Context Navigation

← Previous Period
Next Period →

Timeline

Mar 23, 2016:

11:32 PM Changeset in webkit [198618] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Timeline range selection changes with ProfileView should not cause navigation bar items to flicker
https://bugs.webkit.org/show_bug.cgi?id=155834

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-23
Reviewed by Timothy Hatcher.

UserInterface/Views/ProfileView.js:

(WebInspector.ProfileView.prototype._recreate):
The only reason our selection path components would change is if we
had focus nodes before and do not anymore.

10:16 PM Changeset in webkit [198617] by commit-queue@webkit.org

2 edits in trunk/Tools

webkit-patch failed to open pretty diff on Windows
https://bugs.webkit.org/show_bug.cgi?id=155827

Patch by Bill Ming <mbbill@gmail.com> on 2016-03-23
Reviewed by Alex Christensen.

Scripts/webkitpy/tool/steps/confirmdiff.py:

(ConfirmDiff._show_pretty_diff):

10:13 PM Changeset in webkit [198616] by commit-queue@webkit.org

2 edits in trunk

Fixed ninja build path.
https://bugs.webkit.org/show_bug.cgi?id=155796

Patch by Bill Ming <mbbill@gmail.com> on 2016-03-23
Reviewed by Alex Christensen.

Tools/Scripts/build-webkit:

8:31 PM Changeset in webkit [198615] by rniwa@webkit.org

1 edit
1 delete in trunk/Websites/perf.webkit.org

Delete a file that was supposed to be removed in r198614 for real.

unit-tests/resources/v3-models.js: Removed.

8:25 PM Changeset in webkit [198614] by rniwa@webkit.org

6 edits
2 copies
2 adds in trunk/Websites/perf.webkit.org

Add a model for parsing buildbot JSON with unit tests
https://bugs.webkit.org/show_bug.cgi?id=155814

Reviewed by Joseph Pecoraro.

Added BuildbotSyncer and BuildbotBuildEntry classes to parse buildbot JSON files with unit tests.
They will be used in the new syncing scripts to improve A/B testing.

public/v3/models/build-request.js:

(BuildRequest):

tools/js/buildbot-syncer.js: Added.

(BuildbotBuildEntry): Added.
(BuildbotBuildEntry.prototype.slaveName): Added.
(BuildbotBuildEntry.prototype.buildRequestId): Added.
(BuildbotBuildEntry.prototype.isInProgress): Added.
(BuildbotSyncer): Added.
(BuildbotSyncer.prototype.testPath): Added.
(BuildbotSyncer.prototype.builderName): Added.
(BuildbotSyncer.prototype.platformName): Added.
(BuildbotSyncer.prototype.fetchPendingRequests): Added.
(BuildbotSyncer.prototype._propertiesForBuildRequest): Added.
(BuildbotSyncer.prototype._revisionSetFromRootSetWithExclusionList): Added.
(BuildbotSyncer._loadConfig): Added.
(BuildbotSyncer._validateAndMergeConfig): Added.
(BuildbotSyncer._validateAndMergeProperties): Added.

tools/js/v3-models.js: Copied from unit-tests/resources/v3-models.js.

(beforeEach): Deleted since this only defined inside mocha.

unit-tests/analysis-task-tests.js:
unit-tests/buildbot-syncer-tests.js: Added.

(sampleiOSConfig):
(createSampleBuildRequest):
(.smallConfiguration):

unit-tests/measurement-adaptor-tests.js:
unit-tests/measurement-set-tests.js:
unit-tests/resources/mock-v3-models.js: Renamed from unit-tests/resources/v3-models.js.

(beforeEach):

unit-tests/test-groups-tests.js:

(sampleTestGroup):

7:41 PM Changeset in webkit [198613] by dbates@webkit.org

3 edits in trunk/Source/WebCore

CSP: Simplify logic for checking policies
https://bugs.webkit.org/show_bug.cgi?id=155817
<rdar://problem/25326546>

Reviewed by Zalan Bujtas.

Consolidate the various static template functions into a single function called ContentSecurityPolicy::allPoliciesAllow()
that tests whether a resource request when evaluated with respect to a directive (given as a ContentSecurityPolicyDirectiveList
pointer-to-member function) violates any of the CSPs that were delivered with the document.

No functionality changed. So, no new tests.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allPoliciesAllowHashFromContent): Formerly name isAllowedByAllWithHash. Made it
a member function so that we query for the document encoding instead of taking it as an argument. Modified
it to take a predicate function to pass it to allPoliciesAllow().
(WebCore::ContentSecurityPolicy::allowJavaScriptURLs): Modified to use ContentSecurityPolicy::allPoliciesAllow().
(WebCore::ContentSecurityPolicy::allowInlineEventHandlers): Ditto.
(WebCore::ContentSecurityPolicy::allowScriptWithNonce): Ditto.
(WebCore::ContentSecurityPolicy::allowStyleWithNonce): Ditto.
(WebCore::ContentSecurityPolicy::allowInlineScript): Modified to use ContentSecurityPolicy::allPoliciesAllow() and
ContentSecurityPolicy::allPoliciesAllowHashFromContent().
(WebCore::ContentSecurityPolicy::allowInlineStyle): Ditto.
(WebCore::ContentSecurityPolicy::allowEval): Modified to use ContentSecurityPolicy::allPoliciesAllow().
(WebCore::ContentSecurityPolicy::allowFrameAncestors): Ditto.
(WebCore::ContentSecurityPolicy::allowPluginType): Ditto.
(WebCore::ContentSecurityPolicy::allowScriptFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
(WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
(WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
(WebCore::ContentSecurityPolicy::allowBaseURI): Ditto.
(WebCore::isAllowedByAllWithFrame): Deleted.
(WebCore::isAllowedByAll): Deleted.
(WebCore::isAllowedByAllWithState): Deleted.
(WebCore::isAllowedByAllWithContext): Deleted.
(WebCore::isAllowedByAllWithNonce): Deleted.
(WebCore::isAllowedByAllWithHash): Deleted.
(WebCore::isAllowedByAllWithHashFromContent): Deleted.
(WebCore::isAllowedByAllWithURL): Deleted.
(WebCore::ContentSecurityPolicy::documentEncoding): Deleted. Incorporated its functionality into ContentSecurityPolicy::allPoliciesAllowHashFromContent().
(WebCore::ContentSecurityPolicy::isActive): Deleted. This function has been unused since the removal of the CSP script
interface in <http://trac.webkit.org/changeset/197142>.

page/csp/ContentSecurityPolicy.h:

(WebCore::ContentSecurityPolicy::allPoliciesAllow): Added. Returns whether the predicate function evaluates to true
for all CSP policies.

7:40 PM Changeset in webkit [198612] by jonlee@apple.com

5 edits in trunk/PerformanceTests

Update focus and leaves tests
https://bugs.webkit.org/show_bug.cgi?id=155825

Reviewed by Simon Fraser.

Particles would improperly disappear, before they were fully off stage. Update the calculation.

Animometer/tests/dom/resources/leaves.js:
Animometer/tests/master/resources/leaves.js:

Animometer/tests/master/focus.html: Update the center element styling.
Animometer/tests/master/resources/focus.js:

(FocusElement.Utilities.createClass): Give enough space in the container for each particle for the blur
to spread. It should be about 3x more space than the blur radius on each side.
(Stage.call.initialize): Ditto for the center element.

7:40 PM Changeset in webkit [198611] by jonlee@apple.com

11 edits
1 delete in trunk/PerformanceTests

Update support for other platforms
https://bugs.webkit.org/show_bug.cgi?id=155824

Reviewed by Simon Fraser.

Animometer/resources/debug-runner/animometer.css: Remove extraneous media query. All of it should

be handled in the release stylesheet.

Animometer/resources/debug-runner/animometer.js: Add support for browsers that return an HTMLCollection

when retrieving radio elements with a name, instead of the selected value.

Animometer/resources/runner/animometer.css: Adjust the queries for devices of varying widths.

(.frame-container): Move overflow:hidden to #stage.

Animometer/tests/master/resources/stage.css: Consolidate into tests/resources/stage.css.
Animometer/tests/resources/stage.css:

(body): Remove overflow:hidden.
(#stage): Set overflow:hidden here.
(#center-text): Moved from master/resources/stage.css.

Update stylesheet hrefs.

Animometer/tests/master/canvas-stage.html:
Animometer/tests/master/focus.html:
Animometer/tests/master/leaves.html:
Animometer/tests/master/multiply.html:
Animometer/tests/master/particles.html:
Animometer/tests/master/text.html: Adjust text size to fit in the device screen.

7:08 PM Changeset in webkit [198610] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Make the benchmark require device to be in landscape orientation
https://bugs.webkit.org/show_bug.cgi?id=155822
rdar://problem/25258650

Reviewed by Ryosuke Niwa.

Check that the device is in landscape orientation. If not, disable the button to start it,
and show a warning message.

Animometer/developer.html: Add a message about how the browser should be set up. Include a

warning message that appears if the orientation is incorrect on mobile devices.

Animometer/index.html: Ditto.

Animometer/resources/debug-runner/animometer.css: Migrate the .hidden rule into the release

stylesheet. Update the style to accommodate the new UI.

Animometer/resources/runner/animometer.css:

Animometer/resources/runner/animometer.js:

(window.benchmarkController.initialize): Add the orientation listener is needed.
(window.benchmarkController.addOrientationListenerIfNecessary): Only mobile devices need this. Check
to see for support of window.orientation.
(window.benchmarkController._orientationChanged): Toggle the warning based on whether we match the
landscape query. Set a state variable, which is needed for the debug harness. Call updateStartButtonState.
(window.benchmarkController.updateStartButtonState):

Animometer/resources/debug-runner/animometer.js: Change _updateStartButtonState to return

a boolean about whether at least one test is selected. That will be used in
benchmarkController.updateStartButtonState(). Move the load event listener to the release version.
(window.benchmarkController.updateStartButtonState): Override the release version, and also check
that at least one test is selected.

5:43 PM Changeset in webkit [198609] by jer.noble@apple.com

2 edits
2 adds in trunk

Media elements allowed to play without a user gesture, but requiring fullscreen playback, should not be allowed to autoplay.
https://bugs.webkit.org/show_bug.cgi?id=155599

Reviewed by Darin Adler.

Test: media/video-autoplay-allowed-but-fullscreen-required.html

Entering fullscreen should always require a user gesture.

html/MediaElementSession.cpp:

(WebCore::MediaElementSession::playbackPermitted):

5:42 PM Changeset in webkit [198608] by jer.noble@apple.com

2 edits in trunk/Tools

[ios-sim] RequiresUserActionForPlaybackTest.DoesNotRequireUserActionForMediaPlayback and RequiresUserActionForVideoButNotAudioPlayback failing
https://bugs.webkit.org/show_bug.cgi?id=155764

Reviewed by Eric Carlson.

Remove the requirement for media elements to have webkit-playsinline attributes on iOS.

TestWebKitAPI/Tests/WebKit2Cocoa/RequiresUserActionForPlayback.mm:

(RequiresUserActionForPlaybackTest::SetUp):

5:13 PM Changeset in webkit [198607] by commit-queue@webkit.org

3 edits
2 deletes in trunk

Unreviewed, rolling out r198538.
https://bugs.webkit.org/show_bug.cgi?id=155819

Broke two API tests on iOS simulator (Requested by ap on
#webkit).

Reverted changeset:

"Media elements allowed to play without a user gesture, but
requiring fullscreen playback, should not be allowed to
autoplay."
https://bugs.webkit.org/show_bug.cgi?id=155599
http://trac.webkit.org/changeset/198538

5:12 PM Changeset in webkit [198606] by ggaren@apple.com

9 edits
1 add in trunk/Source/bmalloc

bmalloc: Added an Object helper class
https://bugs.webkit.org/show_bug.cgi?id=155818

Reviewed by Gavin Barraclough.

Object is an abstraction that breaks out a void* into its component
metadata pointers.

This is slightly faster than recomputing them, and it enables a future
patch in which Object will tell us whether it is small or large.

bmalloc.xcodeproj/project.pbxproj: Added to the project.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::reallocate): Use Object to compute size.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::processObjectLog):

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallPage):
(bmalloc::Heap::deallocateSmallLine):

bmalloc/Heap.h:

(bmalloc::Heap::derefSmallLine): Use Object to deallocate.

bmalloc/Object.h: Added.

(bmalloc::Object::Object):
(bmalloc::Object::chunk):
(bmalloc::Object::line):
(bmalloc::Object::page): Helper class to break out a void* into its
component metadata pointers.

bmalloc/SmallChunk.h:

(bmalloc::SmallChunk::SmallChunk): SmallPage::get doesn't exist anymore
so we use our new helper functions instead.

(bmalloc::SmallChunk::offset):
(bmalloc::SmallChunk::object):
(bmalloc::SmallChunk::page):
(bmalloc::SmallChunk::line):
(bmalloc::SmallLine::begin):
(bmalloc::SmallLine::end):
(bmalloc::SmallPage::begin): New helpers that operate on the data
stored in Object.

(bmalloc::SmallLine::get): Deleted.
(bmalloc::SmallPage::get): Deleted.

bmalloc/SmallLine.h:

(bmalloc::SmallLine::refCount): Added a default ref value for convenience.

bmalloc/SmallPage.h:

(bmalloc::SmallPage::SmallPage):

4:47 PM Changeset in webkit [198605] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Allow clicking the Timeline in Editing Mode to toggle the checkbox
https://bugs.webkit.org/show_bug.cgi?id=155815

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-23
Reviewed by Timothy Hatcher.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview.prototype._startEditingInstruments):
Remove unused variable.

UserInterface/Views/TimelineTreeElement.js:

(WebInspector.TimelineTreeElement.prototype.onattach):
(WebInspector.TimelineTreeElement.prototype._clickHandler):
Make clicking on the tree element toggle the checkbox.

4:47 PM Changeset in webkit [198604] by andersca@apple.com

5 edits
1 add in trunk

Crash when using KVO from within -[WebView initWithCoder:]
https://bugs.webkit.org/show_bug.cgi?id=155816
rdar://problem/17073265

Reviewed by Dan Bernstein.

Source/WebKit/mac:

Get rid of the observationInfo getter and setter. It's not clear why they were added (in 2003),
and the methods on NSObject are good enough for us.

WebView/WebView.mm:

(-[WebView setObservationInfo:]): Deleted.
(-[WebView observationInfo]): Deleted.

WebView/WebViewData.h:

Tools:

Add test.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/mac/EarlyKVOCrash.mm: Added.

(-[EarlyKVOCrashResponder initWithWebView:]):
(-[EarlyKVOCrashResponder initWithCoder:]):
(-[EarlyKVOCrashResponder dealloc]):
(-[EarlyKVOCrashResponder encodeWithCoder:]):
(TestWebKitAPI::TEST):

4:42 PM Changeset in webkit [198603] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Timeline Tab sometimes restores as blank
https://bugs.webkit.org/show_bug.cgi?id=155811

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-23
Reviewed by Timothy Hatcher.

UserInterface/Views/TimelineTabContentView.js:

(WebInspector.TimelineTabContentView.prototype.restoreFromCookie):
When early bailing in restore, if there is no content view to restore,
then at least fallback to showing the Overview.

3:45 PM Changeset in webkit [198602] by commit-queue@webkit.org

4 edits in trunk/Source/WebInspectorUI

Web Inspector: REGRESSION: Timeline Reset does not clear datagrids
https://bugs.webkit.org/show_bug.cgi?id=155804

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-23
Reviewed by Timothy Hatcher.

UserInterface/Views/HeapAllocationsTimelineView.js:

(WebInspector.HeapAllocationsTimelineView.prototype.shown):
(WebInspector.HeapAllocationsTimelineView.prototype.hidden):
(WebInspector.HeapAllocationsTimelineView.prototype.closed):
(WebInspector.HeapAllocationsTimelineView.prototype.reset):
Although we don't use the popover features of TimelineDataGrid,
be a good citizen and call methods on the datagrid.

UserInterface/Views/OverviewTimelineView.js:

(WebInspector.OverviewTimelineView.prototype.reset):
Clear the datagrid on reset.

UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid.prototype.reset):
Clear the datagrid on reset.

3:45 PM Changeset in webkit [198601] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Uncaught exceptions closing Timeline tab
https://bugs.webkit.org/show_bug.cgi?id=155805

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-23
Reviewed by Timothy Hatcher.

UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange):
Gracefully handle if there is no content view.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype.closed): Deleted.
Fix typo.

3:33 PM Changeset in webkit [198600] by commit-queue@webkit.org

8 edits
2 deletes in trunk

Unreviewed, rolling out r198582.
https://bugs.webkit.org/show_bug.cgi?id=155812

"It broke debugging in the web inspector" (Requested by
saamyjoon on #webkit).

Reverted changeset:

"We should not disable inlining when the debugger is enabled"
https://bugs.webkit.org/show_bug.cgi?id=155741
http://trac.webkit.org/changeset/198582

3:27 PM Changeset in webkit [198599] by Simon Fraser

2 edits in trunk/Source/WebCore

Change the paint count indicator to indicate whether a layer is opaque
https://bugs.webkit.org/show_bug.cgi?id=155810

Reviewed by Tim Horton.

In non-opaque layers, give the paint count indicator a diagonal top left corner. Being
able to see layer opaqueness helps diagnose bugs.

Also use CGContextStateSaver, and move the indicator in by a pixel to overlap less
with the layer border.

platform/graphics/ca/PlatformCALayer.cpp:

(WebCore::PlatformCALayer::drawRepaintIndicator):

2:55 PM Changeset in webkit [198598] by rniwa@webkit.org

6 edits
1 add in trunk/Websites/perf.webkit.org

Add unit tests for test-group.js
https://bugs.webkit.org/show_bug.cgi?id=155781

Reviewed by Joseph Pecoraro.

Added unit tests for test-group.js that would have caught regressions fixed in r198503.

public/v3/components/chart-pane-base.js:

(ChartPaneBase.prototype._renderAnnotations): Added a forgotten break statement.

public/v3/models/build-request.js:

(BuildRequest.prototype.setResult):
(BuildRequest):

public/v3/models/test-group.js:
unit-tests/measurement-set-tests.js: Use ./resources/v3-models.js to reduce the code duplication.
unit-tests/resources/v3-models.js: Import more stuff from v3 models.

(beforeEach):

unit-tests/test-groups-tests.js: Added. Added some unit tests for TestGroup.

(sampleTestGroup):
(.testGroupWithStatusList):

2:40 PM Changeset in webkit [198597] by Alan Bujtas

3 edits
2 adds in trunk

ASSERTION FAILED: y2 >= y1 in WebCore::RenderElement::drawLineForBoxSide
https://bugs.webkit.org/show_bug.cgi?id=155791

Reviewed by Simon Fraser.

With certain combination of border rect and adjacent width, we could end up with an empty final rect.
This patch ensures that we don't try to paint this empty rect.

Source/WebCore:

Test: fast/borders/empty-outline-border-assert.html

rendering/RenderElement.cpp:

(WebCore::RenderElement::drawLineForBoxSide):

LayoutTests:

fast/borders/empty-outline-border-assert-expected.txt: Added.
fast/borders/empty-outline-border-assert.html: Added.

2:29 PM Changeset in webkit [198596] by Lucas Forschler

2 edits in trunk/Tools

Teach kill-old-processes about perl 5.18.

Reviewed by Alexey Proskuryakov

BuildSlaveSupport/kill-old-processes:

(main):

2:20 PM Changeset in webkit [198595] by dino@apple.com

2 edits in trunk/Source/WebCore

Screen queries should query the exact screen, not a default
https://bugs.webkit.org/show_bug.cgi?id=155806
<rdar://problem/25322916>

Reviewed by Simon Fraser.

Some of our media queries were using helper functions that
would query the capabilities of the deepest screen, rather
than the currently used screen. I changed them to use
the existing helper function (that works with WebKit 2)
and comment in some other helpers why a generic check is
ok.

Covered by the existing tests.

platform/mac/PlatformScreenMac.mm:

(WebCore::screenDepth): Use the helper function.
(WebCore::screenDepthPerComponent):
(WebCore::screenIsMonochrome): Move these and make a comment.
(WebCore::screenHasInvertedColors):

2:07 PM Changeset in webkit [198594] by ggaren@apple.com

6 edits in trunk/Source/bmalloc

bmalloc: process the object log before asking for new memory
https://bugs.webkit.org/show_bug.cgi?id=155801

Reviewed by Gavin Barraclough.

This is a step toward merging large and small objects: In future, if we
have large objects in the log, we need to process them right away to
avoid pushing up peak memory use.

But it also appears to be a speedup and memory use improvement now.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::allocate):
(bmalloc::Allocator::refillAllocatorSlowCase):
(bmalloc::Allocator::allocateLarge): Process the log before asking for
more memory.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::processObjectLog):
(bmalloc::Deallocator::deallocateSlowCase):

bmalloc/Deallocator.h: Provide a public API for processing the object log.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallPage): Pop fragmented pages from the front
instead of from the back. This resolves a regression on tree_churn
--parallel. Popping from the front gives us the oldest pages. The oldest
pages have had the most time to accumulate free lines. They are therefore
the least fragmented on average.

bmalloc/List.h:

(bmalloc::List::popFront):
(bmalloc::List::insertAfter): New API to pop from front.

2:06 PM Changeset in webkit [198593] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit2

MiniBrowser doesn't use accelerated drawing in WebKit2 windows if a WebKit1 window was opened first
https://bugs.webkit.org/show_bug.cgi?id=141576
<rdar://problem/25304548>

Reviewed by Simon Fraser.

UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences init]):
Make the NSUserDefaults key prefix for debug preferences (the only ones read
from NSUserDefaults) "WebKitDebug" instead of just "WebKit" so that they
don't conflict with the names that WebKit1 registers default values for.

2:03 PM Changeset in webkit [198592] by msaboff@apple.com

4 edits
3 adds in trunk

JavaScriptCore ArrayPrototype::join shouldn't cache butterfly when it makes effectful calls
https://bugs.webkit.org/show_bug.cgi?id=155776

Reviewed by Saam Barati.

Source/JavaScriptCore:

Array.join ends up calling toString, possibly on some object. Since these calls
could be effectful and could change the array itself, we can't hold the butterfly
pointer while making effectful calls. Changed the code to fall back to the general
case when an effectful toString() call might be made.

runtime/ArrayPrototype.cpp:

(JSC::join):

runtime/JSStringJoiner.h:

(JSC::JSStringJoiner::appendWithoutSideEffects): New helper that doesn't make effectful
toString() calls.
(JSC::JSStringJoiner::append): Built upon appendWithoutSideEffects.

LayoutTests:

New test.

js/regress-155776-expected.txt: Added.
js/regress-155776.html: Added.
js/script-tests/regress-155776.js: Added.

(fillBigArrayViaToString):
(Function.prototype.toString):

1:58 PM Changeset in webkit [198591] by dbates@webkit.org

168 edits in trunk

CSP: Make violation console messages concise and consistent
https://bugs.webkit.org/show_bug.cgi?id=155777
<rdar://problem/25304031>

Reviewed by Darin Adler.

Source/WebCore:

As a first step towards making the log messages that are emitted by the ContentSecurityPolicy object
concise and consistent with the language and formatting used in other WebKit console messages, including
other Content Security Policy messages, make the violation error messages concise and consistent.
Being concise and consistent will help make it straightforward for a person to understand the reason
for the violation by taking advantage of their familiarity with the language and formatting seen in
other WebKit console messages.

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::consoleMessageForViolation): Added. Builds up a console message for violation.
(WebCore::ContentSecurityPolicyDirectiveList::allowJavaScriptURLs): Extract logic for logging a console message/reporting
a violation from ContentSecurityPolicyDirectiveList::checkInlineAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
to build the actual console message.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineEventHandlers): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineScript): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyle): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowEval): Extract logic for logging a console message/reporting
a violation from ContentSecurityPolicyDirectiveList::checkEvalAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
to build the actual console message.
(WebCore::ContentSecurityPolicyDirectiveList::allowPluginType): Extract logic for logging a console message/reporting
a violation from ContentSecurityPolicyDirectiveList::checkMediaTypeAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
to build the actual console message.
(WebCore::ContentSecurityPolicyDirectiveList::allowScriptFromSource): Extract logic for logging a console message/reporting
a violation from ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
to build the actual console message.
(WebCore::ContentSecurityPolicyDirectiveList::allowObjectFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowImageFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowStyleFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFontFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowMediaFromSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowConnectToSource): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFormAction): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowBaseURI): Ditto.
(WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Extract logic for logging a console message/reporting
a violation from ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
to build the actual console message.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Add FIXME comment to log that the frame-src directive is
deprecated. See <https://bugs.webkit.org/show_bug.cgi?id=155773> for more details.
(WebCore::ContentSecurityPolicyDirectiveList::checkEvalAndReportViolation): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkMediaTypeAndReportViolation): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkInlineAndReportViolation): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation): Deleted.
(WebCore::ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation): Deleted.

page/csp/ContentSecurityPolicyDirectiveList.h:

LayoutTests:

Update expected results to reflect new violation message text.

fast/workers/worker-inherits-csp-blocks-xhr-expected.txt:
http/tests/contentextensions/block-cookies-in-csp-report-expected.txt:
http/tests/contentextensions/block-csp-report-expected.txt:
http/tests/contentextensions/hide-on-csp-report-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/base-uri-deny-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-blocked-expected.txt:

...

http/tests/security/contentSecurityPolicy/xsl-blocked-expected.txt:
http/tests/security/contentSecurityPolicy/xsl-img-blocked-expected.txt:
http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt:
http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-1-expected.txt:
http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-expected.txt:
http/tests/security/isolatedWorld/image-load-should-not-bypass-main-world-csp-expected.txt:
media/csp-blocks-video-expected.txt:

1:08 PM Changeset in webkit [198590] by Matt Baker

2 edits
18 adds in trunk/Source/WebInspectorUI

Web Inspector: Quick Open dialog has fuzzy icons at 1x
https://bugs.webkit.org/show_bug.cgi?id=155557
<rdar://problem/25200217>

Reviewed by Timothy Hatcher.

New resource icons (documents and clippings) for large tree items,
for use in the Quick Open dialog's tree outline.

UserInterface/Images/ClippingCSSLarge.png: Added.
UserInterface/Images/ClippingCSSLarge@2x.png: Added.
UserInterface/Images/ClippingGenericLarge.png: Added.
UserInterface/Images/ClippingGenericLarge@2x.png: Added.
UserInterface/Images/ClippingJSLarge.png: Added.
UserInterface/Images/ClippingJSLarge@2x.png: Added.
UserInterface/Images/DocumentCSSLarge.png: Added.
UserInterface/Images/DocumentCSSLarge@2x.png: Added.
UserInterface/Images/DocumentFontLarge.png: Added.
UserInterface/Images/DocumentFontLarge@2x.png: Added.
UserInterface/Images/DocumentGenericLarge.png: Added.
UserInterface/Images/DocumentGenericLarge@2x.png: Added.
UserInterface/Images/DocumentImageLarge.png: Added.
UserInterface/Images/DocumentImageLarge@2x.png: Added.
UserInterface/Images/DocumentJSLarge.png: Added.
UserInterface/Images/DocumentJSLarge@2x.png: Added.
UserInterface/Images/DocumentMarkupLarge.png: Added.
UserInterface/Images/DocumentMarkupLarge@2x.png: Added.

32px icons at 1x and 2x.

UserInterface/Views/ResourceIcons.css:

(.large .resource-icon .icon):
(.large .resource-icon.resource-type-document .icon):
(.large .resource-icon.resource-type-image .icon):
(.large .resource-icon.resource-type-font .icon):
(.large .resource-icon.resource-type-stylesheet .icon):
(.large .resource-icon.resource-type-script .icon):
(.large .anonymous-script-icon .icon):
(.large .source-map-resource.resource-icon .icon):
(.large .source-map-resource.resource-icon.resource-type-stylesheet .icon):
(.large .source-map-resource.resource-icon.resource-type-script .icon):
Large icon styles.

12:42 PM Changeset in webkit [198589] by keith_miller@apple.com

4 edits in trunk/Source/JavaScriptCore

Array.prototype native functions' species constructors should work with proxies
https://bugs.webkit.org/show_bug.cgi?id=155798

Reviewed by Mark Lam.

Before native the species constructors were checking if the this value was a JSArray.
Instead they should look check that the this value returns true on Array.isArray.

runtime/ArrayPrototype.cpp:

(JSC::speciesConstructArray):

tests/es6.yaml:
tests/stress/proxy-array-prototype-methods.js:

12:21 PM Changeset in webkit [198588] by Brent Fulgham

4 edits
2 adds in trunk

[WebGL] Non-power-of-two texture optimization
https://bugs.webkit.org/show_bug.cgi?id=118409

Reviewed by Dean Jackson.

Source/WebCore:

Based on a patch by Przemyslaw Szymanski <p.szymanski3@samsung.com>

This patch optimizes usage of handleNPOTTextures. We do not need to
iterate over each texture unit if no black textures were set. This
optimization provides a few more frames per seconds for certain
draw calls.

Tested by:
(1) Existing tests: webgl/resources/webgl_test_files/conformance/textures/texture-npot.html
(2) New test case: fast/canvas/webgl/texture-alternating-npot.html

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::compressedTexImage2D): Use new helper method.
(WebCore::WebGLRenderingContextBase::validateNPOTTextureLevel): Added.
(WebCore::WebGLRenderingContextBase::drawArrays): Only check texture completeness
if a black texture was used.
(WebCore::WebGLRenderingContextBase::drawElements): Ditto.
(WebCore::WebGLRenderingContextBase::texImage2DBase): Use new helper method.
(WebCore::WebGLRenderingContextBase::validateTexFunc): Ditto.
(WebCore::WebGLRenderingContextBase::checkTextureCompleteness): Return flag to indicate
if a black fallbacktexture was used.

html/canvas/WebGLRenderingContextBase.h:

LayoutTests:

fast/canvas/webgl/texture-alternating-npot-expected.txt: Added.
fast/canvas/webgl/texture-alternating-npot.html: Added.

11:00 AM Changeset in webkit [198587] by ap@apple.com

2 edits in trunk/Source/WebCore

Build fix for a new warning.

editing/VisibleSelection.cpp: (WebCore::makeSearchRange): Don't move when returning,

as that prevents copy elision.

9:48 AM Changeset in webkit [198586] by Keith Rollin

2 edits in trunk/Tools

Unreviewed: add Keith Rollin to the committers list.

Scripts/webkitpy/common/config/contributors.json:

8:53 AM Changeset in webkit [198585] by timothy@apple.com

3 edits in trunk/Source/WebInspectorUI

Web Inspector: String double quoting in the console and elsewhere needs to escape backslash too

https://bugs.webkit.org/show_bug.cgi?id=155752
rdar://problem/25293141

Reviewed by Joseph Pecoraro.

UserInterface/Base/Utilities.js:

(doubleQuotedString): Escape backslashes too.

UserInterface/Views/FormattedValue.js:

(WebInspector.FormattedValue.createLinkifiedElementString): Ditto.

8:39 AM WebKitNightlyElCapWorkaround edited by timothy@apple.com

(diff)

8:36 AM WebKitNightlyElCapWorkaround edited by timothy@apple.com

Update to the latest workaround. (diff)

7:16 AM Changeset in webkit [198584] by Antti Koivisto

5 edits in trunk/Source/WebCore

Share style by sharing RenderStyle substructures not the object itself
https://bugs.webkit.org/show_bug.cgi?id=155787

Reviewed by Anreas Kling.

The current approach where we share RenderStyle objects between elements leads to lot of awkward and bug-prone code.
Most of the RenderStyle consists of shareable substructures. It is better to just share those.

With this patch we create shared styles with RenderStyle::clone(). Sharing is traced as state in Style::SharingResolver
instead of relying on RenderStyle equality to locate potential sharing cousins.

rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::operator==):

m_altText was missing from operator==
This was exposed by TreeResolver::resolveElement change, tested by fast/css/alt-inherit-initial.html

style/StyleSharingResolver.cpp:

(WebCore::Style::elementHasDirectionAuto):
(WebCore::Style::SharingResolver::resolve):

Save share results to a map.

(WebCore::Style::SharingResolver::findSibling):
(WebCore::Style::SharingResolver::locateCousinList):

Instead of traversing we can now just do a hash lookup to locate a candidate cousin list.
There is no need for recursion anymore, the map covers sharing beyond immediate siblings too.
Remove most tests here as they have been already covered when sharing occured.

(WebCore::Style::canShareStyleWithControl):

style/StyleSharingResolver.h:
style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::styleForElement):
(WebCore::Style::TreeResolver::resolveElement):

No need to do forced setting anymore just to support style sharing.

7:05 AM Changeset in webkit [198583] by Gyuyoung Kim

23 edits in trunk/Source/WebCore

Reduce PassRefPtr uses in editing
https://bugs.webkit.org/show_bug.cgi?id=155743

Reviewed by Darin Adler.

Use RefPtr<>&&, raw pointer, or reference in arugments instead of PassRefPtr.
Besides RefPtr is used if function may be able to return nullptr.

dom/Element.cpp:

(WebCore::Element::setOuterHTML):
(WebCore::Element::setInnerHTML):

dom/Range.cpp:

(WebCore::Range::createContextualFragment):

dom/ShadowRoot.cpp:

(WebCore::ShadowRoot::setInnerHTML):

editing/CompositeEditCommand.cpp:

(WebCore::CompositeEditCommand::wrapContentsInDummySpan):

editing/CompositeEditCommand.h:
editing/DictationCommand.cpp:

(WebCore::DictationCommand::insertText):

editing/SplitTextNodeContainingElementCommand.cpp:

(WebCore::SplitTextNodeContainingElementCommand::doApply):

editing/TextInsertionBaseCommand.cpp:

(WebCore::TextInsertionBaseCommand::applyTextInsertionCommand):

editing/TextInsertionBaseCommand.h:
editing/TypingCommand.cpp:

(WebCore::TypingCommand::deleteSelection):
(WebCore::TypingCommand::deleteKeyPressed):
(WebCore::TypingCommand::forwardDeleteKeyPressed):
(WebCore::TypingCommand::insertText):
(WebCore::TypingCommand::insertLineBreak):
(WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
(WebCore::TypingCommand::insertParagraphSeparator):
(WebCore::TypingCommand::lastTypingCommandIfStillOpenForTyping):
(WebCore::TypingCommand::closeTyping):
(WebCore::TypingCommand::ensureLastEditCommandHasCurrentSelectionIfOpenForMoreTyping):

editing/TypingCommand.h:
editing/VisibleSelection.cpp:

(WebCore::VisibleSelection::firstRange):
(WebCore::makeSearchRange):

editing/VisibleSelection.h:
editing/WrapContentsInDummySpanCommand.cpp:

(WebCore::WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand):

editing/WrapContentsInDummySpanCommand.h:

(WebCore::WrapContentsInDummySpanCommand::create):

editing/atk/FrameSelectionAtk.cpp:

(WebCore::maybeEmitTextFocusChange):
(WebCore::FrameSelection::notifyAccessibilityForSelectionChange):

editing/htmlediting.cpp:

(WebCore::createOrderedListElement):
(WebCore::createUnorderedListElement):
(WebCore::createListItemElement):
(WebCore::createTabSpanElement):

editing/htmlediting.h:
editing/markup.cpp:

(WebCore::AttributeChange::AttributeChange):
(WebCore::ancestorToRetainStructureAndAppearanceForBlock):
(WebCore::styleFromMatchedRulesAndInlineDecl):
(WebCore::createFragmentForInnerOuterHTML):
(WebCore::createFragmentForTransformToFragment):
(WebCore::createContextualFragment):

editing/markup.h:
html/HTMLElement.cpp:

(WebCore::HTMLElement::insertAdjacentHTML):

xml/XSLTProcessor.cpp:

(WebCore::XSLTProcessor::transformToFragment):

2:15 AM Changeset in webkit [198582] by sbarati@apple.com

8 edits
2 adds in trunk

We should not disable inlining when the debugger is enabled
https://bugs.webkit.org/show_bug.cgi?id=155741

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

We can enable inlining when the debugger is enabled as long
as we make sure we still jettison the proper CodeBlocks when
a breakpoint is set. This means that for any optimized CodeBlock,
we must ask if any of its inlinees contain the breakpoint that
is being set. If any inlinees do contain the breakpoint, we must
jettison the machine code block that they are a part of.

debugger/Debugger.cpp:

(JSC::Debugger::toggleBreakpoint):
(JSC::Debugger::applyBreakpoints):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::ByteCodeParser):
(JSC::DFG::ByteCodeParser::setLocal):
(JSC::DFG::ByteCodeParser::flush):
(JSC::DFG::ByteCodeParser::flushForTerminal):
(JSC::DFG::ByteCodeParser::inliningCost):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::Graph):
(JSC::DFG::Graph::~Graph):

dfg/DFGGraph.h:

(JSC::DFG::Graph::hasDebuggerEnabled): Deleted.

dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

ftl/FTLCompile.cpp:

(JSC::FTL::compile):

LayoutTests:

inspector/debugger/breakpoint-with-inlining-expected.txt: Added.
inspector/debugger/breakpoint-with-inlining.html: Added.

2:11 AM Changeset in webkit [198581] by Yusuke Suzuki

2 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Allow undefined/null for Symbol.search and Symbol.match
https://bugs.webkit.org/show_bug.cgi?id=155785

Reviewed by Saam Barati.

Undefined and null for Symbol.search and Symbol.match properties of the given RegExp (like) object are allowed.
When they are specified, we go to the fallback path; creating the RegExp with the given object and matching.

builtins/StringPrototype.js:

(match):
(search):

tests/stress/string-symbol-customization.js: Added.

(shouldBe):
(shouldThrow):

1:51 AM Changeset in webkit [198580] by Carlos Garcia Campos

16 edits in trunk/Source

Use Region instead of IntRect in PageClient and WebPageProxy setViewNeedsDisplay method
https://bugs.webkit.org/show_bug.cgi?id=155747

Reviewed by Darin Adler.

Source/WebCore:

Add helper function to make cairo region out of a WebCore::Region.

platform/graphics/cairo/CairoUtilities.cpp:

(WebCore::toCairoRegion):

platform/graphics/cairo/CairoUtilities.h:

Source/WebKit2:

This way instead of calling setViewNeedsDisplay() for every
rectangle in the damage area, we can build a region and call
setViewNeedsDisplay() once. GTK+ has API to queue a redraw for a
given region, so we also avoid scheduling multiple redraws in GTK+
port.

UIProcess/API/gtk/PageClientImpl.cpp:

(WebKit::PageClientImpl::setViewNeedsDisplay): Convert the Region
into a cairo_region_t and use gtk_widget_queue_draw_region()
instyead of gtk_widget_queue_draw_area().

UIProcess/API/gtk/PageClientImpl.h:
UIProcess/DrawingAreaProxyImpl.cpp:

(WebKit::DrawingAreaProxyImpl::incorporateUpdate): Build a Region
with the damage rectangles and call
WebPageProxy::setViewNeedsDisplay() once.

UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::setViewNeedsDisplay):

UIProcess/WebPageProxy.h:
UIProcess/efl/WebView.cpp:

(WebKit::WebView::setViewNeedsDisplay):

UIProcess/efl/WebView.h:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::setViewNeedsDisplay):

UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::setViewNeedsDisplay):

1:21 AM Changeset in webkit [198579] by sbarati@apple.com

2 edits in trunk/Source/WTF

SmallPtrSet leaks memory in its move assignment operator when !this->isSmall()
https://bugs.webkit.org/show_bug.cgi?id=155701

Reviewed by Darin Adler.

wtf/SmallPtrSet.h:

(WTF::SmallPtrSet::SmallPtrSet):
(WTF::SmallPtrSet::operator=):

Mar 22, 2016:

10:46 PM Changeset in webkit [198578] by timothy_horton@apple.com

6 edits in trunk/Source

Invoking a link preview on a complex link (e.g. an image) results in an empty TextIndicator
https://bugs.webkit.org/show_bug.cgi?id=155779
<rdar://problem/22408793>

Reviewed by Simon Fraser.

page/FrameSnapshotting.cpp:

(WebCore::snapshotFrameRect):
(WebCore::snapshotFrameRectWithClip):

page/FrameSnapshotting.h:
page/TextIndicator.cpp:

(WebCore::takeSnapshot):
(WebCore::takeSnapshots):
(WebCore::initializeIndicator):
When snapshotting, clip to the indicated range's rects. This is important
to avoid painting into the margins in the non-selection-only painting case.
This didn't come up with normal selection-only painting because the text
didn't intersect the margin, and the background doesn't paint.

WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::dictionaryPopupInfoForRange):
(WebKit::WebPage::performImmediateActionHitTestAtLocation):
Use the TextIndicator mode where we give up on selection-only snapshotting
and just paint all content on Mac, similar to what we do for 3D Touch indicators.

9:29 PM Changeset in webkit [198577] by Darin Adler

3 edits in trunk/LayoutTests

Tiny tweak to test I just landed.

http/tests/security/cross-origin-modal-dialog-base-expected.txt:

Fix expected result now that I fixed the less than sign.

http/tests/security/cross-origin-modal-dialog-base.html:

9:19 PM Changeset in webkit [198576] by Darin Adler

2 edits in trunk

straighten quotes in ChangeLog

9:16 PM Changeset in webkit [198575] by Darin Adler

4 edits
4 adds in trunk

showModalDialog code runs with “first window” set to wrong window
https://bugs.webkit.org/show_bug.cgi?id=155710

Source/WebCore:

Reviewed by Brent Fulgham.

Test: http/tests/security/cross-origin-modal-dialog-base.html

page/Chrome.cpp:

(WebCore::Chrome::runModal): Null out entryScope so that the "first window"
checks inside the modal dialog won't run in the context of the original window
that presented the dialog.

LayoutTests:

Test by John Wilander.

Reviewed by Brent Fulgham.

http/tests/security/cross-origin-modal-dialog-base-expected.txt: Added.
http/tests/security/cross-origin-modal-dialog-base.html: Added.
http/tests/security/resources/cross-origin-modal-dialog-base-1.html: Added.
http/tests/security/resources/cross-origin-modal-dialog-base-2.html: Added.
platform/wk2/TestExpectations: Skip test until we get better showModalDialog support.

8:28 PM Changeset in webkit [198574] by commit-queue@webkit.org

3 edits
2 adds in trunk

userSpaceOnUse patterns are not stroked for empty object bounding box elements
https://bugs.webkit.org/show_bug.cgi?id=109758

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-03-22
Reviewed by Brent Fulgham.
Source/WebCore:

Checking whether the patternUnits is objectBoundingBox needs to be done
after calling collectPatternAttributes(). Otherwise the default value
will be always checked which is 'objectBoundingBox'.

Tests: svg/custom/pattern-units-fill-stroke.svg

rendering/svg/RenderSVGResourcePattern.cpp:

(WebCore::RenderSVGResourcePattern::buildPattern):
(WebCore::RenderSVGResourcePattern::applyResource):

LayoutTests:

Ensure the SVG pattern is drawn correctly if it is used as a stroke for
empty objectBoundingBox elements.

svg/custom/pattern-units-fill-stroke-expected.svg: Added.
svg/custom/pattern-units-fill-stroke.svg: Added.

7:30 PM Changeset in webkit [198573] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Fix a typo.

config.json:

7:12 PM Changeset in webkit [198572] by commit-queue@webkit.org

4 edits in trunk/Source/JavaScriptCore

[JSC] correctly handle indexed properties in Object.getOwnPropertyDescriptors
https://bugs.webkit.org/show_bug.cgi?id=155563

Patch by Caitlin Potter <caitp@igalia.com> on 2016-03-22
Reviewed by Saam Barati.

runtime/JSObject.h:

(JSC::JSObject::putOwnDataPropertyMayBeIndex):

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetOwnPropertyDescriptors):

6:39 PM Changeset in webkit [198571] by ggaren@apple.com

11 edits in trunk/Source/bmalloc

bmalloc: use a log scale for large-ish size classes
https://bugs.webkit.org/show_bug.cgi?id=155770

Reviewed by Michael Saboff.

At larger sizes, precise allocation sizes don't save much memory -- and
they can cost memory when objects of distinct size classes can't
allocate together.

This is a small savings up to our current allocation limits, and it may
enable changing those limits in the long term.

bmalloc/Algorithm.h:

(bmalloc::log2): We use this to compute large-ish size classes.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::Allocator): Iterate by size class instead of by
object size so we can change object size limits without breaking stuff.

(bmalloc::Allocator::scavenge): Ditto.

(bmalloc::Allocator::allocateLogSizeClass): New helper function for
allocating based on log size classes.

(bmalloc::Allocator::allocateSlowCase): Account for extra size class
possibilities.

bmalloc/Allocator.h:

(bmalloc::Allocator::allocateFastCase): We only handle up to 512b on
the fastest fast path now.

bmalloc/BumpAllocator.h:

(bmalloc::BumpAllocator::validate): Deleted. I noticed that this function
had been refactored not to do anything anymore.

bmalloc/Heap.cpp:

(bmalloc::Heap::initializeLineMetadata): Iterate by size class. (See
Allocator::Allocator.)

bmalloc/Heap.h: Use the sizeClassCount constant instead of hard coding

things.

bmalloc/Sizes.h:

(bmalloc::Sizes::maskSizeClass):
(bmalloc::Sizes::maskObjectSize):
(bmalloc::Sizes::logSizeClass):
(bmalloc::Sizes::logObjectSize):
(bmalloc::Sizes::sizeClass):
(bmalloc::Sizes::objectSize): Separate size class calculation between
simple size classes that can be computed with a mask and are 8-byte-precise
and complex size classes that require more math and are less precise.

bmalloc/SmallLine.h:

(bmalloc::SmallLine::ref):

bmalloc/SmallPage.h:

(bmalloc::SmallPage::SmallPage):
(bmalloc::SmallPage::ref):
(bmalloc::SmallPage::deref): Cleaned up some ASSERTs that triggered
while working on this patch.

bmalloc/Zone.cpp:

(bmalloc::statistics):
(bmalloc::zoneSize):
(bmalloc::Zone::Zone):
(bmalloc::size): Deleted. Renamed these symbols to work around an lldb
bug that makes it impossible to print out variables named 'size' -- which
can be a problem when working on malloc.

6:38 PM Changeset in webkit [198570] by sbarati@apple.com

11 edits in trunk/Source/JavaScriptCore

We should FTL compile code when the debugger is enabled
https://bugs.webkit.org/show_bug.cgi?id=155740

Reviewed by Oliver Hunt.

There was no fundamental reason why we didn't support debugging
with the FTL. It looks like this was just an oversight. We had
a Breakpoint node in the DFG that amounted to a nop. By removing
this node, we now support debugging in the FTL. Anytime a breakpoint
is set, we will jettison any DFG/FTL CodeBlocks that contain the breakpoint
that was set.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

6:19 PM Changeset in webkit [198569] by bshafiei@apple.com

2 edits in tags/Safari-602.1.25/Source/WebKit2

Merged r198562. rdar://problem/25301027

5:58 PM Changeset in webkit [198568] by mmaxfield@apple.com

9 edits in trunk/Source/WebCore

Use references instead of pointers for absolute positioning code
https://bugs.webkit.org/show_bug.cgi?id=155775

Reviewed by Simon Fraser.

There are many pointers which will never be null in this code. This patch
migrates them to use references.

No new tests because there is no behavior change.

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::layoutBlockChild):
(WebCore::RenderBlockFlow::marginBeforeEstimateForChild):
(WebCore::RenderBlockFlow::insertFloatingObject):

rendering/RenderBox.cpp:

(WebCore::RenderBox::constrainLogicalWidthInRegionByMinMax):
(WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
(WebCore::RenderBox::computeLogicalWidthInRegion):
(WebCore::RenderBox::computeLogicalWidthInRegionUsing):
(WebCore::RenderBox::computeInlineDirectionMargins):
(WebCore::RenderBox::renderBoxRegionInfo):
(WebCore::RenderBox::computeLogicalHeight):
(WebCore::RenderBox::skipContainingBlockForPercentHeightCalculation):
(WebCore::RenderBox::computePercentageLogicalHeight):
(WebCore::RenderBox::computeReplacedLogicalWidthUsing):
(WebCore::RenderBox::computeReplacedLogicalHeightUsing):
(WebCore::RenderBox::availableLogicalHeightUsing):
(WebCore::RenderBox::computeBlockDirectionMargins):
(WebCore::RenderBox::computeAndSetBlockDirectionMargins):
(WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
(WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
(WebCore::computeInlineStaticDistance):
(WebCore::RenderBox::computePositionedLogicalWidth):
(WebCore::computeLogicalLeftPositionedOffset):
(WebCore::RenderBox::computePositionedLogicalWidthUsing):
(WebCore::computeBlockStaticDistance):
(WebCore::RenderBox::computePositionedLogicalHeight):
(WebCore::computeLogicalTopPositionedOffset):
(WebCore::RenderBox::computePositionedLogicalHeightUsing):
(WebCore::RenderBox::computePositionedLogicalWidthReplaced):
(WebCore::RenderBox::computePositionedLogicalHeightReplaced):
(WebCore::percentageLogicalHeightIsResolvable):
(WebCore::RenderBox::percentageLogicalHeightIsResolvableFromBlock):
(WebCore::RenderBox::hasDefiniteLogicalHeight):
(WebCore::RenderBox::hasUnsplittableScrollingOverflow):

rendering/RenderBox.h:
rendering/RenderDeprecatedFlexibleBox.cpp:

(WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
(WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):

rendering/RenderFlexibleBox.cpp:

(WebCore::RenderFlexibleBox::computeMainAxisExtentForChild):
(WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::minSizeForChild):
(WebCore::RenderGrid::computeMarginLogicalHeightForChild):

rendering/RenderTable.cpp:

(WebCore::RenderTable::updateLogicalWidth):

rendering/RenderTableRow.cpp:

(WebCore::RenderTableRow::layout):

5:49 PM Changeset in webkit [198567] by Jon Davis

2 edits in trunk/Source/WebCore

Add Download Attribute to the Feature Status page
https://bugs.webkit.org/show_bug.cgi?id=155772

Reviewed by Timothy Hatcher.

features.json:

5:47 PM Changeset in webkit [198566] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

CachedResource::MediaResource types shouldn't be blocked due to mixed-content.
https://bugs.webkit.org/show_bug.cgi?id=155588
<rdar://problem/25177795>

Reviewed by Brent Fulgham.

Follow-up to address crashes caused by r198549. Rather than destroy MediaResourceLoader on a background thread,
migrate the Ref to the main thread before releasing.

platform/graphics/PlatformMediaResourceLoader.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession dealloc]):

5:19 PM Changeset in webkit [198565] by keith_miller@apple.com

4 edits in trunk/Source/JavaScriptCore

REGRESSION(r197543): Use-after-free on storage/indexeddb/transaction-abort-private.html
https://bugs.webkit.org/show_bug.cgi?id=155067

Reviewed by Filip Pizlo.

GCIncommingRefCountedSets need to be finalized before we start
destructing members of the Heap object. Previously, we would
clear all our ArrayBuffer objects when the GCIncommingRefCountedSet
holding them was destroyed. However, ArrayBuffers have a weak
reference to their wrappers. When we would attempt to destroy the
ArrayBuffer object we would end up accessing the WeakImpl for
the weak reference, which had already been freed as we destroyed
our weak block. The solution to this is to move the old
GCIncommingRefCountedSet destructor functionality to a new
function lastChanceToFinalize. This function is called when
we finalize our other objects on Heap destruction.

heap/GCIncomingRefCountedSet.h:
heap/GCIncomingRefCountedSetInlines.h:

(JSC::GCIncomingRefCountedSet<T>::lastChanceToFinalize):
(JSC::GCIncomingRefCountedSet<T>::~GCIncomingRefCountedSet): Deleted.

heap/Heap.cpp:

(JSC::Heap::lastChanceToFinalize):

5:19 PM WebKitNightlyElCapWorkaround edited by beidson@apple.com

(diff)

5:12 PM Changeset in webkit [198564] by mmaxfield@apple.com

3 edits in trunk/LayoutTests

Post-review test update after r198560
https://bugs.webkit.org/show_bug.cgi?id=155533

Unreviewed.

fast/scrolling/rtl-scrollbars-positioning-expected.html:
fast/scrolling/rtl-scrollbars-positioning.html:

4:47 PM Changeset in webkit [198563] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: REGRESSION: Switching Timelines via Path Component does not work
https://bugs.webkit.org/show_bug.cgi?id=155767
<rdar://problem/25298945>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-22
Reviewed by Timothy Hatcher.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype._timelinePathComponentSelected):
(WebInspector.TimelineRecordingContentView.prototype._instrumentAdded):

4:33 PM Changeset in webkit [198562] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Fix HTTPS on Mac using NSURLSession after r198457
https://bugs.webkit.org/show_bug.cgi?id=155774
<rdar://problem/25301027>

Reviewed by Anders Carlsson.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSession::NetworkSession):
r198457 was intended to fix an issue on iOS and have no change in behavior on Mac.
It did have a subtle change in behavior, setting the source application bundle identifier
on iOS and was causing problems with HTTPS connections using NSURLSession, so this patch
reverts that change.

3:27 PM Changeset in webkit [198561] by commit-queue@webkit.org

7 edits
1 copy
2 moves
21 adds in trunk

Restrict WebSockets header parsing according to RFC6455 and RFC7230. Based on Lamarque V. Souza's original patch.
https://bugs.webkit.org/show_bug.cgi?id=82714

Patch by John Wilander <wilander@apple.com> on 2016-03-22
Reviewed by Brent Fulgham.

Source/WebCore:

Tests: http/tests/websocket/tests/hybi/error-event-ready-state-non-existent-url-with-server-responding-404.html

http/tests/websocket/tests/hybi/handshake-fail-by-invalid-http-version.html
http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-accept.html
http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-extensions.html
http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-protocol.html
http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-status-line.html
http/tests/websocket/tests/hybi/handshake-fail-by-null-char-in-status.html
http/tests/websocket/tests/hybi/handshake-ok-with-http-version-beyond-1_1.html

Modules/websockets/WebSocketHandshake.cpp:

(WebCore::WebSocketHandshake::httpURLForAuthenticationAndCookies):
(WebCore::headerHasValidHTTPVersion):

Check for HTTP version 1.1 and above.

(WebCore::WebSocketHandshake::readStatusLine):

Only allow ASCII characters in status line.
Only allow HTTP version 1.1 and above in status line.

(WebCore::WebSocketHandshake::readHTTPHeaders):

Only allow ASCII characters in values for new HTTP headers.

LayoutTests:

http/tests/websocket/tests/hybi/error-event-ready-state-expected.txt: Removed.
- See comment below on the associated HTML file.
http/tests/websocket/tests/hybi/error-event-ready-state-non-existent-url-with-server-responding-404-expected.txt: Added.
http/tests/websocket/tests/hybi/error-event-ready-state-non-existent-url-with-server-responding-404.html: Added.
- Uses PHP to respond with an HTTP 1.1 404. The old (now removed) test case failed once we restricted WebSockets to HTTP 1.1 and above because the test server responded with an HTTP 1.0 404 for non-existing files.
http/tests/websocket/tests/hybi/error-event-ready-state.html: Removed.
- This test case was renamed "error-event-ready-state-non-existent-url-with-server-responding-404" to make it clear it now relies on a server responding with HTTP 1.1 404.
http/tests/websocket/tests/hybi/handshake-fail-by-invalid-http-version-expected.txt: Added.
http/tests/websocket/tests/hybi/handshake-fail-by-invalid-http-version.html: Added.
http/tests/websocket/tests/hybi/handshake-fail-by-invalid-http-version_wsh.py: Added.