⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Mar 16, 2016:

11:52 PM WebKitGTK/2.10.x edited by Carlos Garcia Campos
(diff)
9:42 PM Changeset in webkit [198317] by Matt Baker
  • 2 edits in trunk/Source/WebInspectorUI

Uncaught Exception: SyntaxError: Invalid regular expression: \ at end of pattern
​https://bugs.webkit.org/show_bug.cgi?id=155556
<rdar://problem/25200058>

Reviewed by Timothy Hatcher.

Use simpleGlobStringToRegExp, which returns a valid regular expression
for strings with trailing backslashes, and also provides globbing.
String.escapeForRegExp returns a JS string ending in "
", which isn't
a valid regular expression.

  • UserInterface/Views/OpenResourceDialog.js:

(WebInspector.OpenResourceDialog):
(WebInspector.OpenResourceDialog.prototype._handleMousedownEvent):
Fixed typo.

(WebInspector.OpenResourceDialog.prototype._updateFilter):
Switch to simpleGlobStringToRegExp.

8:36 PM Changeset in webkit [198316] by commit-queue@webkit.org
  • 3 edits in trunk/Source/WebCore

SVG tear offs should return a const reference if possible
​https://bugs.webkit.org/show_bug.cgi?id=153214

Patch by Nikos Andronikos <​nikos.andronikos-webkit@cisra.canon.com.au> on 2016-03-16
Reviewed by Alex Christensen.

A smaller change than expected because the returned reference is being copied into a value in additional locations that baseVal and animVal are used.

No new tests as there is no change in behaviour.

  • svg/properties/SVGAnimatedEnumerationPropertyTearOff.h:
  • svg/properties/SVGAnimatedStaticPropertyTearOff.h:

(WebCore::SVGAnimatedStaticPropertyTearOff::baseVal):
(WebCore::SVGAnimatedStaticPropertyTearOff::animVal):

7:49 PM Changeset in webkit [198315] by jonlee@apple.com
  • 3 edits
    4 adds in trunk/PerformanceTests

Add a new benchmark test
​https://bugs.webkit.org/show_bug.cgi?id=155570

Reviewed by Simon Fraser.

New Leaves test includes various image sizes and opacity.

  • Animometer/resources/debug-runner/tests.js: Add it to the HTML test suite.
  • Animometer/tests/dom/leaves.html: Added.
  • Animometer/tests/dom/resources/leaves.js: Added. Override the

(Particle.call.reset): Uses a range of sizes, and opacity.
(Particle.call.animate): Opacity goes up then down. When it hits 0, reset the particle.
(Particle.call.move): Set transform and opacity.

  • Animometer/tests/master/resources/leaves.js: Get rid of the closure so that it

can be used in this test. Update the relative path so that it works in both the master
and dom test suite.

7:18 PM Changeset in webkit [198314] by Chris Dumez
  • 2 edits in trunk/Source/WebCore

Unreviewed, partial roll out of r197254.
<rdar://problem/25078552>

It caused a ~1.1% PLT regression on iOS.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad): Deleted.

6:48 PM Changeset in webkit [198313] by matthew_hanson@apple.com
  • 5 edits in branches/safari-601.1.46-branch/Source

Versioning.

6:45 PM Changeset in webkit [198312] by matthew_hanson@apple.com
  • 1 copy in tags/Safari-601.1.46.120

New Tag.

5:56 PM Changeset in webkit [198311] by enrica@apple.com
  • 2 edits in trunk/Source/WebCore

Recognize mailto and tel url as data detector links.
​https://bugs.webkit.org/show_bug.cgi?id=155569
rdar://problem/24836185

Reviewed by Sam Weinig.

When we check if the element is a data detector link,
we should return true also for URLs with mailto: and tel: scheme.

  • editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::isDataDetectorLink):

5:13 PM Changeset in webkit [198310] by Chris Dumez
  • 4 edits in trunk/Tools

Unreviewed, rolling out r198187.
​https://bugs.webkit.org/show_bug.cgi?id=155564

Potentially break testing on iOS (Requested by Guest23 on
#webkit).

Reverted changeset:

"Add twisted-15.5.0 module to
webkitpy.thirdparty.autoinstalled."
​https://bugs.webkit.org/show_bug.cgi?id=154667
​http://trac.webkit.org/changeset/198187

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-03-16

5:07 PM Changeset in webkit [198309] by Alan Bujtas
  • 3 edits
    2 adds in trunk

Subpixel rendering: Directly composited image layers need pixelsnapping.
​https://bugs.webkit.org/show_bug.cgi?id=155558

Reviewed by Simon Fraser.

In order to match non-composited image size/position, we need to pixelsnap both the contents and the clipping
layer bounds for directly composited images.

Source/WebCore:

Test: fast/images/hidpi-directly-composited-image-on-subpixel-position.html

  • rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::resetContentsRect):
(WebCore::RenderLayerBacking::updateChildClippingStrategy):
(WebCore::RenderLayerBacking::updateImageContents):

LayoutTests:

  • fast/images/hidpi-directly-composited-image-on-subpixel-position-expected.html: Added.
  • fast/images/hidpi-directly-composited-image-on-subpixel-position.html: Added.
4:37 PM Changeset in webkit [198308] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Skipping mathml/very-large-stretchy-operators.html on ios-simulator debug
​https://bugs.webkit.org/show_bug.cgi?id=155565

Unreviewed test gardening.

  • platform/ios-simulator/TestExpectations:
4:32 PM Changeset in webkit [198307] by Ryan Haddad
  • 3 edits in trunk/LayoutTests

Marking compositing/visible-rect/animated-from-none.html as flaky on ios-sim-wk2, failing on ios-sim-wk1
​https://bugs.webkit.org/show_bug.cgi?id=155495

Unreviewed test gardening.

  • platform/ios-simulator-wk1/TestExpectations:
  • platform/ios-simulator-wk2/TestExpectations:
4:25 PM Changeset in webkit [198306] by Beth Dakin
  • 28 edits in trunk/Source

Provide NSSpellChecker spellChecking methods with the current insertion point
​https://bugs.webkit.org/show_bug.cgi?id=155532
-and corresponding-
rdar://problem/24066952

Reviewed by Simon Fraser.

Source/WebCore:

Pass the Frame’s selection to a handful of spelling checking methods that
call into WebKit/WebKit2 to ultimately call into NSSpellChecker.

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::hasMisspelling):

  • accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(AXAttributeStringSetSpelling):

  • editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::timerFired):

  • editing/Editor.cpp:

(WebCore::Editor::guessesForMisspelledWord):
(WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):

  • editing/SpellChecker.cpp:

(WebCore::SpellChecker::invokeRequest):
(WebCore::SpellChecker::enqueueRequest):

  • editing/TextCheckingHelper.cpp:

(WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
(WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
(WebCore::TextCheckingHelper::unifiedTextCheckerEnabled):
(WebCore::checkTextOfParagraph):

  • editing/TextCheckingHelper.h:
  • loader/EmptyClients.cpp:

(WebCore::EmptyFrameLoaderClient::createNetworkingContext):
(WebCore::EmptyTextCheckerClient::requestCheckingOfString):

  • loader/EmptyClients.h:
  • platform/text/TextCheckerClient.h:

(WebCore::TextCheckerClient::~TextCheckerClient):

The key needed to include the insertion point.

  • platform/spi/mac/NSSpellCheckerSPI.h:

Source/WebKit/mac:

Extract the insertion point from the VisibleSelection that WebCore has
passed.

  • WebCoreSupport/WebEditorClient.h:

(WebEditorClient::getGuessesForWord):

  • WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::checkTextOfParagraph):
(insertionPointFromCurrentSelection):
(WebEditorClient::getGuessesForWord):
(WebEditorClient::requestCheckingOfString):

Source/WebKit2:

Pass the insertionPoint to the UIProcess

  • UIProcess/TextChecker.h:
  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::checkTextOfParagraph):
(WebKit::WebPageProxy::getGuessesForWord):
(WebKit::WebPageProxy::requestCheckingOfString):

  • UIProcess/WebPageProxy.h:
  • UIProcess/WebPageProxy.messages.in:
  • UIProcess/efl/TextCheckerEfl.cpp:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):

  • UIProcess/gtk/TextCheckerGtk.cpp:

(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):
(WebKit::TextChecker::checkTextOfParagraph):

  • UIProcess/ios/TextCheckerIOS.mm:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):

  • UIProcess/mac/TextCheckerMac.mm:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::ignoreWord):
(WebKit::TextChecker::requestCheckingOfString):

Extract the insertion point from the VisibleSelection that WebCore has
passed.

  • WebProcess/WebCoreSupport/WebEditorClient.cpp:

(WebKit::insertionPointFromCurrentSelection):
(WebKit::WebEditorClient::checkTextOfParagraph):
(WebKit::WebEditorClient::getGuessesForWord):
(WebKit::WebEditorClient::requestCheckingOfString):

  • WebProcess/WebCoreSupport/WebEditorClient.h:
3:10 PM Changeset in webkit [198305] by achristensen@apple.com
  • 2 edits in trunk/Source/WebCore

Fix assertion failure on drive.google.com after r196052
​https://bugs.webkit.org/show_bug.cgi?id=155562

Reviewed by Jer Noble.

  • rendering/RenderGeometryMap.cpp:

(WebCore::RenderGeometryMap::mapToContainer):
Change float equality check to areEssentiallyEqual.
This assertion was failing because rendererMappedResult was (944.335693, 232.047409)
but result was (944.335693, 232.047394). They differ by (0, 0.000015).

3:06 PM Changeset in webkit [198304] by ddkilzer@apple.com
  • 3 edits in trunk/Tools

check-webkit-style: should warn about blank lines after #include "config.h" in TestWebKitAPI
<​http://webkit.org/b/155445>

Reviewed by Darin Adler.

  • Scripts/webkitpy/style/checker.py:

(_PATH_RULES_SPECIFIER): Do not ignore "build/include*" checks
on TestWebKitAPI since this project uses a config.h header as of
r95188. Also remove references to WebKitAPITest, which ceased
to exist in r95944.

  • Scripts/webkitpy/style/checker_unittest.py:

(GlobalVariablesTest.test_path_rules_specifier): Add tests.
Remove reference to WebKitAPITest project.

2:49 PM Changeset in webkit [198303] by n_wang@apple.com
  • 3 edits
    2 adds in trunk

AX: Expose aria-current status to children
​https://bugs.webkit.org/show_bug.cgi?id=155469

Reviewed by Chris Fleizach.

Source/WebCore:

Added aria-current to the global ARIA attributes list.

Test: accessibility/aria-current-global-attribute.html

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::supportsARIAAttributes):

LayoutTests:

  • accessibility/aria-current-global-attribute-expected.txt: Added.
  • accessibility/aria-current-global-attribute.html: Added.
2:31 PM Changeset in webkit [198302] by timothy_horton@apple.com
  • 6 edits in trunk

[mac] Printing test snapshots are upside-down after r198242
​https://bugs.webkit.org/show_bug.cgi?id=155543

Reviewed by Simon Fraser.

Source/WebCore:

  • page/PrintContext.cpp:

(WebCore::PrintContext::spoolAllPagesWithBoundaries):
Stop PLATFORM(COCOA)-conditionally flipping here. Just paint.
This function is only used by the test runners so this doesn't have a
huge impact on anything else.

Tools:

  • DumpRenderTree/mac/PixelDumpSupportMac.mm:

(createPagedBitmapContext):
Flip printing snapshots in DRT so that everything is right-side-up.

LayoutTests:

Re-un-skip these tests.

1:58 PM Changeset in webkit [198301] by dbates@webkit.org
  • 2 edits in trunk/Source/WebCore

Update WebKit Feature Status page to include the status of Content Security Policy Level 2 and Level 3

  • features.json:
1:44 PM Changeset in webkit [198300] by matthew_hanson@apple.com
  • 2 edits in branches/safari-601-branch/Source/WebCore

Merge r188574. rdar://problem/25070230

1:44 PM Changeset in webkit [198299] by matthew_hanson@apple.com
  • 18 edits
    12 deletes in branches/safari-601-branch

Merge r188566. rdar://problem/25070230

1:17 PM Changeset in webkit [198298] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebKit2

REGRESSION (r192184): CleanMyDrive 2's tutorial window is blank
​https://bugs.webkit.org/show_bug.cgi?id=155550
<rdar://problem/24250689>

Reviewed by Dan Bernstein.

  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _setDrawsTransparentBackground:]):
The app is using this SPI via key-value coding, so just keeping the implementation
is sufficient to make AppKit stop throwing an undefined key exception.
Log once that this is deprecated (... it's also SPI) and then forward to setDrawsBackground.

1:13 PM Changeset in webkit [198297] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking inspector/controller/runtime-controller.html as flaky on mac
​https://bugs.webkit.org/show_bug.cgi?id=154688

Unreviewed test gardening.

  • platform/mac/TestExpectations:
1:12 PM Changeset in webkit [198296] by fpizlo@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode
​https://bugs.webkit.org/show_bug.cgi?id=153805

Reviewed by Mark Lam.

The object allocation sinking phase uses InferredValue::isStillValid() in the opposite
way from most clients: it will do an *extra* optimization if it returns false. The
phase will first compute sink candidates and then it will compute materialization
points. If something is a sink candidate then it is not a materialization point. A
NewFunction node may appear as not being a sink candidate during the first pass, so it's
not added to the set of things that will turn into PhantomNewFunction. But on the second
pass where we add materializations, we check isStillValid() again. Now this may become
false, so that second pass thinks that NewFunction is a sink candidate (even though it's
not in the sink candidates set) and so is not a materialization point.

This manifests as the NewFunction referring to a PhantomCreateActivation or whatever.

The solution is to have the phase cache results of calls to isStillValid(). It's OK if
we just remember the result of the first call and assume that it's not a sink candidate.
That's the worst that can happen.

No new tests since this is a super hard race and sink-huge-activation seemed to already
be catching it.

  • dfg/DFGObjectAllocationSinkingPhase.cpp:
1:09 PM Changeset in webkit [198295] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Mark http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html as flaky
​https://bugs.webkit.org/show_bug.cgi?id=94458

Unreviewed test gardening.

  • platform/ios-simulator/TestExpectations:
12:49 PM Changeset in webkit [198294] by sbarati@apple.com
  • 3 edits
    1 add in trunk/Source/JavaScriptCore

[ES6] Make Array.prototype.reverse spec compatible.
​https://bugs.webkit.org/show_bug.cgi?id=155528

Reviewed by Michael Saboff.

This patch make Array.prototype.reverse spec compatible.
Before, we weren't performing a HasProperty of each index
before performing a Get on that index. We now do that on
the slow path.

  • runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncReverse):

  • tests/stress/array-reverse-proxy.js: Added.

(assert):
(test):
(shallowCopy):
(shallowEqual):
(let.handler.get getSet):
(test.let.handler.get getSet):

12:47 PM Changeset in webkit [198293] by ap@apple.com
  • 2 edits in trunk/Tools

Update unit test for iOS debug queues.

  • BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:
12:46 PM Changeset in webkit [198292] by dbates@webkit.org
  • 20 edits
    1 move
    48 adds in trunk

<video> and <audio> elements do not obey Content Security Policy on redirect
​https://bugs.webkit.org/show_bug.cgi?id=155509
<rdar://problem/10234844>

Reviewed by Alex Christensen.

Source/WebCore:

Fixes an issue where the Content Security Policy of the page was not enforced
on redirects when loading a media subresource via an HTML video or HTML audio
element.

Tests: http/tests/security/contentSecurityPolicy/audio-redirect-allowed.html

http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html
http/tests/security/contentSecurityPolicy/font-redirect-allowed.html
http/tests/security/contentSecurityPolicy/font-redirect-blocked.html
http/tests/security/contentSecurityPolicy/image-redirect-allowed.html
http/tests/security/contentSecurityPolicy/image-redirect-blocked.html
http/tests/security/contentSecurityPolicy/script-redirect-allowed.html
http/tests/security/contentSecurityPolicy/script-redirect-blocked.html
http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed.html
http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html
http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed.html
http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html
http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed.html
http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html
http/tests/security/contentSecurityPolicy/track-redirect-allowed.html
http/tests/security/contentSecurityPolicy/track-redirect-blocked.html
http/tests/security/contentSecurityPolicy/video-redirect-allowed.html
http/tests/security/contentSecurityPolicy/video-redirect-blocked.html
http/tests/security/contentSecurityPolicy/xsl-redirect-allowed.html
http/tests/security/contentSecurityPolicy/xsl-redirect-blocked.html

  • inspector/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::cachedResourceContent): Treat media resources as raw resources just as we do currently.
(WebCore::InspectorPageAgent::cachedResourceType): Ditto.

  • loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::requestResource): Modified to use CachedResourceLoader::requestMedia() instead
of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
initiated by an element in a user agent shadow tree. See <​https://bugs.webkit.org/show_bug.cgi?id=155505> for
more details.

  • loader/ResourceLoadInfo.cpp:

(WebCore::toResourceType): Treat media resources as raw resources just as we do currently. Also, add cases for
CachedResource::LinkPrefetch and CachedResource::LinkSubresource (when ENABLE(LINK_PREFETCH) is enabled) and
remove the default statement to force a compile-time error when a new CachedResource enumerator is added and
the switch block in this function is not updated.

  • loader/SubresourceLoader.cpp:

(WebCore::logResourceLoaded): Ditto.

  • loader/cache/CachedRawResource.cpp:

(WebCore::CachedRawResource::CachedRawResource): Substitute CachedResource::isMainOrMediaOrRawResource() for
CachedResource::isMainOrRawResource() as the latter was renamed to the former.

  • loader/cache/CachedRawResource.h:

(isType): Ditto.

  • loader/cache/CachedResource.cpp:

(WebCore::defaultPriorityForResourceType): Use priority ResourceLoadPriority::Medium for media resources just as
we do currently.

  • loader/cache/CachedResource.h:

(WebCore::CachedResource::isMainOrMediaOrRawResource): Formerly named isMainOrRawResource. Returns true if the type
of this resource is a main resource, media resource, or raw resource.
(WebCore::CachedResource::isMainOrRawResource): Deleted.

  • loader/cache/CachedResourceLoader.cpp:

(WebCore::createResource): Treat media resources as raw resources just as we do currently.
(WebCore::CachedResourceLoader::requestMedia): Added.
(WebCore::contentTypeFromResourceType): Consider media resources as MixedContentChecker::ContentType::Active
just as we do currently.
(WebCore::CachedResourceLoader::checkInsecureContent): Apply the mixed content policy to media resources
just as we do currently.
(WebCore::CachedResourceLoader::canRequest): Apply the Same Origin Policy to media resources just as we
do currently. Query the Content Security Policy of the page to determine if the media resource can be
requested.
(WebCore::CachedResourceLoader::determineRevalidationPolicy): Substitute CachedResource::isMainOrMediaOrRawResource()
for CachedResource::isMainOrRawResource() as the latter was renamed to the former.

  • loader/cache/CachedResourceLoader.h:
  • platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:

(WebCore::WebCoreAVFResourceLoader::startLoading): Modified to use CachedResourceLoader::requestMedia() instead
of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
initiated by an element in a user agent shadow tree. See <​https://bugs.webkit.org/show_bug.cgi?id=155505> for
more details. Additionally, simplified code that determined whether to request the media resource or error out
by coalescing two conditional expressions into one conditional on whether we have a loader and substituted
nullptr for 0.

Source/WebKit2:

Use 0ms as the maximum buffering time for media resource just as we do currently.

  • WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::maximumBufferingTime):

LayoutTests:

Add tests to ensure that the Content Security Policy is enforced on redirects when
loading a subresource, including a video or audio file.

  • http/tests/resources/redirect.php: Fix PHP "undefined index" warnings when either query

parameter code or refresh (or both) are not specified.

  • http/tests/security/contentSecurityPolicy/audio-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/audio-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/font-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/font-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/font-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/image-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/image-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/image-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/resources/ABCFont.svg: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/userAgentShadowDOM/resources/ABCFont.svg.
  • http/tests/security/contentSecurityPolicy/resources/alert-fail.xsl: Added.
  • http/tests/security/contentSecurityPolicy/resources/alert-pass.xsl: Added.
  • http/tests/security/contentSecurityPolicy/resources/green-square.svg: Added.
  • http/tests/security/contentSecurityPolicy/resources/red-square.svg: Added.
  • http/tests/security/contentSecurityPolicy/resources/xsl-redirect-allowed.php: Added.
  • http/tests/security/contentSecurityPolicy/resources/xsl-redirect-blocked.php: Added.
  • http/tests/security/contentSecurityPolicy/script-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/script-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/script-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/track-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/track-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-svg-font.html:
  • http/tests/security/contentSecurityPolicy/video-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/video-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/video-redirect-blocked.html: Added.
  • http/tests/security/contentSecurityPolicy/xsl-redirect-allowed-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/xsl-redirect-allowed.html: Added.
  • http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/xsl-redirect-blocked.html: Added.
  • platform/efl/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. We will also need to fix
<​https://bugs.webkit.org/show_bug.cgi?id=153866> before we can unskip test http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-video.html
As far as I can tell the functionality exercised by these tests is not being using by the EFL port.

  • platform/gtk/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. As far as I can tell the functionality
exercised by these tests is not being using by the GTK port.

  • platform/ios-simulator/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: Added expected failure result as

AV Foundation is responsible for loading media on iOS. That is, WebCore is not responsible for loading media.

  • platform/ios-simulator/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: Ditto.
  • platform/mac/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. The functionality exercised by these
tests is not used on OS X. Additionally, mark as Failure on Yosemite and ElCapitan the added tests
http/tests/security/contentSecurityPolicy/{video, audio}-redirect-blocked.html as we do not support
Content Security Policy for media redirects in these versions of OS X.

12:33 PM Changeset in webkit [198291] by Chris Dumez
  • 17 edits in trunk/Source

Unreviewed, rolling out r198235, r198240, r198241, and
r198252.

Causing crashes on ARM

Reverted changesets:

"Remove compile time define for SEPARATED_HEAP"
​https://bugs.webkit.org/show_bug.cgi?id=155508
​http://trac.webkit.org/changeset/198235

"Gardening: build fix after r198235."
​http://trac.webkit.org/changeset/198240

"Build fix."
​http://trac.webkit.org/changeset/198241

"Rename performJITMemcpy to something more inline with our
normal webkit function names"
​https://bugs.webkit.org/show_bug.cgi?id=155525
​http://trac.webkit.org/changeset/198252

12:03 PM Changeset in webkit [198290] by BJ Burg
  • 4 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r198257.
​https://bugs.webkit.org/show_bug.cgi?id=155553

This change is unnecessary, clients can instead compile the
file with ARC enabled (Requested by brrian on #webkit).

Reverted changeset:

"REGRESSION(r198077): generated Objective-C protocol object
getters leak their wrappers"
​https://bugs.webkit.org/show_bug.cgi?id=155523
​http://trac.webkit.org/changeset/198257

11:31 AM Changeset in webkit [198289] by jiewen_tan@apple.com
  • 22 edits
    2 adds in trunk

URL Parsing should signal failure for illegal IDN
​https://bugs.webkit.org/show_bug.cgi?id=154945
<rdar://problem/8014795>

Reviewed by Brent Fulgham.

Source/WebCore:

WebCore::URL will now invalidate URLs with illegal IDN. And functions inside WebCoreNSURLExtras.h
that deal with IDN mapping will now return nil to signal error.

Test: fast/url/invalid-idn.html

  • platform/URL.cpp:

(WebCore::isSchemeFirstChar):
(WebCore::URL::init):
(WebCore::appendEncodedHostname):
(WebCore::encodeHostnames):
(WebCore::encodeRelativeString):

  • platform/mac/WebCoreNSURLExtras.h:
  • platform/mac/WebCoreNSURLExtras.mm:

(WebCore::mapHostNameWithRange):
(WebCore::hostNameNeedsDecodingWithRange):
(WebCore::hostNameNeedsEncodingWithRange):
(WebCore::decodeHostNameWithRange):
(WebCore::encodeHostNameWithRange):
(WebCore::decodeHostName):
(WebCore::encodeHostName):
(WebCore::collectRangesThatNeedMapping):
(WebCore::mapHostNames):
(WebCore::URLWithData):
(WebCore::dataWithUserTypedString):
(WebCore::URLWithUserTypedString):
(WebCore::URLWithUserTypedStringDeprecated):
(WebCore::userVisibleString):

Source/WebKit/ios:

  • Misc/WebNSStringExtrasIOS.m:

(-[NSString _web_possibleURLsForForUserTypedString:]):

  • WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder _updateTitleForURL:]):

Source/WebKit/mac:

In this patch, we add new SPIs _webkit_URLWithUserTypedString, _webkit_decodeHostName and
_webkit_encodeHostName which will return nil while dealing with illegal IDN.

Old SPIs _web_URLWithUserTypedString, _web_decodeHostName and _web_encodeHostName are marked
deprecated as they ignore URL parsing failure.

  • History/WebHistoryItem.mm:

(-[WebHistoryItem initFromDictionaryRepresentation:]):

  • Misc/WebKitErrors.m:

(+[NSError _webKitErrorWithCode:failingURL:]):

  • Misc/WebNSFileManagerExtras.mm:

(-[NSFileManager _webkit_setMetadataURL:referrer:atPath:]):

  • Misc/WebNSPasteboardExtras.mm:

(-[NSPasteboard _web_bestURL]):

  • Misc/WebNSURLExtras.h:
  • Misc/WebNSURLExtras.mm:

(+[NSURL _web_URLWithUserTypedString:]):
(+[NSURL _webkit_URLWithUserTypedString:relativeToURL:]):
(+[NSURL _webkit_URLWithUserTypedString:]):
(-[NSString _web_decodeHostName]):
(-[NSString _web_encodeHostName]):
(-[NSString _webkit_decodeHostName]):
(-[NSString _webkit_encodeHostName]):

  • Panels/WebAuthenticationPanel.m:

(-[WebAuthenticationPanel setUpForChallenge:]):

  • WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::canonicalizeURLString):

Tools:

  • MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController fetch:]):

  • TestWebKitAPI/Tests/Cocoa/URLExtras.mm:

(TestWebKitAPI::TEST):

LayoutTests:

  • fast/url/host-expected.txt:
  • fast/url/idna2003-expected.txt:
  • fast/url/invalid-idn-expected.txt: Added.
  • fast/url/invalid-idn.html: Added.
11:16 AM Changeset in webkit [198288] by mark.lam@apple.com
  • 42 edits
    1 add in trunk

Add support for setting Function.name from computed properties.
​https://bugs.webkit.org/show_bug.cgi?id=155437

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

In JS code, we can have initialization of computed properties with function and
class objects e.g.

var o = {

[x]: function() {},
[y]: class {}

}

The ES6 spec states that the function and class in the example above (being
anonymous) should take on the value of x and y respectively as their names:

o[x].name; should be the "stringified" value of x.
o[y].name; should be the "stringified" value of y.

To achieve this, we will now inject an op_set_function_name bytecode at property
initialization sites if:

  1. the property assigned value is a function or class, and
  2. the function and class is anonymous, and
  3. if property assigned value is a class, it doesn't have a static method that is statically named "name".

The op_set_function_name will result in JSFunction::setFunctionName() being
called on the target function / class before it is assigned to the property.
JSFunction::setFunctionName() will take care of:

  1. computing the name to use from the value of the computed property name e.g. x and y in the example above.

If the computed property name is not a symbol, then the function / class name
should be the toString() value of that computed property name.

If the computed property name is a symbol, then ...

  1. if the Symbol has a defined description (e.g. Symbol("foo")), then the function / class name should be "[<symbol description>]" e.g. "[foo]".
  2. if the Symbol has an undefined description (e.g. Symbol()), then the function / class name should be "".

Note: Symbol("") is not the same as Symbol(). The former has a defined
descriptor "", and hence, yields a function / class name of "[]". The latter
yields a function / class name of "".

  1. reifying the lazy name property with this function / class name.

op_set_function_name is named after the SetFunctionName internal function
in the ES6 spec that performs the above operation.

It is behaviorally correct to use op_set_function_name at every property
initialization site with computed property names. However, we choose to not
emit the op_set_function_name bytecode when we already know that it will do
nothing i.e. when the target function / class is proven to already have a name or
name property. This is done as an optimization to avoid unnecessary calls to
JSFunction::setFunctionName().

Note: we could further check if the class has a static method with a computed
name that is a constant string "name" and elide op_set_function_name there too.
However, we don't bother because this should be rare. JSFunction::setFunctionName()
will still do the right thing.

  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitNewFunction):
(JSC::BytecodeGenerator::emitSetFunctionNameIfNeeded):
(JSC::BytecodeGenerator::emitCall):

  • bytecompiler/BytecodeGenerator.h:
  • bytecompiler/NodesCodegen.cpp:

(JSC::PropertyListNode::emitBytecode):
(JSC::PropertyListNode::emitPutConstantProperty):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunction):
(JSC::DFG::SpeculativeJIT::compileSetFunctionName):
(JSC::DFG::SpeculativeJIT::compileForwardVarargs):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGStoreBarrierInsertionPhase.cpp:
  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::compileSetFunctionName):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

  • jit/JIT.h:
  • jit/JITInlines.h:

(JSC::JIT::callOperation):

  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_strcat):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emitSlow_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_strcat):

  • jit/JITOperations.cpp:
  • jit/JITOperations.h:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::handleHostCall):

  • llint/LLIntSlowPaths.h:
  • llint/LowLevelInterpreter.asm:
  • parser/Nodes.cpp:

(JSC::FunctionNode::finishParsing):
(JSC::PropertyListNode::hasStaticallyNamedProperty):
(JSC::VariableEnvironmentNode::VariableEnvironmentNode):

  • parser/Nodes.h:
  • runtime/JSFunction.cpp:

(JSC::getCalculatedDisplayName):
(JSC::JSFunction::setFunctionName):
(JSC::JSFunction::reifyLength):
(JSC::JSFunction::reifyName):

  • runtime/JSFunction.h:
  • tests/es6.yaml:
  • tests/stress/computed-function-names.js: Added.

(toKeyString):
(toFuncName):
(shouldBe):
(return.propKey):

LayoutTests:

  • js/object-literal-computed-methods-expected.txt:
  • Exercise op_set_function_name at all tiers.
  • js/script-tests/function-toString-vs-name.js:
  • Added tests for computed properties.
  • js/script-tests/object-literal-computed-methods.js:
  • rebased results.
10:20 AM Changeset in webkit [198287] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking imported/blink/fast/multicol/dynamic/relayout-abspos-in-relpos-spanner.html as flaky on ios-sim
​https://bugs.webkit.org/show_bug.cgi?id=155339

Unreviewed test gardening.

  • platform/ios-simulator/TestExpectations:
10:17 AM Changeset in webkit [198286] by matthew_hanson@apple.com
  • 2 edits in branches/safari-601-branch/Source/WebCore

Merge r192054. rdar://problem/25152937

9:58 AM Changeset in webkit [198285] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Skipping failing printing tests
​https://bugs.webkit.org/show_bug.cgi?id=155543

Unreviewed test gardening.

Three printing tests that rely on software snapshotting are failing after r198242 exposed
an underlying issue. Skipping these tests to get the bots back to green during investigation.

9:46 AM Changeset in webkit [198284] by Antti Koivisto
  • 5 edits
    2 adds in trunk

Don't invalidate style unnecessarily when setting inline style cssText
​https://bugs.webkit.org/show_bug.cgi?id=155541
rdar://problem/23318893

Reviewed by Simon Fraser.

Source/WebCore:

We currently invalidate style when cssText is set whether the style declaration changed or not.

Based on a patch by Simon.

Test: fast/css/style-invalidation-inline-csstext.html

  • css/PropertySetCSSStyleDeclaration.cpp:

(WebCore::PropertySetCSSStyleDeclaration::cssText):
(WebCore::PropertySetCSSStyleDeclaration::setCssText):

Invalidate only if the parsed style changed.

  • css/StyleProperties.cpp:

(WebCore::MutableStyleProperties::parseDeclaration):

Compare the original and new style after parsing, return result.

  • css/StyleProperties.h:

LayoutTests:

  • fast/css/style-invalidation-inline-csstext-expected.txt: Added.
  • fast/css/style-invalidation-inline-csstext.html: Added.
9:26 AM Changeset in webkit [198283] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Rebaseline fast/css/getPropertyValue-webkit-marquee.html after r198255
​https://bugs.webkit.org/show_bug.cgi?id=155544

Unreviewed test gardening.

  • fast/css/getPropertyValue-webkit-marquee-expected.txt:
8:35 AM Changeset in webkit [198282] by Carlos Garcia Campos
  • 1 copy in releases/WebKitGTK/webkit-2.11.92

WebKitGTK+ 2.11.92

8:31 AM Changeset in webkit [198281] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r198127 - Enable GSS-Negotiate support in libsoup
​https://bugs.webkit.org/show_bug.cgi?id=155354

Patch by Tomas Popela <​tpopela@redhat.com> on 2016-03-14
Reviewed by Carlos Garcia Campos.

Enable the SOUP_TYPE_AUTH_NEGOTIATE feature if libsoup was compiled
with the GSS-Negotiate support.

  • platform/network/soup/SoupNetworkSession.cpp:

(WebCore::SoupNetworkSession::SoupNetworkSession):

8:16 AM Changeset in webkit [198280] by Carlos Garcia Campos
  • 4 edits in releases/WebKitGTK/webkit-2.12

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.92 release.

.:

  • Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

  • gtk/NEWS: Add release notes for 2.11.92.
8:16 AM Changeset in webkit [198279] by Carlos Garcia Campos
  • 22 edits
    6 deletes in releases/WebKitGTK/webkit-2.12

Revert "Merge r197549 - DFG/FTL should inline accesses to RegExpObject::m_lastIndex"

This reverts commit 75a052408f9d2d6401972afb8a422f0e5979aeff.

8:15 AM Changeset in webkit [198278] by Carlos Garcia Campos
  • 11 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197622 - The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell"

This reverts commit 782aaddfb605fb925d3de4cb1e7b562cc26821b7.

8:15 AM Changeset in webkit [198277] by Carlos Garcia Campos
  • 33 edits
    5 deletes in releases/WebKitGTK/webkit-2.12

Revert "Merge r197641 - RegExpMatchesArray doesn't know how to have a bad time"

This reverts commit 240414640dd08dd67d4866c3992f399cb1035bc1.

8:14 AM Changeset in webkit [198276] by Carlos Garcia Campos
  • 9 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197715 - RegExp.prototype.exec() should call into Yarr at most once"

This reverts commit 2731cf7e9df14edf11cba6984e4c8cd1b14e752b.

8:14 AM Changeset in webkit [198275] by Carlos Garcia Campos
  • 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197730 - Reduce the number of instructions needed to record the last regexp result"

This reverts commit 074b9a12367b04dd3cd70f9d7c73695f8184fbb6.

8:14 AM Changeset in webkit [198274] by Carlos Garcia Campos
  • 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197729 - createRegExpMatchesArray should allocate substrings more quickly"

This reverts commit 5127c006fe6f7fcb4a512376866bce75b83a1c27.

8:13 AM Changeset in webkit [198273] by Carlos Garcia Campos
  • 9 edits
    2 deletes in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197796 - Regexp matching should incur less call overhead"

This reverts commit 462dd3fe9ae1b6992bbf331c52e9d4d440298a16.

8:13 AM Changeset in webkit [198272] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r198269 - REGRESSION(r195661): [GTK] very slow scrolling
​https://bugs.webkit.org/show_bug.cgi?id=155334

Reviewed by Sergio Villar Senin.

Fix smooth scrolling behaviour change after r195661.

  • platform/ScrollAnimationSmooth.cpp:

(WebCore::getAnimationParametersForGranularity): Fix a typo,
animationTime for pixel granularity should be 11 * tickTime.
(WebCore::ScrollAnimationSmooth::animateScroll): Previous code
reset all the data except the visibleLenght, so keep it in the
PerAxisData after the reset.

8:13 AM Changeset in webkit [198271] by Carlos Garcia Campos
  • 7 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r198266 - Unreviewed, rolling out r196803.
​https://bugs.webkit.org/show_bug.cgi?id=155534

Introduced several rendering issues in popular websites
(Requested by KaL on #webkit).

Reverted changeset:

"[GTK] Limit the number of tiles according to the visible
area"
​https://bugs.webkit.org/show_bug.cgi?id=126122
​http://trac.webkit.org/changeset/196803

6:59 AM Changeset in webkit [198270] by Yusuke Suzuki
  • 29 edits
    1 copy
    3 adds in trunk

[ES6] Reflect.set with receiver
​https://bugs.webkit.org/show_bug.cgi?id=155294

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch introduces the receiver parameter support for Reflect.set.
Reflect.set can alter the receiver with arbitrary values.
Each property descriptor uses the receiver in Set.

1) In the accessor descriptor case, the receiver is used as |this| value for setter calls.
2) In the data descriptor case, the actual property will be set onto the receiver objects.

The current put operation does not support the receiver that is different from the base object.
In particular, (2) case is not supported.
The naive implementation adds one more GetOwnProperty for the receiver per Set (9.1.9.1-4-c [1]), and it is unacceptable.
To keep the fast path efficiently, we fall back to the slow but generic implementation (ordinarySetSlow)
only when the receiver is altered.

We need not to change any JIT part, because the JS code cannot alter the receiver without Reflect.set.
The property accesses generated by the JIT code always have the receiver that is the same to the base object.
ProxyObject can alter the receiver, but this situation has no problem because ProxyObject disables Inline Caching.
NOTE: Generating Inline Caching for JSProxy (that is used for the Window proxy) is already disabled before this change.

[1]: ​https://tc39.github.io/ecma262/#sec-ordinaryset

  • jsc.cpp:

(functionCreateProxy):

  • runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::put):

  • runtime/JSArray.cpp:

(JSC::JSArray::put):

  • runtime/JSArrayBuffer.cpp:

(JSC::JSArrayBuffer::put):

  • runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::put):

  • runtime/JSCJSValue.h:
  • runtime/JSCJSValueInlines.h:

(JSC::isThisValueAltered):

  • runtime/JSDataView.cpp:

(JSC::JSDataView::put):

  • runtime/JSFunction.cpp:

(JSC::JSFunction::put):

  • runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::put):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::put):

  • runtime/JSObject.cpp:

(JSC::ordinarySetSlow):
(JSC::JSObject::putInlineSlow):

  • runtime/JSObject.h:
  • runtime/JSObjectInlines.h:

(JSC::JSObject::putInline):

  • runtime/JSProxy.h:

(JSC::JSProxy::createStructure):

  • runtime/Lookup.h:

(JSC::putEntry):

  • runtime/PropertySlot.h:
  • runtime/ProxyObject.cpp:

(JSC::ProxyObject::put):

  • runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):
(JSC::PutPropertySlot::isCacheablePut):
(JSC::PutPropertySlot::isCacheableSetter):
(JSC::PutPropertySlot::isCacheableCustom):
(JSC::PutPropertySlot::isCustomAccessor):
(JSC::PutPropertySlot::disableCaching):
(JSC::PutPropertySlot::isCacheable):

  • runtime/ReflectObject.cpp:

(JSC::reflectObjectSet):

  • runtime/RegExpObject.cpp:

(JSC::RegExpObject::put):
(JSC::reject): Deleted.

  • runtime/StringObject.cpp:

(JSC::StringObject::put):

  • tests/es6.yaml:
  • tests/stress/ordinary-set-exceptions.js: Added.

(shouldBe):
(shouldThrow):
(shouldThrow.set get var):

  • tests/stress/proxy-set.js:
  • tests/stress/reflect-set-proxy-set.js: Copied from Source/JavaScriptCore/tests/stress/proxy-set.js.

(shouldBe):
(unreachable):
(assert):
(throw.new.Error.let.handler.set 45):
(throw.new.Error):
(let.target.set x):
(let.target.get x):
(set let):

  • tests/stress/reflect-set-receiver-proxy-set.js: Added.

(shouldBe):
(unreachable):
(assert):
(let.handler.set 45):
(catch):
(let.target.set x):
(let.target.get x):
(set let):

  • tests/stress/reflect-set-with-global-proxy.js: Added.

(shouldBe):
(unreachable):
(get shouldBe):
(set shouldBe):
(set test1):
(set test2):
(set test3):

  • tests/stress/reflect-set.js:

(shouldThrow):
(unreachable):
(get shouldBe):
(set shouldBe):
(receiverTestIndexed):
(set get Uint8Array):
(receiverCase): Deleted.
(proxyCase): Deleted.
(stringObjectCase.set get shouldBe): Deleted.
(regExpLastIndex): Deleted.

LayoutTests:

Currently, putDelegate (JSLocation is special case) and CustomIndexedSetter work as special setters.

  • js/dom/reflect-set-onto-dom-expected.txt:
  • js/dom/script-tests/reflect-set-onto-dom.js:
2:36 AM Changeset in webkit [198269] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebCore

REGRESSION(r195661): [GTK] very slow scrolling
​https://bugs.webkit.org/show_bug.cgi?id=155334

Reviewed by Sergio Villar Senin.

Fix smooth scrolling behaviour change after r195661.

  • platform/ScrollAnimationSmooth.cpp:

(WebCore::getAnimationParametersForGranularity): Fix a typo,
animationTime for pixel granularity should be 11 * tickTime.
(WebCore::ScrollAnimationSmooth::animateScroll): Previous code
reset all the data except the visibleLenght, so keep it in the
PerAxisData after the reset.

12:18 AM Changeset in webkit [198268] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebKit/win

Unreviewed, rolling out r196951 and r197031.

Revert also WinCairo follow ups after r196803

Reverted changesets:

"[WinCairo] Compile fix."
​https://bugs.webkit.org/show_bug.cgi?id=154545
​http://trac.webkit.org/changeset/196951

"[WinCairo] Mark layer as non composited."
​https://bugs.webkit.org/show_bug.cgi?id=154640
​http://trac.webkit.org/changeset/197031

12:11 AM Changeset in webkit [198267] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebKit/win

Unreviewed, rolling out r197693.

197031

Reverted changeset:

"[WinCairo][AcceleratedCompositing] Rendering issues on
www.bbc.com."
​https://bugs.webkit.org/show_bug.cgi?id=154912
​http://trac.webkit.org/changeset/197693

12:05 AM Changeset in webkit [198266] by commit-queue@webkit.org
  • 7 edits in trunk/Source

Unreviewed, rolling out r196803.
​https://bugs.webkit.org/show_bug.cgi?id=155534

Introduced several rendering issues in popular websites
(Requested by KaL on #webkit).

Reverted changeset:

"[GTK] Limit the number of tiles according to the visible
area"
​https://bugs.webkit.org/show_bug.cgi?id=126122
​http://trac.webkit.org/changeset/196803

12:02 AM Changeset in webkit [198265] by rniwa@webkit.org
  • 11 edits
    2 adds in trunk/Websites/perf.webkit.org

Analysis task page should allow specifying commits that caused or fixed a regression or a progression
​https://bugs.webkit.org/show_bug.cgi?id=155529

Reviewed by Chris Dumez.

Added the capability to associate revisions that caused or fixed a progression or a regression for which
an analysis task was created. Added task_commits that stores this relationship and added the backend
support to retrieve this table in /api/analysis-tasks and an privileged API to update this table at
/privileged-api/associate-commit.

Also extracted a new component, MutableListView, out of AnalysisTaskPage to render and manipulate a list
of mutable items, and used it to render the list of associated bugs and commits. The view takes a list of
kinds (e.g. repositories or bug trackers), and accepts a pair of a kind and arbitrary text as a new item
value.

  • init-database.sql: Added task_commits table.
  • public/api/analysis-tasks.php:

(main):
(fetch_associated_data_for_tasks): Renamed from fetch_and_push_bugs_to_tasks now that it also fetches
the list of commits associated with each analysis task by calling CommitLogFetcher::fetch_for_tasks.
Also fixe the bug that we were not taking
(format_task): No longer sets 'category' since the computation of category now depends on the list of
commits associated with this analysis task which aren't available until fetch_associated_data_for_tasks.
(determine_category): Added. Categorize any analysis tasks with "fixes" commits as "closed" and "causes"
commits as "identified".

  • public/include/commit-log-fetcher.php:

(CommitLogFetcher::construct): Remove the unused instance variable.
(CommitLogFetcher::fetch_for_tasks): Added. Fetches all commits associated with a list of analysis tasks.
Assumes the caller (fetch_associated_data_for_tasks) had setup "fixes" and "causes" fields on each task.

  • public/privileged-api/associate-commit.php: Added. Updates task_commits table to associate or disassociate

a commit with an analysis task. When the specified analysis task and the specified commit are already
associated, we simply update the table instead of adding a duplicating entry or error. For dissociation,
the front-end specifies the commit ID.
(main): Added.

  • public/v3/index.html:
  • public/v3/components/mutable-list-view.js: Added. Used by the list associated bugs and commits.

(MutableListView): Added.
(MutableListView.prototype.setList): Added.
(MutableListView.prototype.setKindList): Added.
(MutableListView.prototype.setAddCallback): Added. This callback is invoked when the user tries to add
a new item to the list.
(MutableListView.prototype.render): Added.
(MutableListView.prototype._submitted): Added.
(MutableListView.cssTemplate):
(MutableListView.htmlTemplate):
(MutableListItem): Added. RemovalLink could be a hyperlink or a callback and gets involved when the user
tries to delete this item.
(MutableListItem.prototype.content):

  • public/v3/models/analysis-task.js:

(AnalysisTask): Added the support of the list of commits that fixed and caused changes.
(AnalysisTask.prototype.updateSingleton): Ditto.
(AnalysisTask.prototype.causes): Added.
(AnalysisTask.prototype.fixes): Added.
(AnalysisTask.prototype.associateCommit): Added. Use the API added at /privileged-api/associate-commit
to associate a new commit with this analysis task. Each commit has either caused or fixed the change.
(AnalysisTask.prototype.dissociateCommit): Added. Use the same API to disassociate each commit.
(AnalysisTask._constructAnalysisTasksFromRawData): Find all commits associated with each analysis task.
Because commit log objects use a fake ID fdue to /api/measurement-set not providing commit IDs, we must
use CommitLog.findByRemoteId to find each commit instead of usual CommitLog.findById.
(AnalysisTask._constructAnalysisTasksFromRawData.resolveCommits): Added.

  • public/v3/models/build-request.js:

(BuildRequest.prototype.hasFinished): Renamed from hasCompleted since it was confusing for this._status
being "completed" wasn't a necessary condition for this function to return true.

  • public/v3/models/commit-log.js:

(CommitLog): Added the static map for actual commit ID instead of a fake ID created in ensureSingleton.
(CommitLog.prototype.remoteId): Added. Returns the real commit ID.
(CommitLog.findByRemoteId): Added. Finds an CommitLog object using the real ID.

  • public/v3/models/test-group.js:

(TestGroup.prototype.hasFinished): Renamed from hasCompleted to match the rename in BuildRequest.

  • public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage): Added lists for the commits that fixed and caused the change using MutableListView.
Also adopted MutableListView for the list of associated bugs.
(AnalysisTaskPage.prototype.render): Added the code to populate the newly added lists.
(AnalysisTaskPage.prototype._makeCommitListItem): Added.
(AnalysisTaskPage.prototype._associateBug): Now this is a callback from MutableListView.
(AnalysisTaskPage.prototype._associateCommit): Added.
(AnalysisTaskPage.prototype._dissociateCommit): Added.
(AnalysisTaskPage.htmlTemplate):
(AnalysisTaskPage.cssTemplate):

  • public/v3/remote.js:

(getJSON): Spit out the entire responseText when JSON failed to parse to make debugging easier.

Mar 15, 2016:

11:48 PM Changeset in webkit [198264] by commit-queue@webkit.org
  • 2 edits in trunk/Source/JavaScriptCore

[JSC] Remove hint from SlowCaseEntry
​https://bugs.webkit.org/show_bug.cgi?id=155530

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-15
Reviewed by Alex Christensen.

  • jit/JIT.h:

(JSC::SlowCaseEntry::SlowCaseEntry):

11:30 PM Changeset in webkit [198263] by bshafiei@apple.com
  • 1 copy in tags/Safari-601.5.17.2.1

New tag.

11:26 PM Changeset in webkit [198262] by bshafiei@apple.com
  • 2 edits in branches/safari-601-branch/Source/WebKit/win

Merged r198244. rdar://problem/25181891

11:25 PM Changeset in webkit [198261] by bshafiei@apple.com
  • 5 edits in branches/safari-601.5.17.2-branch/Source

Versioning.

11:23 PM Changeset in webkit [198260] by bshafiei@apple.com
  • 2 edits in branches/safari-601.5.17.2-branch/Source/WebKit/win

Merged r198244. rdar://problem/25181891

11:22 PM Changeset in webkit [198259] by bshafiei@apple.com
  • 5 edits in branches/safari-601.5.17.2-branch/Source

Versioning.

11:18 PM Changeset in webkit [198258] by bshafiei@apple.com
  • 1 copy in branches/safari-601.5.17.2-branch

New Branch.

8:31 PM Changeset in webkit [198257] by BJ Burg
  • 4 edits in trunk/Source/JavaScriptCore

REGRESSION(r198077): generated Objective-C protocol object getters leak their wrappers
​https://bugs.webkit.org/show_bug.cgi?id=155523
<rdar://problem/25181764>

Reviewed by Joseph Pecoraro.

Since the code may not be compiled with ARC, autorelease the returned wrapper.

  • inspector/scripts/codegen/objc_generator.py:

(ObjCGenerator.protocol_to_objc_expression_for_member):

  • inspector/scripts/tests/expected/type-declaration-object-type.json-result:
  • inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
7:16 PM Changeset in webkit [198256] by commit-queue@webkit.org
  • 6 edits in trunk/Source/JavaScriptCore

[JSC] Help clang generate better code on arrayProtoFuncToString()
​https://bugs.webkit.org/show_bug.cgi?id=155512

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-15
Reviewed by Mark Lam.

3d-raytrace hits Array.toString() hard with small arrays.
Half of the time is going into overhead around the StringJoiner.
This patch makes the function shorter and the layout better.

  • runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncToString):
Add "UNLIKELY" on rare cases. Clang pushes that code to the tail.

Factor the code of jsMakeNontrivialString() so that the operation
is not duplicated in the function.

  • runtime/JSStringBuilder.h:

(JSC::jsMakeNontrivialString):
jsNontrivialString() supports r-value reference.
Move the result string into jsNontrivialString(), this removes
the deref+destructor from the function.

  • runtime/JSStringJoiner.cpp:

(JSC::JSStringJoiner::~JSStringJoiner):
The destructor is pretty large. No point in inlining it.

(JSC::joinStrings):

  • runtime/JSStringJoiner.h:

(JSC::JSStringJoiner::JSStringJoiner):
(JSC::JSStringJoiner::append):
The calls were duplicated. That's unnecessary.

  • runtime/NumericStrings.h:

(JSC::NumericStrings::add):
Return a reference in all cases.
This removes a deref+destructor.

6:51 PM Changeset in webkit [198255] by Alan Bujtas
  • 13 edits
    2 deletes in trunk

Remove overflow: -webkit-marquee
​https://bugs.webkit.org/show_bug.cgi?id=155517
<rdar://problem/25028481>

Reviewed by Simon Fraser.

This patch is based on Blink patch from ​jchaffraix@chromium.org (​https://src.chromium.org/viewvc/blink?revision=151756&view=revision)

Source/WebCore:

  • css/CSSParser.cpp:

(WebCore::isValidKeywordPropertyAndValue):

  • css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Deleted.
(WebCore::CSSPrimitiveValue::operator EOverflow): Deleted.

  • css/CSSValueKeywords.in:
  • css/StyleResolver.cpp:

(WebCore::StyleResolver::adjustRenderStyle):

  • css/html.css:

(marquee): Deleted.

  • rendering/RenderBox.cpp:

(WebCore::RenderBox::sizesLogicalWidthToFitContent):

  • rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo):
(WebCore::RenderLayer::updateScrollInfoAfterLayout):
(WebCore::RenderLayer::calculateClipRects):

  • rendering/RenderLayer.h:
  • rendering/RenderMarquee.h:
  • rendering/style/RenderStyleConstants.h:

LayoutTests:

  • fast/css/getPropertyValue-webkit-marquee.html:
  • fast/css/webkit-marquee-anonymous-node-crash-expected.txt: Removed.
  • fast/css/webkit-marquee-anonymous-node-crash.html: Removed.
6:45 PM Changeset in webkit [198254] by jdiggs@igalia.com
  • 11 edits in trunk

AX: Expose pointers to SVG elements referenced by aria-labelledby
​https://bugs.webkit.org/show_bug.cgi?id=155481

Reviewed by Chris Fleizach.

Source/WebCore:

Expose elements referenced by aria-labelledby via ATK_RELATION_LABELLED_BY.
Stop calling the supportsARIA* methods before getting the elements referred
to by the associated ARIA property in the accessible wrapper for ATK and
the inspector: Getting the elements will be just as fast when there are no
such elements, and faster when there are.

Modified the w3c-svg-name-calculation.html test to include AXTitleUIElement
in its output.

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::supportsARIAAttributes):
(WebCore::AccessibilityObject::ariaElementsFromAttribute): Added.
(WebCore::AccessibilityObject::ariaControlsElements): Added.
(WebCore::AccessibilityObject::ariaDescribedByElements): Added.
(WebCore::AccessibilityObject::ariaFlowToElements): Added.
(WebCore::AccessibilityObject::ariaLabelledByElements): Added.
(WebCore::AccessibilityObject::ariaOwnsElements): Added.

  • accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::ariaOwnsElements): No longer virtual.
(WebCore::AccessibilityObject::supportsARIAFlowTo): Deleted.
(WebCore::AccessibilityObject::ariaFlowToElements): No longer virtual.
(WebCore::AccessibilityObject::supportsARIADescribedBy): Deleted.
(WebCore::AccessibilityObject::ariaDescribedByElements): No longer virtual.
(WebCore::AccessibilityObject::supportsARIAControls): Deleted.
(WebCore::AccessibilityObject::ariaControlsElements): No longer virtual.

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::ariaElementsFromAttribute): Moved to AccessibilityObject.
(WebCore::AccessibilityRenderObject::supportsARIAFlowTo): Deleted.
(WebCore::AccessibilityRenderObject::ariaFlowToElements): Moved to AccessibilityObject.
(WebCore::AccessibilityRenderObject::supportsARIADescribedBy): Deleted.
(WebCore::AccessibilityRenderObject::ariaDescribedByElements): Moved to AccessibilityObject.
(WebCore::AccessibilityRenderObject::supportsARIAControls): Deleted.
(WebCore::AccessibilityRenderObject::ariaControlsElements): Moved to AccessibilityObject.
(WebCore::AccessibilityRenderObject::ariaOwnsElements): Moved to AccessibilityObject.

  • accessibility/AccessibilityRenderObject.h:
  • accessibility/atk/WebKitAccessibleWrapperAtk.cpp:

(setAtkRelationSetFromCoreObject):

  • inspector/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):

LayoutTests:

  • accessibility/w3c-svg-name-calculation.html: Modified to also output AXTitleUIElement.
  • platform/gtk/accessibility/w3c-svg-name-calculation-expected.txt: Updated.
  • platform/mac/accessibility/w3c-svg-name-calculation-expected.txt: Updated.
6:07 PM Changeset in webkit [198253] by commit-queue@webkit.org
  • 2 edits in trunk/Source/JavaScriptCore

Remove stale ArrayPrototype declarations
​https://bugs.webkit.org/show_bug.cgi?id=155520

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-15
Reviewed by Mark Lam.

  • runtime/ArrayPrototype.cpp:

The implementations went away when the methods were moved to builtins
but the declarations were left behind.

6:02 PM Changeset in webkit [198252] by oliver@apple.com
  • 4 edits in trunk/Source/JavaScriptCore

Rename performJITMemcpy to something more inline with our normal webkit function names
​https://bugs.webkit.org/show_bug.cgi?id=155525

Reviewed by Saam Barati.

Simple bulk search/replace with a better name.

  • assembler/ARM64Assembler.h:

(JSC::ARM64Assembler::fillNops):
(JSC::ARM64Assembler::replaceWithJump):
(JSC::ARM64Assembler::replaceWithLoad):
(JSC::ARM64Assembler::replaceWithAddressComputation):
(JSC::ARM64Assembler::setPointer):
(JSC::ARM64Assembler::repatchInt32):
(JSC::ARM64Assembler::repatchCompact):
(JSC::ARM64Assembler::linkJumpOrCall):
(JSC::ARM64Assembler::linkCompareAndBranch):
(JSC::ARM64Assembler::linkConditionalBranch):
(JSC::ARM64Assembler::linkTestAndBranch):

  • assembler/LinkBuffer.cpp:

(JSC::LinkBuffer::copyCompactAndLinkCode):

  • jit/ExecutableAllocator.h:

(JSC::writeToExecutableRegion):
(JSC::performJITMemcpy): Deleted.

5:45 PM Changeset in webkit [198251] by jer.noble@apple.com
  • 2 edits in trunk/Source/WebKit/mac

[ios-sim debug] API test WebKit1.AudioSessionCategoryIOS timing out
​https://bugs.webkit.org/show_bug.cgi?id=155275

Reviewed by Alexey Proskuryakov.

The videoPlaybackRequiresUserGesture and audioPlaybackRequiresUserGesture should both defalut to
NO, so that legacy clients of -[UIWebView setMediaPlaybackRequiresUserAction:] continue to work
as expected.

  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]):

5:22 PM Changeset in webkit [198250] by matthew_hanson@apple.com
  • 2 edits in branches/safari-601.1.46-branch/Source/WebKit2

Merge r195982. rdar://problem/24560759

5:22 PM Changeset in webkit [198249] by matthew_hanson@apple.com
  • 4 edits
    1 add in branches/safari-601.1.46-branch

Merge r194060. rdar://problem/24560757

5:22 PM Changeset in webkit [198248] by matthew_hanson@apple.com
  • 4 edits in branches/safari-601.1.46-branch/Source/WebCore

Merge r197125. rdar://problem/24860685

5:22 PM Changeset in webkit [198247] by matthew_hanson@apple.com
  • 2 edits in branches/safari-601.1.46-branch/Source/WebCore

Merge r196670. rdar://problem/24860681

5:22 PM Changeset in webkit [198246] by matthew_hanson@apple.com
  • 19 edits
    2 adds in branches/safari-601.1.46-branch

Merge r196268. rdar://problem/24748259

5:02 PM Changeset in webkit [198245] by enrica@apple.com
  • 2 edits in trunk/Source/WebKit2

Follow up to r195769.
​https://bugs.webkit.org/show_bug.cgi?id=155519
rdar://problem/25146483

Reviewed by Tim Horton.

There are two code paths that lead to calling handleSyntheticClick()
where we need to check if the default action can be performed on the
data detector link.
Only one was covered in r195769 and this patch addresses the missing one.
I've also discovered that the point reported in DidNotHandleTapAsClick was
incorrectly always (0, 0) and I've fixed it.

  • WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::handleTap):

5:00 PM Changeset in webkit [198244] by Brent Fulgham
  • 2 edits in trunk/Source/WebKit/win

[Win] Correct double-release of CFURLConnectionRef
​https://bugs.webkit.org/show_bug.cgi?id=155515
<rdar://problem/25159143>

Reviewed by Tim Horton.

Tested by http/tests/download suite.

  • WebDownloadCFNet.cpp: Remove extra CFRelease.
4:59 PM Changeset in webkit [198243] by Simon Fraser
  • 2 edits in trunk/Source/WebCore

Occasional crash under GraphicsContext::platformContext() when dragging Google maps
​https://bugs.webkit.org/show_bug.cgi?id=155521
rdar://problem/24357307

Reviewed by Tim Horton.

It's possible for createDragImageForSelection() to return a null image, if the bounds
of the selection are an empty rect. That would cause a crash under convertImageToBitmap()
because a zero-sized ShareableBitmap will return a null GraphicsContext.

To avoid this, early return from DragController::startDrag() if the dragImage is null.

I wasn't able to come up with a test for this.

  • page/DragController.cpp:

(WebCore::DragController::startDrag):

4:51 PM Changeset in webkit [198242] by timothy_horton@apple.com
  • 2 edits in trunk/Tools

[iOS Simulator] Test result snapshots are upside down
​https://bugs.webkit.org/show_bug.cgi?id=154761

Reviewed by Simon Fraser.

  • WebKitTestRunner/cg/TestInvocationCG.cpp:

(WTR::createCGContextFromImage):
(WTR::TestInvocation::dumpPixelsAndCompareWithExpected):
In r97104, Simon added code to take WindowServer snapshots, which came
in flipped, and added code to flip them back. At this point, WindowServer
snapshots got flipped, and software snapshots did not.

In r140067, Simon noticed that WindowServer ref test images were upside-down
on Mac (not sure why this changed), so turned off the flipping code (but
didn't delete it!). Now, WindowServer snapshots and software snapshots both
are not flipped.

In r190304, Carlos added an enum for the source of the snapshot ("WebView"
for window server snapshots, and "WebContent" for software snapshots),
and - critically - changed the flipping logic to flip software snapshots!

We didn't notice this on Mac because at this point we've made it so that
we *always* have WindowServer snapshots, but on iOS we still don't have
WindowServer snapshots, so now they're flipped.

And that's how we got here.

To restore the behavior from r140067, and correctly unflip snapshots on
iOS, just delete this code.

4:29 PM Changeset in webkit [198241] by oliver@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

Improved build fix.

4:24 PM Changeset in webkit [198240] by mark.lam@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

Gardening: build fix after r198235.

Not Reviewed.

  • jit/ExecutableAllocatorFixedVMPool.cpp:

(JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):

4:13 PM Changeset in webkit [198239] by timothy_horton@apple.com
  • 12 edits
    2 adds in trunk

iOS <attachment> element should allow customization of action text color
​https://bugs.webkit.org/show_bug.cgi?id=155513
<rdar://problem/24805991>

Reviewed by Simon Fraser.

Test: fast/attachment/attachment-action.html

  • css/html.css:

(attachment):
On iOS (the only place it is used), <attachment> color should default to system blue.

  • rendering/RenderThemeIOS.mm:

(WebCore::attachmentActionColor):
(WebCore::AttachmentInfo::AttachmentInfo):
Make use of the <attachment>'s CSS color for the action text.
This is a little weird because there are multiple bits of text in an
<attachment>, but only the action text ever changes color.

  • fast/attachment/attachment-action-expected.html: Added.
  • fast/attachment/attachment-action.html: Added.
  • platform/ios-simulator/fast/attachment/attachment-label-highlight-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-progress-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-rendering-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-select-on-click-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-select-on-click-inside-user-select-all-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-subtitle-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-title-expected.txt:

Rebaseline some tests and add one that action text matches the requested color.

4:10 PM Changeset in webkit [198238] by Alan Bujtas
  • 9 edits in trunk/Source/WebCore

Delay HTMLFormControlElement::focus() call until after layout is finished.
​https://bugs.webkit.org/show_bug.cgi?id=155503
<rdar://problem/24046635>

Reviewed by Simon Fraser.

Calling focus on a form element can trigger arbitrary JS code which could interfere with
the ongoing layout.
This patch delays HTMLFormControlElement::focus() call until after layout is finished.
If we are currently not in the middle of a layout, HTMLFormControlElement::focus() is delayed until
after style resolution is done.

Covered by LayoutTests/fast/dom/adopt-node-crash-2.html

  • accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::updateBackingStore):

  • dom/Document.cpp:

(WebCore::Document::updateStyleIfNeeded):
(WebCore::Document::updateLayout):
(WebCore::Document::updateLayoutIfDimensionsOutOfDate):

  • html/HTMLEmbedElement.cpp:

(WebCore::HTMLEmbedElement::renderWidgetLoadingPlugin):

  • html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::didAttachRenderers):

  • page/FrameView.cpp:

(WebCore::FrameView::layout):
(WebCore::FrameView::queuePostLayoutCallback):
(WebCore::FrameView::flushPostLayoutTasksQueue):
(WebCore::FrameView::performPostLayoutTasks):
(WebCore::FrameView::sendResizeEventIfNeeded):

  • page/FrameView.h:
  • rendering/RenderBox.cpp:

(WebCore::RenderBox::imageChanged):

  • rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo):

3:57 PM Changeset in webkit [198237] by Ryan Haddad
  • 2 edits in trunk/Source/WebKit2

Unreviewed, rolling out r198230.

This change caused LayoutTests to fail on Mac

Reverted changeset:

"REGRESSION (r194660): Navigating to HTTPS sites may fail with
error"
​https://bugs.webkit.org/show_bug.cgi?id=155455
​http://trac.webkit.org/changeset/198230

3:46 PM Changeset in webkit [198236] by Simon Fraser
  • 2 edits
    7 adds in trunk/PerformanceTests

Add developer Animometer test that bounces P3-tagged images
​https://bugs.webkit.org/show_bug.cgi?id=155511

Reviewed by Tim Horton.

Add a test for rendering performance of tagged images. The 5 images are tagged
with the Display P3 colorspace.

  • Animometer/resources/debug-runner/tests.js:
  • Animometer/tests/bouncing-particles/bouncing-tagged-images.html: Added.
  • Animometer/tests/bouncing-particles/resources/bouncing-tagged-images.js: Added.
  • Animometer/tests/bouncing-particles/resources/image1.jpg: Added.
  • Animometer/tests/bouncing-particles/resources/image2.jpg: Added.
  • Animometer/tests/bouncing-particles/resources/image3.jpg: Added.
  • Animometer/tests/bouncing-particles/resources/image4.jpg: Added.
  • Animometer/tests/bouncing-particles/resources/image5.jpg: Added.
3:44 PM Changeset in webkit [198235] by oliver@apple.com
  • 16 edits in trunk/Source

Remove compile time define for SEPARATED_HEAP
​https://bugs.webkit.org/show_bug.cgi?id=155508

Reviewed by Mark Lam.

Source/JavaScriptCore:

This removes the compile time define for the SEPARATED_HEAP
feature, and moves to a default-off runtime preference.

This happily also removes the need for world rebuilds while
bringing it up on different platforms.

  • Configurations/FeatureDefines.xcconfig:
  • assembler/LinkBuffer.cpp:

(JSC::LinkBuffer::copyCompactAndLinkCode):

  • jit/ExecutableAllocator.h:

(JSC::performJITMemcpy):

  • jit/ExecutableAllocatorFixedVMPool.cpp:

(JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
(JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
(JSC::FixedVMPoolExecutableAllocator::genericWriteToJITRegion):
(JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): Deleted.

  • runtime/Options.cpp:

(JSC::recomputeDependentOptions):

  • runtime/Options.h:

Source/WebCore:

Remove the feature define.

  • Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

Remove the feature define.

  • Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Remove the feature define.

  • Configurations/FeatureDefines.xcconfig:

Source/WTF:

Remove the feature define.

  • wtf/FeatureDefines.h:
  • wtf/Platform.h:
3:42 PM Changeset in webkit [198234] by rniwa@webkit.org
  • 2 edits
    1 add in trunk/Websites/perf.webkit.org

Extract the code to format commit logs into its own PHP file
​https://bugs.webkit.org/show_bug.cgi?id=155514

Rubber-stamped by Chris Dumez.

Extracted CommitLogFetcher out of /api/commits so that it could be used in analysis-tasks.php
in the future to support associating cause/fix for each analysis task.

  • public/api/commits.php:
  • public/include/commit-log-fetcher.php: Added.

(CommitLogFetcher)
(CommitLogFetcher::construct): Added.
(CommitLogFetcher::repository_id_from_name): Added.
(CommitLogFetcher::fetch_between): Added.
(CommitLogFetcher::fetch_oldest): Added.
(CommitLogFetcher::fetch_latest): Added.
(CommitLogFetcher::fetch_last_reported): Added.
(CommitLogFetcher::fetch_revision): Added.
(CommitLogFetcher::commit_for_revision): Added.
(CommitLogFetcher::format_single_commit): Added.
(CommitLogFetcher::format_commit): Added.

3:38 PM Changeset in webkit [198233] by commit-queue@webkit.org
  • 6 edits in trunk

Unreviewed, rolling out r198148.
​https://bugs.webkit.org/show_bug.cgi?id=155518

"Lets do this patch at a later time" (Requested by saamyjoon
on #webkit).

Reverted changeset:

"[ES6] Disallow var assignments in for-in loops"
​https://bugs.webkit.org/show_bug.cgi?id=155451
​http://trac.webkit.org/changeset/198148

3:22 PM Changeset in webkit [198232] by ap@apple.com
  • 2 edits in trunk/LayoutTests

Test result gardening for
ASSERT_NOT_REACHED on imported/w3c/web-platform-tests/html/semantics/embedded-content/the-area-element/area-coords.html
​https://bugs.webkit.org/show_bug.cgi?id=155516

  • TestExpectations: Skip the test in debug, as it's not useful to crash every time.
3:04 PM Changeset in webkit [198231] by ap@apple.com
  • 2 edits in trunk/Tools

run-api-tests doesn't print test name when the test crashes
​https://bugs.webkit.org/show_bug.cgi?id=155476

Reviewed by Daniel Bates.

  • Scripts/run-api-tests: Print "UNEXPECTEDLY EXITED" with a test name when output

doesn't contain the test name yet. Changed test name output to always be before raw
stdout for clarity.

2:55 PM Changeset in webkit [198230] by dbates@webkit.org
  • 2 edits in trunk/Source/WebKit2

REGRESSION (r194660): Navigating to HTTPS sites may fail with error
​https://bugs.webkit.org/show_bug.cgi?id=155455
<rdar://problem/24308793>

Reviewed by Alexey Proskuryakov.

Fixes an issue where navigating to an HTTPS site may fail because the Security Framework uses
a cache directory that it does not have permission to use.

  • Shared/mac/ChildProcessMac.mm:

(WebKit::codeSigningIdentifierForProcess): Queries the Security Framework for the code signed
bundle identifier/code signing identifier.
(WebKit::ChildProcess::initializeSandbox): Use the client identifier as part of the user directory
suffix. Verify that the client identifier matches the code signed bundled identifier/code
signing identifier for the code signed app/tool. Fix minor code style issue; use a C++-style cast
instead of a C-style cast when casting an OSStatus to a long.
(WebKit::findSecCodeForProcess): Deleted; incorporated logic into WebKit::codeSigningIdentifierForProcess().

2:48 PM Changeset in webkit [198229] by commit-queue@webkit.org
  • 4 edits in trunk

REGRESSION: ASSERTION FAILED: !m_lastActiveBlock on js/function-apply.html
​https://bugs.webkit.org/show_bug.cgi?id=155411
<rdar://problem/25134537>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-15
Reviewed by Mark Lam.

Source/JavaScriptCore:

  • heap/Heap.cpp:

(JSC::Heap::collectImpl):
(JSC::Heap::didFinishCollection):
During collection allocators are stop/reset. The HeapProfiler tasks
were using HeapIterationScope (to satisfy MarkedSpace forEachCell API
contracts) which was doing its own stop/resume of allocators. Doing a
stop/resume in between the normal stop/reset of collection is unexpected.

Move this to didFinishCollection, alongside other heap iterations
like zombies and immortal objects. Putting this after those tasks
also means the heap snapshots will respect the zombies/immortal options
when deciding if the cell is alive or not.

LayoutTests:

  • platform/mac/TestExpectations:

Unmark test as flakey.

1:41 PM Changeset in webkit [198228] by sbarati@apple.com
  • 13 edits in trunk/Source/JavaScriptCore

We should have different JSTypes for JSGlobalLexicalEnvironment and JSLexicalEnvironment and JSModuleEnvironment
​https://bugs.webkit.org/show_bug.cgi?id=152406

Reviewed by Mark Lam.

This makes testing for a JSGlobalLexicalEnvironment faster
because we can just check the Cell's type instead of using
jsDynamicCast. I also changed code that does jsDynamicCast<JSGlobalObject*>
instead of isGlobalObject().

  • interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

  • jit/JITOperations.cpp:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):

  • runtime/JSGlobalLexicalEnvironment.h:

(JSC::JSGlobalLexicalEnvironment::createStructure):

  • runtime/JSLexicalEnvironment.h:

(JSC::JSLexicalEnvironment::createStructure):
(JSC::JSLexicalEnvironment::JSLexicalEnvironment):

  • runtime/JSModuleEnvironment.h:

(JSC::JSModuleEnvironment::createStructure):
(JSC::JSModuleEnvironment::offsetOfModuleRecord):

  • runtime/JSObject.h:

(JSC::JSObject::isGlobalObject):
(JSC::JSObject::isJSLexicalEnvironment):
(JSC::JSObject::isGlobalLexicalEnvironment):
(JSC::JSObject::isErrorInstance):

  • runtime/JSScope.cpp:

(JSC::abstractAccess):
(JSC::isUnscopable):
(JSC::JSScope::resolve):
(JSC::JSScope::collectVariablesUnderTDZ):
(JSC::JSScope::isVarScope):
(JSC::JSScope::isLexicalScope):
(JSC::JSScope::isModuleScope):
(JSC::JSScope::isCatchScope):
(JSC::JSScope::isFunctionNameScopeObject):
(JSC::JSScope::isNestedLexicalScope):
(JSC::JSScope::constantScopeForCodeBlock):
(JSC::isScopeType): Deleted.
(JSC::JSScope::isGlobalLexicalEnvironment): Deleted.

  • runtime/JSScope.h:
  • runtime/JSType.h:
1:31 PM Changeset in webkit [198227] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Fixing expectation for css3/masking/mask-svg-script-none-to-png.html on ios-simulator

Unreviewed test gardening.

  • platform/ios-simulator/TestExpectations:
1:27 PM Changeset in webkit [198226] by timothy_horton@apple.com
  • 12 edits in trunk/LayoutTests

Unskip and rebaseline <attachment> tests on iOS
<rdar://problem/24805991>

  • fast/attachment/attachment-default-icon.html:
  • fast/attachment/attachment-folder-icon.html:
  • fast/attachment/attachment-type-attribute.html:

Make these tests have identical titles between ref and actual, because
on iOS the layout differs if you have a title or not (unlike on Mac).

  • platform/ios-simulator/TestExpectations:
  • platform/ios-simulator/fast/attachment/attachment-label-highlight-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-progress-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-rendering-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-select-on-click-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-select-on-click-inside-user-select-all-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-subtitle-expected.txt:
  • platform/ios-simulator/fast/attachment/attachment-title-expected.txt:

Unskip and rebaseline all but one of the attachment tests on iOS.

1:01 PM Changeset in webkit [198225] by Chris Dumez
  • 2 edits in trunk/Source/WebCore

Restore pre-r197244 behavior on Mac
​https://bugs.webkit.org/show_bug.cgi?id=155507
<rdar://problem/25174132>

Reviewed by Gavin Barraclough.

<​http://trac.webkit.org/changeset/197244> changed the session restore
behavior to disallow stale content on all platforms except iOS.
We would also like to maintain the behavior on Mac for performance
reasons and consistency between iOS and Mac.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadDifferentDocumentItem):

12:46 PM Changeset in webkit [198224] by Antti Koivisto
  • 2 edits in trunk/Source/WebKit2

Add Antti to WebKit2 Owners file
​https://bugs.webkit.org/show_bug.cgi?id=155504

Reviewed by Anders Carlsson and Sam Weinig.

  • Owners:
12:45 PM Changeset in webkit [198223] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebCore

<attachment> on iOS isn't quite vertically centered
​https://bugs.webkit.org/show_bug.cgi?id=155502
<rdar://problem/24805991>

Reviewed by Beth Dakin.

No new tests; there are existing tests that will be enabled shortly.

  • rendering/RenderThemeIOS.mm:

(WebCore::AttachmentInfo::AttachmentInfo):
We were overcounting the total height of the attachment content by one margin, because each item
would add in its margin, including the last one. Remove one margin.

12:43 PM Changeset in webkit [198222] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Remove flaky expectation for webgl/1.0.2/conformance/rendering/gl-scissor-test.html for mac
​https://bugs.webkit.org/show_bug.cgi?id=126586

Unreviewed test gardening.

  • platform/mac/TestExpectations:
12:24 PM Changeset in webkit [198221] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Fixing a typo in the ios-simulator TestExpectations file

Unreviewed test gardening.

  • platform/ios-simulator/TestExpectations:
12:15 PM Changeset in webkit [198220] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking animations/3d/transform-origin-vs-functions.html as flaky on ios-simulator-wk2
​https://bugs.webkit.org/show_bug.cgi?id=155501

Unreviewed test gardening.

  • platform/ios-simulator-wk2/TestExpectations:
12:03 PM Changeset in webkit [198219] by Chris Fleizach
  • 3 edits
    2 adds in trunk

AX: certain elements not included in accessibility tree
​https://bugs.webkit.org/show_bug.cgi?id=155480

Reviewed by Beth Dakin.

Source/WebCore:

This test case exposed a hole in the nextSibling logic where you can get into a state where we skip content.
The fix is to check if an inline element continuation has no sibling, to fall back on to the parent case to see if that has a sibling.

Test: accessibility/double-nested-inline-element-missing-from-tree.html

  • accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::nextSibling):

LayoutTests:

  • accessibility/double-nested-inline-element-missing-from-tree-expected.txt: Added.
  • accessibility/double-nested-inline-element-missing-from-tree.html: Added.
11:26 AM Changeset in webkit [198218] by Chris Dumez
  • 22 edits
    2 deletes in trunk

Unreviewed, rolling out r198203.

Favorites view is no longer loading on iOS

Reverted changeset:

"URL Parsing should signal failure for illegal IDN"
​https://bugs.webkit.org/show_bug.cgi?id=154945
​http://trac.webkit.org/changeset/198203

11:25 AM Changeset in webkit [198217] by timothy_horton@apple.com
  • 3 edits in trunk/Source/WebCore

<attachment> on iOS should use short and emphasized fonts
​https://bugs.webkit.org/show_bug.cgi?id=155485
<rdar://problem/24805991>

Reviewed by Simon Fraser.

No new tests; there are existing tests that will be enabled shortly.

  • rendering/RenderThemeIOS.mm:

(WebCore::attachmentActionFont):
(WebCore::attachmentTitleFont):
(WebCore::attachmentSubtitleFont):
(WebCore::AttachmentInfo::buildTitleLines):
(WebCore::AttachmentInfo::buildSingleLine):
(WebCore::AttachmentInfo::AttachmentInfo):
No need for UIFonts, we can use CoreText, and that allows us to ask for the
correct Short and Emphasized variants that we need.

10:26 AM Changeset in webkit [198216] by Antti Koivisto
  • 9 edits in trunk

Source/WebCore:
REGRESSION (196383): Class change invalidation does not handle :not correctly
​https://bugs.webkit.org/show_bug.cgi?id=155493
<rdar://problem/24846762>

Reviewed by Andreas Kling.

We fail to invalidate bar style in

:not(.foo) bar { }

when class foo is added or removed.

There is a logic error in the invalidation code. It assumes that class addition can only make new selectors match
and removal make them not match. This is not true when :not is present.

  • style/AttributeChangeInvalidation.h:

(WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):

  • style/ClassChangeInvalidation.cpp:

(WebCore::Style::ClassChangeInvalidation::invalidateStyle):

Invalidate style and collect full set of rules that may affect descendant style.

(WebCore::Style::ClassChangeInvalidation::invalidateDescendantStyle):

Invalidate with this set both before and after committing the changes.

(WebCore::Style::ClassChangeInvalidation::computeClassChange): Deleted.

  • style/ClassChangeInvalidation.h:

(WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
(WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

LayoutTests:
Class change invalidation does not handle :not correctly
​https://bugs.webkit.org/show_bug.cgi?id=155493
<rdar://problem/24846762>

Reviewed by Andreas Kling.

  • fast/css/style-invalidation-attribute-change-descendants-expected.txt:
  • fast/css/style-invalidation-attribute-change-descendants.html:

Also add :not case for attribute changes (which handles this correctly already).

  • fast/css/style-invalidation-class-change-descendants-expected.txt:
  • fast/css/style-invalidation-class-change-descendants.html:

Add :not case.

8:30 AM Changeset in webkit [198215] by bshafiei@apple.com
  • 5 edits in trunk/Source

Versioning.

8:28 AM Changeset in webkit [198214] by bshafiei@apple.com
  • 1 copy in tags/Safari-602.1.23

New tag.

8:27 AM Changeset in webkit [198213] by bshafiei@apple.com
  • 1 delete in tags/Safari-602.1.23

Delete tag.

8:26 AM Changeset in webkit [198212] by fpizlo@apple.com
  • 45 edits
    2 deletes in trunk/Source/JavaScriptCore

Remove the Baker barrier from JSC
​https://bugs.webkit.org/show_bug.cgi?id=155479

Reviewed by Saam Barati.

It's been a while since I added a Baker barrier, but I never followed it up with an actual
concurrent GC. While thinking about the GC, I became convinced that the right path forward
is to do a non-copying concurrent GC. That is, remove the copied space and just use the
marked space. The downside of using marked space cannot be more than the overhead of the
Baker barrier, so concurrent non-copying GC is definitely better than copying
non-concurrent GC. I also suspect that just plain non-copying non-concurrent GC is going to
be fine also, so the path forward will probably be to first just remove CopiedSpace.

Anyway, for now this patch just removes the Baker barrier. It was a cute implementation but
it just cost performance and I don't think we'll ever use it.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generate):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGArgumentsEliminationPhase.cpp:
  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGCopyBarrierOptimizationPhase.cpp: Removed.
  • dfg/DFGCopyBarrierOptimizationPhase.h: Removed.
  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

  • dfg/DFGHeapLocation.h:
  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThreadImpl):

  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileGetButterfly):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
(JSC::FTL::DFG::LowerDFGToB3::compileConstantStoragePointer):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
(JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
(JSC::FTL::DFG::LowerDFGToB3::getById):
(JSC::FTL::DFG::LowerDFGToB3::isFastTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetButterflyReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadButterflyWithBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::copyBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::isInToSpace): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadButterflyReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::removeSpaceBits): Deleted.

  • heap/CopyBarrier.h:

(JSC::CopyBarrierBase::CopyBarrierBase):
(JSC::CopyBarrierBase::operator bool):
(JSC::CopyBarrierBase::get):
(JSC::CopyBarrierBase::clear):
(JSC::CopyBarrierBase::setWithoutBarrier):
(JSC::CopyBarrier::CopyBarrier):
(JSC::CopyBarrier::get):
(JSC::CopyBarrier::set):
(JSC::CopyBarrier::setWithoutBarrier):
(JSC::CopyBarrierBase::operator!): Deleted.
(JSC::CopyBarrierBase::getWithoutBarrier): Deleted.
(JSC::CopyBarrierBase::getPredicated): Deleted.
(JSC::CopyBarrierBase::copyState): Deleted.
(JSC::CopyBarrierBase::setCopyState): Deleted.
(JSC::CopyBarrierBase::weakCASWithoutBarrier): Deleted.
(JSC::CopyBarrier::getWithoutBarrier): Deleted.
(JSC::CopyBarrier::getPredicated): Deleted.
(JSC::CopyBarrier::weakCASWithoutBarrier): Deleted.

  • heap/Heap.cpp:

(JSC::Heap::addToRememberedSet):
(JSC::Heap::collectAndSweep):
(JSC::Heap::copyBarrier): Deleted.

  • heap/Heap.h:

(JSC::Heap::writeBarrierBuffer):

  • jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::branchIfNotFastTypedArray):
(JSC::AssemblyHelpers::purifyNaN):
(JSC::AssemblyHelpers::loadTypedArrayVector): Deleted.

  • jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::branchStructure):
(JSC::AssemblyHelpers::addressForByteOffset):
(JSC::AssemblyHelpers::branchIfToSpace): Deleted.
(JSC::AssemblyHelpers::branchIfNotToSpace): Deleted.
(JSC::AssemblyHelpers::removeSpaceBits): Deleted.

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompile):

  • jit/JITOpcodes.cpp:

(JSC::JIT::emitSlow_op_has_indexed_property):
(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emitSlow_op_get_direct_pname):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emitSlow_op_get_direct_pname):

  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emitDoubleLoad):
(JSC::JIT::emitContiguousLoad):
(JSC::JIT::emitArrayStorageLoad):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emitIntTypedArrayGetByVal):
(JSC::JIT::emitFloatTypedArrayGetByVal):
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/DirectArguments.cpp:

(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::copyBackingStore):
(JSC::DirectArguments::overrideArgument):
(JSC::DirectArguments::copyToArguments):

  • runtime/DirectArguments.h:

(JSC::DirectArguments::canAccessIndexQuickly):
(JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG):

  • runtime/JSArray.cpp:

(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::fastSlice):
(JSC::JSArray::fastConcatWith):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):

  • runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::finalize):

  • runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::isNeutered):
(JSC::JSArrayBufferView::vector):
(JSC::JSArrayBufferView::length):

  • runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
(JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):

  • runtime/JSObject.cpp:

(JSC::JSObject::visitChildren):
(JSC::JSObject::copyBackingStore):
(JSC::JSObject::heapSnapshot):
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::setIndexQuicklyToUndecided):
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putIndexedDescriptor):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putDirectIndexBeyondVectorLength):
(JSC::JSObject::getNewVectorLength):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
(JSC::JSObject::growOutOfLineStorage):
(JSC::getBoundSlotBaseFunctionForGetterSetter):
(JSC::JSObject::getEnumerableLength):

  • runtime/JSObject.h:

(JSC::JSObject::getArrayLength):
(JSC::JSObject::getVectorLength):
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::canSetIndexQuicklyForPutDirect):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::hasSparseMap):
(JSC::JSObject::inSparseIndexingMode):
(JSC::JSObject::inlineStorage):
(JSC::JSObject::butterfly):
(JSC::JSObject::outOfLineStorage):
(JSC::JSObject::locationForOffset):
(JSC::JSObject::ensureInt32):
(JSC::JSObject::ensureDouble):
(JSC::JSObject::ensureContiguous):
(JSC::JSObject::ensureArrayStorage):
(JSC::JSObject::arrayStorage):
(JSC::JSObject::arrayStorageOrNull):
(JSC::JSObject::ensureLength):
(JSC::JSObject::putDirectWithoutTransition):

  • runtime/MapData.h:

(JSC::JSIterator>::IteratorData::next):
(JSC::JSIterator>::IteratorData::refreshCursor):

  • runtime/MapDataInlines.h:

(JSC::JSIterator>::find):
(JSC::JSIterator>::add):
(JSC::JSIterator>::remove):
(JSC::JSIterator>::replaceAndPackBackingStore):
(JSC::JSIterator>::replaceBackingStore):
(JSC::JSIterator>::ensureSpaceForAppend):
(JSC::JSIterator>::visitChildren):
(JSC::JSIterator>::copyBackingStore):

  • runtime/Options.h:
8:20 AM Changeset in webkit [198211] by jer.noble@apple.com
  • 5 edits
    2 adds in trunk

Video elements with autoplay do not begin playing when scrolling into view if InvisibleAutoplayNotPermitted is set.
​https://bugs.webkit.org/show_bug.cgi?id=155468

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/video-restricted-invisible-autoplay-allowed-when-visible.html

A few bugs came together to cause this behavior. We were not telling the media session that we were going to begin
the autoplaying state, we were not restoring the correct state when the interruption ended, and we were not checking
to see if we could actually play correctly when the interruption ended.

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::prepareForLoad):
(WebCore::HTMLMediaElement::canTransitionFromAutoplayToPlay):
(WebCore::HTMLMediaElement::setReadyState):
(WebCore::HTMLMediaElement::resumeAutoplaying):
(WebCore::HTMLMediaElement::updateShouldPlay):
(WebCore::elementCanTransitionFromAutoplayToPlay): Deleted.

  • html/HTMLMediaElement.h:
  • platform/audio/PlatformMediaSession.cpp:

(WebCore::PlatformMediaSession::endInterruption):

LayoutTests:

  • media/video-restricted-invisible-autoplay-allowed-when-visible-expected.txt: Added.
  • media/video-restricted-invisible-autoplay-allowed-when-visible.html: Added.
8:10 AM Changeset in webkit [198210] by Manuel Rego Casasnovas
  • 10 edits
    1 move in trunk/Source/WebCore

[css-grid] Rename GridCoordinate to GridArea
​https://bugs.webkit.org/show_bug.cgi?id=155489

Reviewed by Sergio Villar Senin.

As the comment in GridCoordinate states,
it actually represents a grid area as it stores
the initial and final positions in both axis (columns and rows).

Someone can think about a grid coordinate just like a single cell.
However this class was representing an area of several cells.

On top of that the "grid area" concept is defined in the spec:
​https://drafts.csswg.org/css-grid/#grid-area-concept

No new tests, no change of behavior.

  • WebCore.xcodeproj/project.pbxproj:
  • css/CSSGridTemplateAreasValue.cpp:

(WebCore::stringForPosition):

  • css/CSSGridTemplateAreasValue.h:
  • css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateAreasRow):

  • css/CSSParser.h:
  • rendering/RenderGrid.cpp:

(WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::placeItemsOnGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::clearGrid):
(WebCore::RenderGrid::cachedGridArea):
(WebCore::RenderGrid::cachedGridSpan):

  • rendering/RenderGrid.h:
  • rendering/style/GridArea.h: Renamed from Source/WebCore/rendering/style/GridCoordinate.h.

(WebCore::GridSpan::untranslatedDefiniteGridSpan):
(WebCore::GridSpan::translatedDefiniteGridSpan):
(WebCore::GridSpan::indefiniteGridSpan):
(WebCore::GridSpan::operator==):
(WebCore::GridSpan::integerSpan):
(WebCore::GridSpan::untranslatedResolvedInitialPosition):
(WebCore::GridSpan::untranslatedResolvedFinalPosition):
(WebCore::GridSpan::resolvedInitialPosition):
(WebCore::GridSpan::resolvedFinalPosition):
(WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
(WebCore::GridSpan::GridSpanIterator::operator unsigned&):
(WebCore::GridSpan::GridSpanIterator::operator*):
(WebCore::GridSpan::begin):
(WebCore::GridSpan::end):
(WebCore::GridSpan::isTranslatedDefinite):
(WebCore::GridSpan::isIndefinite):
(WebCore::GridSpan::translate):
(WebCore::GridSpan::GridSpan):
(WebCore::GridArea::GridArea):
(WebCore::GridArea::operator==):
(WebCore::GridArea::operator!=):

  • rendering/style/GridPositionsResolver.cpp:
  • rendering/style/StyleGridData.h:
7:21 AM Changeset in webkit [198209] by jh718.park@samsung.com
  • 2 edits in trunk/Source/WebCore

[GTK] Remove duplicate HashMap traversal and unneeded reference count churn in DataObjectGtk::forClipboard
​https://bugs.webkit.org/show_bug.cgi?id=155470

Reviewed by Carlos Garcia Campos.

No new tests, no new behaviours.

  • platform/gtk/DataObjectGtk.cpp:

(WebCore::DataObjectGtk::forClipboard):

3:42 AM Changeset in webkit [198208] by Gyuyoung Kim
  • 2 edits in trunk/Source/WebKit2

EFL build has been broken since r198180
​https://bugs.webkit.org/show_bug.cgi?id=155488

Unreviewed build fix.

  • WebProcess/UserContent/WebUserContentController.h: Use ENABLE(USER_MESSAGE_HANDLERS) guard.
3:38 AM Changeset in webkit [198207] by Manuel Rego Casasnovas
  • 7 edits
    2 moves in trunk/Source/WebCore

[css-grid] Rename GridResolvedPosition to GridPositionsResolver
​https://bugs.webkit.org/show_bug.cgi?id=155486

Reviewed by Sergio Villar Senin.

GridResolvedPosition is not storing a position (track or line) anymore.
Currently it's just a class wrapping the methods to resolve
grid positions from style.
Renamed the class to avoid confusions.

No new tests, no change of behavior.

  • CMakeLists.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/RenderGrid.cpp:

(WebCore::RenderGrid::placeItemsOnGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

  • rendering/RenderGrid.h:
  • rendering/style/GridCoordinate.h:
  • rendering/style/GridPositionsResolver.cpp: Renamed from Source/WebCore/rendering/style/GridResolvedPosition.cpp.

(WebCore::isColumnSide):
(WebCore::isStartSide):
(WebCore::initialPositionSide):
(WebCore::finalPositionSide):
(WebCore::gridLinesForSide):
(WebCore::implicitNamedGridLineForSide):
(WebCore::GridPositionsResolver::isNonExistentNamedLineOrArea):
(WebCore::adjustGridPositionsFromStyle):
(WebCore::GridPositionsResolver::explicitGridColumnCount):
(WebCore::GridPositionsResolver::explicitGridRowCount):
(WebCore::explicitGridSizeForSide):
(WebCore::lookAheadForNamedGridLine):
(WebCore::lookBackForNamedGridLine):
(WebCore::resolveNamedGridLinePositionFromStyle):
(WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::GridPositionsResolver::spanSizeForAutoPlacedItem):
(WebCore::resolveGridPositionFromStyle):
(WebCore::GridPositionsResolver::resolveGridPositionsFromStyle):

  • rendering/style/GridPositionsResolver.h: Renamed from Source/WebCore/rendering/style/GridResolvedPosition.h.
  • rendering/style/StyleAllInOne.cpp:
1:59 AM Changeset in webkit [198206] by sbarati@apple.com
  • 5 edits
    2 adds in trunk/Source/JavaScriptCore

Destructuring parameters are evaluated in the wrong scope
​https://bugs.webkit.org/show_bug.cgi?id=155454

Reviewed by Geoffrey Garen.

This patch makes our engine compatible with how parameter
lists are evaluated in ES6. A parameter list that contains
a rest parameter, any destructuring patterns, or default parameter values,
is classified as being non-simple. Non-simple parameter lists
must get their own scope to live in, and the variables in the
scope are under TDZ. This means that functions evaluated in the
parameter list don't have access to variables inside the function
body. Also, non-simple parameter lists get the strict-mode arguments object.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::~BytecodeGenerator):
(JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
(JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):

  • bytecompiler/BytecodeGenerator.h:
  • parser/Nodes.h:

(JSC::FunctionParameters::size):
(JSC::FunctionParameters::at):
(JSC::FunctionParameters::append):
(JSC::FunctionParameters::hasDefaultParameterValues): Deleted.

  • tests/es6.yaml:
  • tests/stress/parameter-scoping.js: Added.

(assert):
(test):
(test.foo):
(test.):

1:58 AM Changeset in webkit [198205] by commit-queue@webkit.org
  • 3 edits in trunk/Source/WebCore

Leak: Accelerated ImageBufferCairo doesn't destroy the used textures
​https://bugs.webkit.org/show_bug.cgi?id=155431

Patch by Miguel Gomez <​magomez@igalia.com> on 2016-03-15
Reviewed by Žan Doberšek.

When using the Cairo backend, add a destructor to ImageBufferData and use it to destroy the
textures created if the buffer is being accelerated.

No new tests, already covered by existing ones.

  • platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBufferData::ImageBufferData):
Store the renderingMode flag.
(WebCore::ImageBufferData::~ImageBufferData):
Destroy gl resources if renderingMode is accelerated.
(WebCore::ImageBuffer::ImageBuffer):
Pass renderingMode to the data class and use it fro checks instead of the function parameter.

  • platform/graphics/cairo/ImageBufferDataCairo.h:

Add destructor and a renderingMode flag.

1:49 AM Changeset in webkit [198204] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r198201 - REGRESSION (r197724): [GTK] Web Inspector: Images being blocked by CSP 2.0
​https://bugs.webkit.org/show_bug.cgi?id=155432

Reviewed by Darin Adler.

The GTK+ port Web Inspector uses GResources for all internal
resources (images, fonts, scripts, etc.) that are now blocked by
the CSP. GResouces are like data URLs in practice, so we should
always allow them.

  • page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar):

12:53 AM Changeset in webkit [198203] by jiewen_tan@apple.com
  • 22 edits
    2 adds in trunk

URL Parsing should signal failure for illegal IDN
​https://bugs.webkit.org/show_bug.cgi?id=154945
<rdar://problem/8014795>

Reviewed by Brent Fulgham.

Source/WebCore:

WebCore::URL will now invalidate URLs with illegal IDN. And functions inside WebCoreNSURLExtras.h
that deal with IDN mapping will now return nil to signal error.

Test: fast/url/invalid-idn.html

  • platform/URL.cpp:

(WebCore::isSchemeFirstChar):
(WebCore::URL::init):
(WebCore::appendEncodedHostname):
(WebCore::encodeHostnames):
(WebCore::encodeRelativeString):

  • platform/mac/WebCoreNSURLExtras.h:
  • platform/mac/WebCoreNSURLExtras.mm:

(WebCore::mapHostNameWithRange):
(WebCore::hostNameNeedsDecodingWithRange):
(WebCore::hostNameNeedsEncodingWithRange):
(WebCore::decodeHostNameWithRange):
(WebCore::encodeHostNameWithRange):
(WebCore::decodeHostName):
(WebCore::encodeHostName):
(WebCore::collectRangesThatNeedMapping):
(WebCore::mapHostNames):
(WebCore::URLWithData):
(WebCore::dataWithUserTypedString):
(WebCore::URLWithUserTypedString):
(WebCore::URLWithUserTypedStringDeprecated):
(WebCore::userVisibleString):

Source/WebKit/ios:

  • Misc/WebNSStringExtrasIOS.m:

(-[NSString _web_possibleURLsForForUserTypedString:]):

  • WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder _updateTitleForURL:]):

Source/WebKit/mac:

In this patch, we add new SPIs _webkit_URLWithUserTypedString, _webkit_decodeHostName and
_webkit_encodeHostName which will return nil while dealing with illegal IDN.

Old SPIs _web_URLWithUserTypedString, _web_decodeHostName and _web_encodeHostName are marked
deprecated as they ignore URL parsing failure.

  • History/WebHistoryItem.mm:

(-[WebHistoryItem initFromDictionaryRepresentation:]):

  • Misc/WebKitErrors.m:

(+[NSError _webKitErrorWithCode:failingURL:]):

  • Misc/WebNSFileManagerExtras.mm:

(-[NSFileManager _webkit_setMetadataURL:referrer:atPath:]):

  • Misc/WebNSPasteboardExtras.mm:

(-[NSPasteboard _web_bestURL]):

  • Misc/WebNSURLExtras.h:
  • Misc/WebNSURLExtras.mm:

(+[NSURL _web_URLWithUserTypedString:]):
(+[NSURL _webkit_URLWithUserTypedString:relativeToURL:]):
(+[NSURL _webkit_URLWithUserTypedString:]):
(-[NSString _web_decodeHostName]):
(-[NSString _web_encodeHostName]):
(-[NSString _webkit_decodeHostName]):
(-[NSString _webkit_encodeHostName]):

  • Panels/WebAuthenticationPanel.m:

(-[WebAuthenticationPanel setUpForChallenge:]):

  • WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::canonicalizeURLString):

Tools:

  • MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController fetch:]):

  • TestWebKitAPI/Tests/Cocoa/URLExtras.mm:

(TestWebKitAPI::TEST):

LayoutTests:

  • fast/url/host-expected.txt:
  • fast/url/idna2003-expected.txt:
  • fast/url/invalid-idn-expected.txt: Added.
  • fast/url/invalid-idn.html: Added.
12:37 AM Changeset in webkit [198202] by Chris Dumez
  • 2 edits in trunk/Source/WebKit2

Regression(r197939): ASSERTION FAILED: url.containsOnlyASCII() in URL.cpp
​https://bugs.webkit.org/show_bug.cgi?id=155449
<rdar://problem/25134826>

Reviewed by Carlos Garcia Campos.

Bump WK2 Network Disk Cache version after r197939 as the new cache format
is not compatible with the old one and leads to assertions being hit when
browsing in Debug builds.

SubresourceInfo used to only contain a boolean and would therefore be
serialized as "0" / "1". However, after r197939, a URL field was added
and when trying to decode old cache entries with the new format, we
would try to construct a URL from the String "0" or "1". This would
assert because these are not valid URLs.

  • NetworkProcess/cache/NetworkCacheStorage.h:
12:01 AM Changeset in webkit [198201] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebCore

REGRESSION (r197724): [GTK] Web Inspector: Images being blocked by CSP 2.0
​https://bugs.webkit.org/show_bug.cgi?id=155432

Reviewed by Darin Adler.

The GTK+ port Web Inspector uses GResources for all internal
resources (images, fonts, scripts, etc.) that are now blocked by
the CSP. GResouces are like data URLs in practice, so we should
always allow them.

  • page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar):

Note: See TracTimeline for information about the timeline view.