page/UserContentProvider.h: Added.

Add abstract class for providing user content and add some helpers on it.

• page/UserMessageHandlerDescriptor.h:

(WebCore::UserMessageHandlerDescriptor::create):
(WebCore::UserMessageHandlerDescriptor::client):
(WebCore::UserMessageHandlerDescriptor::invalidateClient):

• page/UserMessageHandlersNamespace.cpp:

(WebCore::UserMessageHandlersNamespace::handler):
Simplify now that userContentProvider() and userMessageHandlerDescriptors() are references.

Source/WebKit/mac:

• WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(-[WebView initSimpleHTMLDocumentWithStyle:frame:preferences:groupName:]):
(-[WebView setGroupName:]):
Update to account for the name change from UserContentController -> UserContentProvider.

Source/WebKit2:

• Moves to a model for user content where instead of using a WebCore::UserContentController object, we implement the new WebCore::UserContentProvider interface (on the existing WebUserContentController object).
• Uses this to maintain maps of UserStylesSheets and UserScripts along with their identifiers, freeing up the URL, which had been acting as the identifier, to be used as the baseURL which was what it was intended for.
• Adds a baseURL property to _WKUserStyleSheet.

• WebKit2.xcodeproj/project.pbxproj:

Add new files.

• Scripts/webkit/messages.py:

(headers_for_type):
Add support for sending WebUserContentControllerDataTypes.

• Shared/WebUserContentControllerDataTypes.cpp: Added.

(WebKit::WebUserScriptData::encode):
(WebKit::WebUserScriptData::decode):
(WebKit::WebUserStyleSheetData::encode):
(WebKit::WebUserStyleSheetData::decode):

• Shared/WebUserContentControllerDataTypes.h: Added.

Add helper types for sending user content over IPC.

• UIProcess/API/APIUserScript.cpp:

(API::UserScript::generateUniqueURL):
(API::UserScript::UserScript):

• UIProcess/API/APIUserScript.h:
• UIProcess/API/APIUserStyleSheet.cpp:

(API::UserStyleSheet::generateUniqueURL):
(API::UserStyleSheet::UserStyleSheet):

• UIProcess/API/APIUserStyleSheet.h:

Add identifiers for tracking across processes.

• UIProcess/API/Cocoa/_WKUserStyleSheet.h:
• UIProcess/API/Cocoa/_WKUserStyleSheet.mm:

(-[_WKUserStyleSheet initWithSource:forMainFrameOnly:legacyWhitelist:legacyBlacklist:baseURL:userContentWorld:]):
(-[_WKUserStyleSheet baseURL]):
Add new initializer which takes a baseURL as well as an accessor for the baseURL.

• UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
Pass identifiers as well as user content.

• WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::addUserScript):
(WebKit::InjectedBundle::addUserStyleSheet):
Move user content in via move semantics rather than using a unique_ptr.

(WebKit::InjectedBundle::removeUserScript):
(WebKit::InjectedBundle::removeUserStyleSheet):
(WebKit::InjectedBundle::removeUserScripts):
(WebKit::InjectedBundle::removeUserStyleSheets):
(WebKit::InjectedBundle::removeAllUserContent):
Update for new function signatures.

• WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::WebUserContentController):
(WebKit::WebUserContentController::~WebUserContentController):
(WebKit::WebUserContentController::addUserContentWorlds):
(WebKit::WebUserContentController::removeUserContentWorlds):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):
(WebKit::WebUserContentController::addUserStyleSheets):
(WebKit::WebUserContentController::removeUserStyleSheet):
(WebKit::WebUserContentController::removeAllUserStyleSheets):
(WebKit::WebUserContentController::addUserScriptMessageHandlers):
(WebKit::WebUserContentController::removeUserScriptMessageHandler):
(WebKit::WebUserContentController::addUserContentExtensions):
(WebKit::WebUserContentController::removeUserContentExtension):
(WebKit::WebUserContentController::removeAllUserContentExtensions):
(WebKit::WebUserContentController::addUserScriptInternal):
(WebKit::WebUserContentController::addUserScript):
(WebKit::WebUserContentController::removeUserScriptWithURL):
(WebKit::WebUserContentController::removeUserScriptInternal):
(WebKit::WebUserContentController::removeUserScripts):
(WebKit::WebUserContentController::addUserStyleSheetInternal):
(WebKit::WebUserContentController::addUserStyleSheet):
(WebKit::WebUserContentController::removeUserStyleSheetWithURL):
(WebKit::WebUserContentController::removeUserStyleSheetInternal):
(WebKit::WebUserContentController::removeUserStyleSheets):
(WebKit::WebUserContentController::removeAllUserContent):
(WebKit::WebUserContentController::forEachUserScript):
(WebKit::WebUserContentController::forEachUserStyleSheet):

• WebProcess/UserContent/WebUserContentController.h:
• WebProcess/UserContent/WebUserContentController.messages.in:

Convert to inheriting from UserContentProvider, rather than containing a UserContentController.
This means adding the storage for the user content, which has been simplified to avoid using
unique_ptrs.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::addUserScript):
(WebKit::WebPage::addUserStyleSheet):
(WebKit::WebPage::removeAllUserContent):
Update to call the WebUserContentController, rather than going to the UserContentController, which
no longer exists.

• WebProcess/WebPage/WebPageGroupProxy.cpp:

(WebKit::WebPageGroupProxy::userContentController):

• WebProcess/WebPage/WebPageGroupProxy.h:

Return the WebUserContentController rather than old UserContentController.

10:23 AM Changeset in webkit [197942] by ddkilzer@apple.com

• 5 edits in trunk

[iOS] DumpRenderTree crashes when accessing window.testRunner.inspectorTestStubURL
<​http://webkit.org/b/155295>

Reviewed by Brent Fulgham.

Tools:

• DumpRenderTree/mac/TestRunnerMac.mm:

(TestRunner::inspectorTestStubURL): Always return nullptr for
PLATFORM(IOS). This matches what we did in r192604 for
WebKitTestRunner/InjectedBundle/mac/TestRunnerMac.mm.

LayoutTests:

• platform/ios-simulator-wk1/TestExpectations:
• platform/ios-simulator-wk2/TestExpectations:
• Remove all "inspector/" tests. They are already skipped in platform/ios-simulator/TestExpectations, so no need to resurrect them here.

9:55 AM Changeset in webkit [197941] by Ryan Haddad

• 22 edits in trunk/Source

Unreviewed, rolling out r197923.
​https://bugs.webkit.org/show_bug.cgi?id=155301

Rolling out this change due to breaking the build and
LayoutTests. (Requested by ryanhaddad on #webkit).

Reverted changeset:

"Font antialiasing (smoothing) changes when elements are
rendered into compositing layers"
​https://bugs.webkit.org/show_bug.cgi?id=23364
​http://trac.webkit.org/changeset/197923

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-03-10

9:46 AM Changeset in webkit [197940] by dbates@webkit.org

• 28 edits
  8 adds in trunk

CSP: Implement support for inline script and inline style hashes
​https://bugs.webkit.org/show_bug.cgi?id=155007
<rdar://problem/24964098>

Reviewed by Brent Fulgham.

Source/WebCore:

Inspiration taken from the analogous implementation in Blink.

Add support for script-src and style-src hashes as per sections Hash usage for script elements
and Hash usage for style elements of the Content Security Policy 2.0 spec., <​https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Test: http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html

• WebCore.xcodeproj/project.pbxproj: Add file ContentSecurityPolicyHash.h. Also sort the list of files

in the group WebCore/page/csp.

• dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet): Pass the content of the stylesheet when querying whether
the stylesheet is allowed by the Content Security Policy.

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::executeScript): Pass the content of the inline JavaScript script when querying
whether the script is allowed by the Content Security Policy.

• dom/StyledElement.cpp:

(WebCore::StyledElement::styleAttributeChanged): The Content Security Policy style-src hashes do not apply
to inline styles defined in the HTML style attribute. So, pass a null string (to indicate the absence of
content) when querying whether the inline style is allowed by the Content Security Policy.

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::toCryptoDigestAlgorithm): Convenience function that maps a ContentSecurityPolicyHashAlgorithm
enumerator to a CryptoDigest::Algorithm enumerator.
(WebCore::isAllowedByAllWithHashFromContent): Computes the digest of the specified content for each
hash algorithm and checks if digest matches a hash that was specified in a policy.
(WebCore::ContentSecurityPolicy::documentEncoding): Added.
(WebCore::ContentSecurityPolicy::allowInlineScript): Check if the hash of the script matches a known
hash if applicable. Otherwise, fall back to checking the URL of the script.
(WebCore::ContentSecurityPolicy::allowInlineStyle): Check if the hash of the stylesheet matches a
known hash if applicable. Otherwise, fall back to checking the URL of the stylesheet.

• page/csp/ContentSecurityPolicy.h:

(WebCore::ContentSecurityPolicy::addHashAlgorithmsForInlineScripts): Adds the specified set of
hash algorithms to the existing set of hash algorithms we know are used for inline scripts.
(WebCore::ContentSecurityPolicy::addHashAlgorithmsForInlineStylesheets): Adds the specified set of
hash algorithms to the existing set of hash algorithms we know are used for inline stylesheets.

• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::checkEval): Make this a static, non-member function because it does not depend on any
instance or class variables. Mark this function as inline to give a hint to the compiler that it
should consider inlining the implementation of this function into the caller.
(WebCore::checkInline): Ditto.
(WebCore::checkSource): Ditto.
(WebCore::checkHash): Checks if the directive allows content with the specified hash.
(WebCore::checkMediaType): Make this a static, non-member function because it does not depend on
any instance or class variables. Mark this function as inline to give a hint to the compiler that
it should consider inlining the implementation of this function into the caller.
(WebCore::ContentSecurityPolicyDirectiveList::create): Modified as needed now that WebCore::checkEval()
is a static, non-member function.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineScriptWithHash): Added.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyleWithHash): Added.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Modified to pass the hash algorithms seen
from parsing the directives script-src, style-src, and default-src to the ContentSecurityPolicy object.
(WebCore::ContentSecurityPolicyDirectiveList::checkEval): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkInline): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkSource): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkMediaType): Deleted.

• page/csp/ContentSecurityPolicyDirectiveList.h:
• page/csp/ContentSecurityPolicyHash.h: Added.

(WTF::DefaultHash<WebCore::ContentSecurityPolicyDigest>::Hash::hash): Compute the hash of a digest as
we would compute the hash of a string.
(WTF::DefaultHash<WebCore::ContentSecurityPolicyDigest>::Hash::equal): Compare digests for equality
by making use of Vector's equality operator.

• page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::matches): Checks if the hash is in the set of known hashes.
(WebCore::ContentSecurityPolicySourceList::parse): Modified to call ContentSecurityPolicySourceList::parseHashSource()
to try to parse the source list expression as a hash source. If this fails then we try to parse the
source expression as a scheme/host/port expression.
(WebCore::parseHashAlgorithmAdvancingPosition): Parses the hash algorithm from a hash source expression.
(WebCore::isBase64Character): Returns whether the specified character is a valid Base64/Base64url character,
excluding the padding character '='. Disregarding the omission of the padding character '=', this function
conforms to the ABNF grammar defined in section Source Lists of the Content Security Policy Level 3 spec.,
<​https://w3c.github.io/webappsec-csp> (Editor’s Draft, 29 February 2016). We take the padding character '='
into account in ContentSecurityPolicySourceList::parseHashSource().
(WebCore::ContentSecurityPolicySourceList::parseHashSource): Parses a hash source expression per the ABNF
grammar described in section Source Lists of the Content Security Policy Level 3 spec.

• page/csp/ContentSecurityPolicySourceList.h:

(WebCore::ContentSecurityPolicySourceList::hashAlgorithmsUsed): Returns the set of hash algorithms seen from
parsing the source list.
(WebCore::ContentSecurityPolicySourceList::allowInline): We only allow inline scripts/stylesheets if
'unsafe-inline' was specified in the source list and the source list does not contain any hash sources.

• page/csp/ContentSecurityPolicySourceListDirective.cpp:

(WebCore::ContentSecurityPolicySourceListDirective::allows): Checks if the specified hash is in the source list.

• page/csp/ContentSecurityPolicySourceListDirective.h:

(WebCore::ContentSecurityPolicySourceListDirective::hashAlgorithmsUsed): Turns around and calls ContentSecurityPolicySourceList::hashAlgorithmsUsed().

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html to ensure that
script hashes are interpreted correctly. Update many existing tests that had a hash source with
a SHA-1 hash to use a SHA-256 hash. The valid hash algorithms are SHA-256, SHA-384, and SHA-512
per the Content Security Policy Level 3 spec. At the time of writing, Blink also supports SHA-1.

• TestExpectations: Mark many CSP 1.1 tests as PASS so that we run them. Remove entries for tests

http/tests/security/contentSecurityPolicy/1.1/{script, style}hash-default-src.html as these tests
now pass.

• http/tests/security/contentSecurityPolicy/1.1/resources/didRunInlineScriptEpilogue.js: Added.
• http/tests/security/contentSecurityPolicy/1.1/resources/didRunInlineScriptPrologue.js: Added.
• http/tests/security/contentSecurityPolicy/1.1/resources/testScriptHash.php: Added.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed.html: Update test as SHA-1 is not

a supported hash algorithm per the Content Security Policy Level 3 spec.

• http/tests/security/contentSecurityPolicy/1.1/scripthash-basic-blocked-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-basic-blocked.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-default-src-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-ignore-unsafeinline-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-ignore-unsafeinline.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-malformed-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-tests-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html: Added.
• http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html: Update test

as SHA-1 is not a supported hash algorithm per the Content Security Policy Level 3 spec.

• http/tests/security/contentSecurityPolicy/1.1/stylehash-allowed-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-allowed.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-basic-blocked-error-event.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-basic-blocked-expected.txt: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-basic-blocked.html: Ditto.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-default-src-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/1.1/stylehash-svg-style-basic-blocked-error-event.html: Update test

as SHA-1 is not a supported hash algorithm per the Content Security Policy Level 3 spec.

8:57 AM Changeset in webkit [197939] by Chris Dumez

• 10 edits in trunk/Source

Speculative revalidation requests do not have their 'first party for cookies' URL set
​https://bugs.webkit.org/show_bug.cgi?id=155284
<rdar://problem/25053203>

Reviewed by Antti Koivisto.

Source/WebCore:

Export a few more symbols so they can be used in WebKit2.

• platform/URL.h:
• platform/network/ResourceRequestBase.h:

Source/WebKit2:

Speculative revalidation requests did not have their 'first party for cookies'
URL set. This means the underlying NSURLRequest has a nil mainDocumentURL.
Without a way to determine whether the cookie is in a third-party context,
CFNetwork defaults to accepting all cookies for these resources.

• NetworkProcess/cache/NetworkCacheCoders.cpp:

(WebKit::NetworkCache::Coder<WebCore::URL>::encode):
(WebKit::NetworkCache::Coder<WebCore::URL>::decode):

• NetworkProcess/cache/NetworkCacheCoders.h:

Add template specialization to support encoding / decoding WebCore::URL.

• NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp:

(WebKit::NetworkCache::constructRevalidationRequest):
Set the "first party for cookies" URL on the revalidation request.

(WebKit::NetworkCache::SpeculativeLoadManager::PendingFrameLoad::registerSubresourceLoad):
(WebKit::NetworkCache::SpeculativeLoadManager::PendingFrameLoad::saveToDiskIfReady):
Now keep the subresources' ResourceRequests, in addition to their key, so we can later
extract the 'first party for cookies' URL from the request and save it to disk.

(WebKit::NetworkCache::SpeculativeLoadManager::registerLoad):
Pass the ResourceRequest in addition to the key to
PendingFrameLoad::registerSubresourceLoad().

(WebKit::NetworkCache::SpeculativeLoadManager::revalidateEntry):
Add an extra SubresourceInfo parameter, in addition to the Entry, so we
have access to the first party for cookies URL. Pass this URL to
constructRevalidationRequest().

(WebKit::NetworkCache::SpeculativeLoadManager::preloadEntry):
Add an extra SubresourceInfo parameter, in addition to the Entry, so we
have access to the first party for cookies URL.

(WebKit::NetworkCache::SpeculativeLoadManager::startSpeculativeRevalidation):
Pass the SubresourceInfo to preloadEntry().

• NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.h:

• NetworkProcess/cache/NetworkCacheSubresourcesEntry.cpp:

(WebKit::NetworkCache::SubresourcesEntry::SubresourceInfo::encode):
(WebKit::NetworkCache::SubresourcesEntry::SubresourceInfo::decode):
Encode / Decode new firstPartyForCookies member.

(WebKit::NetworkCache::SubresourcesEntry::SubresourcesEntry):
(WebKit::NetworkCache::SubresourcesEntry::updateSubresourceLoads):
Take SubresourceLoad objects in, instead of simple Key objects so we have
access to the ResourceRequest. We extract the first party for cookies URL
from the request and pass it to the SubresourceInfo constructor.

• NetworkProcess/cache/NetworkCacheSubresourcesEntry.h:

(WebKit::NetworkCache::SubresourcesEntry::SubresourceInfo::SubresourceInfo):
(WebKit::NetworkCache::SubresourcesEntry::SubresourceLoad::SubresourceLoad):

8:28 AM Changeset in webkit [197938] by jer.noble@apple.com

• 6 edits in trunk/Source

Enable AVFoundationNSURLSessionEnabled by default
​https://bugs.webkit.org/show_bug.cgi?id=154469

Reviewed by Sam Weinig.

Source/WebCore:

• page/Settings.cpp:

Source/WebKit/mac:

• WebView/WebPreferences.mm:

(+[WebPreferences initialize]):

Source/WebKit2:

• Shared/WebPreferencesDefinitions.h:

8:24 AM Changeset in webkit [197937] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r197927 - [GTK] Artifacts when using web view background color
​https://bugs.webkit.org/show_bug.cgi?id=155229

Reviewed by Mario Sanchez Prada.

This is because when using a web view color, we fill with the
color every rectangle updated by the web process, but we should
always fill the entire backing store before rendering the actual
contents on top.

• WebProcess/WebPage/DrawingAreaImpl.cpp:

(WebKit::DrawingAreaImpl::display): Ensure the web process always
renders the whole visible rectangle when background is rendered by
the UI process.

8:22 AM Changeset in webkit [197936] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r197733 - REGRESSION(r197062): [GTK] Transparent backgrounds no longer work after r197062
​https://bugs.webkit.org/show_bug.cgi?id=155119

Reviewed by Martin Robinson.

This is because after r197062 we are now realizing the view too
early, even before the toplevel window has been realized, forcing
the toplevel window to be realized. If the RGBA visual is set on
the window after it has been realzied it doesn't have any
effect. We should wait until the toplevel window is realized to
realize the web view, giving time to the application to set RGBA
visual and background color. If the toplevel window is already
realized we realize the web view immediately, so that this doesn't
affect the tearing problems fixed in r197062.

• UIProcess/API/gtk/WebKitWebViewBase.cpp:

(toplevelWindowRealized):
(webkitWebViewBaseSetToplevelOnScreenWindow):

8:10 AM Changeset in webkit [197935] by Carlos Garcia Campos

• 5 edits
  2 moves in releases/WebKitGTK/webkit-2.10

Merge r196807 - Revert to dispatching the popstate event synchronously
​https://bugs.webkit.org/show_bug.cgi?id=153297
rdar://problem/24092294

Reviewed by Brent Fulgham.

Source/WebCore:

r192369 made the popstate event dispatch asynchronously, which matches what the HTML5 spec says to do. However,
due to compatibility regressions we need to revert back to dispatching synchronously. This change reverts
r192369's changes to Document.cpp, but retains the new tests.

Firing popstate synchronously makes both fast/loader/remove-iframe-during-history-navigation-different.html and
fast/loader/remove-iframe-during-history-navigation-same.html crash, because their onpopstate handlers remove
frames from the document that will later be accessed by HistoryController::recursiveGoToItem().

To prevent the crashes, this change does two things:

1. Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling loadInSameDocument() might otherwise delete it.
2. Handle a null frame when iterating a HistoryItem's child frames in HistoryController::recursiveGoToItem(), since calling goToItem() on one frame might cause another frame to be deleted.

Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous.html was renamed to
fast/loader/stateobjects/popstate-is-synchronous.html and modified to expect synchronous dispatch.

• dom/Document.cpp:

(WebCore::Document::enqueuePopstateEvent):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadSameDocumentItem):

• loader/HistoryController.cpp:

(WebCore::HistoryController::recursiveGoToItem):

LayoutTests:

Renamed and modified this test to expect synchronous dispatch.

• fast/loader/stateobjects/popstate-is-synchronous-expected.txt: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous-expected.txt.
• fast/loader/stateobjects/popstate-is-synchronous.html: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous.html.

8:09 AM Changeset in webkit [197934] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10

Merge r192369 - popstate event should be dispatched asynchronously
​https://bugs.webkit.org/show_bug.cgi?id=36202
<rdar://problem/7761279>

Based on an original patch by Mihai Parparita <​mihaip@chromium.org>.

Reviewed by Brent Fulgham.

Source/WebCore:

Tests: fast/loader/remove-iframe-during-history-navigation-different.html

fast/loader/remove-iframe-during-history-navigation-same.html
fast/loader/stateobjects/popstate-is-asynchronous.html

• dom/Document.cpp:

(WebCore::Document::enqueuePopstateEvent):
Use enqueueWindowEvent().

LayoutTests:

• fast/loader/remove-iframe-during-history-navigation-different-expected.txt: Added.
• fast/loader/remove-iframe-during-history-navigation-different.html: Added.

Imported from Blink.

• fast/loader/remove-iframe-during-history-navigation-same-expected.txt: Added.
• fast/loader/remove-iframe-during-history-navigation-same.html: Added.

Ditto.

• fast/loader/stateobjects/popstate-fires-on-history-traversal.html:

Modified to account for popstate firing asynchronously.

• fast/loader/stateobjects/popstate-is-asynchronous-expected.txt: Added.
• fast/loader/stateobjects/popstate-is-asynchronous.html: Added.

Based on Mihai's original test. Modified to pass in current WebKit.

7:30 AM Changeset in webkit [197933] by fred.wang@free.fr

• 16 edits
  53 adds in trunk

[GTK] Add support for WOFF2
​https://bugs.webkit.org/show_bug.cgi?id=152616

.:

Patch by Frederic Wang <​fwang@igalia.org> on 2016-03-10
Reviewed by Carlos Garcia Campos.

• Source/CMakeLists.txt: Build brotli and woff2 third-party libraries if WOFF2 is enabled.
• Source/cmake/OptionsGTK.cmake: Always enable WOFF2 on GTK.

Source/ThirdParty:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-03-10
Reviewed by Carlos Garcia Campos.

We import the source of the third-party brotli and woff2 libraries because release packages do not exist yet.
The script to update source from upstream as well as the makefile to compile relevant files are based on similar code from Mozilla.

• brotli/CMakeLists.txt: Added. We force BROTLI_BUILD_PORTABLE by default, see ​https://github.com/google/brotli/issues/307.
• brotli/LICENSE: Added.
• brotli/README.webkit: Added.
• brotli/dec/Makefile: Added.
• brotli/dec/bit_reader.c: Added.
• brotli/dec/bit_reader.h: Added.
• brotli/dec/context.h: Added.
• brotli/dec/decode.c: Added.
• brotli/dec/decode.h: Added.
• brotli/dec/dictionary.c: Added.
• brotli/dec/dictionary.h: Added.
• brotli/dec/huffman.c: Added.
• brotli/dec/huffman.h: Added.
• brotli/dec/port.h: Added.

(BrotliRBit):

• brotli/dec/prefix.h: Added.
• brotli/dec/state.c: Added.
• brotli/dec/state.h: Added.
• brotli/dec/transform.h: Added.
• brotli/dec/types.h: Added.
• brotli/update.sh: Added. This script helps to get the latest version of the decoder source code.
• woff2/CMakeLists.txt: Added. We only compile the decoder files.
• woff2/LICENSE: Added.
• woff2/README.webkit: Added.
• woff2/src/buffer.h: Added.

(woff2::Failure):
(woff2::Buffer::Buffer):
(woff2::Buffer::Skip):
(woff2::Buffer::Read):
(woff2::Buffer::ReadU8):
(woff2::Buffer::ReadU16):
(woff2::Buffer::ReadS16):
(woff2::Buffer::ReadU24):
(woff2::Buffer::ReadU32):
(woff2::Buffer::ReadS32):
(woff2::Buffer::ReadTag):
(woff2::Buffer::ReadR64):
(woff2::Buffer::buffer):
(woff2::Buffer::offset):
(woff2::Buffer::length):
(woff2::Buffer::set_offset):

• woff2/src/file.h: Added.

(woff2::GetFileContent):
(woff2::SetFileContents):

• woff2/src/font.cc: Added.
• woff2/src/font.h: Added.
• woff2/src/glyph.cc: Added.
• woff2/src/glyph.h: Added.

(woff2::Glyph::Glyph):

• woff2/src/normalize.cc: Added.
• woff2/src/normalize.h: Added.
• woff2/src/port.h: Added.

(woff2::Log2Floor):

• woff2/src/round.h: Added.

(woff2::Round4):

• woff2/src/store_bytes.h: Added.

(woff2::StoreU32):
(woff2::Store16):
(woff2::StoreBytes):

• woff2/src/table_tags.cc: Added.
• woff2/src/table_tags.h: Added.
• woff2/src/transform.cc: Added.
• woff2/src/transform.h: Added.
• woff2/src/variable_length.cc: Added.
• woff2/src/variable_length.h: Added.
• woff2/src/woff2_common.cc: Added.
• woff2/src/woff2_common.h: Added.

(woff2::Table::operator<):

• woff2/src/woff2_compress.cc: Added.
• woff2/src/woff2_dec.cc: Added.
• woff2/src/woff2_dec.h: Added.
• woff2/src/woff2_decompress.cc: Added.
• woff2/src/woff2_enc.cc: Added.
• woff2/src/woff2_enc.h: Added.

(woff2::WOFF2Params::WOFF2Params):

• woff2/update.sh: Added. This script helps to get the latest upstream version.

Source/WebCore:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-03-10
Reviewed by Carlos Garcia Campos.

No new tests (Covered by existing tests).

• CMakeLists.txt: Add woff2 source to the include directory and link WebCore against brotli and woff2.
• platform/graphics/WOFFFileFormat.cpp:

(WebCore::isWOFF): Recognize the signature of WOFF2 font.
(WebCore::convertWOFFToSfnt): If the font has the WOFF2 signature, then try and decompress it using the woff2 library.

• platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:

(WebCore::FontCustomPlatformData::supportsFormat): Add woff2 to the list of supported formats.

Source/WTF:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-03-10
Reviewed by Carlos Garcia Campos.

• wtf/FeatureDefines.h: Enable USE_WOFF2 flag on GTK.

Tools:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-03-10
Reviewed by Carlos Garcia Campos.

• Scripts/webkitpy/style/checker.py: Only verify basic style for third party modules brotli and woff2.

LayoutTests:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-03-10
Reviewed by Carlos Garcia Campos.

• fast/text/woff2-expected.html: Adjust font-size to work around anti-aliasing effects.
• fast/text/woff2.html: Ditto.
• platform/gtk/TestExpectations: Update test expectation of woff2 test for GTK.

6:32 AM Changeset in webkit [197932] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Fix the build in Windows.

Reviewed by Alberto Garcia.

• interpreter/JSStack.cpp:

(JSC::commitSize):

6:25 AM WebKitGTK/2.12.x edited by Michael Catanzaro

(diff)

4:26 AM Changeset in webkit [197931] by eric.carlson@apple.com

• 2 edits in trunk/Source/WebKit2

Unreviewed, revert changes accidentally committed with previous patch.

• WebProcess/com.apple.WebProcess.sb.in:

4:15 AM Changeset in webkit [197930] by Manuel Rego Casasnovas

• 12 edits
  2 adds in trunk

[css-grid] Fix placement for unknown named grid lines
​https://bugs.webkit.org/show_bug.cgi?id=155230

Reviewed by Sergio Villar Senin.

Source/WebCore:

The spec has changed and now all the implicit lines should be considered
when we're resolving named grid lines with an unknown name.

The relevant part of the spec is
(​http://dev.w3.org/csswg/css-grid/#line-placement):
"If a name is given as a <custom-ident>, only lines with that name

are counted. If not enough lines with that name exist,
all implicit grid lines are assumed to have that name
for the purpose of finding this position."

Modified the code to resolve named grid lines in GridResolvedPosition.
We need to keep the old behavior of considering "auto" unknown named
grid lines for the case of positioned grid items.

Test: fast/css-grid-layout/grid-item-unknown-named-grid-line-resolution.html

• rendering/style/GridResolvedPosition.cpp:

(WebCore::adjustGridPositionsFromStyle):
(WebCore::lookAheadForNamedGridLine):
(WebCore::lookBackForNamedGridLine):
(WebCore::resolveNamedGridLinePositionFromStyle):
(WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::resolveGridPositionFromStyle):

LayoutTests:

Updated current tests to the new expected behavior and created a new
test checking different cases explicitly.

• fast/css-grid-layout/grid-container-change-named-grid-lines-recompute-child.html:
• fast/css-grid-layout/grid-item-bad-named-area-auto-placement-expected.txt:
• fast/css-grid-layout/grid-item-bad-named-area-auto-placement.html:
• fast/css-grid-layout/grid-item-named-grid-area-resolution.html:
• fast/css-grid-layout/grid-item-named-grid-line-resolution-expected.txt:
• fast/css-grid-layout/grid-item-named-grid-line-resolution.html:
• fast/css-grid-layout/grid-item-negative-position-resolution.html:
• fast/css-grid-layout/grid-item-position-changed-dynamic.html:
• fast/css-grid-layout/grid-item-unknown-named-grid-line-resolution-expected.txt: Added.
• fast/css-grid-layout/grid-item-unknown-named-grid-line-resolution.html: Added.
• fast/css-grid-layout/named-grid-lines-with-named-grid-areas-resolution.html:

4:05 AM Changeset in webkit [197929] by eric.carlson@apple.com

• 13 edits in trunk/Source

[MediaStream] push media stream state to the UI process
​https://bugs.webkit.org/show_bug.cgi?id=155281

Reviewed by Darin Adler.

Source/WebCore:

• Modules/mediastream/MediaStream.cpp:

(WebCore::MediaStream::MediaStream): Register with the document as an audio producer.
(WebCore::MediaStream::~MediaStream): Unregister.
(WebCore::MediaStream::setIsActive): Update document status.
(WebCore::MediaStream::pageMutedStateDidChange): Mute/unmute according to the page mute setting.
(WebCore::MediaStream::mediaState): Return state.
(WebCore::MediaStream::statusDidChange): Call document.updateIsPlayingMedia.
(WebCore::MediaStream::characteristicsChanged): Track stream mute state.
(WebCore::MediaStream::scheduleActiveStateChange): m_isActive -> m_active.

• Modules/mediastream/MediaStream.h:

• page/MediaProducer.h: Add HasActiveMediaCaptureDevice.

• platform/mediastream/MediaStreamPrivate.cpp:

(WebCore::MediaStreamPrivate::hasVideo): Make const.
(WebCore::MediaStreamPrivate::hasAudio): Ditto.
(WebCore::MediaStreamPrivate::muted): New.

• platform/mediastream/MediaStreamPrivate.h:

• platform/mediastream/mac/AVMediaCaptureSource.mm:

(WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Initialize muted to true.
(WebCore::AVMediaCaptureSource::captureSessionIsRunningDidChange): Set muted.

Source/WebKit2:

• UIProcess/API/C/WKPage.cpp:

(WKPageGetMediaState): New.

• UIProcess/API/C/WKPagePrivate.h:

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didCommitLoadForFrame): Clear m_mediaState.
(WebKit::WebPageProxy::isPlayingMediaDidChange): Call m_pageClient.isPlayingMediaDidChange when

audio or video state changes, call m_uiClient->isPlayingAudioDidChange when audio, vidoe,
or media stream state changes.

• UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::mediaStateFlags): New.

12:19 AM Changeset in webkit [197928] by gskachkov@gmail.com

• 7 edits in trunk/Source/JavaScriptCore

How we load new.target in arrow functions is broken
​https://bugs.webkit.org/show_bug.cgi?id=155153

Reviewed by Saam Barati.

Fixed not correct approach of caching new.target. In current patch was added code feature
flag that shows that current function is using new.target, when generating byte code an arrow
function we are loading new.target value to its register from arrow function lexical environment.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):

• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::newTarget):

• parser/ASTBuilder.h:

(JSC::ASTBuilder::createNewTargetExpr):
(JSC::ASTBuilder::usesNewTarget):

• parser/Nodes.h:

(JSC::ScopeNode::usesNewTarget):

• parser/ParserModes.h:
• tests/stress/arrowfunction-lexical-bind-newtarget.js:

Mar 9, 2016:

11:13 PM Changeset in webkit [197927] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit2

[GTK] Artifacts when using web view background color
​https://bugs.webkit.org/show_bug.cgi?id=155229

Reviewed by Mario Sanchez Prada.

This is because when using a web view color, we fill with the
color every rectangle updated by the web process, but we should
always fill the entire backing store before rendering the actual
contents on top.

• WebProcess/WebPage/DrawingAreaImpl.cpp:

(WebKit::DrawingAreaImpl::display): Ensure the web process always
renders the whole visible rectangle when background is rendered by
the UI process.

10:15 PM Changeset in webkit [197926] by commit-queue@webkit.org

• 12 edits
  4 adds in trunk

Web Inspector: Get a RemoteObject or ObjectPreview from HeapSnapshot Object Identifier
​https://bugs.webkit.org/show_bug.cgi?id=155264
<rdar://problem/25070716>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-09
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

• inspector/InjectedScript.h:
• inspector/InjectedScript.cpp:

(Inspector::InjectedScript::functionDetails):
(Inspector::InjectedScript::previewValue):
New InjectedScript methods for building Debugger.FunctionDetails
or Runtime.ObjectPreview protocol objects from a JSValue.

• inspector/InjectedScriptSource.js:

(InjectedScript.prototype.previewValue):
(InjectedScript.prototype.functionDetails):
(InjectedScript.prototype.getFunctionDetails):
(InjectedScript.RemoteObject.prototype._isPreviewableObjectInternal):
(InjectedScript.RemoteObject.prototype._createObjectPreviewForValue): Deleted.
(InjectedScript.RemoteObject.prototype._appendEntryPreviews): Deleted.
Share code around creating function details or object preview objects.

• inspector/agents/InspectorHeapAgent.cpp:

(Inspector::InspectorHeapAgent::InspectorHeapAgent):
(Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
(Inspector::InspectorHeapAgent::getPreview):
(Inspector::InspectorHeapAgent::getRemoteObject):

• inspector/agents/InspectorHeapAgent.h:
• inspector/protocol/Heap.json:

New protocol methods that go from heap object identifier to a
remote object or some kind of preview.

• inspector/scripts/codegen/generator.py:

Allow runtime casts for ObjectPreview.

LayoutTests:

• inspector/heap/getPreview-expected.txt: Added.
• inspector/heap/getPreview.html: Added.
• inspector/heap/getRemoteObject-expected.txt: Added.
• inspector/heap/getRemoteObject.html: Added.

Test the new protocol methods in different scenarios.

• inspector/heap/snapshot-expected.txt:
• inspector/heap/snapshot.html:

Fix typo.

9:28 PM Changeset in webkit [197925] by commit-queue@webkit.org

• 11 edits in trunk

[INTL] Intl Constructors not web compatible with Object.create usage
​https://bugs.webkit.org/show_bug.cgi?id=153679

Patch by Andy VanWagoner <​thetalecrafter@gmail.com> on 2016-03-09
Reviewed by Darin Adler.

Source/JavaScriptCore:

Add workaround for initializing NumberFormat and DateTimeFormat objects
using Object.create followed by constructor.call. This is necessary for
backwards compatibility with libraries relying on v1 behavior of Intl
constructors.

Collator does not get the workaround, since polyfills do not include it,
and there are not any known instances of v2 incompatible libraries.

The workaround involves checking for an object that inherits from the
*Format constructor, but was not actually initialized with that type. A
substitute instance is created and attached to the object using a private
name. The prototype functions then check for the private property to use
in place of the original object.

Since this behavior is not part of the v2 spec, it should be removed as
soon as the incompatible behavior is no longer in common use.

• runtime/CommonIdentifiers.h:
• runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::callIntlDateTimeFormat):

• runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototypeGetterFormat):
(JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):

• runtime/IntlNumberFormatConstructor.cpp:

(JSC::callIntlNumberFormat):

• runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototypeGetterFormat):
(JSC::IntlNumberFormatPrototypeFuncResolvedOptions):

LayoutTests:

Add tests for Object.create + contructor.call initialization of NumberFormat
and DateTimeFormat objects.

• js/intl-datetimeformat-expected.txt:
• js/intl-numberformat-expected.txt:
• js/script-tests/intl-datetimeformat.js:
• js/script-tests/intl-numberformat.js:

9:27 PM Changeset in webkit [197924] by rniwa@webkit.org

• 5 edits
  2 adds in trunk/Source/WebCore

Extract EventPath.h/cpp out of EventDispatcher.cpp
​https://bugs.webkit.org/show_bug.cgi?id=155285

Reviewed by Chris Dumez.

Extracted EventPath.h/cpp out of EventDispatcher.cpp to add the support for Event.deepPath()
in webkit.org/b/153538. The new file defines member functions of EventPath and RelatedNodeRetargeter.

• CMakeLists.txt:
• WebCore.xcodeproj/project.pbxproj:
• dom/DOMAllInOne.cpp:
• dom/EventDispatcher.cpp:

(WebCore::EventDispatcher::dispatchScopedEvent):
(WebCore::EventDispatcher::dispatchEvent):
(WebCore::EventPath): Moved to EventPath.cpp.
(WebCore::eventTargetRespectingTargetRules): Moved to EventPath.h.
(WebCore::shouldEventCrossShadowBoundary): Moved to EventPath.cpp.
(WebCore::nodeOrHostIfPseudoElement): Ditto.
(WebCore::RelatedNodeRetargeter): Moved to EventPath.cpp.

• dom/EventPath.cpp: Added.

(WebCore::shouldEventCrossShadowBoundary): Moved from EventDispatcher.cpp.
(WebCore::nodeOrHostIfPseudoElement): Ditto.
(WebCore::EventPath::EventPath): Ditto.
(WebCore::RelatedNodeRetargeter): Ditto.

• dom/EventPath.h: Added.

(WebCore::EventPath::isEmpty):
(WebCore::EventPath::size):
(WebCore::EventPath::contextAt):
(WebCore::EventPath::lastContextIfExists):
(WebCore::EventPath::eventTargetRespectingTargetRules): Moved from EventDispatcher.cpp.

9:26 PM Changeset in webkit [197923] by Simon Fraser

• 22 edits in trunk/Source

Font antialiasing (smoothing) changes when elements are rendered into compositing layers
​https://bugs.webkit.org/show_bug.cgi?id=23364
rdar://problem/7288429

Reviewed by Tim Horton.
Source/WebCore:

Improve the appearance of subpixel-antialiased ("smoothed") text in non-opaque layers
by opting in to a new CALayer backing store format.

GraphicsLayer now has setSupportsSmoothedFonts(), which is called by RenderLayerBacking
when the platform has support for the new feature. Ideally this would only be set when
we know a layer has smoothed text drawn into it, but, for now, enable this for all
layers. The right thing happens with opaque layers under the hood.

setSupportsSmoothedFonts() is turned into a PlatformCALayer contentsFormat flag, which
is ultimately passed to setBackingStoreFormat().

We also need to propagate this flag to TileController tiles.

• platform/graphics/GraphicsLayer.cpp:

(WebCore::GraphicsLayer::supportsSmoothedFontsInNonOpaqueLayers):
(WebCore::GraphicsLayer::GraphicsLayer):

• platform/graphics/GraphicsLayer.h:

(WebCore::GraphicsLayer::supportsSmoothedFonts):
(WebCore::GraphicsLayer::setSupportsSmoothedFonts):

• platform/graphics/TiledBacking.h:
• platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayer::supportsSmoothedFontsInNonOpaqueLayers):
(WebCore::GraphicsLayerCA::setSupportsSmoothedFonts):
(WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
(WebCore::GraphicsLayerCA::updateContentsFormat):

• platform/graphics/ca/GraphicsLayerCA.h:
• platform/graphics/ca/PlatformCALayer.cpp:

(WebCore::PlatformCALayer::drawRepaintIndicator): Give the number a "shadow" when
the contents format says we support smoothed fonts.

• platform/graphics/ca/PlatformCALayer.h:
• platform/graphics/ca/TileController.cpp:

(WebCore::TileController::setTileContentsFormatFlags):
(WebCore::TileController::createTileLayer):

• platform/graphics/ca/TileController.h:
• platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::updateTileLayerProperties):

• platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
• platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

(WebCore::setBackingStoreFormat):
(PlatformCALayerCocoa::commonInit):
(PlatformCALayerCocoa::setContentsFormat):
(PlatformCALayer::drawLayerContents): Previously, we turned off font smoothing in
non-opaque layers to improve text appearance. We no longer need to do that when
the contents format has "SmoothedFonts".

• platform/ios/LegacyTileGridTile.mm:

(WebCore::setBackingStoreFormat):
(WebCore::LegacyTileGridTile::LegacyTileGridTile):

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::createGraphicsLayer):

Source/WebKit2:

Send the ContentsFormat to the UI process (but nothing happens to it there yet).

• Shared/mac/RemoteLayerTreeTransaction.h:
• Shared/mac/RemoteLayerTreeTransaction.mm:

(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):

• WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:

(WebKit::PlatformCALayerRemote::setContentsFormat):
(WebKit::PlatformCALayerRemote::contentsFormat):

• WebProcess/WebPage/mac/PlatformCALayerRemote.h:

9:17 PM Changeset in webkit [197922] by barraclough@apple.com

• 3 edits in trunk/Source/WebCore

WebKit should adopt journal_mode=wal for all SQLite databases.
​https://bugs.webkit.org/show_bug.cgi?id=133496

Reviewed by Brady Eidson & Darin Adler.

The statement intended to enable WAL mode is always failing because it is missing a
prepare(). Fix this. We were also previously permitting SQLITE_OK results - this
was in error (we were only getting these because stepping the unprepared statement
returned SQLITE_OK). Also set the SQLITE_OPEN_AUTOPROXY flag when opening the
database - this will improve perfomance when the database is accessed via an AFP
mount.

• platform/sql/SQLiteDatabase.cpp:

(WebCore::SQLiteDatabase::open):

• call prepareAndStep(), only check for SQLITE_ROW result.

• platform/sql/SQLiteFileSystem.cpp:

(WebCore::SQLiteFileSystem::openDatabase):

• should set SQLITE_OPEN_AUTOPROXY flag when opening database.

8:43 PM Changeset in webkit [197921] by rniwa@webkit.org

• 25 edits in trunk

Add runtime flags for shadow DOM and custom elements
​https://bugs.webkit.org/show_bug.cgi?id=155213

Reviewed by Dean Jackson.

Source/WebCore:

Added new runtime flags for shadow DOM and custom elements.

• bindings/generic/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setShadowDOMEnabled): Added.
(WebCore::RuntimeEnabledFeatures::shadowDOMEnabled): Added.
(WebCore::RuntimeEnabledFeatures::setCustomElementsEnabled): Added.
(WebCore::RuntimeEnabledFeatures::customElementsEnabled): Added.

• dom/Document.idl:
• dom/Element.idl:
• dom/Node.idl:
• dom/NonDocumentTypeChildNode.idl:
• dom/ShadowRoot.idl:
• html/HTMLSlotElement.idl:

Source/WebKit/mac:

Set the runtime flag based on preferences. Enable shadow DOM and disable custom elements by default.

• WebView/WebPreferenceKeysPrivate.h:
• WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences shadowDOMEnabled]):
(-[WebPreferences setShadowDOMEnabled:]):
(-[WebPreferences customElementsEnabled]):
(-[WebPreferences setCustomElementsEnabled:]):

• WebView/WebPreferencesPrivate.h:
• WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:

Set the runtime flag based on preferences. Enable shadow DOM and disable custom elements by default.

• Shared/WebPreferencesDefinitions.h:
• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetShadowDOMEnabled):
(WKPreferencesGetShadowDOMEnabled):
(WKPreferencesSetCustomElementsEnabled):
(WKPreferencesGetCustomElementsEnabled):

• UIProcess/API/C/WKPreferencesRefPrivate.h:
• WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

Source/WTF:

Removed the manual overrides of ENABLE_SHADOW_DOM and ENABLE_CUSTOM_ELEMENTS as they were
making --no-shadow-dom and --no-custom-elements flags on build-webkit useless.

• wtf/FeatureDefines.h:

Tools:

Always enable shadow DOM and custom elements during testing.

• DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues):

• WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::beginTesting):

• WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::setShadowDOMEnabled): Added.

• WebKitTestRunner/InjectedBundle/TestRunner.h:

8:06 PM Changeset in webkit [197920] by Brent Fulgham

• 5 edits in trunk

Handling 'allowUniversalAccessFromFileURLs' on WKWebViewConfiguration causes test breakage
​https://bugs.webkit.org/show_bug.cgi?id=155265
<rdar://problem/11101440>

Reviewed by Andy Estes.

Source/WebKit2:

We require "AllowUniversalAccessFromFileURLs" to permit file URLs from accessing
localStorage. However, this setting is not available on the Cocoa WKPreference (by design).
Instead, you need to set this value on the WKWebViewConfiguration.

Back out the work-around landed in r197889,

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]): Remove test workaround.

• UIProcess/mac/WebInspectorProxyMac.mm:

(WebKit::WebInspectorProxy::platformCreateInspectorPage): Set the correct flag on
the WKWebViewConfiguration.

Tools:

WK2 localStorage tests need the 'AllowUniversalAccessFromFileURLs' preference set by default.
Tests that confirm blocking localStorage manually set the flag to "False" in the test.

• WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::initializeWebViewConfiguration): Set the default state to the correct value.

7:16 PM Changeset in webkit [197919] by Matt Baker

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: LayoutTimelineView path components should reflect grid row nesting
​https://bugs.webkit.org/show_bug.cgi?id=155279
<rdar://problem/25075355>

Reviewed by Timothy Hatcher.

• UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView.prototype.get selectionPathComponents):
Walk grid nodes to build path component array.

6:41 PM Changeset in webkit [197918] by sbarati@apple.com

• 5 edits
  1 add in trunk/Source/JavaScriptCore

Add proper JSON.stringify support for Proxy when the target is an array
​https://bugs.webkit.org/show_bug.cgi?id=155180

Reviewed by Darin Adler.

This patch makes the following type of program true:
JSON.stringify(new Proxy([25], {})) === "[25]"

We need to change the JSON stringifier to use the IsArray test
in section 7.2.2 of ES6 spec instead of the JSC inherits(JSArray::info())
test.

This patch also adds tests for general JSON.stringify support
of Proxy.

• runtime/ArrayConstructor.cpp:

(JSC::arrayConstructorIsArray):
(JSC::arrayConstructorPrivateFuncIsArrayConstructor):

• runtime/ArrayConstructor.h:

(JSC::isArray):

• runtime/JSONObject.cpp:

(JSC::Stringifier::Holder::object):
(JSC::Stringifier::appendStringifiedValue):
(JSC::Stringifier::startNewLine):
(JSC::Stringifier::Holder::Holder):

• tests/es6.yaml:
• tests/stress/proxy-json.js: Added.

(assert):
(test):

6:33 PM Changeset in webkit [197917] by rniwa@webkit.org

• 12 edits
  2 adds in trunk

defineElement should upgrade existing unresolved custom elements
​https://bugs.webkit.org/show_bug.cgi?id=155107

Reviewed by Darin Adler.

Source/WebCore:

Added the support for upgrading existing unresolved custom elements when defineElement is called.

The current implementation upgrades elements in the order they were created and has the issue that
it keeps accumulating all elements with a hyphen in its name until defineElement is called as
documented in ​https://github.com/w3c/webcomponents/issues/419

This patch re-purposes IsEditingTextFlag to indicate that the node is an unresolved custom element.
Since isEditingText() is only called in textRendererIsNeeded only on Text nodes, it's mutually
exclusive with isUnresolvedCustomElement().

The list of unresolved custom elements is kept in m_upgradeCandidatesMap, a hash map of element names
to the list of unresolved elements with that name.

In addition, added the logic to use HTMLElement as the interface for unresolved custom element instead
of HTMLUnknownElement.

Test: fast/custom-elements/upgrading/upgrading-parser-created-element.html

• bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::upgradeElement): Clear the flag.

• bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineElement): Set the unique private name to keep the interface alive before
calling addElementDefinition as the call can now invoke author scripts.

• dom/CustomElementDefinitions.cpp:

(WebCore::CustomElementDefinitions::addElementDefinition): Upgrade existing unresolved elements kept
in m_upgradeCandidatesMap.
(WebCore::CustomElementDefinitions::addUpgradeCandidate): Added.

• dom/CustomElementDefinitions.h:
• dom/Document.cpp:

(WebCore::createHTMLElementWithNameValidation): Added the code to add the unresolved custom elements
to the upgrade candidates map. Also instantiate it as HTMLElement instead of HTMLUnknownElement.
(WebCore::createFallbackHTMLElement): Ditto.

• dom/Node.h:

(WebCore::Node::setIsCustomElement):
(WebCore::Node::isUnresolvedCustomElement): Added.
(WebCore::Node::setIsUnresolvedCustomElement): Added.
(WebCore::Node::setCustomElementIsResolved): Added. Clears IsEditingTextOrUnresolvedCustomElementFlag
and sets IsCustomElement.
(WebCore::Node::isEditingText): Check both IsEditingTextOrUnresolvedCustomElementFlag and IsTextFlag
for safety even though it's currently only used in textRendererIsNeeded which takes Text&.

• dom/make_names.pl:

(defaultParametersHash): Added customElementInterfaceName as a parameter.
(printWrapperFactoryCppFile): Generate the code to use customElementInterfaceName when the element
for which the wrapper is created has isUnresolvedCustomElement flag set.

• html/HTMLTagNames.in: Use HTMLElement for unresolved custom elements.
• html/parser/HTMLConstructionSite.cpp:

(WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface): Added the code to add
the unresolved custom elements to the upgrade candidates map. Also instantiate it as HTMLElement instead
of HTMLUnknownElement.

LayoutTests:

Added W3C style testharness.js tests for asynchronously defining custom elements.

• fast/custom-elements/upgrading/Node-cloneNode.html:
• fast/custom-elements/upgrading/upgrading-parser-created-element-expected.txt: Added.
• fast/custom-elements/upgrading/upgrading-parser-created-element.html: Added.

6:05 PM Changeset in webkit [197916] by enrica@apple.com

• 12 edits in trunk/Source

Retrieve additional context for some data detector link for preview and action menu.
​https://bugs.webkit.org/show_bug.cgi?id=155278
rdar://problem/24884951

Reviewed by Tim Horton.

Source/WebCore:

Adding helper function to compute a range by moving by a number of characters
from a given position and direction.
Adding function to check if the given data detector link element requires
an extended context.

• editing/VisibleUnits.cpp:

(WebCore::rangeExpandedByCharactersInDirectionAtWordBoundary):

• editing/VisibleUnits.h:
• editing/cocoa/DataDetection.h:
• editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::requiresExtendedContext):

Source/WebKit2:

Data detector results for items like calendar events, can be augmented
retrieving the text surrounding the link.

• Platform/spi/ios/DataDetectorsUISPI.h:
• Shared/ios/InteractionInformationAtPosition.h:
• Shared/ios/InteractionInformationAtPosition.mm:

(WebKit::InteractionInformationAtPosition::encode):
(WebKit::InteractionInformationAtPosition::decode):

• UIProcess/ios/WKActionSheetAssistant.mm:

(-[WKActionSheetAssistant showDataDetectorsSheet]):

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _dataForPreviewItemController:atPosition:type:]):

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):

6:04 PM Changeset in webkit [197915] by sbarati@apple.com

• 16 edits
  1 add in trunk

ES6: Implement lexical scoping for function definitions in strict mode
​https://bugs.webkit.org/show_bug.cgi?id=152844

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This patch implements block scoping for function definitions
in strict mode. The implementation works as follows:

• If we're in sloppy mode, function declarations work exactly as they did before this patch. I.e, function declarations are hoisted and declared like "var" variables.

• If you're in strict mode and at the top of a function scope or program scope, function declarations still work like they used to. They are defined like "var" variables. This is necessary for backwards compatibility because ES5 strict mode allowed duplicate function declarations at the top-most scope of a program/function.

• If you're in strict mode and inside a block statement or a switch statement, function declarations are now block scoped. All function declarations within a block are hoisted to the beginning of the block. They are not hoisted out of the block like they are in sloppy mode. This allows for the following types of programs: ` function foo() {

function bar() { return 20; }
{

function bar() { return 30; }
bar(); 30

}
bar(); 20

}
`

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::instantiateLexicalVariables):
(JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
(JSC::BytecodeGenerator::pushLexicalScope):
(JSC::BytecodeGenerator::pushLexicalScopeInternal):
(JSC::BytecodeGenerator::initializeBlockScopedFunctions):
(JSC::BytecodeGenerator::popLexicalScope):
(JSC::BytecodeGenerator::liftTDZCheckIfPossible):
(JSC::BytecodeGenerator::pushTDZVariables):
(JSC::BytecodeGenerator::getVariablesUnderTDZ):
(JSC::BytecodeGenerator::emitNewRegExp):
(JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
(JSC::BytecodeGenerator::emitNewFunctionExpression):
(JSC::BytecodeGenerator::emitNewArrowFunctionExpression):

• bytecompiler/BytecodeGenerator.h:
• parser/ASTBuilder.h:

(JSC::ASTBuilder::createSourceElements):
(JSC::ASTBuilder::features):
(JSC::ASTBuilder::numConstants):
(JSC::ASTBuilder::createFuncDeclStatement):
(JSC::ASTBuilder::createClassDeclStatement):
(JSC::ASTBuilder::createBlockStatement):
(JSC::ASTBuilder::createTryStatement):
(JSC::ASTBuilder::createSwitchStatement):
(JSC::ASTBuilder::Scope::Scope):
(JSC::ASTBuilder::funcDeclarations): Deleted.

• parser/NodeConstructors.h:

(JSC::CaseBlockNode::CaseBlockNode):
(JSC::SwitchNode::SwitchNode):
(JSC::BlockNode::BlockNode):

• parser/Nodes.cpp:

(JSC::ScopeNode::ScopeNode):
(JSC::ScopeNode::singleStatement):
(JSC::ProgramNode::ProgramNode):
(JSC::ModuleProgramNode::ModuleProgramNode):
(JSC::EvalNode::EvalNode):
(JSC::FunctionNode::FunctionNode):
(JSC::VariableEnvironmentNode::VariableEnvironmentNode):

• parser/Nodes.h:

(JSC::VariableEnvironmentNode::VariableEnvironmentNode):
(JSC::VariableEnvironmentNode::lexicalVariables):
(JSC::VariableEnvironmentNode::functionStack):
(JSC::ScopeNode::captures):
(JSC::ScopeNode::varDeclarations):
(JSC::ScopeNode::neededConstants):
(JSC::ProgramNode::startColumn):
(JSC::ProgramNode::endColumn):
(JSC::EvalNode::startColumn):
(JSC::EvalNode::endColumn):
(JSC::ModuleProgramNode::startColumn):
(JSC::ModuleProgramNode::endColumn):
(JSC::ScopeNode::functionStack): Deleted.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::didFinishParsing):
(JSC::Parser<LexerType>::parseStatementListItem):
(JSC::Parser<LexerType>::parseSwitchStatement):
(JSC::Parser<LexerType>::parseBlockStatement):
(JSC::Parser<LexerType>::parseStatement):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::getMetadata):
(JSC::Parser<LexerType>::parseFunctionDeclaration):
(JSC::Parser<LexerType>::parseExportDeclaration):

• parser/Parser.h:

(JSC::Scope::declareVariable):
(JSC::Scope::declareFunction):
(JSC::Scope::appendFunction):
(JSC::Scope::takeFunctionDeclarations):
(JSC::Scope::declareLexicalVariable):
(JSC::Parser::currentVariableScope):
(JSC::Parser::currentLexicalDeclarationScope):
(JSC::Parser::currentFunctionScope):
(JSC::Parser::pushScope):
(JSC::Parser::popScopeInternal):
(JSC::Parser::declareVariable):
(JSC::Parser::declareFunction):
(JSC::Parser::hasDeclaredVariable):
(JSC::Parser::isFunctionMetadataNode):
(JSC::Parser<LexerType>::parse):

• parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createFuncDeclStatement):
(JSC::SyntaxChecker::createClassDeclStatement):
(JSC::SyntaxChecker::createBlockStatement):
(JSC::SyntaxChecker::createExprStatement):
(JSC::SyntaxChecker::createIfStatement):
(JSC::SyntaxChecker::createContinueStatement):
(JSC::SyntaxChecker::createTryStatement):
(JSC::SyntaxChecker::createSwitchStatement):
(JSC::SyntaxChecker::createWhileStatement):
(JSC::SyntaxChecker::createWithStatement):
(JSC::SyntaxChecker::createDoWhileStatement):

• parser/VariableEnvironment.h:

(JSC::VariableEnvironmentEntry::isExported):
(JSC::VariableEnvironmentEntry::isImported):
(JSC::VariableEnvironmentEntry::isImportedNamespace):
(JSC::VariableEnvironmentEntry::isFunction):
(JSC::VariableEnvironmentEntry::setIsCaptured):
(JSC::VariableEnvironmentEntry::setIsConst):
(JSC::VariableEnvironmentEntry::setIsExported):
(JSC::VariableEnvironmentEntry::setIsImported):
(JSC::VariableEnvironmentEntry::setIsImportedNamespace):
(JSC::VariableEnvironmentEntry::setIsFunction):
(JSC::VariableEnvironmentEntry::clearIsVar):
(JSC::VariableEnvironment::VariableEnvironment):
(JSC::VariableEnvironment::begin):
(JSC::VariableEnvironment::end):

• tests/es6.yaml:
• tests/stress/block-scoped-function-declarations.js: Added.

(assert):
(test):
(f.foo.bar):
(f.foo.):
(f.foo):
(f):
(assert.foo.):
(assert.foo):
(assert.foo.foo):
(assert.foo.bar):
(assert.foo.switch.case.1):
(assert.foo.switch.case.2):
(assert.foo.switch.foo):
(assert.foo.switch.bar):

LayoutTests:

• js/let-syntax-expected.txt:
• js/parser-syntax-check-expected.txt:
• js/script-tests/parser-syntax-check.js:

(testFailed):
(runTest):

5:55 PM Changeset in webkit [197914] by barraclough@apple.com

• 3 edits in trunk/Source/WebKit2

Last opened tab does not receive SetHiddenPageTimerThrottlingIncreaseLimit message
​https://bugs.webkit.org/show_bug.cgi?id=155126

Reviewed by Anders Carlson.

WebPageProxy will increment the hidden page throttling counter from within its constructor,
which currently causes the WebProcessPool to try to synchronously message all processes.
The web page triggering the increment then fails to receive the message, since it was
still being constructed. Make the update of the limit async, such that the page is fully
constructed before the WebProcessPool processes the update.

• UIProcess/WebProcessPool.cpp:

(WebKit::m_hiddenPageThrottlingAutoIncreasesCounter):

• This now schedules a zero-delay timer to handle the update.

(WebKit::m_hiddenPageThrottlingTimer):

• This is now responsible for calling updateHiddenPageThrottlingAutoIncreaseLimit.

• UIProcess/WebProcessPool.h:
  • Added m_hiddenPageThrottlingTimer.

5:54 PM Changeset in webkit [197913] by bshafiei@apple.com

• 5 edits in branches/safari-601-branch/Source

Versioning.

5:53 PM Changeset in webkit [197912] by ddkilzer@apple.com

• 3 edits in trunk/Tools

check-webkit-style: fix false-positive warnings about @try/@catch blocks in Objective-C++ source files
<​http://webkit.org/b/155273>

Reviewed by Andy Estes.

• Scripts/webkitpy/style/checkers/cpp.py:

(check_spacing_for_function_call): Ignore @catch lines.
(check_braces): Ditto.

• Scripts/webkitpy/style/checkers/cpp_unittest.py:

(CppStyleTest.test_brace_at_begin_of_line): Add test case.

5:46 PM Changeset in webkit [197911] by dbates@webkit.org

• 2 edits in trunk/Source/WebCore

Fix the Windows build after <​https://trac.webkit.org/changeset/197905>
(​https://bugs.webkit.org/show_bug.cgi?id=155247)

We need to call the std::unique_ptr<CryptoDigest>() constructor directly
instead of using the convenience function std::make_unique<CryptoDigest>()
because std::make_unique<CryptoDigest>() cannot access the private constructor
CryptoDigest().

• platform/crypto/win/CryptoDigestWin.cpp:

(WebCore::CryptoDigest::create):

5:38 PM Changeset in webkit [197910] by jonlee@apple.com

• 6 edits in trunk/PerformanceTests

Enhance existing Animometer tests
​https://bugs.webkit.org/show_bug.cgi?id=155261

Reviewed by Simon Fraser.

• Animometer/tests/master/resources/canvas-tests.js: Add a gradient to

the filled circles. To expose more of the gradient, add another circle.
(SimpleCanvasStage.call.animate): For each frame, create a gradient with
undulating stop points and colors. Fill the circles twice; once with
the solid color, and once with the gradient.

• Animometer/tests/master/resources/dom-particles.js: Refactor the

emission variables into a separate stage for this test. Add a colorOffset
variable to make the colors of each particle slightly different, since
the ramp controller can add large numbers of particles all at once, which
would otherwise get all the same color.

• Animometer/tests/master/resources/particles.js:

(initialize): Remove the code specific to the SVG mask test.

• Animometer/tests/master/resources/image-data.js:

(initialize): Remove unused local variable.

• Animometer/tests/master/resources/multiply.js:

(initialize): Make the test harder by adding more total particles.

5:38 PM Changeset in webkit [197909] by Matt Baker

• 14 edits
  1 move in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: use DataGridNode for TimelineView selection path components
​https://bugs.webkit.org/show_bug.cgi?id=154954
<rdar://problem/24947939>

Reviewed by Timothy Hatcher.

This patch adds a new path component, TimelineDataGridNodePathComponent,
for creating a path component from the current grid selection. This is
needed since TimelineViews will no longer have an associated content tree
outline once the navigation sidebar is removed.

TimelineDataGridNode has new protected methods, "displayName" and
"iconClassNames", which are used to populate hierarchical path components,
create grid node data, and create cell content.

TimelineView subclasses share a certain amount of boilerplate code for
getting selection path components and handling path component selection.
In the future we may be able to reduce this code by introducing a new
DataGridTimelineView base class.

• UserInterface/Main.html:

Added/removed files.

• UserInterface/Views/LayoutTimelineDataGridNode.js:

(WebInspector.LayoutTimelineDataGridNode.prototype.get data):
(WebInspector.LayoutTimelineDataGridNode.prototype.createCellContent):
(WebInspector.LayoutTimelineDataGridNode):
(WebInspector.LayoutTimelineDataGridNode.prototype.get record): Deleted.
Moved to base class.

• UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView.prototype.get selectionPathComponents):
(WebInspector.LayoutTimelineView.prototype.dataGridNodePathComponentSelected):
(WebInspector.LayoutTimelineView.prototype.treeElementPathComponentSelected): Deleted.
TimelineView tree outlines are going away.

• UserInterface/Views/MemoryTimelineView.js:

(WebInspector.MemoryTimelineView.prototype.treeElementPathComponentSelected): Deleted.
TimelineView tree outlines are going away.

• UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView.prototype.get selectionPathComponents):
(WebInspector.NetworkTimelineView.prototype.dataGridNodePathComponentSelected):
(WebInspector.NetworkTimelineView.prototype.treeElementPathComponentSelected): Deleted.
TimelineView tree outlines are going away.

• UserInterface/Views/ProfileNodeDataGridNode.js:

(WebInspector.ProfileNodeDataGridNode.prototype.get data):
(WebInspector.ProfileNodeDataGridNode.prototype.createCellContent):
(WebInspector.ProfileNodeDataGridNode.prototype.displayName):
(WebInspector.ProfileNodeDataGridNode.prototype.iconClassNames):
(WebInspector.ProfileNodeDataGridNode):
(WebInspector.ProfileNodeDataGridNode.prototype._iconClassNameForProfileNode): Deleted.
(WebInspector.ProfileNodeDataGridNode.prototype._titleForProfileNode): Deleted.
Re-implemented as overrides of the base class methods "iconClassNames"
and "displayName".

• UserInterface/Views/RenderingFrameTimelineDataGridNode.js:

(WebInspector.RenderingFrameTimelineDataGridNode.prototype.createCellContent):
(WebInspector.RenderingFrameTimelineDataGridNode):
(WebInspector.RenderingFrameTimelineDataGridNode.prototype.get record): Deleted.
Moved to base class.

• UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode.prototype.createCellContent):
(WebInspector.ResourceTimelineDataGridNode.prototype.displayName):
(WebInspector.ResourceTimelineDataGridNode.prototype.iconClassNames):
Override base class methods, making it possible to remove ResourceTimelineDataGridNodePathComponent,
and treat all TimelineDataGridNodes in a uniform manner.

(WebInspector.ResourceTimelineDataGridNode.prototype._createNameCellDocumentFragment):
Replace duplicated code with call to "displayName".

• UserInterface/Views/ResourceTimelineDataGridNodePathComponent.js: Removed.

Replaced by more generic solution, TimelineDataGridNodePathComponent.

• UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView.prototype.get selectionPathComponents):
(WebInspector.ScriptDetailsTimelineView.prototype.dataGridNodePathComponentSelected):
(WebInspector.ScriptDetailsTimelineView.prototype.treeElementPathComponentSelected): Deleted.
TimelineView tree outlines are going away.

• UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.createCellContent):
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
Replace duplicated code with call to "displayName".

(WebInspector.ScriptTimelineDataGridNode):
(WebInspector.ScriptTimelineDataGridNode.prototype.get record): Deleted.
Moved to base class.

• UserInterface/Views/SourceCodeTimelineTimelineDataGridNode.js:

(WebInspector.SourceCodeTimelineTimelineDataGridNode.prototype.createCellContent):
(WebInspector.SourceCodeTimelineTimelineDataGridNode.prototype._createNameCellContent):
Replace duplicated code with call to "displayName".

• UserInterface/Views/TimelineDataGridNode.js:

(WebInspector.TimelineDataGridNode.prototype.get record):
Implemented in terms of the "records" getter, since all subclasses simply returned the
node's first (or only) record.

(WebInspector.TimelineDataGridNode.prototype.displayName):
(WebInspector.TimelineDataGridNode.prototype.iconClassNames):
Base class implementations, using utility methods in TimelineTabContentView
to get display data based on the node's timeline record. Can be overridden
by nodes that either don't have a timeline record (ProfileNodeDataGridNode)

• UserInterface/Views/TimelineDataGridNodePathComponent.js:

(WebInspector.TimelineDataGridNodePathComponent):
(WebInspector.TimelineDataGridNodePathComponent.prototype.get timelineDataGridNode):
(WebInspector.TimelineDataGridNodePathComponent.prototype.get previousSibling):
(WebInspector.TimelineDataGridNodePathComponent.prototype.get nextSibling):

• UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView):
(WebInspector.TimelineView.prototype.get selectionPathComponents):
Must be implemented by subclasses since not all TimelineViews use a DataGrid.

5:37 PM Changeset in webkit [197908] by jonlee@apple.com

• 4 edits
  3 adds
  1 delete in trunk/PerformanceTests

Add text tests
​https://bugs.webkit.org/show_bug.cgi?id=155257

Reviewed by Simon Fraser.

• Animometer/resources/extensions.js:

(UnitBezier.Utilities.createClass): Add a class that computes Bezier points
assuming that two of the control points are at (0,0) and (1,1). Taken from
WebCore/platform/graphics/UnitBezier.h

• Animometer/resources/runner/tests.js: Add a test for English text and one

for international text.

• Animometer/tests/master/international.html: Added.
• Animometer/tests/master/resources/text.js: Added. The test assumes there is

#template div which it will copy. The copies are placed behind the template, and
are set with different colors each frame. They are moved around with CSS transform.

• Animometer/tests/master/text.html: Added.

Remove the other text tests, since these ones cover the same techniques.

• Animometer/tests/text/layering-text.html: Removed.
• Animometer/tests/text/resources/layering-text.js: Removed.
• Animometer/tests/text/resources/text-boxes.js: Removed.
• Animometer/tests/text/text-boxes.html: Removed.
• Animometer/resources/debug-runner/tests.js:

5:35 PM Changeset in webkit [197907] by jonlee@apple.com

• 5 edits
  15 adds in trunk/PerformanceTests

Add a new image test
​https://bugs.webkit.org/show_bug.cgi?id=155232

Reviewed by Dean Jackson.
Provisionally reviewed by Said Abou-Hallawa.

The image test renders PNGs and moves them with translate and rotate
transforms. Each particle has a lifetime, and when the lifetime ends or
the particle goes offscreen, it resets itself somewhere on the stage.

• Animometer/resources/debug-runner/tests.js: Remove the CSS bouncing PNG

images test, because this one tests the same technique.

• Animometer/resources/runner/tests.js: Added here as "Leaves".
• Animometer/tests/master/leaves.html: Added.
• Animometer/tests/master/resources/particles.js: Refactor out the parts

specific to the DOM particles test. Consequently make velocity a public
member.
(initialize): The options parameter is never used, so remove it.
(animate): Remove unused local variable.

• Animometer/tests/master/resources/leaves.js: Maintains a focal point that

moves back and forth across the canvas. That point affects the velocity
of the particles. When the focal point is on the leftmost side, it is
between [-6, -2], and set in reset(). When the focal point is on the rightmost
side, it will be from [2, 6].

• Animometer/tests/master/resources/dom-particles.js: Move JS specific to

this test here from particles.js.

New images.

• Animometer/tests/master/resources/compass100.png: Added.
• Animometer/tests/master/resources/console100.png: Added.
• Animometer/tests/master/resources/contribute100.png: Added.
• Animometer/tests/master/resources/debugger100.png: Added.
• Animometer/tests/master/resources/inspector100.png: Added.
• Animometer/tests/master/resources/layout100.png: Added.
• Animometer/tests/master/resources/performance100.png: Added.
• Animometer/tests/master/resources/script100.png: Added.
• Animometer/tests/master/resources/shortcuts100.png: Added.
• Animometer/tests/master/resources/standards100.png: Added.
• Animometer/tests/master/resources/storage100.png: Added.
• Animometer/tests/master/resources/styles100.png: Added.
• Animometer/tests/master/resources/timeline100.png: Added.

5:10 PM Changeset in webkit [197906] by Matt Baker

• 3 edits in trunk/Source/WebInspectorUI

Web Inspector: Nodes in Computed Styles > Container Regions formatted incorrectly.
​https://bugs.webkit.org/show_bug.cgi?id=155277
<rdar://problem/25072711>

Reviewed by Timothy Hatcher.

• UserInterface/Views/DOMTreeDataGrid.js:

(WebInspector.DOMTreeDataGrid):
Enable icon column property.

• UserInterface/Views/DOMTreeDataGridNode.js:

(WebInspector.DOMTreeDataGridNode):
Removed calls to unused methods.

(WebInspector.DOMTreeDataGridNode.prototype.createCellContent):
(WebInspector.DOMTreeDataGridNode.prototype._createNameCellDocumentFragment):
Simplified cell content creation.

(WebInspector.DOMTreeDataGridNode.prototype._updateNodeName): Deleted.
(WebInspector.DOMTreeDataGridNode.prototype._makeNameCell): Deleted.
Renamed _createNameCellDocumentFragment to be consistent with similar
methods in other data grid node classes.

(WebInspector.DOMTreeDataGridNode.prototype._updateNameCellData): Deleted.
No longer needed.

5:09 PM Changeset in webkit [197905] by dbates@webkit.org

• 3 edits
  2 adds in trunk/Source/WebCore

[Win] Implement CryptoDigest
​https://bugs.webkit.org/show_bug.cgi?id=155247
<rdar://problem/25065843>

Reviewed by Brent Fulgham.

Implement the CryptoDigest abstraction for Windows so that we can compute cryptographically
secure hashes. This will allow us to support Content Security Policy inline script and inline
stylesheet hashes on Windows.

• PlatformWin.cmake: Add file CryptoDigestWin.cpp.
• PlatformWinCairo.cmake: Ditto.
• platform/crypto/win/CryptoDigestWin.cpp: Added.

(WebCore::CryptoDigest::CryptoDigest): Instantiate a CryptoDigestContext object.
(WebCore::CryptoDigest::~CryptoDigest): Destroy the cryptographic service provider and hash
object if non-null.
(WebCore::CryptoDigest::create): Acquire a handle to a cryptographic service provider (HCRYPTPROV)
and a handle to a hash object (HCRYPTHASH).
(WebCore::CryptoDigest::addBytes): Add the contents of the specified buffer to the hash object.
(WebCore::CryptoDigest::computeHash): Compute and return a Vector of bytes that represent the digest.

5:02 PM Changeset in webkit [197904] by rniwa@webkit.org

• 2 edits in trunk/Websites/perf.webkit.org

Build fix after r196870.

• public/include/report-processor.php:

5:00 PM Changeset in webkit [197903] by rniwa@webkit.org

• 3 edits in trunk/Websites/perf.webkit.org

Add Size metric to perf dashboard
​https://bugs.webkit.org/show_bug.cgi?id=155266

Reviewed by Chris Dumez.

Added the "Size" metric and use bytes as its unit.

• public/js/helper-classes.js:

(PerfTestRuns):

• public/v2/data.js:

(RunsData.unitFromMetricName):

4:56 PM Changeset in webkit [197902] by ddkilzer@apple.com

• 10 edits in trunk/Source

REGRESSION (r197149): Missing availability checks when soft-linking DataDetectors.framework
<​http://webkit.org/b/155258>

Reviewed by Andy Estes.

Source/WebCore:

• page/mac/ServicesOverlayController.mm:

(WebCore::ServicesOverlayController::Highlight::setDDHighlight):
(WebCore::ServicesOverlayController::Highlight::paintContents):
(WebCore::ServicesOverlayController::mouseIsOverHighlight):

• Add check that returns early if DataDetectors.framework is not available.

• platform/spi/mac/DataDetectorsSPI.h:
• Mark Objective-C classses as optional.

Source/WebKit/mac:

• WebView/WebImmediateActionController.mm:

(-[WebImmediateActionController _clearImmediateActionState]):
(-[WebImmediateActionController immediateActionRecognizerWillBeginAnimation:]):
(-[WebImmediateActionController _animationControllerForDataDetectedText]):
(-[WebImmediateActionController _animationControllerForDataDetectedLink]):

• Add check that returns early if DataDetectors.framework is not available.

Source/WebKit2:

• Platform/mac/MenuUtilities.mm:

(WebKit::menuItemForTelephoneNumber):
(WebKit::menuForTelephoneNumber):

• Add check that returns early if DataDetectors.framework is not available.

• Shared/mac/WebHitTestResultData.mm:

(WebKit::WebHitTestResultData::platformDecode):

• Add Debug assertion. The soft-linked code should never be called if there was no actionContext passed in.

• UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::dismissContentRelativeChildWindowsFromViewOnly):

• Protect calls to DDActionsManager with availability check.

• UIProcess/mac/WKImmediateActionController.mm:

(-[WKImmediateActionController _clearImmediateActionState]):
(-[WKImmediateActionController immediateActionRecognizerWillBeginAnimation:]):

• Protect calls to DDActionsManager with availability check.

(-[WKImmediateActionController _animationControllerForDataDetectedText]):
(-[WKImmediateActionController _animationControllerForDataDetectedLink]):

• Add check that returns early if DataDetectors.framework is not available.

4:45 PM Changeset in webkit [197901] by commit-queue@webkit.org

• 7 edits in trunk/Source

Add state dumping facility
​https://bugs.webkit.org/show_bug.cgi?id=154930
<rdar://problem/24939135>

Patch by Keith Rollin <Keith Rollin> on 2016-03-09
Reviewed by Anders Carlsson.

Source/WebKit2:

Collect the times at which pages are loaded. Dump them when an OS
state dump is triggered.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::didCommitLoad):

• WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::lastPageLoadTime):

• WebProcess/WebProcess.h:
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::registerWithStateDumper):
(WebKit::WebProcess::platformInitializeProcess):

Source/WTF:

Add an OS_STATE flag to control the inclusion of process state dumping
functionality.

• wtf/Platform.h:

4:40 PM Changeset in webkit [197900] by jmarcell@apple.com

• 2 edits in trunk/Tools

Removing reference to Dashboard.Repository.Internal.trac from open source unit tests.
​https://bugs.webkit.org/show_bug.cgi?id=155274

Reviewed by Alexey Proskuryakov.

• BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/tests.js:

(setup): Deleted. In bug 154180 we removed Dashboard.Repository.Internal which was causing an
error in the unit tests.

4:36 PM Changeset in webkit [197899] by sbarati@apple.com

• 6 edits
  1 add in trunk/Source/JavaScriptCore

Array.isArray support for Proxy
​https://bugs.webkit.org/show_bug.cgi?id=155179

Reviewed by Mark Lam.

This patch implements Array.isArray to be compliant
with the ES6 spec. Specifically, it needs to interface
properly with Proxy arguments.
​https://tc39.github.io/ecma262/#sec-isarray

• runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::getCallData):
(JSC::arrayConstructorIsArray):
(JSC::arrayConstructorPrivateFuncIsArrayConstructor):

• runtime/ArrayPrototype.cpp:

(JSC::speciesConstructArray):

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::revoke):
(JSC::ProxyObject::isRevoked):
(JSC::ProxyObject::visitChildren):

• runtime/ProxyObject.h:

(JSC::ProxyObject::target):
(JSC::ProxyObject::handler):

• tests/es6.yaml:
• tests/stress/proxy-is-array.js: Added.

(assert):
(test):

4:22 PM Changeset in webkit [197898] by jer.noble@apple.com

• 7 edits
  14 adds in trunk

Add heuristic for "main content" videos which override user gesture requirements
​https://bugs.webkit.org/show_bug.cgi?id=155224

Reviewed by Eric Carlson.

Source/WebCore:

Tests: media/video-main-content-allow-then-deny.html

media/video-main-content-allow.html
media/video-main-content-deny-display-none.html
media/video-main-content-deny-not-in-dom.html
media/video-main-content-deny-not-visible.html
media/video-main-content-deny-obscured.html
media/video-main-content-deny-too-small.html

Add a new behavior "restriction" to MediaElementSession that allows media elements
to optionally overriding their own user gesture requirements if the session determines
that the media element is the page's "main content".

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::didAttachRenderers):
(WebCore::HTMLMediaElement::updateShouldPlay):

• html/HTMLMediaElement.h:
• html/MediaElementSession.cpp:

(WebCore::restrictionName):
(WebCore::MediaElementSession::MediaElementSession):
(WebCore::MediaElementSession::addBehaviorRestriction):
(WebCore::MediaElementSession::playbackPermitted):
(WebCore::MediaElementSession::dataLoadingPermitted):
(WebCore::isMainContent):
(WebCore::MediaElementSession::mainContentCheckTimerFired):
(WebCore::MediaElementSession::updateIsMainContent):

• html/MediaElementSession.h:
• testing/Internals.cpp:

(WebCore::Internals::setMediaElementRestrictions):

LayoutTests:

• media/video-main-content-allow-expected.txt: Added.
• media/video-main-content-allow-then-deny-expected.txt: Added.
• media/video-main-content-allow-then-deny.html: Added.
• media/video-main-content-allow.html: Added.
• media/video-main-content-deny-display-none-expected.txt: Added.
• media/video-main-content-deny-display-none.html: Added.
• media/video-main-content-deny-not-in-dom-expected.txt: Added.
• media/video-main-content-deny-not-in-dom.html: Added.
• media/video-main-content-deny-not-visible-expected.txt: Added.
• media/video-main-content-deny-not-visible.html: Added.
• media/video-main-content-deny-obscured-expected.txt: Added.
• media/video-main-content-deny-obscured.html: Added.
• media/video-main-content-deny-too-small-expected.txt: Added.
• media/video-main-content-deny-too-small.html: Added.

4:14 PM Changeset in webkit [197897] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

Added missing #if(SOUP) after r197591.
​https://bugs.webkit.org/show_bug.cgi?id=155259

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-03-09
Reviewed by Alex Christensen.

No new tests needed.

• platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

4:03 PM Changeset in webkit [197896] by andersca@apple.com

• 2 edits in trunk/Source/WebKit2

_WKWebsiteDataSize.h should be an SPI header.

Rubber-stamped by Tim Horton.

• WebKit2.xcodeproj/project.pbxproj:

3:57 PM Changeset in webkit [197895] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

[JSC] Fix the ARM64 MacroAssembler after r197816
​https://bugs.webkit.org/show_bug.cgi?id=155268

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-09
Reviewed by Mark Lam.

The patch tries to generate instructions that do not exist,
causing quite fun stuff at runtime.

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::load8):
(JSC::MacroAssemblerARM64::store16):
(JSC::MacroAssemblerARM64::store8):

3:47 PM Changeset in webkit [197894] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skipping js/regress/getter-richards-try-catch.html on ios-simulator debug
​https://bugs.webkit.org/show_bug.cgi?id=155271

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

3:36 PM Changeset in webkit [197893] by adachan@apple.com

• 3 edits in trunk/Source/WebCore

Add a getter for WebVideoFullscreenInterfaceObjC and update its rate property
​https://bugs.webkit.org/show_bug.cgi?id=155239

Reviewed by Eric Carlson.

• platform/mac/WebVideoFullscreenInterfaceMac.h:

Move the stub implementation of setVideoDimensions() to the mm file.
Declare a getter to WebVideoFullscreenInterfaceMacObjC.

• platform/mac/WebVideoFullscreenInterfaceMac.mm:

(WebCore::WebVideoFullscreenInterfaceMac::setRate):
Also update the rate property of WebVideoFullscreenInterfaceMacObjC.
(WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions):
Stub implementation of setVideoDimensions() has been moved to here.

3:33 PM Changeset in webkit [197892] by achristensen@apple.com

• 2 edits in trunk/Source/WebCore

Fix Mac build without video enabled after r197633.

• bindings/objc/DOM.mm:

3:07 PM Changeset in webkit [197891] by aakash_jain@apple.com

• 2 edits in trunk/Tools

use ulimit command to check process limit in webkitpy
​https://bugs.webkit.org/show_bug.cgi?id=155260

Reviewed by Alexey Proskuryakov.

• Scripts/webkitpy/port/ios.py:

(IOSSimulatorPort.default_child_processes): Use ulimit command output instead of
launchctl limit maxproc command.

3:02 PM Changeset in webkit [197890] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skip two flaky tests on mac-wk1
​https://bugs.webkit.org/show_bug.cgi?id=155196

Unreviewed test gardening.

media/video-with-blob-url-allowed-by-csp-media-src-star.html and media/video-with-data-url-allowed-by-csp-media-src-star.html
are flaky on mac-wk1. Skipping to get bots to green during investigation.

• platform/mac-wk1/TestExpectations:

3:00 PM Changeset in webkit [197889] by Brent Fulgham

• 2 edits in trunk/Source/WebKit2

Handling 'allowUniversalAccessFromFileURLs' on WKWebViewConfiguration causes test breakage
​https://bugs.webkit.org/show_bug.cgi?id=155265

Unreviewed work-around to allow testing to continue.

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]): Workaround build break.

2:34 PM Changeset in webkit [197888] by commit-queue@webkit.org

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r197873.
​https://bugs.webkit.org/show_bug.cgi?id=155262

"Crashes some JSC tests" (Requested by mlam on #webkit).

Reverted changeset:

"Add dumping of function expression names in CodeBlock
bytecode dump."
​https://bugs.webkit.org/show_bug.cgi?id=155248
​http://trac.webkit.org/changeset/197873

2:29 PM Changeset in webkit [197887] by rniwa@webkit.org

• 16 edits
  1 copy
  2 moves
  1 add in trunk

Rename Node.treeRoot to rootNode and turn it on by default
​https://bugs.webkit.org/show_bug.cgi?id=155226

Reviewed by Antonio Gomes.
Source/WebCore:

Node.prototype.treeRoot has been merged into DOM spec from Shadow DOM spec and renamed to rootNode:
​https://dom.spec.whatwg.org/#dom-node-rootnode

Rename the method and expose it unconditionally on Node.prototype.

Tests: fast/dom/Node/rootNode.html

fast/shadow-dom/Node-interface-rootNode.html

• dom/ContainerNode.h:

(WebCore::Node::highestAncestor): Deleted. There is no need for this function to be inlined.

• dom/Document.h: Now that both TreeScope and Node defines rootNode, we need to pick either.

Here, we pick TreeScope's definition since Document is by definition always in a document so there is
no need to even check inTreeScope().

• dom/Node.cpp:

(WebCore::Node::rootNode): Moved here. Also added a fast path for when "this" node is in a document
or a shadow root since TreeScope stores its root node as a member variable (m_rootNode).

• dom/Node.h:
• dom/Node.idl: Renamed the method and removed Conditional=SHADOW_DOM.
• dom/ShadowRoot.h: Similar to the change in Document.h. See above.
• editing/Editor.cpp:

(WebCore::correctSpellcheckingPreservingTextCheckingParagraph): Use rootNode instead of free function
defined in htmlediting.cpp, which was removed in this patch.

• editing/htmlediting.cpp:

(WebCore::highestAncestor): Deleted.

• editing/htmlediting.h:
• html/FormAssociatedElement.cpp:

(WebCore::computeRootNode): Added.
(WebCore::FormAssociatedElement::removedFrom): We can't use Node::rootNode here because this function
is called in the middle of removing a subtree, and some associated form element's inDocument flag may
not have been updated yet. So use computeRootNode to manually find the highest ancestor.
(WebCore::FormAssociatedElement::formRemovedFromTree): Ditto.

• xml/XPathPath.cpp:

(WebCore::XPath::LocationPath::evaluate):

LayoutTests:

Split Node-interface-treeRoot.html into two pieces, the one that doesn't invoke shadow DOM and the other that tests
shadow DOM related cases. I intend to upstream these tests to W3C at some point so keep them in testharness.js form.

• fast/dom/Node/rootNode-expected.txt: Added.
• fast/dom/Node/rootNode.html: Copied from LayoutTests/fast/shadow-dom/Node-interface-treeRoot.html.
• fast/shadow-dom/Node-interface-rootNode-expected.txt: Renamed from Node-interface-treeRoot-expected.txt.
• fast/shadow-dom/Node-interface-rootNode.html: Renamed from LayoutTests/fast/shadow-dom/Node-interface-treeRoot.html.
• js/dom/dom-static-property-for-in-iteration-expected.txt:
• platform/efl/js/dom/dom-static-property-for-in-iteration-expected.txt:
• platform/gtk/js/dom/dom-static-property-for-in-iteration-expected.txt:

1:50 PM Changeset in webkit [197886] by commit-queue@webkit.org

• 4 edits in trunk

[cmake] Fixed All-in-One build.
​https://bugs.webkit.org/show_bug.cgi?id=155241

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-03-09
Reviewed by Csaba Osztrogonác.

.:

• Source/cmake/WebKitMacros.cmake: Last item of WebCore_SOURCES was

not removed in PROCESS_ALLINONE_FILE.

Source/WebCore:

No new tests needed.

• bindings/js/JSBindingsAllInOne.cpp: Should not include generated

file.

1:49 PM Changeset in webkit [197885] by achristensen@apple.com

• 2 edits in trunk/Source/WebKit2

Fix use-after-free when cancelling synchronous XHR when using NetworkSession
​https://bugs.webkit.org/show_bug.cgi?id=155253

Reviewed by Brady Eidson.

• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::continueWillSendRequest):
Store the completion handler on the stack before calling didFail, which deletes the
NetworkLoad, so we don't access m_redirectCompletionHandler after deleting the NetworkLoad.

1:48 PM Changeset in webkit [197884] by Chris Dumez

• 3 edits in trunk/Source/WebCore

Unreviewed, rebaseline bindings tests after r197874.

• bindings/scripts/test/JS/JSattribute.cpp:

(WebCore::JSattribute::getOwnPropertySlot):

• bindings/scripts/test/JS/JSattribute.h:

1:44 PM Changeset in webkit [197883] by ap@apple.com

• 5 edits in trunk/Tools

Stop building armv7 on iOS device builders
​https://bugs.webkit.org/show_bug.cgi?id=155246

Reviewed by David Kilzer.

• BuildSlaveSupport/build.webkit.org-config/config.json: Building both armv7 and

armv7s makes the bots unnecessarily slow. We can catch super rare v7-only regressions
elsewhere.

• Scripts/webkitpy/common/config/ews.json: Changed EWS to match, as we always want

EWS configuration to be verified by buildbot queues.

• Scripts/webkitdirs.pm:
• Scripts/webkitpy/port/ios.py:

Changed default to arm64. I think that the default is probably not used in any
practical scenarios, but it's nice to make it more sensible.

1:31 PM Changeset in webkit [197882] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebKit2

Unreviewed, rolling out r197698.
​https://bugs.webkit.org/show_bug.cgi?id=155252

Caused assertions, and wasn't reviewed by a WK2 owner
(Requested by andersca on #webkit).

Reverted changeset:

"Last opened tab does not receive
SetHiddenPageTimerThrottlingIncreaseLimit message"
​https://bugs.webkit.org/show_bug.cgi?id=155126
​http://trac.webkit.org/changeset/197698

1:30 PM Changeset in webkit [197881] by Conrad Shultz

• 2 edits in trunk/Source/WebKit2

WebsiteDataStore::Configuration::legacyWebsiteDataStoreConfiguration() should respect the passed-in configuration
​https://bugs.webkit.org/show_bug.cgi?id=155250

Reviewed by Anders Carlsson.

Note that the legacy directories are already set by default in ProcessPoolConfiguration::createWithLegacyOptions(),
which is also where the shouldHaveLegacyDataStore flag, which will cause this code path to be reached, is set.

• UIProcess/WebProcessPool.cpp:

(WebKit::legacyWebsiteDataStoreConfiguration):
Use the passed-in configuration to set the application cache, network cache, and media keys storage directories.

1:30 PM Changeset in webkit [197880] by Jon Davis

• 2 edits in trunk/Websites/webkit.org

For RSS feeds, convert image and link relative URIs to absolute URIs
​https://bugs.webkit.org/show_bug.cgi?id=155237

Reviewed by Timothy Hatcher.

• wp-content/themes/webkit/functions.php:

1:22 PM Changeset in webkit [197879] by Chris Dumez

• 8 edits in trunk/Source/WebKit2

Speculative disk cache resource revalidations are sometimes wasted
​https://bugs.webkit.org/show_bug.cgi?id=155187
<rdar://problem/25032905>

Reviewed by Antti Koivisto.

Speculative disk cache resource revalidations were sometimes wasted.

We would sometimes correctly revalidate a resource but the
NetworkResourceLoader then either:

1. Fail to reuse the speculatively validated entry
2. Reuse the speculatively validated entry but then validate it again

Bug 1 was caused by the revalidated entry key sometimes being
different from the cached entry key. This could happen when
revalidation fails (the server did not send back a 304) in
which case we call NetworkCache::store() which creates a new
cache Entry, generating a cache key from our revalidation
request. If the original request has a cache partition or a
range, then the keys would not match because we did not set
the cache partition or the range on the revalidation request.
This has been addressed by setting the cache partition on the
revalidation request in constructRevalidationRequest() and by
not doing revalidation if the original request had a 'range'
header.

Bug 2 was caused by us marking a speculatively revalidated entry
as "not needing revalidating" only in Cache::update(). Cache::update()
is only called in the case the revalidation was successful (server
returned a 304). If revalidation was not successful, Cache::store()
would be called instead was we would fail to update the
needsRevalidation flag. NetworkResourceLoader would then validate
again the resource that was already speculatively revalidated.
To address the problem, we now update the 'needsRevalidation' flag
as soon as the speculative revalidation completes, in
SpeculativeLoad::didComplete().

• NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::retrieve):
(WebKit::NetworkCache::makeCacheKey):
(WebKit::NetworkCache::Cache::update):

• NetworkProcess/cache/NetworkCacheEntry.cpp:

(WebKit::NetworkCache::Entry::setNeedsValidation):

• NetworkProcess/cache/NetworkCacheEntry.h:
• NetworkProcess/cache/NetworkCacheKey.cpp:

(WebKit::NetworkCache::noPartitionString):
(WebKit::NetworkCache::Key::Key):
(WebKit::NetworkCache::Key::hasPartition):

• NetworkProcess/cache/NetworkCacheKey.h:
• NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::didComplete):

• NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp:

(WebKit::NetworkCache::constructRevalidationRequest):
(WebKit::NetworkCache::SpeculativeLoadManager::retrieveEntryFromStorage):
(WebKit::NetworkCache::SpeculativeLoadManager::revalidateEntry):

1:15 PM Changeset in webkit [197878] by oliver@apple.com

• 4 edits in trunk/Source

Fix old iOS

1:13 PM Changeset in webkit [197877] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Remove unnecessary constructor
​https://bugs.webkit.org/show_bug.cgi?id=155249

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-09
Reviewed by Timothy Hatcher.

• UserInterface/Views/ScriptTimelineDataGrid.js:

(WebInspector.ScriptTimelineDataGrid):

1:09 PM Changeset in webkit [197876] by oliver@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Wincairo buildfix
​https://bugs.webkit.org/show_bug.cgi?id=155245

Reviewed by Mark Lam.

Fix up exports for a few symbols

• jit/ExecutableAllocator.h:
• jit/ExecutableAllocatorFixedVMPool.cpp:

12:55 PM Changeset in webkit [197875] by Chris Dumez

• 7 edits in trunk

focus() / blur() should be on HTMLElement / SVGElement, not Element
​https://bugs.webkit.org/show_bug.cgi?id=155216

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

focus() / blur() should be on HTMLElement / SVGElement, not Element:

• ​https://html.spec.whatwg.org/multipage/dom.html#htmlelement
• ​https://www.w3.org/TR/SVG2/types.html#InterfaceSVGElement

Chrome and Firefox match the specification.

Note that after this change, focus() / blur() is no longer exposed
on MathMLElement. This matches the MathML specification and is
consistent with Firefox and Chrome.

• dom/Element.idl:
• html/HTMLElement.idl:
• svg/SVGElement.idl:

12:37 PM Changeset in webkit [197874] by Chris Dumez

• 5 edits in trunk

Move attributes to the instance for most interfaces that have "Error" in their name
​https://bugs.webkit.org/show_bug.cgi?id=155231

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Our bindings generator was keeping attributes on the instances for
interfaces having "Error" or "Exception" in their name. The reason is
that interfaces that have "Error" in their prototype would not behave
correctly otherwise because "Error" incorrectly has its attributes on
the instance at the moment. However, in our bindings generator, the
condition to decide if an interface's prototype should be "Error" is
if $interface->isException. Therefore, we should use the same condition
to decide if we should keep attributes on the instance until "Error"
is updated to have its attributes on the prototype. Doing this for any
interface having "Error" or "Exception" in their name is overkill.

No new tests, already covered by existing test.

• bindings/scripts/CodeGeneratorJS.pm:

(InterfaceRequiresAttributesOnInstance):

12:36 PM Changeset in webkit [197873] by mark.lam@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Add dumping of function expression names in CodeBlock bytecode dump.
​https://bugs.webkit.org/show_bug.cgi?id=155248

Reviewed by Filip Pizlo.

Because ...
[ 19] new_func_exp loc5, loc3, f0:foo

... is more informative than
[ 19] new_func_exp loc5, loc3, f0

Anonymous functions will be dumped as <anon>.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpFunctionExpr):
(JSC::CodeBlock::dumpBytecode):

• bytecode/CodeBlock.h:

12:36 PM Changeset in webkit [197872] by ap@apple.com

• 2 edits in trunk/Tools

Add iOS Simulator EWS to bot watcher's dashboard
​https://bugs.webkit.org/show_bug.cgi?id=155220

Reviewed by Lucas Forschler.

• BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BubbleQueueServer.js:

12:25 PM Changeset in webkit [197871] by dbates@webkit.org

• 3 edits
  1 copy
  1 add
  1 delete in trunk/Source/WebCore

Rename WebCore/platform/crypto/mac/CryptoDigestMac.cpp to WebCore/platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp
​https://bugs.webkit.org/show_bug.cgi?id=155244

Reviewed by Alexey Proskuryakov.

The file WebCore/platform/crypto/mac/CryptoDigestMac.cpp is applicable to both iOS and OS X.
We should move and rename this file to reflect that is applicable to both of these platforms.

• PlatformMac.cmake:
• WebCore.xcodeproj/project.pbxproj:
• platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp: Renamed from Source/WebCore/platform/crypto/mac/CryptoDigestMac.cpp.

12:22 PM Changeset in webkit [197870] by Brent Fulgham

• 8 edits in trunk

Local HTML should be blocked from localStorage access unless "Disable Local File Restrictions" is checked
​https://bugs.webkit.org/show_bug.cgi?id=155185
Source/WebKit2:

Reviewed by Anders Carlsson.
<rdar://problem/11101440>

Tested by TestWebKitAPI tests IndexedDB.IndexedDBMultiProcess and IndexedDB.IndexedDBPersistence.

Allow Cocoa WKWebViewConfiguration access to the 'allowUniversalAccessFromFileURLs' setting.

• UIProcess/API/Cocoa/WKWebView.mm:

(- [WKWebView _initializeWithConfiguration]): Set 'allowUniversalAccessFromFileURLsKey' in
page configuration.

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration _allowUniversalAccessFromFileURLs]): Added,
(-[WKWebViewConfiguration _setAllowUniversalAccessFromFileURLs:]): Added.

• UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:

Tools:

<rdar://problem/11101440>

Reviewed by Anders Carlsson.

• TestWebKitAPI/Tests/WebKit2/CloseFromWithinCreatePage.cpp:

(TestWebKitAPI::TEST): Allow local file accesss to run test.

• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm:

(TEST): Ditto.

• TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence.mm:

(TEST): Ditto.

12:11 PM Changeset in webkit [197869] by msaboff@apple.com

• 23 edits
  3 adds in trunk

[ES6] Implement RegExp sticky flag and related functionality
​https://bugs.webkit.org/show_bug.cgi?id=155177

Reviewed by Saam Barati.

Source/JavaScriptCore:

Implemented the ES6 RegExp sticky functionality.

There are two main behavior changes when the sticky flag is specified.
1) Matching starts at lastIndex and lastIndex is updated after the match.
2) The regular expression is only matched from the start position in the string.
See ES6 section 21.2.5.2.2 for details.

Changed both the Yarr interpreter and jit to not loop to the next character for sticky RegExp's.
Updated RegExp exec and match, and stringProtoFuncMatch to handle lastIndex changes.

Restructured the way flags are passed to and through YarrPatterns to use RegExpFlags instead of
individual bools.

Updated tests for 'y' flag and new behavior.

• bytecode/CodeBlock.cpp:

(JSC::regexpToSourceString):

• inspector/ContentSearchUtilities.cpp:

(Inspector::ContentSearchUtilities::findMagicComment):

• runtime/CommonIdentifiers.h:
• runtime/RegExp.cpp:

(JSC::regExpFlags):
(JSC::RegExpFunctionalTestCollector::outputOneTest):
(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

• runtime/RegExp.h:
• runtime/RegExpKey.h:
• runtime/RegExpObjectInlines.h:

(JSC::RegExpObject::execInline):
(JSC::RegExpObject::matchInline):

• runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncCompile):
(JSC::flagsString):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterSticky):
(JSC::regExpProtoGetterUnicode):

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncMatch):

• tests/es6.yaml:
• tests/stress/static-getter-in-names.js:

(shouldBe):

• yarr/RegularExpression.cpp:

(JSC::Yarr::RegularExpression::Private::compile):

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::tryConsumeBackReference):
(JSC::Yarr::Interpreter::matchAssertionBOL):
(JSC::Yarr::Interpreter::matchAssertionEOL):
(JSC::Yarr::Interpreter::matchAssertionWordBoundary):
(JSC::Yarr::Interpreter::matchDotStarEnclosure):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::Interpreter::Interpreter):
(JSC::Yarr::ByteCompiler::atomPatternCharacter):

• yarr/YarrInterpreter.h:

(JSC::Yarr::BytecodePattern::BytecodePattern):
(JSC::Yarr::BytecodePattern::estimatedSizeInBytes):
(JSC::Yarr::BytecodePattern::ignoreCase):
(JSC::Yarr::BytecodePattern::multiline):
(JSC::Yarr::BytecodePattern::sticky):
(JSC::Yarr::BytecodePattern::unicode):

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::matchCharacterClass):
(JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
(JSC::Yarr::YarrGenerator::generateAssertionBOL):
(JSC::Yarr::YarrGenerator::generateAssertionEOL):
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
(JSC::Yarr::YarrGenerator::backtrack):

• yarr/YarrPattern.cpp:

(JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
(JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
(JSC::Yarr::YarrPatternConstructor::optimizeBOL):
(JSC::Yarr::YarrPattern::compile):
(JSC::Yarr::YarrPattern::YarrPattern):

• yarr/YarrPattern.h:

(JSC::Yarr::YarrPattern::reset):
(JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
(JSC::Yarr::YarrPattern::ignoreCase):
(JSC::Yarr::YarrPattern::multiline):
(JSC::Yarr::YarrPattern::sticky):
(JSC::Yarr::YarrPattern::unicode):

LayoutTests:

New and updated tests.

• js/Object-getOwnPropertyNames-expected.txt:
• js/regexp-flags-expected.txt:
• js/regexp-sticky-expected.txt: Added.
• js/regexp-sticky.html: Added.
• js/script-tests/Object-getOwnPropertyNames.js:
• js/script-tests/regexp-flags.js:

(RegExp.prototype.hasOwnProperty): Deleted check for sticky property.

• js/script-tests/regexp-sticky.js: New test.

(asString):
(testStickyExec):
(testStickyMatch):

11:56 AM Changeset in webkit [197868] by timothy_horton@apple.com

• 5 edits in trunk

Removing and re-adding a script message handler with the same name results in an unusable message handler
​https://bugs.webkit.org/show_bug.cgi?id=155223

Reviewed by Sam Weinig.
Source/WebCore:

New API test: WKUserContentController.ScriptMessageHandlerReplaceWithSameName.

• page/UserMessageHandler.h:

(WebCore::UserMessageHandler::descriptor):

• page/UserMessageHandlersNamespace.cpp:

(WebCore::UserMessageHandlersNamespace::handler):
This lazy removal mechanism combined with the fact that we only compare
handler name and world makes it such that m_messageHandlers could have
a stale UserMessageHandler with a UserMessageHandlerDescriptor that differed
only in client.

It is safe to compare the descriptors by pointer instead because m_messageHandler
holds a strong reference to its UserMessageHandlerDescriptors, and this will ensure
that the add-remove-add path (with identical name and world) causes a new
UserContentController to be created.

We also now clean up any stale UserMessageHandlers whenever we're about to
add a new one, by removing any which the UserContentController no longer knows about.

Tools:

• TestWebKitAPI/Tests/WebKit2Cocoa/UserContentController.mm:

(TEST):
Add a test ensuring that it is possible to remove and re-add a script message handler
with the same name and still dispatch messages to it.

11:36 AM Changeset in webkit [197867] by mark.lam@apple.com

• 11 edits in trunk

FunctionExecutable::ecmaName() should not be based on inferredName().
​https://bugs.webkit.org/show_bug.cgi?id=155203

Reviewed by Michael Saboff.

Source/JavaScriptCore:

The ES6 rules for how a function name should be inferred closely matches JSC's
implementation with one exception:

var o = {}
o.foo = function() {}

JSC's inferredName for o.foo would be "foo".
ES6 specifies that o.foo.name is "".

The fix is to add a distinct FunctionExecutable::ecmaName() which applies the ES6
rules for inferring the initial value of Function.name.

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):

• bytecode/UnlinkedFunctionExecutable.h:
• parser/ASTBuilder.h:

(JSC::ASTBuilder::createAssignResolve):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createProperty):
(JSC::ASTBuilder::makeAssignNode):

• parser/Nodes.h:
• runtime/Executable.h:
• runtime/JSFunction.cpp:

(JSC::JSFunction::reifyName):

• tests/es6.yaml:

LayoutTests:

• js/script-tests/function-toString-vs-name.js:
• Fixed up object property test section and added new test cases.
• platform/mac/http/tests/media/media-source/mediasource-sourcebuffer-mode-expected.txt:

11:29 AM Changeset in webkit [197866] by enrica@apple.com

• 10 edits in trunk/Source/WebKit2

Add two finger tap on links.
​https://bugs.webkit.org/show_bug.cgi?id=155205
rdar://problem/22937516

Reviewed by Sam Weinig.

Adds two finger tap gesture recognizer. When performed
on a link, it calls the delegate.

• Platform/spi/ios/UIKitSPI.h:
• UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
• UIProcess/WebPageProxy.h:
• UIProcess/ios/WKContentViewInteraction.h:
• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView setupInteraction]):
(-[WKContentView cleanupInteraction]):
(-[WKContentView _removeDefaultGestureRecognizers]):
(-[WKContentView _addDefaultGestureRecognizers]):
(-[WKContentView _twoFingerSingleTapGestureRecognized:]):

• UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::handleTwoFingerTapAtPoint):

• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:
• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::handleTwoFingerTapAtPoint):

11:04 AM Changeset in webkit [197865] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebKit2

Always call NSURLSession completion handlers
​https://bugs.webkit.org/show_bug.cgi?id=155137

Patch by Alex Christensen <​achristensen@webkit.org> on 2016-03-09
Reviewed by Darin Adler.

There are some edge cases which should not be hit, but if they are they would cause the
network process to hang and network resources to be leaked. This can be avoided.
There are also a few release asserts that do not need to crash release builds.

• NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::didReceiveChallenge):
(WebKit::NetworkDataTask::didCompleteWithError):
(WebKit::NetworkDataTask::didReceiveResponse):
(WebKit::NetworkDataTask::didReceiveData):
(WebKit::NetworkDataTask::willPerformHTTPRedirection):
(WebKit::NetworkDataTask::scheduleFailure):
(WebKit::NetworkDataTask::tryPasswordBasedAuthentication):

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):

10:45 AM Changeset in webkit [197864] by Chris Dumez

• 8 edits
  2 adds in trunk

Align HTMLKeygenElement.keytype with the specification
​https://bugs.webkit.org/show_bug.cgi?id=155214

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

• web-platform-tests/html/dom/reflection-forms-expected.txt:

Source/WebCore:

Align HTMLKeygenElement.keytype with the specification:

• ​https://html.spec.whatwg.org/#dom-keygen-keytype
• ​https://html.spec.whatwg.org/#attr-keygen-keytype

In particular, the following changes were made:

1. Return "rsa" by default (i.e. when the corresponding content attribute is missing)
2. Only return known values

Test: fast/dom/HTMLKeygenElement/keygen-keytype.html

• html/HTMLKeygenElement.cpp:

(WebCore::HTMLKeygenElement::setKeytype):
(WebCore::HTMLKeygenElement::keytype):
(WebCore::HTMLKeygenElement::appendFormData):

• html/HTMLKeygenElement.h:
• html/HTMLKeygenElement.idl:

LayoutTests:

Add test coverage for HTMLKeygenElement.keytype.

• fast/dom/HTMLKeygenElement/keygen-keytype-expected.txt: Added.
• fast/dom/HTMLKeygenElement/keygen-keytype.html: Added.

10:26 AM Changeset in webkit [197863] by Philippe Normand

• 5 edits in trunk/Source/WebCore

[GStreamer] Fix MediaPlayerPrivate conflicts
​https://bugs.webkit.org/show_bug.cgi?id=155236

Reviewed by Martin Robinson.

In some cases the mediastream player would be used to play
non-mediastream videos or MSE streams. The OWR player should be
used only for mediastreams and the MediaPlayerPrivateGStreamer
player should be used only for normal <video> elements and
MediaSource support.

This patch intends to fix the massive tests timeouts currently
happening on the GTK bots after r197752.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::supportsType): Bail out if
the type checked represents a mediastream.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

Prevent signal disconnection on possible NULL GObjects.
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:

(WebCore::MediaPlayerPrivateGStreamerOwr::MediaPlayerPrivateGStreamerOwr):
Simplify constructor to the bare minimum.
(WebCore::MediaPlayerPrivateGStreamerOwr::load): Create sinks only
if needed from the load method.
(WebCore::MediaPlayerPrivateGStreamerOwr::getSupportedTypes):
Initialize the type cache to an empty static hashset.
(WebCore::MediaPlayerPrivateGStreamerOwr::supportsType): This
player does support mediastreams and nothing else.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:

10:10 AM Changeset in webkit [197862] by msaboff@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Harden JSC Root element functions from bad values
​https://bugs.webkit.org/show_bug.cgi?id=155234

Reviewed by Saam Barati.

Changed jsCast() to jsDynamicCast() in Root related function to protect against being
called with non-Root arguments.

• jsc.cpp:

(functionCreateElement):
(functionGetElement):
(functionSetElementRoot):

9:51 AM Changeset in webkit [197861] by benjamin@webkit.org

• 18 edits in trunk/Source/JavaScriptCore

[JSC] Pick how to OSR Enter to FTL at runtime instead of compile time
​https://bugs.webkit.org/show_bug.cgi?id=155217

Reviewed by Filip Pizlo.

This patch addresses 2 types of problems with tiering up to FTL
with OSR Entry in a loop:
-When there are nested loops, it is generally valuable to enter

an outer loop rather than an inner loop.

-When tiering up at a point that cannot OSR Enter, we are at

the mercy of the outer loop frequency to compile the right
entry point.

The first case is significant in the test "gaussian-blur".
That test has 4 nested loops. When we have an OSR Entry,
the analysis phases have to be pesimistic where we enter:
we do not really know what constraint can be proven from
the DFG code that was running.

In "gaussian-blur", integer-range analysis removes pretty
much all overflow checks in the inner loops of where we entered.
The more outside we enter, the better code we generate.

Since we spend the most iterations in the inner loop, we naturally
tend to OSR Enter into the 2 most inner loops, making the most
pessimistic assumptions.

To avoid such problems, I changed how we decide where to OSR Enter.
Previously, the last CheckTierUpAndOSREnter to cross the threshold
was where we take the entry point for FTL.

What happens now is that the entry point is not decied when
compiling the CheckTierUp variants. Instead, all the information
we need is gathered during compilation and keept on the JITCode
to be used at runtime.

When we try to tier up and decide to OSR Enter, we use the information
we have to pick a good outer loop for OSR Entry.

Now the problem is outer loop do not CheckTierUpAndOSREnter often,
wasting several miliseconds before entering the newly compiled FTL code.

To solve that, every CheckTierUpAndOSREnter has its own trigger that
bypass the counter. When the FTL Code is compiled, the trigger is set
and we enter through the right CheckTierUpAndOSREnter immediately.

---

This new mechanism also solves a problem of ai-astar.
When we try to tier up in ai-astar, we had nothing to compile until
the outer loop is reached.

To make sure we reached the CheckTierUpAndOSREnter in a reasonable time,
we had CheckTierUpWithNestedTriggerAndOSREnter with a special trigger.

With the new mechanism, we can do much better:
-When we keep hitting CheckTierUpInLoop, we now have all the information

we need to already start compiling the outer loop.
Instead of waiting for the outer loop to be reached a few times, we compile
it as soon as the inner loop is hammering CheckTierUpInLoop.

-With the new triggers, the very next time we hit the outer loop, we OSR Enter.

This allow us to compile what we need sooner and enter sooner.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize): Deleted.

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC): Deleted.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode): Deleted.

• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::JITCompiler):
(JSC::DFG::JITCompiler::compileEntryExecutionFlag):

• dfg/DFGNodeType.h:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPlan.h:

(JSC::DFG::Plan::canTierUpAndOSREnter):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate): Deleted.

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute): Deleted.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Deleted.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):
(JSC::DFG::TierUpCheckInjectionPhase::buildNaturalLoopToLoopHintMap):
(JSC::DFG::TierUpCheckInjectionPhase::findLoopsContainingLoopHintWithoutOSREnter): Deleted.

• dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:

(JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
(JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
(JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
(JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):

• dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:

9:44 AM Changeset in webkit [197860] by Ryan Haddad

• 3 edits in trunk/LayoutTests

Cleaning up TestExpectations files to remove deleted tests and duplicate entries for ios-simulator.

Unreviewed test gardening.

• TestExpectations:
• platform/ios-simulator/TestExpectations:

9:25 AM Changeset in webkit [197859] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skipping fast/events/max-tabindex-focus.html on ios-simulator
​https://bugs.webkit.org/show_bug.cgi?id=155233

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

9:06 AM Changeset in webkit [197858] by Brent Fulgham

• 3 edits
  3 adds in trunk

Local HTML should be blocked from localStorage access unless "Disable Local File Restrictions" is checked..
​https://bugs.webkit.org/show_bug.cgi?id=155185
<rdar://problem/11101440>

Reviewed by Zalan Bujtas.

Source/WebCore:

Tested by storage/domstorage/localstorage/blocked-file-access.html.

• page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canAccessStorage): If the origin is a local file, and we have not been granted
universal file access, prevent access to DOM localStorage.

LayoutTests:

• storage/domstorage/localstorage/blocked-file-access-expected.txt: Added.
• storage/domstorage/localstorage/blocked-file-access.html: Added.
• storage/domstorage/localstorage/resources/blocked-example.html: Added.

6:26 AM Changeset in webkit [197857] by Manuel Rego Casasnovas

• 4 edits
  4 adds in trunk

[css-grid] Allow to place positioned grid items on the padding
​https://bugs.webkit.org/show_bug.cgi?id=155199

Reviewed by Sergio Villar Senin.

Source/WebCore:

According to the following discussion on the CSS WG mailing list,
we should be able to place positioned grid items on the padding directly:
​https://lists.w3.org/Archives/Public/www-style/2015Nov/0070.html

This means that a positioned grid item can be placed on the padding itself.
The "auto" value resolves to the padding edges (0th and -0th lines).
So if a positioned item is placed with: grid-column: auto / 1;
it'd be placed on the padding, from line 0th to 1st line.

On top of that, we've to detect properly the first and last explicit
grid lines during the layout of positioned grid items.
We have to consider that the grid can have implicit tracks created
previously by regular grid items.

Tests: fast/css-grid-layout/grid-positioned-items-padding.html

fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

LayoutTests:

Add new tests and updated results in a current one.

• fast/css-grid-layout/grid-positioned-items-implicit-grid.html:
• fast/css-grid-layout/grid-positioned-items-padding-expected.txt: Added.
• fast/css-grid-layout/grid-positioned-items-padding.html: Added.
• fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track-expected.txt: Added.
• fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html: Added.

4:00 AM Changeset in webkit [197856] by akling@apple.com

• 3 edits
  2 adds in trunk

ImageDocuments leak their world.
<​https://webkit.org/b/155167>
<rdar://problem/24987363>

Reviewed by Antti Koivisto.

Source/WebCore:

ImageDocument uses a special code path in ImageLoader in order to manually
control how the image is loaded. It has to do this because the ImageDocument
is really just a synthetic wrapper around a main resource that's an image.

This custom loading code had a bug where it would create a new CachedImage
and neglect to set its CachedResource::m_state flag to Pending (which is
normally set by CachedResource::load(), but we don't call that for these.)

This meant that when ImageDocument called CachedImage::finishLoading() to
trigger the notifyFinished() callback path, the image would look at its
loading state and see that it was Unknown (not Pending), and conclude that
it hadn't loaded yet. So we never got the notifyFinished() signal.

The world leaks here because ImageLoader slaps a ref on its <img> element
while it waits for the loading operation to complete. Once finished, whether
successfully or with an error, it derefs the <img>.

Since we never fired notifyFinished(), we ended up with an extra ref on
these <img> forever, and then the element kept its document alive too.

Test: fast/dom/ImageDocument-world-leak.html

• loader/ImageLoader.cpp:

(WebCore::ImageLoader::updateFromElement):

LayoutTests:

Made a little test that loads an image into an <iframe> 10 times and then
triggers a garbage collection and checks that all the documents got destroyed.

Prior to this change, all 10 ImageDocuments would remain alive at the end.

This got rolled out the first time because it failed on bots. It failed due
to expecting a specific number of documents to be live at the start of the
test, which was not reliable on bots since we appear to have more leaks(!)

Tweaked the test to check the delta in live document count instead.

• fast/dom/ImageDocument-world-leak-expected.txt: Added.
• fast/dom/ImageDocument-world-leak.html: Added.

3:24 AM Changeset in webkit [197855] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197654 - [JSC] Remove a superfluous Move in front of every double unboxing
​https://bugs.webkit.org/show_bug.cgi?id=155064

Reviewed by Saam Barati.

Double unboxing was always doing:

Move source, scratch
Add64 tag, scratch
IntToDouble scratch, fp

We do not need to "Move" to copy the source.
Both x86 and ARM64 have an efficient 3 operands Add instruction.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileDoubleRep):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::unboxDouble):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::unboxDoubleWithoutAssertions):
(JSC::AssemblyHelpers::unboxDouble):
(JSC::AssemblyHelpers::unboxDoubleNonDestructive):

3:02 AM Changeset in webkit [197854] by svillar@igalia.com

• 7 edits in trunk

[css-grid] Fix auto-track sizing with min-size:auto and specific sizes
​https://bugs.webkit.org/show_bug.cgi?id=155165

Reviewed by Darin Adler.

Source/WebCore:

Specs recently changed the way auto tracks are sized. In the
previous versions, when sizing auto minimums, only the
min-width|height of the items spanning through the auto tracks
were used to size them. The new text specifies that for items
with a specified minimum size of auto, the behavior is
equivalent to a min-content minimum.

This means that from now on, auto tracks with min-size:auto
will no longer be smaller than min-content tracks (which was
pretty weird from the user POV).

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::minSizeForChild): use grid items
min-content contributions whenever the specified size is not
auto or when min-size is auto.

LayoutTests:

• fast/css-grid-layout/grid-automatic-minimum-for-auto-columns-expected.txt:
• fast/css-grid-layout/grid-automatic-minimum-for-auto-columns.html:
• fast/css-grid-layout/grid-automatic-minimum-for-auto-rows-expected.txt:
• fast/css-grid-layout/grid-automatic-minimum-for-auto-rows.html:

2:56 AM Changeset in webkit [197853] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197733 - REGRESSION(r197062): [GTK] Transparent backgrounds no longer work after r197062
​https://bugs.webkit.org/show_bug.cgi?id=155119

Reviewed by Martin Robinson.

This is because after r197062 we are now realizing the view too
early, even before the toplevel window has been realized, forcing
the toplevel window to be realized. If the RGBA visual is set on
the window after it has been realzied it doesn't have any
effect. We should wait until the toplevel window is realized to
realize the web view, giving time to the application to set RGBA
visual and background color. If the toplevel window is already
realized we realize the web view immediately, so that this doesn't
affect the tearing problems fixed in r197062.

• UIProcess/API/gtk/WebKitWebViewBase.cpp:

(toplevelWindowRealized):
(webkitWebViewBaseSetToplevelOnScreenWindow):

2:52 AM Changeset in webkit [197852] by Carlos Garcia Campos

• 6 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197653 - [JSC] Use 3 operands Add in more places
​https://bugs.webkit.org/show_bug.cgi?id=155082

Reviewed by Filip Pizlo.

• assembler/MacroAssembler.h:

(JSC::MacroAssembler::addPtr):
(JSC::MacroAssembler::add32):

• assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::add32):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithAdd):
The case with child1 constant is useless.
The canonical form will have the constant as child2.

Also add register reuse for the fast-add.
Registers are a scarce resource on x86.

• jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generate):

2:28 AM Changeset in webkit [197851] by Carlos Garcia Campos

• 14 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r197652 - [JSC] Improve codegen of Compare and Test
​https://bugs.webkit.org/show_bug.cgi?id=155055

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-06
Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch introduces a few improvements on how we lower
Compare and Test with immediates:

-Add certain Immediate forms of ARM64.
-Use CBZ/CBNZ when possible on ARM64.
-When possible, convert a CMP into a TST

On some hardware, we can issue more TST simultaneously.

On x86, any TST+Jump is candidate for macro-fusion.
They are also smaller.
(sections 3.4.2.2 and 3.5.1.9)

-Do not load the mask immediate of a TST

if it only contains ones (mostly useful for ARM64
since that would not have been a valid immediate).

• assembler/MacroAssembler.h:

(JSC::MacroAssembler::compare32):

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
This is somewhat unrelated but I found that out while working
on moveDoubleConditionallyTest32:

If "thenCase" and "dest" are assigned the same register
by the allocator, then the first (f)fcsel would override
the "thenCase" and the second fcsel would always be "elseCase".

This is covered by testb3 but was only uncovered
after recent "Move" removals in lowering.

(JSC::MacroAssemblerARM64::moveConditionally32):
(JSC::MacroAssemblerARM64::moveConditionally64):
(JSC::MacroAssemblerARM64::moveConditionallyTest32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally64):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
(JSC::MacroAssemblerARM64::branch32):
(JSC::MacroAssemblerARM64::branch64):
(JSC::MacroAssemblerARM64::branchTest32):
(JSC::MacroAssemblerARM64::test32):
The version taking an immediate was guarded by

(cond == Zero)

(cond == NonZero). That is overzealous,

and only needed for CBZ/CBNZ.

(JSC::MacroAssemblerARM64::branchTest64):
(JSC::MacroAssemblerARM64::compare32):
(JSC::MacroAssemblerARM64::compare64):
(JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::moveConditionally32):
(JSC::MacroAssemblerX86Common::moveConditionallyTest32):
(JSC::MacroAssemblerX86Common::branch32):
(JSC::MacroAssemblerX86Common::test32):
(JSC::MacroAssemblerX86Common::branchTest32):
(JSC::MacroAssemblerX86Common::compare32):
(JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::compare64):
(JSC::MacroAssemblerX86_64::branch64):
(JSC::MacroAssemblerX86_64::moveConditionally64):

• b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createGenericCompare):
Unfortunately this cannot be abstracted by the MacroAssembler.
Those immediates are not valid, we have to pick the better
for right away.

• b3/air/AirOpcode.opcodes:
• b3/testb3.cpp:

(JSC::B3::int64Operands):
(JSC::B3::modelCompare):
(JSC::B3::testCompareImpl):
(JSC::B3::testCompare):
(JSC::B3::b3Pow):
(JSC::B3::testPowDoubleByIntegerLoop):
Some versions of pow(double, int) do not return
the exact same bits as our integer loop.
Added a new version to have the same behavior
as the B3 loop.

(JSC::B3::run):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileInt32Compare):
Comparing to an immediate is super common. Do not waste
a register for that!

Source/WebCore:

• cssjit/FunctionCall.h:

(WebCore::FunctionCall::callAndBranchOnCondition):

2:15 AM Changeset in webkit [197850] by Manuel Rego Casasnovas

• 10 edits
  2 adds in trunk

[css-grid] Initial support for implicit grid before explicit grid
​https://bugs.webkit.org/show_bug.cgi?id=155014

Reviewed by Darin Adler.

Source/WebCore:

Change GridSpan to store int instead of unsigned. This allows us to
resolve positions before the explicit grid with negative values.

This patch adds a new type of GridSpan called "Untranslated".
This type is only used in populateExplicitGridAndOrderIterator().
Where we store the smallest negative position in both axis.

Then the GridSpans are translated into positive values, using the offset
calculated before. This is done in placeItemsOnGrid() and from that
moment the rest of the code uses "Definite" GridSpans, which returns
only positive positions (unsigned instead of int).
This allows us to don't have to modify the rest of the code, as it keeps
using GridSpans as before.

Let's use an example to explain how it works. Imagine that we've a 2
columns grid and 2 items placed like:

• Item A: grid-column: -5;
• Item B: grid-column: 1;

Initially we'll use "Unstranslated" GridSpans with the following values:

• Item A: GridSpan(-2, -1)
• Item B: GridSpan(0, 1)

Then we'll translate them using the smallest position as offset (-2)
so we've "Definite" GridSpans:

• Item A: GridSpan(0, 1)
• Item B: GridSpan(2, 3)

Test: fast/css-grid-layout/implicit-tracks-before-explicit.html

• css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateAreasRow):

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::gridTrackSize):
(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::placeItemsOnGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
(WebCore::RenderGrid::layoutPositionedObject): Deleted.

• rendering/RenderGrid.h:
• rendering/style/GridCoordinate.h:

(WebCore::GridSpan::untranslatedDefiniteGridSpan):
(WebCore::GridSpan::translatedDefiniteGridSpan):
(WebCore::GridSpan::integerSpan):
(WebCore::GridSpan::untranslatedResolvedInitialPosition):
(WebCore::GridSpan::untranslatedResolvedFinalPosition):
(WebCore::GridSpan::resolvedInitialPosition):
(WebCore::GridSpan::resolvedFinalPosition):
(WebCore::GridSpan::begin):
(WebCore::GridSpan::end):
(WebCore::GridSpan::isTranslatedDefinite):
(WebCore::GridSpan::isIndefinite):
(WebCore::GridSpan::translate):
(WebCore::GridSpan::GridSpan):
(WebCore::GridSpan::operator==): Deleted.
(WebCore::GridSpan::GridSpanIterator::GridSpanIterator): Deleted.
(WebCore::GridSpan::GridSpanIterator::operator unsigned&): Deleted.

• rendering/style/GridResolvedPosition.cpp:

(WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::resolveGridPositionFromStyle):
(WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
(WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem): Deleted.

LayoutTests:

Updated results in current tests and added specific test for this.

• fast/css-grid-layout/grid-auto-flow-resolution.html:
• fast/css-grid-layout/grid-item-negative-position-resolution.html:
• fast/css-grid-layout/grid-item-spanning-resolution.html:
• fast/css-grid-layout/implicit-tracks-before-explicit-expected.txt: Added.
• fast/css-grid-layout/implicit-tracks-before-explicit.html: Added.

2:05 AM Changeset in webkit [197849] by Carlos Garcia Campos

• 15 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197649 - DFG should know how to speculate StringOrOther
​https://bugs.webkit.org/show_bug.cgi?id=155094

Reviewed by Saam Barati.

Any code that processes the regexp matches array was previously doing a relatively expensive
Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
code that loops over the matches array and branches on the entries being non-empty.

To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
m_out.newBlock(). It's much nicer that way.

This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.

• bytecode/SpeculatedType.h:

(JSC::isStringSpeculation):
(JSC::isStringOrOtherSpeculation):
(JSC::isSymbolSpeculation):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateString):
(JSC::DFG::Node::shouldSpeculateStringOrOther):
(JSC::DFG::Node::shouldSpeculateStringObject):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileStringZeroLength):
(JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
(JSC::DFG::SpeculativeJIT::emitStringBranch):
(JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
(JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculateString):
(JSC::DFG::SpeculativeJIT::speculateStringOrOther):
(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
(JSC::DFG::SpeculativeJIT::speculate):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):
(JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
(JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
(JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
(JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileGetById):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
(JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
(JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
(JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
(JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
(JSC::FTL::DFG::LowerDFGToB3::compileIsString):
(JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
(JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
(JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
(JSC::FTL::DFG::LowerDFGToB3::checkStructure):
(JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
(JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
(JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
(JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
(JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
(JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
(JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
(JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
(JSC::FTL::DFG::LowerDFGToB3::allocateCell):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::boolify):
(JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
(JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
(JSC::FTL::DFG::LowerDFGToB3::switchString):
(JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
(JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateString):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
(JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
(JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
(JSC::FTL::DFG::LowerDFGToB3::callCheck):

• ftl/FTLOutput.cpp:

(JSC::FTL::Output::initialize):
(JSC::FTL::Output::newBlock):
(JSC::FTL::Output::check):

• ftl/FTLOutput.h:

(JSC::FTL::Output::setFrequency):
(JSC::FTL::Output::insertNewBlocksBefore):

1:35 AM Changeset in webkit [197848] by Carlos Garcia Campos

• 33 edits
  5 adds in releases/WebKitGTK/webkit-2.12

Merge r197641 - RegExpMatchesArray doesn't know how to have a bad time
​https://bugs.webkit.org/show_bug.cgi?id=155069

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

In trunk if we are having a bad time, the regexp matches array is still allocated with a
non-slow-put indexing shape, which makes it have the wrong behavior on indexed setters on
the prototype chain.

Getting this to work right requires introducing bad time code paths into the regexp matches
array. It also requires something more drastic: making this code not play games with the
global object. The code that creates the matches array needs to have the actual global
object of the regexp native function that it's logically created by.

This is totally different from how we've handled global objects in the past because it means
that the global object is not a constant. Normally we can make it a constant because a
script executable will know its global object. But with native functions, it's the function
instance that knows the global object - not the native executable. When we inline a native
intrinsic, we are guaranteed to know the native executable but we're not guaranteed to know
the functon instance. This means that the global object may be a variable that gets computed
by looking at the instance at run-time. So, the RegExpExec/RegExpTest nodes in DFG IR now
take a global object child. That also meant adding a new node type, GetGlobalObject, which
does the thing to the callee that CallFrame::lexicalGlobalObject() would have done.
Eventually, we'll probably have to make other native intrinsics also use GetGlobalObject. It
turns out that this really isn't so bad because usually it's constant-folded anyway, since
although the intrinsic code supports executable-based inlining (which leaves the callee
instance as an unknown), it happens rarely for intrinsics. So, conveying the global object
via a child isn't any worse than conveying it via meta-data, and it's probably better than
telling the inliner not to do executable-based inlining of native intrinsics. That would
have been a confusing special-case.

This is perf-neutral on my machines but it fixes a bug and it unlocks some interesting
possibilities. For example, RegExpExec can now make a firm promise about the type of array
it's creating.

This also contains some other changes:

• We are now using Structure::addPropertyTransition() in a lot of places even though it was meant to be an internal method with a quirky contract - for example if only works if you know that there is not existing transition. This relaxes this constraint.

• Restores the use of "*" for heap references in JSString.h. It's very unusual to have heap references pointed at with "&", since we don't currently do that anywhere. The fact that it was using the wrong reference type also meant that the code couldn't elegantly make use of some our GC pointer helpers like jsCast<>.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::attemptToInlineCall):
(JSC::DFG::ByteCodeParser::handleMinMax):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGNodeType.h:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileSkipScope):
(JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileSkipScope):
(JSC::FTL::DFG::LowerDFGToB3::compileGetGlobalObject):
(JSC::FTL::DFG::LowerDFGToB3::compileGetClosureVar):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):

• jit/JITOperations.h:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::haveABadTime):
(JSC::JSGlobalObject::visitChildren):

• runtime/JSGlobalObject.h:
• runtime/JSObject.h:

(JSC::JSObject::putDirectInternal):

• runtime/JSString.h:

(JSC::jsString):
(JSC::jsSubstring):

• runtime/RegExpCachedResult.cpp:

(JSC::RegExpCachedResult::lastResult):

• runtime/RegExpMatchesArray.cpp:

(JSC::tryCreateUninitializedRegExpMatchesArray):
(JSC::createRegExpMatchesArray):
(JSC::createStructureImpl):
(JSC::createRegExpMatchesArrayStructure):
(JSC::createRegExpMatchesArraySlowPutStructure):

• runtime/RegExpMatchesArray.h:
• runtime/RegExpObject.cpp:

(JSC::RegExpObject::put):
(JSC::RegExpObject::exec):
(JSC::RegExpObject::match):

• runtime/RegExpObject.h:

(JSC::RegExpObject::getLastIndex):
(JSC::RegExpObject::test):

• runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncTest):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncCompile):

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncMatch):

• runtime/Structure.cpp:

(JSC::Structure::suggestedArrayStorageTransition):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::addNewPropertyTransition):

• runtime/Structure.h:
• tests/stress/regexp-matches-array-bad-time.js: Added.
• tests/stress/regexp-matches-array-slow-put.js: Added.

LayoutTests:

• js/regress/regexp-exec-expected.txt: Added.
• js/regress/regexp-exec.html: Added.
• js/regress/script-tests/regexp-exec.js: Added.

12:54 AM Changeset in webkit [197847] by mmaxfield@apple.com

• 7 edits
  2 adds in trunk

[iOS] Arabic text on Wikipedia is shown as boxes
​https://bugs.webkit.org/show_bug.cgi?id=155129
<rdar://problem/24919902>

Reviewed by Darin Adler.

Source/WebCore:

GeezaPro is the PostScript name, not the family name.

Test: fast/text/arabic-blacklisted.html

• platform/graphics/ios/FontCacheIOS.mm:

(WebCore::platformLookupFallbackFont):

LayoutTests:

This test is iOS-specific.

• platform/efl/TestExpectations:
• platform/gtk/TestExpectations:
• platform/mac/TestExpectations:
• platform/win/TestExpectations:
• fast/text/arabic-blacklisted-expected.html: Added.
• fast/text/arabic-blacklisted.html: Added.

12:46 AM Changeset in webkit [197846] by Carlos Garcia Campos

• 3 edits
  1 add in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197640 - [JSC] RegExp#lastIndex should handle writable attribute when defining in defineOwnProperty path
​https://bugs.webkit.org/show_bug.cgi?id=155093

Reviewed by Filip Pizlo.

Before this patch, setLastIndex(ExecState* exec, size_t lastIndex) always overwrites the existing value
regardless of writable attribute.
And when defining RegExp#lastIndex in defineOwnProperty, we need to define the value first
before making the attribute readonly. After changing the writable attribute, we cannot define the value.

• runtime/RegExpObject.cpp:

(JSC::RegExpObject::defineOwnProperty):

• runtime/RegExpObject.h:

(JSC::RegExpObject::setLastIndex):

• tests/stress/regexp-last-index-writable.js: Added.

(shouldBe):
(shouldThrow):
(regExpLastIndex):

12:32 AM Changeset in webkit [197845] by Carlos Garcia Campos

• 11 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197622 - The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell
​https://bugs.webkit.org/show_bug.cgi?id=154900

Reviewed by Saam Barati.

These old operations used to speculate cell. That's what they did when they were first
introduced. That was probably about as good as they could do back then because we didn't have
very powerful checks. Now we have powerful checks, so we can do this right.

The most profitable thing to check is that child1 is a RegExpObject and child2 is a JSString.
Sometimes though, we will not know what child2 is even though we know that child1 is a
RegExpObject. So, this patch means that RegExpExec/RegExpTest have the following overloads:

RegExpExec(RegExpObject:, String:)
RegExpExec(RegExpObject:, Untyped:)
RegExpExec(Untyped:, Untyped:)

This shaves off some type checks in Octane/regexp. It also cleans up some problems in our
modeling of the effectfulness of these operations.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):

• jit/JITOperations.h:

12:05 AM Changeset in webkit [197844] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197609 - [GTK] Scrollbars are broken again with GTK+ >= 3.19.11
​https://bugs.webkit.org/show_bug.cgi?id=154890

Reviewed by Michael Catanzaro.

Scrollbar style properties have been deprecated in GTK+, and it
seems that now deprecating means keeping the properties but
ignoring them. So, this reworks the whole scrollbars theme code
again to not cache style properties anymore, but retrieve them
from the GtkStyleContext. Previous GTK+ versions still need to
query the style properties, so I've added helper functions to get
all the style properties with the ifdefs, trying to keep the
common render code free of GTK+ versions ifdefs.

• platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::backButtonRect):
(WebCore::ScrollbarThemeGtk::forwardButtonRect):
(WebCore::ScrollbarThemeGtk::trackRect):
(WebCore::ScrollbarThemeGtk::thumbRect):
(WebCore::ScrollbarThemeGtk::paintTrackBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paint):
(WebCore::ScrollbarThemeGtk::scrollbarThickness):
(WebCore::ScrollbarThemeGtk::buttonSize):
(WebCore::ScrollbarThemeGtk::stepperSize):
(WebCore::ScrollbarThemeGtk::getStepperSpacing):
(WebCore::ScrollbarThemeGtk::troughUnderSteppers):
(WebCore::ScrollbarThemeGtk::minimumThumbLength):
(WebCore::ScrollbarThemeGtk::thumbFatness):
(WebCore::ScrollbarThemeGtk::getTroughBorder):
(WebCore::ScrollbarThemeGtk::getOrCreateStyleContext):
(WebCore::ScrollbarThemeGtk::updateThemeProperties):
(WebCore::ScrollbarThemeGtk::handleMousePressEvent):

• platform/gtk/ScrollbarThemeGtk.h: