Timeline

Mar 17, 2016:

11:56 PM Changeset in webkit [198383] by Carlos Garcia Campos

• 5 edits in trunk/Source/WebCore

REGRESSION(r195661): [GTK] very slow scrolling
​https://bugs.webkit.org/show_bug.cgi?id=155334

Reviewed by Michael Catanzaro.

We need to also restore the PerAxisData visible length when it's
reset because of a non animated scroll. To prevent making the same
mistake in the future, the current position and visible lengths
members are now required to construct PerAxisData. This also
simplifies the code and ensures that when the ScrollAnimatorSmooth
is created, it's updated to the current position.

• platform/ScrollAnimationSmooth.cpp:

(WebCore::ScrollAnimationSmooth::ScrollAnimationSmooth):
Initialize PerAxisData members.
(WebCore::ScrollAnimationSmooth::setCurrentPosition): Pass the
current position and visible length as parameters to the
PerAxisData constructor.
(WebCore::ScrollAnimationSmooth::animateScroll): Ditto.

• platform/ScrollAnimationSmooth.h: Add a PerAxisData constructor

that receives current position and visible length and disallow to
use the default constructor.

• platform/ScrollAnimatorSmooth.cpp:

(WebCore::ScrollAnimatorSmooth::ScrollAnimatorSmooth): Pass the
current position to the ScrollAnimationSmooth constructor.

• platform/gtk/ScrollAnimatorGtk.cpp:

(WebCore::ScrollAnimatorGtk::ensureSmoothScrollingAnimation): Ditto.

11:53 PM Changeset in webkit [198382] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebInspectorUI

REGRESSION (r197724): [GTK] Web Inspector: Images being blocked by CSP 2.0
​https://bugs.webkit.org/show_bug.cgi?id=155432

Reviewed by Daniel Bates.

Allow Web Inspector to load resource: image resources.

• UserInterface/Main.html:

11:52 PM Changeset in webkit [198381] by Chris Fleizach

• 7 edits in trunk

AX: WEB: VoiceOver does not announce some WAI-ARIA document structures
​https://bugs.webkit.org/show_bug.cgi?id=155603
<rdar://problem/25227385>

Reviewed by Darin Adler.

Source/WebCore:

Expose more ARIA landmark type roles on iOS for accessibility.

Updated test: accessibility/ios-simulator/landmark-type.html

• accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper _accessibilityIsLandmarkRole:]):
(-[WebAccessibilityObjectWrapper accessibilityLabel]):

• platform/LocalizedStrings.cpp:

(WebCore::searchMenuClearRecentSearchesText):
(WebCore::AXWebAreaText):
(WebCore::AXListItemActionVerb):
(WebCore::AXAutoFillCredentialsLabel):

• platform/LocalizedStrings.h:

LayoutTests:

• accessibility/ios-simulator/landmark-type-expected.txt:
• accessibility/ios-simulator/landmark-type.html:

11:36 PM Changeset in webkit [198380] by bshafiei@apple.com

• 5 edits in branches/safari-601-branch/Source

Versioning.

11:32 PM Changeset in webkit [198379] by dbates@webkit.org

• 7 edits in trunk/Source/WebCore

Cleanup: Remove the need to pass reporting status to ContentSecurityPolicy functions
​https://bugs.webkit.org/show_bug.cgi?id=155623

Reviewed by Andy Estes and Alex Christensen.

ScriptController::initScript() is the only function that passes ContentSecurityPolicy::ReportingStatus::SuppressReport
following the removal of the SecurityPolicy script interface in <​http://trac.webkit.org/changeset/197142>. It
passes this reporting status to prevent sending a violation report when determining whether the CSP policy allows
use of the JavaScript eval()/operator eval so that it enable or disable this capability as appropriate. We
should teach ScriptController::initScript() to delegate the responsibility of enabling/disabling this capability
to the ContentSecurityPolicy. Then we can remove the need to expose ContentSecurityPolicy::ReportingStatus as
part of the ContentSecurityPolicy interface.

No functionality changed. So, no new tests.

• bindings/js/ScriptController.cpp:

(WebCore::ScriptController::createWindowShell): Return a reference to a JSDOMWindowShell object
instead of a pointer as the pointer is always non-null.
(WebCore::ScriptController::initScript): Updated as needed now that ScriptController::createWindowShell()
returns a reference. Moved logic to enable/disable JavaScript eval() and operator eval from here into
ContentSecurityPolicy::didCreateWindowShell() and make use of this member function.

• bindings/js/ScriptController.h:
• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::didCreateWindowShell): Added. Moved logic from to enable/disable JavaScript
eval() and operator eval from ScriptController::initScript() to here.
(WebCore::ContentSecurityPolicy::didReceiveHeader): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
to ContentSecurityPolicyDirectiveList. Fix minor code style nit; substitute nullptr for 0 in the first argument
to ContentSecurityPolicyDirectiveList::allowEval().
(WebCore::isAllowedByAllWithFrame): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
to ContentSecurityPolicyDirectiveList.
(WebCore::isAllowedByAll): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
to ContentSecurityPolicyDirectiveList. Also make this function static so that it has internal linkage.
(WebCore::isAllowedByAllWithState): Ditto.
(WebCore::isAllowedByAllWithContext): Ditto.
(WebCore::isAllowedByAllWithHashFromContent): Ditto.
(WebCore::isAllowedByAllWithURL): Ditto.
(WebCore::ContentSecurityPolicy::allowJavaScriptURLs): Remove argument reportingStatus and always pass
ContentSecurityPolicyDirectiveList::ReportingStatus::SendReport to the directive list member function. In a
subsequent patch we will remove the need to pass the reporting status to the directive list member function.
(WebCore::ContentSecurityPolicy::allowInlineEventHandlers): Ditto.
(WebCore::ContentSecurityPolicy::allowInlineScript): Ditto.
(WebCore::ContentSecurityPolicy::allowInlineStyle): Ditto.
(WebCore::ContentSecurityPolicy::allowEval): Ditto.
(WebCore::ContentSecurityPolicy::allowFrameAncestors): Ditto.
(WebCore::ContentSecurityPolicy::allowPluginType): Ditto.
(WebCore::ContentSecurityPolicy::allowScriptFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
(WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
(WebCore::ContentSecurityPolicy::allowBaseURI): Ditto.
(WebCore::ContentSecurityPolicy::evalDisabledErrorMessage): Deleted.

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::allowJavaScriptURLs): Substitute ReportingStatus for
ContentSecurityPolicy::ReportingStatus as the enum has moved from class ContentSecurityPolicy to this class.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineEventHandlers): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineScript): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyle): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowEval): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowPluginType): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowScriptFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowObjectFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowImageFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowStyleFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFontFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowMediaFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowConnectToSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFormAction): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowBaseURI): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Ditto.

• page/csp/ContentSecurityPolicyDirectiveList.h:

11:12 PM Changeset in webkit [198378] by achristensen@apple.com

• 2 edits in trunk/Source/WebKit2

SpeculativeLoad needs to continue NetworkLoad when it receives a redirect response
​https://bugs.webkit.org/show_bug.cgi?id=155612

Reviewed by Andy Estes.

• NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::willSendRedirectedRequest):
Call continueWillSendRequest. Otherwise, we will hang a thread in the NetworkProcess
if we are using ResourceHandle or we will not call the willPerformHTTPRedirection
completion handler if we are using NetworkSession. This will cause us to stop loading
from the server after the maximum number of connections is reached.

9:45 PM Changeset in webkit [198377] by Brent Fulgham

• 3 edits
  2 adds in trunk

[XSS Auditor] Off by one in XSSAuditor::canonicalizedSnippetForJavaScript()
​https://bugs.webkit.org/show_bug.cgi?id=155624
<rdar://problem/25219962>

Unreviewed merge from Blink (patch by Tom Sepez <​tsepez@chromium.org>):
<​https://src.chromium.org/viewvc/blink?revision=201803&view=revision>

Source/WebCore:

Test: http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html

• html/parser/XSSAuditor.cpp:

(WebCore::XSSAuditor::canonicalizedSnippetForJavaScript): Correct off-by-one error.

LayoutTests:

• http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode-expected.txt: Added.
• http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html: Added.

9:06 PM Changeset in webkit [198376] by commit-queue@webkit.org

• 8 edits in trunk/Source

[JSC] Make CSE's ImpureData faster when dealing with large blocks
​https://bugs.webkit.org/show_bug.cgi?id=155594

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-03-17
Reviewed by Filip Pizlo.

Source/JavaScriptCore:

In some tests with large blocks, the time spent in DFG's LocalCSE
can be over 10% of the total compile time.
In those cases, LocalCSE is completely dominated by handling large
blocks.

This patch addresses the most obvious hot spots ImpureData's handling.

Initially, most of the time was going into HashTable::rehash().
The reason is the buckets are <HeapLocation, LazyNode> gigantic.
The hash table would easily get into several kilobytes and the CPU
was spending more time dealing with memory than anything.

To solve that, I moved the pairs lazily to the heap. The table itself
just contains the unique_ptr to those values. This makes the table
reasonably small and the alloc/dealloc are paid for by the fast rehash().

Once addImpure() was better, the next big bottleneck was clobber().
For each clobber(), we need to go over the entire map and test each value.
That loop was where most of the time was going.

Most calls to clobber() come from two kinds: SideState and Stack.

SideState is easy: it is never def'ed so we can always skip it.

Stack is disjoint from Heap too so we can also put it separately.

Splitting the map into 2 helped reduce the overhead. The maps are:
-Stack
-Heap

Having Stack alone was not enough for many blocks. In some cases,
you have a ton of SetLocal/GetLocal and having Stack separately
makes no difference.

To solve that, I split Stack in two: a map addressed by AbstractHeap
+ unique HeapLocation and a fallback map for everything else.
Since most Stack are not TOP and are unique per AbstractHeap,
I get O(1) clobber in most cases.

I could achieve the same result with a custom hash structure.
I don't think it is worth the effort, in most cases, m_fallbackStackMap
has a size of zero or one.

This patch introduces a lot of coupling between CSE and AbstractHeap.
To reduce the risk of bugs, the old map is still maintained in debug
and each step checks that the results are the same as the new implementation.

A new validation step also verify the strong assumptions made by CSE:
-SideState and World are never def().
-We never write HEAP TOP, we only write specific heap location.

• dfg/DFGCSEPhase.cpp:
• dfg/DFGHeapLocation.h:
• dfg/DFGLazyNode.h:

(JSC::DFG::LazyNode::hash):

Source/WTF:

• wtf/HashSet.h:

(WTF::V>::removeIf):

7:11 PM Changeset in webkit [198375] by sbarati@apple.com

• 7 edits
  1 add in trunk/Source

Implement SmallPtrSet and integrate it into the Parser
​https://bugs.webkit.org/show_bug.cgi?id=155552

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Using SmallPtrSet instead of HashSet really helps speed
up the parser. What saves us most is not needing to always
malloc/free memory in the HashSet.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):

• parser/Parser.h:

(JSC::Scope::Scope):
(JSC::Scope::startSwitch):
(JSC::Scope::endSwitch):
(JSC::Scope::startLoop):
(JSC::Scope::hasDeclaredParameter):
(JSC::Scope::declareWrite):
(JSC::Scope::declareParameter):
(JSC::Scope::usedVariablesContains):
(JSC::Scope::useVariable):
(JSC::Scope::collectFreeVariables):
(JSC::Scope::getCapturedVars):
(JSC::Scope::isValidStrictMode):
(JSC::Scope::shadowsArguments):
(JSC::Scope::copyCapturedVariablesToVector):
(JSC::Scope::setIsModule):
(JSC::Parser::pushScope):
(JSC::Scope::getUsedVariables): Deleted.

Source/WTF:

This patch implements the SmallPtrSet data struture.
Inspired by the implementation in llvm:
​http://llvm.org/docs/doxygen/html/SmallPtrSet_8h_source.html

The data structure uses an inline array for storage up until
a fixed limit (8 entries in our implementation). If that storage
fills up, we fall back to a simple hash table implementation.
Crucially, this implementation doesn't support the remove
operation. This is on purpose. The hash table will only ever
grow.

Also, the implementation allows for it to be memcopied around.
I.e, we can put SmallPtrSet inside a Vector and allow that
Vector to use memcpy as its move operation (of course this
is only valid if the SmallPtrSet in the old memory doesn't have
its destructor called unless it is set back to its initial state.)

For now, SmallPtrSet only supports pointer types that are trivially
destructible. It's probably not too difficult to extend this to
smart pointers, but it's not part of this original implementation.

I've also implemented a pure forwarding varargs constructAndAppend
method on Vector. This allows you to do:
Vector<T> v;
v.constructAndAppend(a1, a2, ...)
as long as T has a constructor that accepts arguments (a1, a2, ...).

• WTF.xcodeproj/project.pbxproj:
• wtf/CMakeLists.txt:
• wtf/SmallPtrSet.h: Added.

(WTF::SmallPtrSet::SmallPtrSet):
(WTF::SmallPtrSet::operator=):
(WTF::SmallPtrSet::~SmallPtrSet):
(WTF::SmallPtrSet::add):
(WTF::SmallPtrSet::contains):
(WTF::SmallPtrSet::iterator::operator++):
(WTF::SmallPtrSet::iterator::operator*):
(WTF::SmallPtrSet::iterator::operator==):
(WTF::SmallPtrSet::iterator::operator!=):
(WTF::SmallPtrSet::begin):
(WTF::SmallPtrSet::end):
(WTF::SmallPtrSet::size):
(WTF::SmallPtrSet::emptyValue):
(WTF::SmallPtrSet::isValidEntry):
(WTF::SmallPtrSet::isSmall):
(WTF::SmallPtrSet::initialize):
(WTF::SmallPtrSet::grow):
(WTF::SmallPtrSet::bucket):

• wtf/Vector.h:

(WTF::Vector::append):
(WTF::Vector::uncheckedAppend):
(WTF::minCapacity>::append):
(WTF::minCapacity>::constructAndAppend):
(WTF::minCapacity>::appendSlowCase):
(WTF::minCapacity>::constructAndAppendSlowCase):

6:53 PM Changeset in webkit [198374] by Alan Bujtas

• 4 edits
  2 adds in trunk

Images in feed on ebay.com jiggle when one is hovered
​https://bugs.webkit.org/show_bug.cgi?id=155608
<rdar://problem/25160681>

The content offset in compositing layer = subpixel gap between the graphics layer and the layer bounds + layer bounds top left.

Reviewed by Simon Fraser.

Source/WebCore:

Test: compositing/hidpi-viewport-clipping-on-composited-content.html

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateGeometry):
(WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):

• rendering/RenderLayerBacking.h:

LayoutTests:

• compositing/hidpi-viewport-clipping-on-composited-content-expected.html: Added.
• compositing/hidpi-viewport-clipping-on-composited-content.html: Added.

6:43 PM Changeset in webkit [198373] by BJ Burg

• 4 edits in trunk/Source/JavaScriptCore

Web Inspector: protocol generator shouldn't generate enums for parameters with non-anonymous enum types
​https://bugs.webkit.org/show_bug.cgi?id=155610
<rdar://problem/25229878>

Reviewed by Joseph Pecoraro.

If a command parameter has an anonymous enum type, the backend dispatcher generator
makes a C++ enum for the parameter. However, if the parameter references a named enum
type specified in a domain's 'type' section, then there's no need to generate an enum.

• inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:

(CppBackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
Add a missing check for the is_anonymous flag. Type references to named enums are resolved
to the underlying aliased EnumType instead of an AliasedType, so we have to check the flag.

Rebaseline tests.

• inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
• inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:

6:26 PM Changeset in webkit [198372] by Brent Fulgham

• 3 edits
  2 adds in trunk

Don't initiate a style recall while drawing text
​https://bugs.webkit.org/show_bug.cgi?id=155618

Patch by Zalan Bujtas <Alan Bujtas> on 2016-03-17
Reviewed by Simon Fraser.

This patch ensures that we don't initiate a style recalc while in the middle of text drawing.

Source/WebCore:

Test: fast/canvas/crash-while-resizing-canvas.html

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawTextInternal):

LayoutTests:

• fast/canvas/crash-while-resizing-canvas-expected.txt: Added.
• fast/canvas/crash-while-resizing-canvas.html: Added.

6:13 PM Changeset in webkit [198371] by Ryan Haddad

• 2 edits in trunk/Source/WebCore

Unreviewed, rolling out r198335.
​https://bugs.webkit.org/show_bug.cgi?id=155617

This change caused existing LayoutTests to crash
intermittently (Requested by ryan|afk on #webkit).

Reverted changeset:

"DataURLDecoder::DecodingResultDispatcher may get deleted
outside main thread"
​https://bugs.webkit.org/show_bug.cgi?id=155584
​http://trac.webkit.org/changeset/198335

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-03-17

6:12 PM Changeset in webkit [198370] by Brent Fulgham

• 2 edits in trunk/Source/WebCore

Improve some metadata tests
​https://bugs.webkit.org/show_bug.cgi?id=155616

Patch by Eric Carlson <​eric.carlson@apple.com> on 2016-03-17
Reviewed by Saam Barati.

• html/track/DataCue.cpp:

(WebCore::DataCue::DataCue):
(WebCore::DataCue::setData):

6:02 PM Changeset in webkit [198369] by mmaxfield@apple.com

• 14 edits
  26 adds in trunk

[RTL Scrollbars] Position: absolute divs are covered by vertical scrollbar
​https://bugs.webkit.org/show_bug.cgi?id=155531

Reviewed by Darin Adler.

Source/WebCore:

This patch updates ScrollView::documentScrollPositionRelativeToViewOrigin(), which is
a helper function primarily used by WebCore::ScrollView::viewToContents() and
WebCore::ScrollView::contentsToView().

Tests: fast/scrolling/rtl-scrollbars-elementFromPoint-static.html

fast/scrolling/rtl-scrollbars-elementFromPoint.html
fast/scrolling/rtl-scrollbars-iframe-offset.html
fast/scrolling/rtl-scrollbars-iframe-position-absolute.html
fast/scrolling/rtl-scrollbars-iframe-scrolled.html
fast/scrolling/rtl-scrollbars-iframe.html
fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html
fast/scrolling/rtl-scrollbars-overflow-position-absolute.html
fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled.html
fast/scrolling/rtl-scrollbars-position-absolute.html
fast/scrolling/rtl-scrollbars-position-fixed.html
fast/scrolling/rtl-scrollbars-text-selection-scrolled.html
fast/scrolling/rtl-scrollbars-text-selection.html

• platform/ScrollView.cpp:

(WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):

LayoutTests:

Add a bunch of tests. Also, this patch adds some tests that caught
​https://bugs.webkit.org/show_bug.cgi?id=155533 (but they are disabled).

• fast/scrolling/rtl-scrollbars-elementFromPoint-expected.txt: Added.
• fast/scrolling/rtl-scrollbars-elementFromPoint-static-expected.txt: Added.
• fast/scrolling/rtl-scrollbars-elementFromPoint-static.html: Added.
• fast/scrolling/rtl-scrollbars-elementFromPoint.html: Added.
• fast/scrolling/rtl-scrollbars-iframe-expected.txt: Added.
• fast/scrolling/rtl-scrollbars-iframe-offset-expected.html: Added.
• fast/scrolling/rtl-scrollbars-iframe-offset.html: Added.
• fast/scrolling/rtl-scrollbars-iframe-position-absolute-expected.txt: Added.
• fast/scrolling/rtl-scrollbars-iframe-position-absolute.html: Added.
• fast/scrolling/rtl-scrollbars-iframe-scrolled-expected.html: Added.
• fast/scrolling/rtl-scrollbars-iframe-scrolled.html: Added.
• fast/scrolling/rtl-scrollbars-iframe.html: Added.
• fast/scrolling/rtl-scrollbars-overflow-elementFromPoint-expected.txt: Added.
• fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html: Added.
• fast/scrolling/rtl-scrollbars-overflow-position-absolute-expected.html: Added.
• fast/scrolling/rtl-scrollbars-overflow-position-absolute.html: Added.
• fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled-expected.html: Added.
• fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled.html: Added.
• fast/scrolling/rtl-scrollbars-position-absolute-expected.html: Added.
• fast/scrolling/rtl-scrollbars-position-absolute.html: Added.
• fast/scrolling/rtl-scrollbars-position-fixed-expected.html: Added.
• fast/scrolling/rtl-scrollbars-position-fixed.html: Added.
• fast/scrolling/rtl-scrollbars-text-selection-expected.html: Added.
• fast/scrolling/rtl-scrollbars-text-selection-scrolled-expected.html: Added.
• fast/scrolling/rtl-scrollbars-text-selection-scrolled.html: Added.
• fast/scrolling/rtl-scrollbars-text-selection.html: Added.
• TestExpectations:

6:00 PM Changeset in webkit [198368] by matthew_hanson@apple.com

• 1 delete in branches/Safari-601.6.10

Delete incorrect tag

5:59 PM Changeset in webkit [198367] by matthew_hanson@apple.com

• 1 copy in tags/Safari-601.6.10

New Tag.

5:57 PM Changeset in webkit [198366] by matthew_hanson@apple.com

• 1 copy in branches/Safari-601.6.10

New Tag.

5:55 PM Changeset in webkit [198365] by timothy_horton@apple.com

• 2 edits in trunk/Tools

Fix some deprecation warnings in WebEditingTester
​https://bugs.webkit.org/show_bug.cgi?id=155601

Reviewed by Simon Fraser.

• WebEditingTester/AppDelegate.m:

(-[WebEditingAppDelegate showOperations:]):
(-[WebEditingAppDelegate _updateNewWindowKeyEquivalents]):

5:53 PM Changeset in webkit [198364] by fpizlo@apple.com

• 95 edits
  2 adds
  2 deletes in trunk/Source

Replace all of the various non-working and non-compiling sampling profiler hacks with a single super hack
​https://bugs.webkit.org/show_bug.cgi?id=155561

Reviewed by Saam Barati.

Source/JavaScriptCore:

A VM needs some internal profiling hacks in addition to the profiler(s) that the user sees, because
you can squeeze out more fidelity if you're willing to make some kind of deal with the devil. Prior
to this change JSC had a bunch of these:

• CodeBlock sampling profiler
• Bytecode sampling profiler
• Sampling flags
• Sampling regions
• Some other stuff

I tried using these recently. They didn't even build. Initially I fixed that, but then I found that
these profilers had some serious bugs that made them report bogus results - like underreporting the
time spent in regions of code by more than 2x.

Part of the problem here is that a profiler loses fidelity as it gains power. The more general it
tries to be, the more code gets executed on the hot path for the profiler, which increasingly
perturbs the results. I believe that's the reason for the underreporting - code ran sufficiently
slower, and in a sufficiently different way when profiling, that the results were just wrong.

This change attacks this problem directly by replacing all of the diverse profiling hacks with just
one, which I call the SuperSampler. It consists of exactly one counter. When enabled, the sampler
will periodically print (via dataLog()) the percentage of samples that saw a non-zero count. Because
it's so simple, it gives better accuracy. This comes about in two ways:

• It runs at a lower rate. That's fine since it's only checking one flag. You don't need a high rate for just one flag.

• The fact that there is only *one* flag means that the user must choose a hypothesis about what is slow. This turns the problem of profiling into a hypothesis testing problem, which is an inherently less flaky kind of experiment to run.

The SuperSampler is enabled with a runtime flag rather than a compile-time flag, so it's much less
likely to break. That also means that you can enable it without rebuilding the universe. The old
samplers all had ENABLE flags in Platform.h, which was rather unfortunate for compile times.

SuperSampler supports both JIT and C++ users. C++ users should use SuperSamplerScope. The default
idiom is to create one and pass "true" to it. You can disable a scope by passing "false" instead.
This patch puts a bunch of scopes in places I care about. I think it's probably OK if people check in
these deactivated scopes. That makes it convenient to retest things we've tested previously.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• bytecode/SamplingTool.cpp: Removed.
• bytecode/SamplingTool.h: Removed.
• bytecode/SuperSampler.cpp: Added.

(JSC::initializeSuperSampler):
(JSC::printSuperSamplerState):

• bytecode/SuperSampler.h: Added.

(JSC::SuperSamplerScope::SuperSamplerScope):
(JSC::SuperSamplerScope::~SuperSamplerScope):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::generate):

• bytecompiler/NodesCodegen.cpp:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):

• dfg/DFGArgumentsEliminationPhase.cpp:

(JSC::DFG::performArgumentsElimination):

• dfg/DFGBackwardsPropagationPhase.cpp:

(JSC::DFG::performBackwardsPropagation):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::parse):

• dfg/DFGCFAPhase.cpp:

(JSC::DFG::performCFA):

• dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::performCFGSimplification):

• dfg/DFGCPSRethreadingPhase.cpp:

(JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
(JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
(JSC::DFG::CPSRethreadingPhase::propagatePhis):
(JSC::DFG::performCPSRethreading):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::performLocalCSE):
(JSC::DFG::performGlobalCSE):

• dfg/DFGCleanUpPhase.cpp:

(JSC::DFG::performCleanUp):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::performConstantFolding):

• dfg/DFGConstantHoistingPhase.cpp:

(JSC::DFG::performConstantHoisting):

• dfg/DFGCriticalEdgeBreakingPhase.cpp:

(JSC::DFG::performCriticalEdgeBreaking):

• dfg/DFGDCEPhase.cpp:

(JSC::DFG::performDCE):

• dfg/DFGDriver.cpp:

(JSC::DFG::compileImpl):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::performFixup):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dethread):

• dfg/DFGIntegerCheckCombiningPhase.cpp:

(JSC::DFG::performIntegerCheckCombining):

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

(JSC::DFG::performIntegerRangeOptimization):

• dfg/DFGInvalidationPointInjectionPhase.cpp:

(JSC::DFG::performInvalidationPointInjection):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

• dfg/DFGLICMPhase.cpp:

(JSC::DFG::performLICM):

• dfg/DFGLiveCatchVariablePreservationPhase.cpp:

(JSC::DFG::performLiveCatchVariablePreservationPhase):

• dfg/DFGLivenessAnalysisPhase.cpp:

(JSC::DFG::performLivenessAnalysis):

• dfg/DFGLoopPreHeaderCreationPhase.cpp:

(JSC::DFG::performLoopPreHeaderCreation):

• dfg/DFGMaximalFlushInsertionPhase.cpp:

(JSC::DFG::performMaximalFlushInsertion):

• dfg/DFGMovHintRemovalPhase.cpp:

(JSC::DFG::performMovHintRemoval):

• dfg/DFGOSRAvailabilityAnalysisPhase.cpp:

(JSC::DFG::performOSRAvailabilityAnalysis):

• dfg/DFGOSREntrypointCreationPhase.cpp:

(JSC::DFG::performOSREntrypointCreation):

• dfg/DFGOSRExitCompiler.cpp:
• dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::performObjectAllocationSinking):

• dfg/DFGOperations.cpp:
• dfg/DFGPhantomInsertionPhase.cpp:

(JSC::DFG::performPhantomInsertion):

• dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThread):

• dfg/DFGPredictionInjectionPhase.cpp:

(JSC::DFG::performPredictionInjection):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::performPredictionPropagation):

• dfg/DFGPutStackSinkingPhase.cpp:

(JSC::DFG::performPutStackSinking):

• dfg/DFGSSAConversionPhase.cpp:

(JSC::DFG::performSSAConversion):

• dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::performSSALowering):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::performStackLayout):

• dfg/DFGStaticExecutionCountEstimationPhase.cpp:

(JSC::DFG::performStaticExecutionCountEstimation):

• dfg/DFGStoreBarrierInsertionPhase.cpp:

(JSC::DFG::performFastStoreBarrierInsertion):
(JSC::DFG::performGlobalStoreBarrierInsertion):

• dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::performStrengthReduction):

• dfg/DFGStructureAbstractValue.cpp:

(JSC::DFG::StructureAbstractValue::assertIsRegistered):
(JSC::DFG::StructureAbstractValue::clobber):
(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):
(JSC::DFG::StructureAbstractValue::add):
(JSC::DFG::StructureAbstractValue::merge):
(JSC::DFG::StructureAbstractValue::mergeSlow):
(JSC::DFG::StructureAbstractValue::mergeNotTop):
(JSC::DFG::StructureAbstractValue::filter):
(JSC::DFG::StructureAbstractValue::filterSlow):
(JSC::DFG::StructureAbstractValue::contains):
(JSC::DFG::StructureAbstractValue::isSubsetOf):
(JSC::DFG::StructureAbstractValue::isSupersetOf):
(JSC::DFG::StructureAbstractValue::overlaps):
(JSC::DFG::StructureAbstractValue::equalsSlow):

• dfg/DFGStructureRegistrationPhase.cpp:

(JSC::DFG::performStructureRegistration):

• dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::performTierUpCheckInjection):

• dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::performTypeCheckHoisting):

• dfg/DFGUnificationPhase.cpp:

(JSC::DFG::performUnification):

• dfg/DFGVarargsForwardingPhase.cpp:

(JSC::DFG::performVarargsForwarding):

• dfg/DFGVirtualRegisterAllocationPhase.cpp:

(JSC::DFG::performVirtualRegisterAllocation):

• dfg/DFGWatchpointCollectionPhase.cpp:

(JSC::DFG::performWatchpointCollection):

• dynbench.cpp:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
(JSC::FTL::DFG::LowerDFGToB3::compileGetRegExpObjectLastIndex):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileFTLOSRExit):

• ftl/FTLOutput.cpp:

(JSC::FTL::Output::store):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::incrementSuperSamplerCount):
(JSC::FTL::Output::decrementSuperSamplerCount):

• ftl/FTLOutput.h:

(JSC::FTL::Output::baseIndex):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::anchor):
(JSC::FTL::Output::absolute): Deleted.

• heap/Heap.cpp:

(JSC::Heap::markRoots):
(JSC::Heap::collectAndSweep):
(JSC::Heap::collectImpl):
(JSC::Heap::zombifyDeadObjects):

• heap/MarkedBlock.cpp:

(JSC::MarkedBlock::specializedSweep):

• interpreter/Interpreter.cpp:

(JSC::setupVarargsFrameAndSetThis):
(JSC::Interpreter::Interpreter):
(JSC::Interpreter::initialize):
(JSC::checkedReturn):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
(JSC::Interpreter::debug):
(JSC::SamplingScope::SamplingScope): Deleted.
(JSC::SamplingScope::~SamplingScope): Deleted.
(JSC::Interpreter::enableSampler): Deleted.
(JSC::Interpreter::dumpSampleData): Deleted.
(JSC::Interpreter::startSampling): Deleted.
(JSC::Interpreter::stopSampling): Deleted.

• interpreter/Interpreter.h:

(JSC::Interpreter::isCallBytecode):
(JSC::Interpreter::sampler): Deleted.

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::branchIfNotFastTypedArray):
(JSC::AssemblyHelpers::incrementSuperSamplerCount):
(JSC::AssemblyHelpers::decrementSuperSamplerCount):
(JSC::AssemblyHelpers::purifyNaN):

• jit/AssemblyHelpers.h:
• jit/JIT.cpp:
• jit/JIT.h:
• jit/JITArithmetic.cpp:
• jit/JITArithmetic32_64.cpp:
• jit/JITCall.cpp:
• jit/JITCall32_64.cpp:
• jit/JITOperations.cpp:
• jit/JITPropertyAccess.cpp:
• jit/JITPropertyAccess32_64.cpp:
• jsc.cpp:

(runWithScripts):
(jscmain):

• parser/Nodes.cpp:
• parser/Parser.h:

(JSC::parse):

• runtime/Executable.h:
• runtime/InitializeThreading.cpp:

(JSC::initializeThreading):

• runtime/Options.h:
• runtime/RegExpCachedResult.h:
• runtime/RegExpMatchesArray.h:

(JSC::createRegExpMatchesArray):

• runtime/StringPrototype.cpp:

(JSC::removeUsingRegExpSearch):
(JSC::stringProtoFuncSubstring):

• runtime/VM.cpp:

(JSC::VM::resetDateCache):
(JSC::VM::whenIdle):
(JSC::VM::deleteAllCode):
(JSC::VM::addSourceProviderCache):
(JSC::VM::startSampling): Deleted.
(JSC::VM::stopSampling): Deleted.
(JSC::VM::dumpSampleData): Deleted.

• runtime/VM.h:

(JSC::VM::regExpCache):

• testRegExp.cpp:

(runFromFiles):

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::interpret):

Source/WebCore:

No new tests because no new behavior.

• platform/audio/ios/MediaSessionManagerIOS.mm:
• platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:

Source/WTF:

This patch replaces all of our various ad hoc profiling hacks with a single ad hoc profiling hack.
That needs to be able to sleep a thread, so I added a portable way to do it.

This also removes a bunch of ENABLE flags for all of the old non-working hacks.

• wtf/CurrentTime.cpp:

(WTF::currentCPUTime):
(WTF::sleep):

• wtf/CurrentTime.h:

(WTF::sleepMS):

• wtf/Platform.h:

5:50 PM Changeset in webkit [198363] by timothy_horton@apple.com

• 4 edits in trunk

Find-in-page indicator in Mail viewer is the wrong scale and cut off
​https://bugs.webkit.org/show_bug.cgi?id=155605
<rdar://problem/23948165>

Reviewed by Simon Fraser.

Source/WebKit2:

• UIProcess/mac/WKTextFinderClient.mm:

(-[WKTextFinderClient didGetImageForMatchResult:]):
Initialize the NSImage with the correct size, instead of inferring the
size from the bitmap, so that we don't lose information about device pixel ratio.

Tools:

• TestWebKitAPI/Tests/WebKit2Cocoa/FindInPage.mm:

(TEST):
Add a test that ensures that the find result image is correctly @2x.
The NSImage size should be in points.

5:46 PM Changeset in webkit [198362] by rniwa@webkit.org

• 2 edits in trunk/Websites/perf.webkit.org

Fix a typo which was supposed to be fixed in r198351.

• public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage.prototype.render):

5:42 PM Changeset in webkit [198361] by Brent Fulgham

• 2 edits in trunk/Source/WebCore

Some media tests are flaky.
​https://bugs.webkit.org/show_bug.cgi?id=155614

Reviewed by Eric Carlson.

• html/track/TextTrack.cpp:

(WebCore::TextTrack::~TextTrack):

4:55 PM Changeset in webkit [198360] by sbarati@apple.com

• 5 edits
  1 add in trunk/Source/JavaScriptCore

[ES6] Make GetProperty(.) inside ArrayPrototype.cpp spec compatible.
​https://bugs.webkit.org/show_bug.cgi?id=155575

Reviewed by Filip Pizlo and Mark Lam.

This patch makes various Array.prototype.(shift | unshift | splice)
spec compliant. Before, they were performing Get and HasProperty as one
operation. Instead, they need to be performed as two distinct operations
when it would be observable.

• runtime/ArrayPrototype.cpp:

(JSC::getProperty):

• runtime/PropertySlot.h:

(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::isCacheableValue):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::setIsTaintedByProxy):
(JSC::PropertySlot::isTaintedByProxy):
(JSC::PropertySlot::internalMethodType):
(JSC::PropertySlot::getValue):

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::getOwnPropertySlotCommon):

• tests/es6.yaml:
• tests/stress/proxy-array-prototype-methods.js: Added.

(assert):
(test):
(shallowEq):

4:26 PM Changeset in webkit [198359] by bshafiei@apple.com

• 5 edits in branches/safari-601-branch/Source

Versioning.

4:25 PM Changeset in webkit [198358] by commit-queue@webkit.org

• 7 edits in trunk/Source/WebInspectorUI

Web Inspector: Prefer retained size to the shallow size in Heap Snapshot data grids
​https://bugs.webkit.org/show_bug.cgi?id=155597
<rdar://problem/25225087>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-17
Reviewed by Timothy Hatcher.

• Localizations/en.lproj/localizedStrings.js:

New datagrid column and tooltip strings.

• UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype.insertColumn):
Allow a column definition to provide a tooltip for the header cell.

• UserInterface/Views/HeapSnapshotClassDataGridNode.js:

(WebInspector.HeapSnapshotClassDataGridNode.prototype.createCellContent):
Include retained size column data.

(WebInspector.HeapSnapshotClassDataGridNode.prototype._populate):
Fix non-batched populate to sort instances on first population.

• UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
Include retained size column data.

• UserInterface/Views/HeapSnapshotInstancesContentView.js:

(WebInspector.HeapSnapshotInstancesContentView):
Include a retained size column. Update initial sort and column widths.

• UserInterface/Views/HeapSnapshotInstancesDataGridTree.js:

(WebInspector.HeapSnapshotInstancesDataGridTree.buildSortComparator):
Include a numeric sort comparator for the new retained size column.

(WebInspector.HeapSnapshotInstancesDataGridTree.prototype._populateTopLevel):
Include retained size, and lazily calculate percentage later.

3:48 PM Changeset in webkit [198357] by beidson@apple.com

• 3 edits
  3 adds in trunk

Don't try to restore deleted MemoryIndexes if their owning object store is not restored.
​https://bugs.webkit.org/show_bug.cgi?id=155068

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/indexeddb/modern/deleteindex-4-private.html

• Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:

(WebCore::IDBServer::MemoryBackingStoreTransaction::indexDeleted):

LayoutTests:

• storage/indexeddb/modern/deleteindex-4-private-expected.txt: Added.
• storage/indexeddb/modern/deleteindex-4-private.html: Added.
• storage/indexeddb/modern/resources/deleteindex-4.js: Added.

3:43 PM Changeset in webkit [198356] by commit-queue@webkit.org

• 11 edits
  13 moves
  2 adds in trunk

AX: attributes to retrieve focusable and editable ancestors
​https://bugs.webkit.org/show_bug.cgi?id=155554

Patch by Doug Russell <​d_russell@apple.com> on 2016-03-17
Reviewed by Chris Fleizach.

Add attributes to help give context to focus changes:
AXFocusableAncestor - nearest accessibility ancestor that returns true for
canSetFocusAttribute().
AXEditableAncestor - nearest accessibility ancestor that returns true for
isTextControl().
AXHighestEditableAncestor - highest element in accessibility that returns true
for isTextControl().

Source/WebCore:

Test: accessibility/mac/ancestor-attributes.html

• accessibility/AccessibilityNodeObject.cpp:
• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::focusableAncestor):
(WebCore::AccessibilityObject::editableAncestor):
(WebCore::AccessibilityObject::highestEditableAncestor):

• accessibility/AccessibilityObject.h:
• accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests:

• accessibility/image-link-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/image-link-expected.txt.
• accessibility/image-map2-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/image-map2-expected.txt.
• accessibility/internal-link-anchors2-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/internal-link-anchors2-expected.txt.
• accessibility/lists-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/lists-expected.txt.
• accessibility/mac/ancestor-attributes-expected.txt: Added.
• accessibility/mac/ancestor-attributes.html: Added.
• accessibility/mac/aria-columnrowheaders-expected.txt:
• accessibility/mac/bounds-for-range-expected.txt:
• accessibility/mac/document-links-expected.txt:
• accessibility/mac/internal-link-anchors-expected.txt:
• accessibility/math-multiscript-attributes-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/math-multiscript-attributes-expected.txt.
• accessibility/plugin-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/plugin-expected.txt.
• accessibility/table-attributes-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-attributes-expected.txt.
• accessibility/table-cell-spans-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-cell-spans-expected.txt.
• accessibility/table-cells-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-cells-expected.txt.
• accessibility/table-detection-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-detection-expected.txt.
• accessibility/table-one-cell-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-one-cell-expected.txt.
• accessibility/table-sections-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-sections-expected.txt.
• accessibility/table-with-rules-expected.txt: Renamed from LayoutTests/platform/mac/accessibility/table-with-rules-expected.txt.
• accessibility/transformed-element-expected.txt:

3:17 PM Changeset in webkit [198355] by Joseph Pecoraro

• 2 edits in trunk/LayoutTests

Unreviewed follow-up fix to test after r198353.

• inspector/unit-tests/heap-snapshot.html:

Account for <root> in a few places.

2:04 PM Changeset in webkit [198354] by weinig@apple.com

• 11 edits in trunk

Implement document.queryCommandSupported("copy")
​https://bugs.webkit.org/show_bug.cgi?id=155548
<rdar://problem/25195295>

Reviewed by Enrica Casucci.

Source/WebCore:

• document.queryCommandSupported("copy") and document.queryCommandSupported("cut") need to return true if the ClipboardAccessPolicy is either Allow or RequiresUserGesture. But, document.queryCommandEnabled("copy") and document.queryCommandEnabled("cut") should still return false when there is no user gesture. I also had to maintain a weird quirk that copy and cut should be allowed to execute, and thus fire the oncopy and oncut events, even when disabled, if coming from a "MenuOrKeyBinding" source. To do this, I upgraded the allowExecutionWhenDisabled bit to a function taking a source, and return true only when the correct source is specified.

• editing/Editor.h:
• editing/EditorCommand.cpp:

(WebCore::defaultValueForSupportedCopyCut):
(WebCore::allowCopyCutFromDOM):
(WebCore::enabledCopy):
(WebCore::enabledCut):
(WebCore::allowExecutionWhenDisabled):
(WebCore::doNotAllowExecutionWhenDisabled):
(WebCore::allowExecutionWhenDisabledCopyCut):
(WebCore::Editor::Command::execute):
(WebCore::Editor::Command::allowExecutionWhenDisabled):

LayoutTests:

• editing/execCommand/clipboard-access-with-user-gesture-expected.txt:
• editing/execCommand/clipboard-access-with-user-gesture.html:

document.queryCommandSupported('copy') should be returning true.

• editing/pasteboard/can-read-in-copy-and-cut-events.html:
• editing/pasteboard/copy-cut-paste-events-fired-when-disabled.html:
• editing/pasteboard/pasting-empty-html-falls-back-to-text.html:
• editing/pasteboard/set_data_typeof_return.html:

Use testRunner.execCommand() to test the behavior of a user.

2:02 PM Changeset in webkit [198353] by Joseph Pecoraro

• 21 edits
  1 move
  11 adds
  3 deletes in trunk

Web Inspector: HeapSnapshots are slow and use too much memory
​https://bugs.webkit.org/show_bug.cgi?id=155571

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

This is the first inclusion of Workers into Web Inspector. In this case
the Main side merely needs to make requests of the Worker and get back
objects that it can interact with more.

New file heirarchies:

UserInterface/Proxies

• new Proxy classes in the Main page.
• treat like Model classes, but not quite model.

UserInterface/Workers/HeapSnapshotWorker

• new Worker classes for Workers. No WebInspector namespace.
• no minification of these resources, they are simply copied.

Remote procedure call interface between the Main/Worker page happens
through the WorkerProxy and Worker classes. There are simple ways
to perform factory style methods and call methods on objects, and
get the result in a callback. Similiar to frontend <-> backend agent
communication:

HeapSnapshotWorkerProxy: (Main world)

• creates the worker
• performAction("actionName", arguments, callback)
• callMethod(objectId, "methodName", arguments, callback)
• handle message => dispatch event or invoke callback

HeapSnapshotWorker: (Worker world)

• sendEvent("eventName", eventData)
• handle message => dispatch action or method on object

Proxy object methods are boilerplate calls to performAction/callMethod
with deserialization of responses. The rest of the frontend can just
treat Proxy objects as Model objects with some data and async methods.

Because the Node/Edge data is so small, objects are cheaply created
when needed and not cached. This means that there may be duplicate
HeapSnapshotNode's for the same node. For example if different Views
both request instancesWithClassName("Foo"). This is fine, as none
of our Views really care about object uniqueness, they are only
interested in the data or querying for more data.

• Scripts/combine-resources.pl:
• Scripts/copy-user-interface-resources.pl:

Copy the Workers directory to the resources directory.
Its code is only meant to be loaded by Workers, so it
shouldn't be included in the Main page.

• UserInterface/Main.html:
• UserInterface/Test.html:
• UserInterface/Models/HeapSnapshot.js: Removed.
• UserInterface/Models/HeapSnapshotDiff.js: Removed.
• UserInterface/Models/HeapSnapshotEdge.js: Removed.
• UserInterface/Models/HeapSnapshotNode.js: Removed.

Replace the old simple Model classes with Proxy classes that interact
with the Worker.

• UserInterface/Models/HeapAllocationsInstrument.js:

(WebInspector.HeapAllocationsInstrument.prototype._takeHeapSnapshot):
(WebInspector.HeapAllocationsInstrument):

• UserInterface/Models/HeapAllocationsTimelineRecord.js:

(WebInspector.HeapAllocationsTimelineRecord):

• UserInterface/Models/HeapSnapshotRootPath.js:

(WebInspector.HeapSnapshotRootPath):
(WebInspector.HeapSnapshotRootPath.prototype.appendEdge):

• UserInterface/Protocol/HeapObserver.js:

(WebInspector.HeapObserver.prototype.trackingStart):
(WebInspector.HeapObserver.prototype.trackingComplete):

• UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.isViewable):

• UserInterface/Views/HeapAllocationsTimelineView.js:

(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotDiff):
(WebInspector.HeapAllocationsTimelineView.prototype._takeHeapSnapshotClicked):
(WebInspector.HeapAllocationsTimelineView.prototype._dataGridNodeSelected):
(WebInspector.HeapAllocationsTimelineView):

• UserInterface/Views/HeapSnapshotClassDataGridNode.js:

(WebInspector.HeapSnapshotClassDataGridNode.prototype._populate):

• UserInterface/Views/HeapSnapshotClusterContentView.js:
• UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode):
(WebInspector.HeapSnapshotInstanceDataGridNode.logHeapSnapshotNode.node.shortestGCRootPath.):
(WebInspector.HeapSnapshotInstanceDataGridNode.logHeapSnapshotNode):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler.appendPath):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler.stringifyEdge):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler):

• UserInterface/Views/HeapSnapshotInstancesContentView.js:

(WebInspector.HeapSnapshotInstancesContentView):

• UserInterface/Views/HeapSnapshotInstancesDataGridTree.js:

(WebInspector.HeapSnapshotInstancesDataGridTree):

• UserInterface/Views/HeapSnapshotSummaryContentView.js:

(WebInspector.HeapSnapshotSummaryContentView):
Update existing code to expect the new Proxy objects or create
the new HeapSnapshot using workers.

• UserInterface/Proxies/HeapSnapshotDiffProxy.js: Added.

(WebInspector.HeapSnapshotDiffProxy):
(WebInspector.HeapSnapshotDiffProxy.deserialize):
(WebInspector.HeapSnapshotDiffProxy.prototype.get snapshot1):
(WebInspector.HeapSnapshotDiffProxy.prototype.get snapshot2):
(WebInspector.HeapSnapshotDiffProxy.prototype.get totalSize):
(WebInspector.HeapSnapshotDiffProxy.prototype.get totalObjectCount):
(WebInspector.HeapSnapshotDiffProxy.prototype.get categories):
(WebInspector.HeapSnapshotDiffProxy.prototype.allocationBucketCounts):
(WebInspector.HeapSnapshotDiffProxy.prototype.instancesWithClassName):
(WebInspector.HeapSnapshotDiffProxy.prototype.nodeWithIdentifier):
A HeapSnapshotDiffProxy looks like a HeapSnapshotProxy and responds to
the same methods, but has the extra snapshot1/2 pointers.

• UserInterface/Proxies/HeapSnapshotEdgeProxy.js:

(WebInspector.HeapSnapshotEdgeProxy):
(WebInspector.HeapSnapshotEdgeProxy.deserialize):
Edge data. No methods are proxied at this point.

• UserInterface/Proxies/HeapSnapshotNodeProxy.js: Added.

(WebInspector.HeapSnapshotNodeProxy):
(WebInspector.HeapSnapshotNodeProxy.deserialize):
(WebInspector.HeapSnapshotNodeProxy.prototype.shortestGCRootPath):
(WebInspector.HeapSnapshotNodeProxy.prototype.dominatedNodes):
(WebInspector.HeapSnapshotNodeProxy.prototype.retainedNodes):
(WebInspector.HeapSnapshotNodeProxy.prototype.retainers):
Node data and methods to query for node relationships.

• UserInterface/Proxies/HeapSnapshotProxy.js: Added.

(WebInspector.HeapSnapshotProxy):
(WebInspector.HeapSnapshotProxy.deserialize):
(WebInspector.HeapSnapshotProxy.prototype.get proxyObjectId):
(WebInspector.HeapSnapshotProxy.prototype.get identifier):
(WebInspector.HeapSnapshotProxy.prototype.get totalSize):
(WebInspector.HeapSnapshotProxy.prototype.get totalObjectCount):
(WebInspector.HeapSnapshotProxy.prototype.get categories):
(WebInspector.HeapSnapshotProxy.prototype.allocationBucketCounts):
(WebInspector.HeapSnapshotProxy.prototype.instancesWithClassName):
(WebInspector.HeapSnapshotProxy.prototype.nodeWithIdentifier):
Snapshot data and methods to query for nodes.

• UserInterface/Proxies/HeapSnapshotWorkerProxy.js: Added.

(WebInspector.HeapSnapshotWorkerProxy):
(WebInspector.HeapSnapshotWorkerProxy.singleton):
(WebInspector.HeapSnapshotWorkerProxy.prototype.createSnapshot):
(WebInspector.HeapSnapshotWorkerProxy.prototype.createSnapshotDiff):
(WebInspector.HeapSnapshotWorkerProxy.prototype.performAction):
(WebInspector.HeapSnapshotWorkerProxy.prototype.callMethod):
(WebInspector.HeapSnapshotWorkerProxy.prototype._postMessage):
(WebInspector.HeapSnapshotWorkerProxy.prototype._handleMessage):
Singleton factory for the worker and proxied communication with the worker.
Provide means for invoking "factory actions" and "object methods".

• UserInterface/Workers/HeapSnapshot/HeapSnapshotWorker.js: Added.

(HeapSnapshotWorker):
(HeapSnapshotWorker.prototype.createSnapshot):
(HeapSnapshotWorker.prototype.createSnapshotDiff):
(HeapSnapshotWorker.prototype.sendEvent):
(HeapSnapshotWorker.prototype._handleMessage):
Main worker code. Handle dispatching actions and methods.

• UserInterface/Workers/HeapSnapshot/HeapSnapshot.js: Added.

(HeapSnapshot):
(HeapSnapshot.buildCategories):
(HeapSnapshot.allocationBucketCounts):
(HeapSnapshot.instancesWithClassName):
(HeapSnapshot.prototype.allocationBucketCounts):
(HeapSnapshot.prototype.instancesWithClassName):
(HeapSnapshot.prototype.nodeWithIdentifier):
(HeapSnapshot.prototype.shortestGCRootPath):
(HeapSnapshot.prototype.dominatedNodes):
(HeapSnapshot.prototype.retainedNodes):
(HeapSnapshot.prototype.retainers):
(HeapSnapshot.prototype.serialize):
(HeapSnapshot.prototype.serializeNode):
(HeapSnapshot.prototype.serializeEdge):
(HeapSnapshot.prototype._buildOutgoingEdges):
(HeapSnapshot.prototype._buildIncomingEdges):
(HeapSnapshot.prototype._buildPostOrderIndexes):
(HeapSnapshot.prototype._buildDominatorIndexes):
(HeapSnapshot.prototype._buildRetainedSizes):
(HeapSnapshot.prototype._gcRootPathes.visitNode):
(HeapSnapshot.prototype._gcRootPathes):
(HeapSnapshotDiff):
(HeapSnapshotDiff.prototype.allocationBucketCounts):
(HeapSnapshotDiff.prototype.instancesWithClassName):
(HeapSnapshotDiff.prototype.nodeWithIdentifier):
(HeapSnapshotDiff.prototype.shortestGCRootPath):
(HeapSnapshotDiff.prototype.dominatedNodes):
(HeapSnapshotDiff.prototype.retainedNodes):
(HeapSnapshotDiff.prototype.retainers):
(HeapSnapshotDiff.prototype.serialize):
New HeapSnapshot data processing implementation. Instead of creating
a new object per Node or per Edge create data arrays containing data
per-Node. Operate on these lists of data instead of creating many objects.

LayoutTests:

• inspector/heap/getPreview.html:
• inspector/heap/getRemoteObject.html:
• inspector/heap/snapshot.html:

Update tests to use the new HeapSnapshotWorker frontend code.

• inspector/unit-tests/heap-snapshot-expected.txt: Added.
• inspector/unit-tests/heap-snapshot.html: Added.

Verify the data processing in and worker communication work HeapSnapshotWorker
produces expected values when compared with the simple HeapSnapshot/Node/Edge
implentation.

2:01 PM Changeset in webkit [198352] by andersca@apple.com

• 3 edits
  1 delete in trunk/Source/WebKit2

Remove use of dyld_register_image_state_change_handler() in PluginProcessMac.mm
​https://bugs.webkit.org/show_bug.cgi?id=155596

Reviewed by Dan Bernstein.

Use _dyld_register_func_for_add_image instead which is API. Use dladdr to find the image path given its header.

• Platform/spi/Cocoa/DyldSPI.h: Removed.
• PluginProcess/mac/PluginProcessMac.mm:

(WebKit::PluginProcess::platformInitializeProcess):

• WebKit2.xcodeproj/project.pbxproj:

1:48 PM Changeset in webkit [198351] by rniwa@webkit.org

• 5 edits in trunk/Websites/perf.webkit.org

An analysis task should be closed if a progression cause is identified
​https://bugs.webkit.org/show_bug.cgi?id=155549

Reviewed by Chris Dumez.

Since a progression is desirable, we should close an analysis task once its cause is identified.

Also fix some typos.

• init-database.sql: Fixed a typo.
• public/api/analysis-tasks.php:
• public/v3/models/analysis-task.js:

(AnalysisTask.prototype.dissociateBug): Renamed from dissociateBug.

• public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage.prototype.render):
(AnalysisTaskPage.prototype._dissociateBug): Renamed from _dissociateBug.
(AnalysisTaskPage.prototype._dissociateCommit): Fixed the typo in the alert.

1:46 PM Changeset in webkit [198350] by Chris Dumez

• 5 edits in trunk/Source

Set the WebContent process's main thread QoS to USER-INTERACTIVE
​https://bugs.webkit.org/show_bug.cgi?id=155595
<rdar://problem/22534965>

Reviewed by Antti Koivisto.

Source/WebKit2:

Increase the WebContent process main thread's QoS to USER-INTERACTIVE
instead of USER-INITIATED as it is drawing UI. However, use a relative
priority of -1 so that its priority is lower than the one of the
scrolling thread.

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess):

Source/WTF:

Add a relativePriority parameter to setCurrentThreadIsUser*() so that
we can do more fine-grained prioritization of threads that have the
same QoS.

• wtf/Threading.cpp:

(WTF::setCurrentThreadIsUserInteractive):
(WTF::setCurrentThreadIsUserInitiated):
(WTF::createThread): Deleted.

• wtf/Threading.h:

1:38 PM Changeset in webkit [198349] by mark.lam@apple.com

• 5 edits in trunk/Source/JavaScriptCore

Make FunctionMode an enum class.
​https://bugs.webkit.org/show_bug.cgi?id=155587

Reviewed by Saam Barati.

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):

• parser/NodeConstructors.h:

(JSC::BaseFuncExprNode::BaseFuncExprNode):
(JSC::FuncExprNode::FuncExprNode):
(JSC::FuncDeclNode::FuncDeclNode):
(JSC::ArrowFuncExprNode::ArrowFuncExprNode):
(JSC::MethodDefinitionNode::MethodDefinitionNode):

• parser/ParserModes.h:

(JSC::functionNameIsInScope):

1:13 PM Changeset in webkit [198348] by msaboff@apple.com

• 7 edits
  1 add in trunk/Source/JavaScriptCore

[ES6] Getters and Setters should be prefixed appropriately
​https://bugs.webkit.org/show_bug.cgi?id=155593

Reviewed by Mark Lam.

Changed the putDirectNativeIntrinsicGetter() to prepend "get " to the funtion name.

Updated places that had their own macro or hand constructed a getter function to use
the JSC_NATIVE_GETTER macro which will properly append "get ".

Prepended "get " and "set " to the proto accessor created on the Object prototype.

When we create the Symbol.species getter, added an explicit function name of "get [Symbol.species]".

• inspector/JSInjectedScriptHostPrototype.cpp:

(Inspector::JSInjectedScriptHostPrototype::finishCreation):
(Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):

• inspector/JSJavaScriptCallFramePrototype.cpp:

(Inspector::JSJavaScriptCallFramePrototype::finishCreation):
(Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluate):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/JSObject.cpp:

(JSC::JSObject::putDirectNativeIntrinsicGetter):

• runtime/MapPrototype.cpp:

(JSC::MapPrototype::finishCreation):
(JSC::MapPrototype::getOwnPropertySlot):

• runtime/SetPrototype.cpp:

(JSC::SetPrototype::finishCreation):
(JSC::SetPrototype::getOwnPropertySlot):

• tests/stress/accessors-get-set-prefix.js: Added.

(tryGetOwnPropertyDescriptorGetName):

12:28 PM Changeset in webkit [198347] by achristensen@apple.com

• 4 edits in trunk/Source/WebKit2

Support manually accepting invalid SSL certificates with NetworkSession
​https://bugs.webkit.org/show_bug.cgi?id=155442
<rdar://problem/24847398>

Reviewed by Darin Adler.

When we click continue after getting a warning about an invalid SSL certificate, we call
NSURLRequest setAllowsSpecificHTTPSCertificate in NetworkProcess::allowSpecificHTTPSCertificateForHost,
which stores information in CFNetwork about the specific invalid SSL certificate we want to accept.
If we see such a certificate during a server trust evaluation, we want to tell CFNetwork to accept it.
This fixes a loop when going to ​https://badssl.com, clicking on expired, and clicking continue.

• NetworkProcess/NetworkDataTask.h:
• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::didReceiveChallenge):
(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):

• NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::transferSandboxExtensionToDownload):
(WebKit::certificatesMatch):
(WebKit::NetworkDataTask::allowsSpecificHTTPSCertificateForHost):
(WebKit::NetworkDataTask::suggestedFilename):

12:07 PM Changeset in webkit [198346] by Nikita Vasilyev

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Large repaints when typing any character in console
​https://bugs.webkit.org/show_bug.cgi?id=155387
<rdar://problem/25125720>

Reviewed by Timothy Hatcher.

• UserInterface/Views/Main.css:

(#content):

11:54 AM Changeset in webkit [198345] by fpizlo@apple.com

• 4 edits in trunk/Source/WTF

Silence leaks in ParkingLot
​https://bugs.webkit.org/show_bug.cgi?id=155510

Reviewed by Alexey Proskuryakov.

ParkingLot has a concurrent hashtable that it reallocates on demand. It will not reallocate
it in steady state. The hashtable is sized to accommodate the high watermark of the number
of active threads - so long as the program doesn't just keep starting an unbounded number
of threads that are all active, the hashtable will stop resizing. Each resize operation is
designed to stay out of the way of the data-access-parallel normal path, in which two
threads operating on different lock addresses don't have to synchronize. To do this, it
simply drops the old hashtable without deleting it, so that threads that were still using
it don't crash. They will realize that they have the wrong hashtable before doing anything
bad, but we don't have a way of proving when all of those threads are no longer going to
read from the old hashtables. So, we just leak them.

This is a bounded leak, since the hashtable resizes exponentially. Thus the total memory
utilization of all hashtables, including the leaked ones, converges to a linear function of
the current hashtable's size (it's 2 * size of current hashtable).

But this leak is a problem for leaks tools, which will always report this leak. This is not
useful. It's better to silence the leak. That's what this patch does by ensuring that all
hashtables, including leaked ones, end up in a global vector. This is perf-neutral.

This requires making a StaticWordLock variant of WordLock. That's probably the biggest part
of this change.

• wtf/ParkingLot.cpp:
• wtf/WordLock.cpp:

(WTF::WordLockBase::lockSlow):
(WTF::WordLockBase::unlockSlow):
(WTF::WordLock::lockSlow): Deleted.
(WTF::WordLock::unlockSlow): Deleted.

• wtf/WordLock.h:

(WTF::WordLockBase::lock):
(WTF::WordLockBase::isLocked):
(WTF::WordLock::WordLock):
(WTF::WordLock::lock): Deleted.
(WTF::WordLock::isLocked): Deleted.

10:37 AM Changeset in webkit [198344] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Marking http/tests/security/aboutBlank/window-open-self-about-blank.html as flaky on ios-sim-debug
​https://bugs.webkit.org/show_bug.cgi?id=94458

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

10:20 AM Changeset in webkit [198343] by bshafiei@apple.com

• 5 edits in trunk/Source

Versioning.

10:18 AM Changeset in webkit [198342] by bshafiei@apple.com

• 1 copy in tags/Safari-602.1.24

New tag.

10:05 AM Changeset in webkit [198341] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r198331 - REGRESSION(r197380): Build fails with new GCC and Clang
​https://bugs.webkit.org/show_bug.cgi?id=155044

Reviewed by Michael Catanzaro.

In C++, std math functions ceil and floor are overloaded for double and float.
Without explicit cast or function pointer assignment, compilers cannot
determine which function address is used in the given context.

• b3/B3LowerMacrosAfterOptimizations.cpp:

10:04 AM Changeset in webkit [198340] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r197241 - [GTK] Fix incorrect cast

Unreviewed.

• MiniBrowser/gtk/main.c:

(createBrowserWindow):

10:03 AM Changeset in webkit [198339] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r197719 - Update perf bot configuration for Animometer
​https://bugs.webkit.org/show_bug.cgi?id=155134

Reviewed by Ryosuke Niwa.

• Scripts/webkitpy/benchmark_runner/data/patches/Animometer.patch: Refactor the patch

to work with the latest version of the harness.

• Scripts/webkitpy/benchmark_runner/data/plans/animometer.plan: Bump up the timeout,

and use the latest version of the harness.

10:03 AM Changeset in webkit [198338] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r197615 - [GTK] Fix logging details after r197505 (Run the run-benchmark script on the performance bot.)
​https://bugs.webkit.org/show_bug.cgi?id=154595

Unreviewed.

• Scripts/webkitpy/benchmark_runner/run_benchmark.py:

(start): Use logging.exception when a test fails in order to get the details about the error.

10:03 AM Changeset in webkit [198337] by Carlos Garcia Campos

• 6 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r197505 - [GTK] Run the run-benchmark script on the performance bot.
​https://bugs.webkit.org/show_bug.cgi?id=154595

Reviewed by Carlos Garcia Campos.

• BuildSlaveSupport/build.webkit.org-config/master.cfg: Add new RunBenchmarkTests step on the perf bots (only for the GTK+ port at this moment).

(RunBenchmarkTests):
(RunBenchmarkTests.start):
(RunBenchmarkTests.getText):
(RunBenchmarkTests.getText2):
(BuildAndPerfTestFactory.init):
(DownloadAndPerfTestFactory.init):

• BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py: Add new test for RunBenchmarkTests and update expected steps of GTK+ perf bot.

(RunBenchmarkTest):
(RunBenchmarkTest.assertResults):
(RunBenchmarkTest.test_success):
(RunBenchmarkTest.test_tests_failed):

• Scripts/webkitpy/benchmark_runner/benchmark_runner.py: Log both the current iteration as also the total iterations for the current benchmark/plan.

(BenchmarkRunner._run_benchmark):

• Scripts/webkitpy/benchmark_runner/browser_driver/gtk_minibrowser_driver.py: Use python logging also for errors.

(GTKMiniBrowserDriver.close_browsers):

• Scripts/webkitpy/benchmark_runner/run_benchmark.py: Implement support for running all available benchmark plans.

(parse_args):
(start):
(main):

10:02 AM Changeset in webkit [198336] by Carlos Garcia Campos

• 7 edits
  2 adds in releases/WebKitGTK/webkit-2.12/Tools

Merge r196979 - [GTK] Allow to run the WebKitGTK+ MiniBrowser with the run-benchmark script.
​https://bugs.webkit.org/show_bug.cgi?id=153993

Reviewed by Carlos Garcia Campos.

• MiniBrowser/gtk/main.c:

(createBrowserWindow): Support --geometry argument for MiniBrowser.
We use this on the gtk_minibrowser_driver script to start the MiniBrowser maximized.

• Scripts/webkitpy/benchmark_runner/browser_driver/init.py: Fix loading of subclasses:

The base class has to be loaded first, otherwise any subclase referencing it will give import error.
In OSX the ordering of os.listdir() causes the base class (browser_driver.py) to be first on the list, but not on Linux.
By specifiying the name of the base class file, we ensure it is always loaded first on any system despite the ordering of listdir.

• Scripts/webkitpy/benchmark_runner/browser_driver/browser_driver_factory.py:

(BrowserDriverFactory.create):

• Scripts/webkitpy/benchmark_runner/browser_driver/gtk_browser_driver.py: Added.

(GTKBrowserDriver):
(GTKBrowserDriver.prepare_env):
(GTKBrowserDriver.restore_env):
(GTKBrowserDriver.close_browsers):
(GTKBrowserDriver._launch_process):
(GTKBrowserDriver._terminate_processes):
(GTKBrowserDriver._screen_size):

• Scripts/webkitpy/benchmark_runner/browser_driver/gtk_minibrowser_driver.py: Added.

(GTKMiniBrowserDriver):
(GTKMiniBrowserDriver.prepare_env):
(GTKMiniBrowserDriver.launch_url):
(GTKMiniBrowserDriver.close_browsers):

• Scripts/webkitpy/benchmark_runner/http_server_driver/init.py: Fix loading of subclasses. See description above.
• Scripts/webkitpy/benchmark_runner/http_server_driver/simple_http_server_driver.py:

(SimpleHTTPServerDriver):
(SimpleHTTPServerDriver.kill_server): Check if the server is still running before trying to terminate it.
Usually the server ends gracefully (no need to terminate it), so this was causing ugly errors on the log.

• Scripts/webkitpy/benchmark_runner/utils.py: Fix loading of subclasses. See description above.

(load_subclasses):

10:02 AM Changeset in webkit [198335] by Antti Koivisto

• 2 edits in trunk/Source/WebCore

DataURLDecoder::DecodingResultDispatcher may get deleted outside main thread
​https://bugs.webkit.org/show_bug.cgi?id=155584
rdar://problem/24492104

Reviewed by Chris Dumez.

This is unsafe as it owns strings and other types that are only safe to delete in the main thread.

• platform/network/DataURLDecoder.cpp:

(WebCore::DataURLDecoder::DecodingResultDispatcher::dispatch):

The problem is that this was a refcounted type. This created a race. If the timer fired before dispatch()
was exited the implicit deref here would trigger the deletion in the dispatching thread.

Fix by getting rid of the unnecessary refcounting. Timer firing will now delete the instance explicitly.

(WebCore::DataURLDecoder::DecodingResultDispatcher::startTimer):
(WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):

9:43 AM Changeset in webkit [198334] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

Unreviewed, rolling out r198201.
​https://bugs.webkit.org/show_bug.cgi?id=155585

That was not the proper solution (Requested by KaL on
#webkit).

Reverted changeset:

"REGRESSION (r197724): [GTK] Web Inspector: Images being
blocked by CSP 2.0"
​https://bugs.webkit.org/show_bug.cgi?id=155432
​http://trac.webkit.org/changeset/198201

9:38 AM Changeset in webkit [198333] by Chris Fleizach

• 11 edits
  2 adds in trunk

AX: Implement AutoFill Available attribute for a text field
​https://bugs.webkit.org/show_bug.cgi?id=155567

Reviewed by Darin Adler.

Source/WebCore:

Expose the auto fill buttons to the AX hierarchy.
Add an attribute for the textfield to inform when the auto fill button is available.

Test: accessibility/auto-fill-types.html

• English.lproj/Localizable.strings:
• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::element):
(WebCore::AccessibilityObject::isValueAutofillAvailable):
(WebCore::AccessibilityObject::isValueAutofilled):

• accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::passwordFieldValue):

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::addTextFieldChildren):

• accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

• html/TextFieldInputType.cpp:

(WebCore::limitLength):
(WebCore::autoFillButtonTypeToAccessibilityLabel):
(WebCore::autoFillButtonTypeToAutoFillButtonPseudoClassName):
(WebCore::TextFieldInputType::createAutoFillButton):
(WebCore::TextFieldInputType::updateAutoFillButton):

• platform/LocalizedStrings.cpp:

(WebCore::AXListItemActionVerb):
(WebCore::AXAutoFillCredentialsLabel):
(WebCore::AXAutoFillContactsLabel):
(WebCore::AXARIAContentGroupText):

• platform/LocalizedStrings.h:

LayoutTests:

• accessibility/auto-fill-types-expected.txt: Added.
• accessibility/auto-fill-types.html: Added.

7:58 AM Changeset in webkit [198332] by mark.lam@apple.com

• 16 edits
  3 adds in trunk

Method names should not appear in the lexical scope of the method's body.
​https://bugs.webkit.org/show_bug.cgi?id=155568

Reviewed by Saam Barati.

Source/JavaScriptCore:

Consider this scenario:

var f = "foo";
var result = ({

f() {

return f; f should be the string "foo", not this method f.

}

}).f();
result === "foo"; Should be true.

The reason this is not current working is because the parser does not yet
distinguish between FunctionExpressions and MethodDefinitions. The ES6 spec
explicitly distinguishes between the 2, and we should do the same.

This patch changes all methods (and getters and setters which are also methods)
to have a FunctionMode of MethodDefinition (instead of FunctionExpression).
functionNameIsInScope() is responsible for determining whether a function's name
should be in its scope or not. It already returns false for any function
whose FunctionMode is not FunctionExpression. Giving methods the MethodDefinition
FunctionMode gets us the correct behavior ES6 expects.

• bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):

• bytecode/UnlinkedFunctionExecutable.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
(JSC::BytecodeGenerator::emitNewMethodDefinition):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ArrowFuncExprNode::emitBytecode):
(JSC::MethodDefinitionNode::emitBytecode):
(JSC::YieldExprNode::emitBytecode):

• parser/ASTBuilder.h:

(JSC::ASTBuilder::createFunctionExpr):
(JSC::ASTBuilder::createMethodDefinition):
(JSC::ASTBuilder::createFunctionMetadata):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createArguments):

• parser/NodeConstructors.h:

(JSC::FunctionParameters::FunctionParameters):
(JSC::BaseFuncExprNode::BaseFuncExprNode):
(JSC::FuncExprNode::FuncExprNode):
(JSC::FuncDeclNode::FuncDeclNode):
(JSC::ArrowFuncExprNode::ArrowFuncExprNode):
(JSC::MethodDefinitionNode::MethodDefinitionNode):
(JSC::YieldExprNode::YieldExprNode):

• parser/Nodes.h:

(JSC::BaseFuncExprNode::metadata):

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseClass):
(JSC::Parser<LexerType>::parsePropertyMethod):

• parser/ParserModes.h:
• parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createFunctionExpr):
(JSC::SyntaxChecker::createFunctionMetadata):
(JSC::SyntaxChecker::createArrowFunctionExpr):
(JSC::SyntaxChecker::createMethodDefinition):
(JSC::SyntaxChecker::setFunctionNameStart):
(JSC::SyntaxChecker::createArguments):

• tests/es6.yaml:

LayoutTests:

• inspector/model/scope-chain-node-expected.txt:
• rebased expected result.

• js/script-tests/function-toString-vs-name.js:
• fixed a bug in the shouldBe() function.

• js/methods-names-should-not-be-in-lexical-scope-expected.txt: Added.
• js/methods-names-should-not-be-in-lexical-scope.html: Added.
• js/script-tests/methods-names-should-not-be-in-lexical-scope.js: Added.
• test all variations of methods.

6:57 AM Changeset in webkit [198331] by Yusuke Suzuki

• 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r197380): Build fails with new GCC and Clang
​https://bugs.webkit.org/show_bug.cgi?id=155044

Reviewed by Michael Catanzaro.

In C++, std math functions ceil and floor are overloaded for double and float.
Without explicit cast or function pointer assignment, compilers cannot
determine which function address is used in the given context.

• b3/B3LowerMacrosAfterOptimizations.cpp:

6:17 AM Changeset in webkit [198330] by Csaba Osztrogonác

• 2 edits in trunk/Source/WebCore

[Mac][cmake] Unreviewed speculative buildfix after r198179. Just for fun.

• PlatformMac.cmake:

6:14 AM Changeset in webkit [198329] by Csaba Osztrogonác

• 2 edits in trunk/Source/WebKit2

[Mac][cmake] Unreviewed buildfix after r198070. Just for fun.

• PlatformMac.cmake:

5:59 AM Changeset in webkit [198328] by Csaba Osztrogonác

• 2 edits in trunk/Source/WebKit/mac

[cmake][Mac] Unreviewed speculative buildfix after r198088. Just for fun.

• WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

5:28 AM Changeset in webkit [198327] by Csaba Osztrogonác

• 13 edits in trunk

Unreviewed, line ending fixes.

Source/ThirdParty:

• gtest/codegear/gtest_all.cc:
• gtest/codegear/gtest_link.cc:

LayoutTests:

• css2.1/20110323/support/at-import-001.css:
• css2.1/20110323/support/at-import-002.css:
• css2.1/20110323/support/at-import-004.css:
• css2.1/20110323/support/at-import-005.css:
• css2.1/20110323/support/at-import-006.css:
• css2.1/20110323/support/at-import-007.css:
• css2.1/20110323/support/eof-green.css:
• storage/indexeddb/set_version_blocked.html:
• storage/indexeddb/transaction-read-only.html:

4:25 AM Changeset in webkit [198326] by youenn.fablet@crf.canon.fr

• 8 edits in trunk

[Fetch API] response-consume.html is crashing on Mac WK1 Debug builds
​https://bugs.webkit.org/show_bug.cgi?id=155490

Reviewed by Darin Adler.

Source/WebCore:

Covered by existing tests.

Ensured to lock state before calling JSC:JSONParse.
Adding fulfillPromiseWithJSON routine to handle it.
Applied it to FetchBody.

• Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::json):
(WebCore::FetchBody::loadedAsText):
(WebCore::FetchBody::resolveAsJSON): Deleted.

• Modules/fetch/FetchBody.h:
• Modules/fetch/FetchBodyOwner.cpp:

(WebCore::FetchBodyOwner::loadedBlobAsText):

• bindings/js/JSDOMPromise.cpp:

(WebCore::parseAsJSON):
(WebCore::fulfillPromiseWithJSON):

• bindings/js/JSDOMPromise.h:

LayoutTests:

• TestExpectations: Removed crash debug expectation of response-consume.html

3:52 AM Changeset in webkit [198325] by adam.bergkvist@ericsson.com

• 13 edits in trunk

WebRTC: Update RTCIceCandidate
​https://bugs.webkit.org/show_bug.cgi?id=155535

Reviewed by Eric Carlson.

Source/WebCore:

Update the RTCIceCandidate constructor procedure to match the WebRTC 1.0 specification [1].
In short: The "candidate" init dictionary member is required. At least one of the dictionary
members "sdpMid" and "sdpMLine" needs to be present; the corresponding attribute of the
other, is initialized to null.

[1] ​https://w3c.github.io/webrtc-pc/archives/20160215/webrtc.html

Tests: Updated fast/mediastream/RTCIceCandidate.htm

• Modules/mediastream/RTCIceCandidate.cpp:

(WebCore::RTCIceCandidate::create):
(WebCore::RTCIceCandidate::RTCIceCandidate):

• Modules/mediastream/RTCIceCandidate.h:

(WebCore::RTCIceCandidate::sdpMLineIndex):
(WebCore::RTCIceCandidate::setSdpMLineIndex):

• Modules/mediastream/RTCIceCandidate.idl:
• bindings/js/JSRTCIceCandidateCustom.cpp:

(WebCore::JSRTCIceCandidate::sdpMid):
(WebCore::JSRTCIceCandidate::sdpMLineIndex):

LayoutTests:

RTCIceCandidate.html is updated to test the new construction behavior and the nullable
attributes. The remaining updated tests simply construct an RTCIceCandidate to be used for
test purposes.

• fast/mediastream/RTCIceCandidate-expected.txt:
• fast/mediastream/RTCIceCandidate.html:
• fast/mediastream/RTCPeerConnection-closed-state.html:
• fast/mediastream/RTCPeerConnection-overloaded-operations-expected.txt:
• fast/mediastream/RTCPeerConnection-overloaded-operations-params-expected.txt:
• fast/mediastream/RTCPeerConnection-overloaded-operations-params.html:
• fast/mediastream/RTCPeerConnection-overloaded-operations.html:

2:46 AM Changeset in webkit [198324] by gskachkov@gmail.com

• 12 edits
  1 add in trunk

Invoking super()/super inside of the eval should not lead to SyntaxError
​https://bugs.webkit.org/show_bug.cgi?id=153864

Reviewed by Saam Barati.

Source/JavaScriptCore:

Added support of the invoking super/super() inside of the eval within class.
Also support cases when eval is invoked in constructor, class method directly
or via arrow function. Access to the new.target in eval is not part of this patch
and will be implemented in ​https://bugs.webkit.org/show_bug.cgi?id=155545

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isNewTargetUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isSuperUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isSuperCallUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):

• interpreter/Interpreter.cpp:

(JSC::eval):

• parser/Parser.cpp:

(JSC::Parser<LexerType>::Parser):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseMemberExpression):

• parser/Parser.h:

(JSC::Scope::Scope):
(JSC::Scope::isEvalContext):
(JSC::Scope::setIsEvalContext):
(JSC::parse):

• runtime/CodeCache.cpp:

(JSC::CodeCache::getGlobalCodeBlock):

• tests/stress/arrowfunction-lexical-bind-supercall-4.js:
• tests/stress/arrowfunction-lexical-bind-superproperty.js:
• tests/stress/class-syntax-super-in-eval.js: Added.
• tests/stress/generator-with-super.js:

LayoutTests:

• js/class-syntax-super-expected.txt:
• js/script-tests/class-syntax-super.js:

12:46 AM Changeset in webkit [198323] by Carlos Garcia Campos

• 1 copy in releases/WebKitGTK/webkit-2.10.9

WebKitGTK+ 2.10.9

12:45 AM Changeset in webkit [198322] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.10

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.10.9 release.

.:

• Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

• gtk/NEWS: Add release notes for 2.10.9

12:44 AM Changeset in webkit [198321] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196467 - [GTK] Allow applications to disable Accelerated Compositing mode.
​https://bugs.webkit.org/show_bug.cgi?id=154147

Reviewed by Carlos Garcia Campos.

• UIProcess/gtk/WebPreferencesGtk.cpp:

(WebKit::WebPreferences::platformInitializeStore): if the environment
variable WEBKIT_DISABLE_COMPOSITING_MODE is defined, then disable AC.

12:44 AM Changeset in webkit [198320] by Carlos Garcia Campos

• 7 edits in releases/WebKitGTK/webkit-2.10/Source

Merge r194518 - WebKit fails to build with musl libc library
​https://bugs.webkit.org/show_bug.cgi?id=152625

Patch by Khem Raj <​raj.khem@gmail.com> on 2016-01-03
Source/JavaScriptCore:

Reviewed by Daniel Bates.

Qualify isnan() calls with std namespace.

• runtime/Options.cpp:

(Option::operator==): Add std namespace qualifier.

Source/WebCore:

Reviewed by Daniel Bates and Alexey Proskuryakov.

malloc_trim is glibc specific API so guard it with GLIBC.

• platform/linux/MemoryPressureHandlerLinux.cpp:

(MemoryPressureHandler::platformReleaseMemory): Guard malloc_trim()
call with GLIBC_.

Source/WTF:

Reviewed by Daniel Bates.

Disable ctype.h check for musl C library on Linux.
Enable backtrace on Linux when using glibc.
We don't have backtrace() implemented on non-glibc system
C libraries on Linux e.g. musl.

• wtf/DisallowCType.h: Check for GLIBC.
• wtf/Assertions.cpp:

(WTFGetBacktrace): Check if libc is glibc.

12:43 AM Changeset in webkit [198319] by Carlos Garcia Campos

• 7 edits in releases/WebKitGTK/webkit-2.10/Source

Revert "Merge r196803 - [GTK] Limit the number of tiles according to the visible area"

This reverts commit f4b75bd5443ace0a438a43f9b73ff6de303d3858.

12:05 AM Changeset in webkit [198318] by aestes@apple.com

• 4 edits in trunk/Source

[Mac] Enable Content-Disposition: attachment sandbox
​https://bugs.webkit.org/show_bug.cgi?id=155578
<rdar://problem/21886326>

Reviewed by Dan Bernstein.

Covered by the existing set of attachment sandbox tests, which have always been run on Mac.

Source/WebKit/mac:

• WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):

Source/WebKit2:

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage):

Mar 16, 2016:

11:52 PM WebKitGTK/2.10.x edited by Carlos Garcia Campos

(diff)

9:42 PM Changeset in webkit [198317] by Matt Baker

• 2 edits in trunk/Source/WebInspectorUI

Uncaught Exception: SyntaxError: Invalid regular expression: \ at end of pattern
​https://bugs.webkit.org/show_bug.cgi?id=155556
<rdar://problem/25200058>

Reviewed by Timothy Hatcher.

Use simpleGlobStringToRegExp, which returns a valid regular expression
for strings with trailing backslashes, and also provides globbing.
String.escapeForRegExp returns a JS string ending in "
", which isn't
a valid regular expression.

• UserInterface/Views/OpenResourceDialog.js:

(WebInspector.OpenResourceDialog):
(WebInspector.OpenResourceDialog.prototype._handleMousedownEvent):
Fixed typo.

(WebInspector.OpenResourceDialog.prototype._updateFilter):
Switch to simpleGlobStringToRegExp.

8:36 PM Changeset in webkit [198316] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebCore

SVG tear offs should return a const reference if possible
​https://bugs.webkit.org/show_bug.cgi?id=153214

Patch by Nikos Andronikos <​nikos.andronikos-webkit@cisra.canon.com.au> on 2016-03-16
Reviewed by Alex Christensen.

A smaller change than expected because the returned reference is being copied into a value in additional locations that baseVal and animVal are used.

No new tests as there is no change in behaviour.

• svg/properties/SVGAnimatedEnumerationPropertyTearOff.h:
• svg/properties/SVGAnimatedStaticPropertyTearOff.h:

(WebCore::SVGAnimatedStaticPropertyTearOff::baseVal):
(WebCore::SVGAnimatedStaticPropertyTearOff::animVal):

7:49 PM Changeset in webkit [198315] by jonlee@apple.com

• 3 edits
  4 adds in trunk/PerformanceTests

Add a new benchmark test
​https://bugs.webkit.org/show_bug.cgi?id=155570

Reviewed by Simon Fraser.

New Leaves test includes various image sizes and opacity.

• Animometer/resources/debug-runner/tests.js: Add it to the HTML test suite.
• Animometer/tests/dom/leaves.html: Added.
• Animometer/tests/dom/resources/leaves.js: Added. Override the

(Particle.call.reset): Uses a range of sizes, and opacity.
(Particle.call.animate): Opacity goes up then down. When it hits 0, reset the particle.
(Particle.call.move): Set transform and opacity.

• Animometer/tests/master/resources/leaves.js: Get rid of the closure so that it

can be used in this test. Update the relative path so that it works in both the master
and dom test suite.

7:18 PM Changeset in webkit [198314] by Chris Dumez

• 2 edits in trunk/Source/WebCore

Unreviewed, partial roll out of r197254.
<rdar://problem/25078552>

It caused a ~1.1% PLT regression on iOS.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad): Deleted.

6:48 PM Changeset in webkit [198313] by matthew_hanson@apple.com

• 5 edits in branches/safari-601.1.46-branch/Source

Versioning.

6:45 PM Changeset in webkit [198312] by matthew_hanson@apple.com

• 1 copy in tags/Safari-601.1.46.120

New Tag.

5:56 PM Changeset in webkit [198311] by enrica@apple.com

• 2 edits in trunk/Source/WebCore

Recognize mailto and tel url as data detector links.
​https://bugs.webkit.org/show_bug.cgi?id=155569
rdar://problem/24836185

Reviewed by Sam Weinig.

When we check if the element is a data detector link,
we should return true also for URLs with mailto: and tel: scheme.

• editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::isDataDetectorLink):

5:13 PM Changeset in webkit [198310] by Chris Dumez

• 4 edits in trunk/Tools

Unreviewed, rolling out r198187.
​https://bugs.webkit.org/show_bug.cgi?id=155564

Potentially break testing on iOS (Requested by Guest23 on
#webkit).

Reverted changeset:

"Add twisted-15.5.0 module to
webkitpy.thirdparty.autoinstalled."
​https://bugs.webkit.org/show_bug.cgi?id=154667
​http://trac.webkit.org/changeset/198187

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-03-16

5:07 PM Changeset in webkit [198309] by Alan Bujtas

• 3 edits
  2 adds in trunk

Subpixel rendering: Directly composited image layers need pixelsnapping.
​https://bugs.webkit.org/show_bug.cgi?id=155558

Reviewed by Simon Fraser.

In order to match non-composited image size/position, we need to pixelsnap both the contents and the clipping
layer bounds for directly composited images.

Source/WebCore:

Test: fast/images/hidpi-directly-composited-image-on-subpixel-position.html

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::resetContentsRect):
(WebCore::RenderLayerBacking::updateChildClippingStrategy):
(WebCore::RenderLayerBacking::updateImageContents):

LayoutTests:

• fast/images/hidpi-directly-composited-image-on-subpixel-position-expected.html: Added.
• fast/images/hidpi-directly-composited-image-on-subpixel-position.html: Added.

4:37 PM Changeset in webkit [198308] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skipping mathml/very-large-stretchy-operators.html on ios-simulator debug
​https://bugs.webkit.org/show_bug.cgi?id=155565

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

4:32 PM Changeset in webkit [198307] by Ryan Haddad

• 3 edits in trunk/LayoutTests

Marking compositing/visible-rect/animated-from-none.html as flaky on ios-sim-wk2, failing on ios-sim-wk1
​https://bugs.webkit.org/show_bug.cgi?id=155495

Unreviewed test gardening.

• platform/ios-simulator-wk1/TestExpectations:
• platform/ios-simulator-wk2/TestExpectations:

4:25 PM Changeset in webkit [198306] by Beth Dakin

• 28 edits in trunk/Source

Provide NSSpellChecker spellChecking methods with the current insertion point
​https://bugs.webkit.org/show_bug.cgi?id=155532
-and corresponding-
rdar://problem/24066952

Reviewed by Simon Fraser.

Source/WebCore:

Pass the Frame’s selection to a handful of spelling checking methods that
call into WebKit/WebKit2 to ultimately call into NSSpellChecker.

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::hasMisspelling):

• accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(AXAttributeStringSetSpelling):

• editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::timerFired):

• editing/Editor.cpp:

(WebCore::Editor::guessesForMisspelledWord):
(WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):

• editing/SpellChecker.cpp:

(WebCore::SpellChecker::invokeRequest):
(WebCore::SpellChecker::enqueueRequest):

• editing/TextCheckingHelper.cpp:

(WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
(WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
(WebCore::TextCheckingHelper::unifiedTextCheckerEnabled):
(WebCore::checkTextOfParagraph):

• editing/TextCheckingHelper.h:
• loader/EmptyClients.cpp:

(WebCore::EmptyFrameLoaderClient::createNetworkingContext):
(WebCore::EmptyTextCheckerClient::requestCheckingOfString):

• loader/EmptyClients.h:
• platform/text/TextCheckerClient.h:

(WebCore::TextCheckerClient::~TextCheckerClient):

The key needed to include the insertion point.

• platform/spi/mac/NSSpellCheckerSPI.h:

Source/WebKit/mac:

Extract the insertion point from the VisibleSelection that WebCore has
passed.

• WebCoreSupport/WebEditorClient.h:

(WebEditorClient::getGuessesForWord):

• WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::checkTextOfParagraph):
(insertionPointFromCurrentSelection):
(WebEditorClient::getGuessesForWord):
(WebEditorClient::requestCheckingOfString):

Source/WebKit2:

Pass the insertionPoint to the UIProcess

• UIProcess/TextChecker.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::checkTextOfParagraph):
(WebKit::WebPageProxy::getGuessesForWord):
(WebKit::WebPageProxy::requestCheckingOfString):

• UIProcess/WebPageProxy.h:
• UIProcess/WebPageProxy.messages.in:
• UIProcess/efl/TextCheckerEfl.cpp:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):

• UIProcess/gtk/TextCheckerGtk.cpp:

(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):
(WebKit::TextChecker::checkTextOfParagraph):

• UIProcess/ios/TextCheckerIOS.mm:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::requestCheckingOfString):

• UIProcess/mac/TextCheckerMac.mm:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::ignoreWord):
(WebKit::TextChecker::requestCheckingOfString):

Extract the insertion point from the VisibleSelection that WebCore has
passed.

• WebProcess/WebCoreSupport/WebEditorClient.cpp:

(WebKit::insertionPointFromCurrentSelection):
(WebKit::WebEditorClient::checkTextOfParagraph):
(WebKit::WebEditorClient::getGuessesForWord):
(WebKit::WebEditorClient::requestCheckingOfString):

• WebProcess/WebCoreSupport/WebEditorClient.h:

3:10 PM Changeset in webkit [198305] by achristensen@apple.com

• 2 edits in trunk/Source/WebCore

Fix assertion failure on drive.google.com after r196052
​https://bugs.webkit.org/show_bug.cgi?id=155562

Reviewed by Jer Noble.

• rendering/RenderGeometryMap.cpp:

(WebCore::RenderGeometryMap::mapToContainer):
Change float equality check to areEssentiallyEqual.
This assertion was failing because rendererMappedResult was (944.335693, 232.047409)
but result was (944.335693, 232.047394). They differ by (0, 0.000015).

3:06 PM Changeset in webkit [198304] by ddkilzer@apple.com

• 3 edits in trunk/Tools

check-webkit-style: should warn about blank lines after #include "config.h" in TestWebKitAPI
<​http://webkit.org/b/155445>

Reviewed by Darin Adler.

• Scripts/webkitpy/style/checker.py:

(_PATH_RULES_SPECIFIER): Do not ignore "build/include*" checks
on TestWebKitAPI since this project uses a config.h header as of
r95188. Also remove references to WebKitAPITest, which ceased
to exist in r95944.

• Scripts/webkitpy/style/checker_unittest.py:

(GlobalVariablesTest.test_path_rules_specifier): Add tests.
Remove reference to WebKitAPITest project.

2:49 PM Changeset in webkit [198303] by n_wang@apple.com

• 3 edits
  2 adds in trunk

AX: Expose aria-current status to children
​https://bugs.webkit.org/show_bug.cgi?id=155469

Reviewed by Chris Fleizach.

Source/WebCore:

Added aria-current to the global ARIA attributes list.

Test: accessibility/aria-current-global-attribute.html

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::supportsARIAAttributes):

LayoutTests:

• accessibility/aria-current-global-attribute-expected.txt: Added.
• accessibility/aria-current-global-attribute.html: Added.

2:31 PM Changeset in webkit [198302] by timothy_horton@apple.com

• 6 edits in trunk

[mac] Printing test snapshots are upside-down after r198242
​https://bugs.webkit.org/show_bug.cgi?id=155543

Reviewed by Simon Fraser.

Source/WebCore:

• page/PrintContext.cpp:

(WebCore::PrintContext::spoolAllPagesWithBoundaries):
Stop PLATFORM(COCOA)-conditionally flipping here. Just paint.
This function is only used by the test runners so this doesn't have a
huge impact on anything else.

Tools:

• DumpRenderTree/mac/PixelDumpSupportMac.mm:

(createPagedBitmapContext):
Flip printing snapshots in DRT so that everything is right-side-up.

LayoutTests:

• TestExpectations:

Re-un-skip these tests.

1:58 PM Changeset in webkit [198301] by dbates@webkit.org

• 2 edits in trunk/Source/WebCore

Update WebKit Feature Status page to include the status of Content Security Policy Level 2 and Level 3

• features.json:

1:44 PM Changeset in webkit [198300] by matthew_hanson@apple.com

• 2 edits in branches/safari-601-branch/Source/WebCore

Merge r188574. rdar://problem/25070230

1:44 PM Changeset in webkit [198299] by matthew_hanson@apple.com

• 18 edits
  12 deletes in branches/safari-601-branch

Merge r188566. rdar://problem/25070230

1:17 PM Changeset in webkit [198298] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit2

REGRESSION (r192184): CleanMyDrive 2's tutorial window is blank
​https://bugs.webkit.org/show_bug.cgi?id=155550
<rdar://problem/24250689>

Reviewed by Dan Bernstein.

• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _setDrawsTransparentBackground:]):
The app is using this SPI via key-value coding, so just keeping the implementation
is sufficient to make AppKit stop throwing an undefined key exception.
Log once that this is deprecated (... it's also SPI) and then forward to setDrawsBackground.

1:13 PM Changeset in webkit [198297] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Marking inspector/controller/runtime-controller.html as flaky on mac
​https://bugs.webkit.org/show_bug.cgi?id=154688

Unreviewed test gardening.

• platform/mac/TestExpectations:

1:12 PM Changeset in webkit [198296] by fpizlo@apple.com

• 2 edits in trunk/Source/JavaScriptCore

ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode
​https://bugs.webkit.org/show_bug.cgi?id=153805

Reviewed by Mark Lam.

The object allocation sinking phase uses InferredValue::isStillValid() in the opposite
way from most clients: it will do an *extra* optimization if it returns false. The
phase will first compute sink candidates and then it will compute materialization
points. If something is a sink candidate then it is not a materialization point. A
NewFunction node may appear as not being a sink candidate during the first pass, so it's
not added to the set of things that will turn into PhantomNewFunction. But on the second
pass where we add materializations, we check isStillValid() again. Now this may become
false, so that second pass thinks that NewFunction is a sink candidate (even though it's
not in the sink candidates set) and so is not a materialization point.

This manifests as the NewFunction referring to a PhantomCreateActivation or whatever.

The solution is to have the phase cache results of calls to isStillValid(). It's OK if
we just remember the result of the first call and assume that it's not a sink candidate.
That's the worst that can happen.

No new tests since this is a super hard race and sink-huge-activation seemed to already
be catching it.

• dfg/DFGObjectAllocationSinkingPhase.cpp:

1:09 PM Changeset in webkit [198295] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Mark http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html as flaky
​https://bugs.webkit.org/show_bug.cgi?id=94458

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

12:49 PM Changeset in webkit [198294] by sbarati@apple.com

• 3 edits
  1 add in trunk/Source/JavaScriptCore

[ES6] Make Array.prototype.reverse spec compatible.
​https://bugs.webkit.org/show_bug.cgi?id=155528

Reviewed by Michael Saboff.

This patch make Array.prototype.reverse spec compatible.
Before, we weren't performing a HasProperty of each index
before performing a Get on that index. We now do that on
the slow path.

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncReverse):

• tests/stress/array-reverse-proxy.js: Added.

(assert):
(test):
(shallowCopy):
(shallowEqual):
(let.handler.get getSet):
(test.let.handler.get getSet):

12:47 PM Changeset in webkit [198293] by ap@apple.com

• 2 edits in trunk/Tools

Update unit test for iOS debug queues.

• BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:

12:46 PM Changeset in webkit [198292] by dbates@webkit.org

• 20 edits
  1 move
  48 adds in trunk

<video> and <audio> elements do not obey Content Security Policy on redirect
​https://bugs.webkit.org/show_bug.cgi?id=155509
<rdar://problem/10234844>

Reviewed by Alex Christensen.

Source/WebCore:

Fixes an issue where the Content Security Policy of the page was not enforced
on redirects when loading a media subresource via an HTML video or HTML audio
element.

Tests: http/tests/security/contentSecurityPolicy/audio-redirect-allowed.html

http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html
http/tests/security/contentSecurityPolicy/font-redirect-allowed.html
http/tests/security/contentSecurityPolicy/font-redirect-blocked.html
http/tests/security/contentSecurityPolicy/image-redirect-allowed.html
http/tests/security/contentSecurityPolicy/image-redirect-blocked.html
http/tests/security/contentSecurityPolicy/script-redirect-allowed.html
http/tests/security/contentSecurityPolicy/script-redirect-blocked.html
http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed.html
http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html
http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed.html
http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html
http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed.html
http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html
http/tests/security/contentSecurityPolicy/track-redirect-allowed.html
http/tests/security/contentSecurityPolicy/track-redirect-blocked.html
http/tests/security/contentSecurityPolicy/video-redirect-allowed.html
http/tests/security/contentSecurityPolicy/video-redirect-blocked.html
http/tests/security/contentSecurityPolicy/xsl-redirect-allowed.html
http/tests/security/contentSecurityPolicy/xsl-redirect-blocked.html

• inspector/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::cachedResourceContent): Treat media resources as raw resources just as we do currently.
(WebCore::InspectorPageAgent::cachedResourceType): Ditto.

• loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::requestResource): Modified to use CachedResourceLoader::requestMedia() instead
of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
initiated by an element in a user agent shadow tree. See <​https://bugs.webkit.org/show_bug.cgi?id=155505> for
more details.

• loader/ResourceLoadInfo.cpp:

(WebCore::toResourceType): Treat media resources as raw resources just as we do currently. Also, add cases for
CachedResource::LinkPrefetch and CachedResource::LinkSubresource (when ENABLE(LINK_PREFETCH) is enabled) and
remove the default statement to force a compile-time error when a new CachedResource enumerator is added and
the switch block in this function is not updated.

• loader/SubresourceLoader.cpp:

(WebCore::logResourceLoaded): Ditto.

• loader/cache/CachedRawResource.cpp:

(WebCore::CachedRawResource::CachedRawResource): Substitute CachedResource::isMainOrMediaOrRawResource() for
CachedResource::isMainOrRawResource() as the latter was renamed to the former.

• loader/cache/CachedRawResource.h:

(isType): Ditto.

• loader/cache/CachedResource.cpp:

(WebCore::defaultPriorityForResourceType): Use priority ResourceLoadPriority::Medium for media resources just as
we do currently.

• loader/cache/CachedResource.h:

(WebCore::CachedResource::isMainOrMediaOrRawResource): Formerly named isMainOrRawResource. Returns true if the type
of this resource is a main resource, media resource, or raw resource.
(WebCore::CachedResource::isMainOrRawResource): Deleted.

• loader/cache/CachedResourceLoader.cpp:

(WebCore::createResource): Treat media resources as raw resources just as we do currently.
(WebCore::CachedResourceLoader::requestMedia): Added.
(WebCore::contentTypeFromResourceType): Consider media resources as MixedContentChecker::ContentType::Active
just as we do currently.
(WebCore::CachedResourceLoader::checkInsecureContent): Apply the mixed content policy to media resources
just as we do currently.
(WebCore::CachedResourceLoader::canRequest): Apply the Same Origin Policy to media resources just as we
do currently. Query the Content Security Policy of the page to determine if the media resource can be
requested.
(WebCore::CachedResourceLoader::determineRevalidationPolicy): Substitute CachedResource::isMainOrMediaOrRawResource()
for CachedResource::isMainOrRawResource() as the latter was renamed to the former.

• loader/cache/CachedResourceLoader.h:
• platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:

(WebCore::WebCoreAVFResourceLoader::startLoading): Modified to use CachedResourceLoader::requestMedia() instead
of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
initiated by an element in a user agent shadow tree. See <​https://bugs.webkit.org/show_bug.cgi?id=155505> for
more details. Additionally, simplified code that determined whether to request the media resource or error out
by coalescing two conditional expressions into one conditional on whether we have a loader and substituted
nullptr for 0.

Source/WebKit2:

Use 0ms as the maximum buffering time for media resource just as we do currently.

• WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::maximumBufferingTime):

LayoutTests:

Add tests to ensure that the Content Security Policy is enforced on redirects when
loading a subresource, including a video or audio file.

• http/tests/resources/redirect.php: Fix PHP "undefined index" warnings when either query

parameter code or refresh (or both) are not specified.

• http/tests/security/contentSecurityPolicy/audio-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/audio-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/font-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/font-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/font-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/image-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/image-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/image-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/resources/ABCFont.svg: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/userAgentShadowDOM/resources/ABCFont.svg.
• http/tests/security/contentSecurityPolicy/resources/alert-fail.xsl: Added.
• http/tests/security/contentSecurityPolicy/resources/alert-pass.xsl: Added.
• http/tests/security/contentSecurityPolicy/resources/green-square.svg: Added.
• http/tests/security/contentSecurityPolicy/resources/red-square.svg: Added.
• http/tests/security/contentSecurityPolicy/resources/xsl-redirect-allowed.php: Added.
• http/tests/security/contentSecurityPolicy/resources/xsl-redirect-blocked.php: Added.
• http/tests/security/contentSecurityPolicy/script-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/script-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/script-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/track-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/track-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/track-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-svg-font.html:
• http/tests/security/contentSecurityPolicy/video-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/video-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/video-redirect-blocked.html: Added.
• http/tests/security/contentSecurityPolicy/xsl-redirect-allowed-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/xsl-redirect-allowed.html: Added.
• http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt: Added.
• http/tests/security/contentSecurityPolicy/xsl-redirect-blocked.html: Added.
• platform/efl/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. We will also need to fix
<​https://bugs.webkit.org/show_bug.cgi?id=153866> before we can unskip test http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-video.html
As far as I can tell the functionality exercised by these tests is not being using by the EFL port.

• platform/gtk/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. As far as I can tell the functionality
exercised by these tests is not being using by the GTK port.

• platform/ios-simulator/http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: Added expected failure result as

AV Foundation is responsible for loading media on iOS. That is, WebCore is not responsible for loading media.

• platform/ios-simulator/http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: Ditto.
• platform/mac/TestExpectations: For now skip tests http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-{audio, video}.html

until we fix <​https://bugs.webkit.org/show_bug.cgi?id=155505>. The functionality exercised by these
tests is not used on OS X. Additionally, mark as Failure on Yosemite and ElCapitan the added tests
http/tests/security/contentSecurityPolicy/{video, audio}-redirect-blocked.html as we do not support
Content Security Policy for media redirects in these versions of OS X.

12:33 PM Changeset in webkit [198291] by Chris Dumez

• 17 edits in trunk/Source

Unreviewed, rolling out r198235, r198240, r198241, and
r198252.

Causing crashes on ARM

Reverted changesets:

"Remove compile time define for SEPARATED_HEAP"
​https://bugs.webkit.org/show_bug.cgi?id=155508
​http://trac.webkit.org/changeset/198235

"Gardening: build fix after r198235."
​http://trac.webkit.org/changeset/198240

"Build fix."
​http://trac.webkit.org/changeset/198241

"Rename performJITMemcpy to something more inline with our
normal webkit function names"
​https://bugs.webkit.org/show_bug.cgi?id=155525
​http://trac.webkit.org/changeset/198252

12:03 PM Changeset in webkit [198290] by BJ Burg

• 4 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r198257.
​https://bugs.webkit.org/show_bug.cgi?id=155553

This change is unnecessary, clients can instead compile the
file with ARC enabled (Requested by brrian on #webkit).

Reverted changeset:

"REGRESSION(r198077): generated Objective-C protocol object
getters leak their wrappers"
​https://bugs.webkit.org/show_bug.cgi?id=155523
​http://trac.webkit.org/changeset/198257

11:31 AM Changeset in webkit [198289] by jiewen_tan@apple.com

• 22 edits
  2 adds in trunk

URL Parsing should signal failure for illegal IDN
​https://bugs.webkit.org/show_bug.cgi?id=154945
<rdar://problem/8014795>

Reviewed by Brent Fulgham.

Source/WebCore:

WebCore::URL will now invalidate URLs with illegal IDN. And functions inside WebCoreNSURLExtras.h
that deal with IDN mapping will now return nil to signal error.

Test: fast/url/invalid-idn.html

• platform/URL.cpp:

(WebCore::isSchemeFirstChar):
(WebCore::URL::init):
(WebCore::appendEncodedHostname):
(WebCore::encodeHostnames):
(WebCore::encodeRelativeString):

• platform/mac/WebCoreNSURLExtras.h:
• platform/mac/WebCoreNSURLExtras.mm:

(WebCore::mapHostNameWithRange):
(WebCore::hostNameNeedsDecodingWithRange):
(WebCore::hostNameNeedsEncodingWithRange):
(WebCore::decodeHostNameWithRange):
(WebCore::encodeHostNameWithRange):
(WebCore::decodeHostName):
(WebCore::encodeHostName):
(WebCore::collectRangesThatNeedMapping):
(WebCore::mapHostNames):
(WebCore::URLWithData):
(WebCore::dataWithUserTypedString):
(WebCore::URLWithUserTypedString):
(WebCore::URLWithUserTypedStringDeprecated):
(WebCore::userVisibleString):

Source/WebKit/ios:

• Misc/WebNSStringExtrasIOS.m:

(-[NSString _web_possibleURLsForForUserTypedString:]):

• WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder _updateTitleForURL:]):

Source/WebKit/mac:

In this patch, we add new SPIs _webkit_URLWithUserTypedString, _webkit_decodeHostName and
_webkit_encodeHostName which will return nil while dealing with illegal IDN.

Old SPIs _web_URLWithUserTypedString, _web_decodeHostName and _web_encodeHostName are marked
deprecated as they ignore URL parsing failure.

• History/WebHistoryItem.mm:

(-[WebHistoryItem initFromDictionaryRepresentation:]):

• Misc/WebKitErrors.m:

(+[NSError _webKitErrorWithCode:failingURL:]):

• Misc/WebNSFileManagerExtras.mm:

(-[NSFileManager _webkit_setMetadataURL:referrer:atPath:]):

• Misc/WebNSPasteboardExtras.mm:

(-[NSPasteboard _web_bestURL]):

• Misc/WebNSURLExtras.h:
• Misc/WebNSURLExtras.mm:

(+[NSURL _web_URLWithUserTypedString:]):
(+[NSURL _webkit_URLWithUserTypedString:relativeToURL:]):
(+[NSURL _webkit_URLWithUserTypedString:]):
(-[NSString _web_decodeHostName]):
(-[NSString _web_encodeHostName]):
(-[NSString _webkit_decodeHostName]):
(-[NSString _webkit_encodeHostName]):

• Panels/WebAuthenticationPanel.m:

(-[WebAuthenticationPanel setUpForChallenge:]):

• WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::canonicalizeURLString):

Tools:

• MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController fetch:]):

• TestWebKitAPI/Tests/Cocoa/URLExtras.mm:

(TestWebKitAPI::TEST):

LayoutTests:

• fast/url/host-expected.txt:
• fast/url/idna2003-expected.txt:
• fast/url/invalid-idn-expected.txt: Added.
• fast/url/invalid-idn.html: Added.

11:16 AM Changeset in webkit [198288] by mark.lam@apple.com

• 42 edits
  1 add in trunk

Add support for setting Function.name from computed properties.
​https://bugs.webkit.org/show_bug.cgi?id=155437

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

In JS code, we can have initialization of computed properties with function and
class objects e.g.

var o = {

[x]: function() {},
[y]: class {}

}

The ES6 spec states that the function and class in the example above (being
anonymous) should take on the value of x and y respectively as their names:

o[x].name; should be the "stringified" value of x.
o[y].name; should be the "stringified" value of y.

To achieve this, we will now inject an op_set_function_name bytecode at property
initialization sites if:

1. the property assigned value is a function or class, and
2. the function and class is anonymous, and
3. if property assigned value is a class, it doesn't have a static method that is statically named "name".

The op_set_function_name will result in JSFunction::setFunctionName() being
called on the target function / class before it is assigned to the property.
JSFunction::setFunctionName() will take care of:

1. computing the name to use from the value of the computed property name e.g. x and y in the example above.

If the computed property name is not a symbol, then the function / class name
should be the toString() value of that computed property name.

If the computed property name is a symbol, then ...

1. if the Symbol has a defined description (e.g. Symbol("foo")), then the function / class name should be "[<symbol description>]" e.g. "[foo]".
2. if the Symbol has an undefined description (e.g. Symbol()), then the function / class name should be "".

Note: Symbol("") is not the same as Symbol(). The former has a defined
descriptor "", and hence, yields a function / class name of "[]". The latter
yields a function / class name of "".

2. reifying the lazy name property with this function / class name.

op_set_function_name is named after the SetFunctionName internal function
in the ES6 spec that performs the above operation.

It is behaviorally correct to use op_set_function_name at every property
initialization site with computed property names. However, we choose to not
emit the op_set_function_name bytecode when we already know that it will do
nothing i.e. when the target function / class is proven to already have a name or
name property. This is done as an optimization to avoid unnecessary calls to
JSFunction::setFunctionName().

Note: we could further check if the class has a static method with a computed
name that is a constant string "name" and elide op_set_function_name there too.
However, we don't bother because this should be rare. JSFunction::setFunctionName()
will still do the right thing.

• bytecode/BytecodeList.json:
• bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitNewFunction):
(JSC::BytecodeGenerator::emitSetFunctionNameIfNeeded):
(JSC::BytecodeGenerator::emitCall):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::PropertyListNode::emitBytecode):
(JSC::PropertyListNode::emitPutConstantProperty):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGNodeType.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunction):
(JSC::DFG::SpeculativeJIT::compileSetFunctionName):
(JSC::DFG::SpeculativeJIT::compileForwardVarargs):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStoreBarrierInsertionPhase.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::compileSetFunctionName):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

• jit/JIT.h:
• jit/JITInlines.h:

(JSC::JIT::callOperation):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_strcat):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emitSlow_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_strcat):

• jit/JITOperations.cpp:
• jit/JITOperations.h:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::handleHostCall):

• llint/LLIntSlowPaths.h:
• llint/LowLevelInterpreter.asm:
• parser/Nodes.cpp:

(JSC::FunctionNode::finishParsing):
(JSC::PropertyListNode::hasStaticallyNamedProperty):
(JSC::VariableEnvironmentNode::VariableEnvironmentNode):

• parser/Nodes.h:
• runtime/JSFunction.cpp:

(JSC::getCalculatedDisplayName):
(JSC::JSFunction::setFunctionName):
(JSC::JSFunction::reifyLength):
(JSC::JSFunction::reifyName):

• runtime/JSFunction.h:
• tests/es6.yaml:
• tests/stress/computed-function-names.js: Added.

(toKeyString):
(toFuncName):
(shouldBe):
(return.propKey):

LayoutTests:

• js/object-literal-computed-methods-expected.txt:
• Exercise op_set_function_name at all tiers.

• js/script-tests/function-toString-vs-name.js:
• Added tests for computed properties.

• js/script-tests/object-literal-computed-methods.js:
• rebased results.

10:20 AM Changeset in webkit [198287] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Marking imported/blink/fast/multicol/dynamic/relayout-abspos-in-relpos-spanner.html as flaky on ios-sim
​https://bugs.webkit.org/show_bug.cgi?id=155339

Unreviewed test gardening.

• platform/ios-simulator/TestExpectations:

10:17 AM Changeset in webkit [198286] by matthew_hanson@apple.com

• 2 edits in branches/safari-601-branch/Source/WebCore

Merge r192054. rdar://problem/25152937

9:58 AM Changeset in webkit [198285] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skipping failing printing tests
​https://bugs.webkit.org/show_bug.cgi?id=155543

Unreviewed test gardening.

Three printing tests that rely on software snapshotting are failing after r198242 exposed
an underlying issue. Skipping these tests to get the bots back to green during investigation.

• TestExpectations:

9:46 AM Changeset in webkit [198284] by Antti Koivisto

• 5 edits
  2 adds in trunk

Don't invalidate style unnecessarily when setting inline style cssText
​https://bugs.webkit.org/show_bug.cgi?id=155541
rdar://problem/23318893

Reviewed by Simon Fraser.

Source/WebCore:

We currently invalidate style when cssText is set whether the style declaration changed or not.

Based on a patch by Simon.

Test: fast/css/style-invalidation-inline-csstext.html

• css/PropertySetCSSStyleDeclaration.cpp:

(WebCore::PropertySetCSSStyleDeclaration::cssText):
(WebCore::PropertySetCSSStyleDeclaration::setCssText):

Invalidate only if the parsed style changed.

• css/StyleProperties.cpp:

(WebCore::MutableStyleProperties::parseDeclaration):

Compare the original and new style after parsing, return result.

• css/StyleProperties.h:

LayoutTests:

• fast/css/style-invalidation-inline-csstext-expected.txt: Added.
• fast/css/style-invalidation-inline-csstext.html: Added.

9:26 AM Changeset in webkit [198283] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Rebaseline fast/css/getPropertyValue-webkit-marquee.html after r198255
​https://bugs.webkit.org/show_bug.cgi?id=155544

Unreviewed test gardening.

• fast/css/getPropertyValue-webkit-marquee-expected.txt:

8:35 AM Changeset in webkit [198282] by Carlos Garcia Campos

• 1 copy in releases/WebKitGTK/webkit-2.11.92

WebKitGTK+ 2.11.92

8:31 AM Changeset in webkit [198281] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r198127 - Enable GSS-Negotiate support in libsoup
​https://bugs.webkit.org/show_bug.cgi?id=155354

Patch by Tomas Popela <​tpopela@redhat.com> on 2016-03-14
Reviewed by Carlos Garcia Campos.

Enable the SOUP_TYPE_AUTH_NEGOTIATE feature if libsoup was compiled
with the GSS-Negotiate support.

• platform/network/soup/SoupNetworkSession.cpp:

(WebCore::SoupNetworkSession::SoupNetworkSession):

8:16 AM Changeset in webkit [198280] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.12

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.92 release.

.:

• Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

• gtk/NEWS: Add release notes for 2.11.92.

8:16 AM Changeset in webkit [198279] by Carlos Garcia Campos

• 22 edits
  6 deletes in releases/WebKitGTK/webkit-2.12

Revert "Merge r197549 - DFG/FTL should inline accesses to RegExpObject::m_lastIndex"

This reverts commit 75a052408f9d2d6401972afb8a422f0e5979aeff.

8:15 AM Changeset in webkit [198278] by Carlos Garcia Campos

• 11 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197622 - The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell"

This reverts commit 782aaddfb605fb925d3de4cb1e7b562cc26821b7.

8:15 AM Changeset in webkit [198277] by Carlos Garcia Campos

• 33 edits
  5 deletes in releases/WebKitGTK/webkit-2.12

Revert "Merge r197641 - RegExpMatchesArray doesn't know how to have a bad time"

This reverts commit 240414640dd08dd67d4866c3992f399cb1035bc1.

8:14 AM Changeset in webkit [198276] by Carlos Garcia Campos

• 9 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197715 - RegExp.prototype.exec() should call into Yarr at most once"

This reverts commit 2731cf7e9df14edf11cba6984e4c8cd1b14e752b.

8:14 AM Changeset in webkit [198275] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197730 - Reduce the number of instructions needed to record the last regexp result"

This reverts commit 074b9a12367b04dd3cd70f9d7c73695f8184fbb6.

8:14 AM Changeset in webkit [198274] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197729 - createRegExpMatchesArray should allocate substrings more quickly"

This reverts commit 5127c006fe6f7fcb4a512376866bce75b83a1c27.

8:13 AM Changeset in webkit [198273] by Carlos Garcia Campos

• 9 edits
  2 deletes in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197796 - Regexp matching should incur less call overhead"

This reverts commit 462dd3fe9ae1b6992bbf331c52e9d4d440298a16.

8:13 AM Changeset in webkit [198272] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r198269 - REGRESSION(r195661): [GTK] very slow scrolling
​https://bugs.webkit.org/show_bug.cgi?id=155334

Reviewed by Sergio Villar Senin.

Fix smooth scrolling behaviour change after r195661.

• platform/ScrollAnimationSmooth.cpp:

(WebCore::getAnimationParametersForGranularity): Fix a typo,
animationTime for pixel granularity should be 11 * tickTime.
(WebCore::ScrollAnimationSmooth::animateScroll): Previous code
reset all the data except the visibleLenght, so keep it in the
PerAxisData after the reset.

8:13 AM Changeset in webkit [198271] by Carlos Garcia Campos

• 7 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r198266 - Unreviewed, rolling out r196803.
​https://bugs.webkit.org/show_bug.cgi?id=155534

Introduced several rendering issues in popular websites
(Requested by KaL on #webkit).

Reverted changeset:

"[GTK] Limit the number of tiles according to the visible
area"
​https://bugs.webkit.org/show_bug.cgi?id=126122
​http://trac.webkit.org/changeset/196803

6:59 AM Changeset in webkit [198270] by Yusuke Suzuki

• 29 edits
  1 copy
  3 adds in trunk

[ES6] Reflect.set with receiver
​https://bugs.webkit.org/show_bug.cgi?id=155294

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch introduces the receiver parameter support for Reflect.set.
Reflect.set can alter the receiver with arbitrary values.
Each property descriptor uses the receiver in Set.

1) In the accessor descriptor case, the receiver is used as |this| value for setter calls.
2) In the data descriptor case, the actual property will be set onto the receiver objects.

The current put operation does not support the receiver that is different from the base object.
In particular, (2) case is not supported.
The naive implementation adds one more GetOwnProperty for the receiver per Set (9.1.9.1-4-c [1]), and it is unacceptable.
To keep the fast path efficiently, we fall back to the slow but generic implementation (ordinarySetSlow)
only when the receiver is altered.

We need not to change any JIT part, because the JS code cannot alter the receiver without Reflect.set.
The property accesses generated by the JIT code always have the receiver that is the same to the base object.
ProxyObject can alter the receiver, but this situation has no problem because ProxyObject disables Inline Caching.
NOTE: Generating Inline Caching for JSProxy (that is used for the Window proxy) is already disabled before this change.

[1]: ​https://tc39.github.io/ecma262/#sec-ordinaryset

• jsc.cpp:

(functionCreateProxy):

• runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::put):

• runtime/JSArray.cpp:

(JSC::JSArray::put):

• runtime/JSArrayBuffer.cpp:

(JSC::JSArrayBuffer::put):

• runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::put):

• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h:

(JSC::isThisValueAltered):

• runtime/JSDataView.cpp:

(JSC::JSDataView::put):

• runtime/JSFunction.cpp:

(JSC::JSFunction::put):

• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::put):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::put):

• runtime/JSObject.cpp:

(JSC::ordinarySetSlow):
(JSC::JSObject::putInlineSlow):

• runtime/JSObject.h:
• runtime/JSObjectInlines.h:

(JSC::JSObject::putInline):

• runtime/JSProxy.h:

(JSC::JSProxy::createStructure):

• runtime/Lookup.h:

(JSC::putEntry):

• runtime/PropertySlot.h:
• runtime/ProxyObject.cpp:

(JSC::ProxyObject::put):

• runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):
(JSC::PutPropertySlot::isCacheablePut):
(JSC::PutPropertySlot::isCacheableSetter):
(JSC::PutPropertySlot::isCacheableCustom):
(JSC::PutPropertySlot::isCustomAccessor):
(JSC::PutPropertySlot::disableCaching):
(JSC::PutPropertySlot::isCacheable):

• runtime/ReflectObject.cpp:

(JSC::reflectObjectSet):

• runtime/RegExpObject.cpp:

(JSC::RegExpObject::put):
(JSC::reject): Deleted.

• runtime/StringObject.cpp:

(JSC::StringObject::put):

• tests/es6.yaml:
• tests/stress/ordinary-set-exceptions.js: Added.

(shouldBe):
(shouldThrow):
(shouldThrow.set get var):

• tests/stress/proxy-set.js:
• tests/stress/reflect-set-proxy-set.js: Copied from Source/JavaScriptCore/tests/stress/proxy-set.js.

(shouldBe):
(unreachable):
(assert):
(throw.new.Error.let.handler.set 45):
(throw.new.Error):
(let.target.set x):
(let.target.get x):
(set let):

• tests/stress/reflect-set-receiver-proxy-set.js: Added.

(shouldBe):
(unreachable):
(assert):
(let.handler.set 45):
(catch):
(let.target.set x):
(let.target.get x):
(set let):

• tests/stress/reflect-set-with-global-proxy.js: Added.

(shouldBe):
(unreachable):
(get shouldBe):
(set shouldBe):
(set test1):
(set test2):
(set test3):

• tests/stress/reflect-set.js:

(shouldThrow):
(unreachable):
(get shouldBe):
(set shouldBe):
(receiverTestIndexed):
(set get Uint8Array):
(receiverCase): Deleted.
(proxyCase): Deleted.
(stringObjectCase.set get shouldBe): Deleted.
(regExpLastIndex): Deleted.

LayoutTests:

Currently, putDelegate (JSLocation is special case) and CustomIndexedSetter work as special setters.

• js/dom/reflect-set-onto-dom-expected.txt:
• js/dom/script-tests/reflect-set-onto-dom.js:

2:36 AM Changeset in webkit [198269] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore

REGRESSION(r195661): [GTK] very slow scrolling
​https://bugs.webkit.org/show_bug.cgi?id=155334

Reviewed by Sergio Villar Senin.

Fix smooth scrolling behaviour change after r195661.

• platform/ScrollAnimationSmooth.cpp:

(WebCore::getAnimationParametersForGranularity): Fix a typo,
animationTime for pixel granularity should be 11 * tickTime.
(WebCore::ScrollAnimationSmooth::animateScroll): Previous code
reset all the data except the visibleLenght, so keep it in the
PerAxisData after the reset.

12:18 AM Changeset in webkit [198268] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit/win

Unreviewed, rolling out r196951 and r197031.

Revert also WinCairo follow ups after r196803

Reverted changesets:

"[WinCairo] Compile fix."
​https://bugs.webkit.org/show_bug.cgi?id=154545
​http://trac.webkit.org/changeset/196951

"[WinCairo] Mark layer as non composited."
​https://bugs.webkit.org/show_bug.cgi?id=154640
​http://trac.webkit.org/changeset/197031

12:11 AM Changeset in webkit [198267] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit/win

Unreviewed, rolling out r197693.

197031

Reverted changeset:

"[WinCairo][AcceleratedCompositing] Rendering issues on
www.bbc.com."
​https://bugs.webkit.org/show_bug.cgi?id=154912
​http://trac.webkit.org/changeset/197693

12:05 AM Changeset in webkit [198266] by commit-queue@webkit.org

• 7 edits in trunk/Source

Unreviewed, rolling out r196803.
​https://bugs.webkit.org/show_bug.cgi?id=155534

Introduced several rendering issues in popular websites
(Requested by KaL on #webkit).

Reverted changeset:

"[GTK] Limit the number of tiles according to the visible
area"
​https://bugs.webkit.org/show_bug.cgi?id=126122
​http://trac.webkit.org/changeset/196803

12:02 AM Changeset in webkit [198265] by rniwa@webkit.org

• 11 edits
  2 adds in trunk/Websites/perf.webkit.org

Analysis task page should allow specifying commits that caused or fixed a regression or a progression
​https://bugs.webkit.org/show_bug.cgi?id=155529

Reviewed by Chris Dumez.

Added the capability to associate revisions that caused or fixed a progression or a regression for which
an analysis task was created. Added task_commits that stores this relationship and added the backend
support to retrieve this table in /api/analysis-tasks and an privileged API to update this table at
/privileged-api/associate-commit.

Also extracted a new component, MutableListView, out of AnalysisTaskPage to render and manipulate a list
of mutable items, and used it to render the list of associated bugs and commits. The view takes a list of
kinds (e.g. repositories or bug trackers), and accepts a pair of a kind and arbitrary text as a new item
value.

• init-database.sql: Added task_commits table.

• public/api/analysis-tasks.php:

(main):
(fetch_associated_data_for_tasks): Renamed from fetch_and_push_bugs_to_tasks now that it also fetches
the list of commits associated with each analysis task by calling CommitLogFetcher::fetch_for_tasks.
Also fixe the bug that we were not taking
(format_task): No longer sets 'category' since the computation of category now depends on the list of
commits associated with this analysis task which aren't available until fetch_associated_data_for_tasks.
(determine_category): Added. Categorize any analysis tasks with "fixes" commits as "closed" and "causes"
commits as "identified".

• public/include/commit-log-fetcher.php:

(CommitLogFetcher::construct): Remove the unused instance variable.
(CommitLogFetcher::fetch_for_tasks): Added. Fetches all commits associated with a list of analysis tasks.
Assumes the caller (fetch_associated_data_for_tasks) had setup "fixes" and "causes" fields on each task.

• public/privileged-api/associate-commit.php: Added. Updates task_commits table to associate or disassociate

a commit with an analysis task. When the specified analysis task and the specified commit are already
associated, we simply update the table instead of adding a duplicating entry or error. For dissociation,
the front-end specifies the commit ID.
(main): Added.

• public/v3/index.html:
• public/v3/components/mutable-list-view.js: Added. Used by the list associated bugs and commits.

(MutableListView): Added.
(MutableListView.prototype.setList): Added.
(MutableListView.prototype.setKindList): Added.
(MutableListView.prototype.setAddCallback): Added. This callback is invoked when the user tries to add
a new item to the list.
(MutableListView.prototype.render): Added.
(MutableListView.prototype._submitted): Added.
(MutableListView.cssTemplate):
(MutableListView.htmlTemplate):
(MutableListItem): Added. RemovalLink could be a hyperlink or a callback and gets involved when the user
tries to delete this item.
(MutableListItem.prototype.content):

• public/v3/models/analysis-task.js:

(AnalysisTask): Added the support of the list of commits that fixed and caused changes.
(AnalysisTask.prototype.updateSingleton): Ditto.
(AnalysisTask.prototype.causes): Added.
(AnalysisTask.prototype.fixes): Added.
(AnalysisTask.prototype.associateCommit): Added. Use the API added at /privileged-api/associate-commit
to associate a new commit with this analysis task. Each commit has either caused or fixed the change.
(AnalysisTask.prototype.dissociateCommit): Added. Use the same API to disassociate each commit.
(AnalysisTask._constructAnalysisTasksFromRawData): Find all commits associated with each analysis task.
Because commit log objects use a fake ID fdue to /api/measurement-set not providing commit IDs, we must
use CommitLog.findByRemoteId to find each commit instead of usual CommitLog.findById.
(AnalysisTask._constructAnalysisTasksFromRawData.resolveCommits): Added.

• public/v3/models/build-request.js:

(BuildRequest.prototype.hasFinished): Renamed from hasCompleted since it was confusing for this._status
being "completed" wasn't a necessary condition for this function to return true.

• public/v3/models/commit-log.js:

(CommitLog): Added the static map for actual commit ID instead of a fake ID created in ensureSingleton.
(CommitLog.prototype.remoteId): Added. Returns the real commit ID.
(CommitLog.findByRemoteId): Added. Finds an CommitLog object using the real ID.

• public/v3/models/test-group.js:

(TestGroup.prototype.hasFinished): Renamed from hasCompleted to match the rename in BuildRequest.

• public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage): Added lists for the commits that fixed and caused the change using MutableListView.
Also adopted MutableListView for the list of associated bugs.
(AnalysisTaskPage.prototype.render): Added the code to populate the newly added lists.
(AnalysisTaskPage.prototype._makeCommitListItem): Added.
(AnalysisTaskPage.prototype._associateBug): Now this is a callback from MutableListView.
(AnalysisTaskPage.prototype._associateCommit): Added.
(AnalysisTaskPage.prototype._dissociateCommit): Added.
(AnalysisTaskPage.htmlTemplate):
(AnalysisTaskPage.cssTemplate):

• public/v3/remote.js:

(getJSON): Spit out the entire responseText when JSON failed to parse to make debugging easier.