Context Navigation

← Previous Period
Next Period →

Timeline

Apr 25, 2016:

10:56 PM Changeset in webkit [200075] by rniwa@webkit.org

46 edits in trunk

Remove the build flag for template elements
https://bugs.webkit.org/show_bug.cgi?id=157022

Reviewed by Daniel Bates.

Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsMac.cmake:
Source/cmake/OptionsWin.cmake:
Source/cmake/WebKitFeatures.cmake:
Source/cmake/tools/vsprops/FeatureDefines.props:
Source/cmake/tools/vsprops/FeatureDefinesCairo.props:

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Removed the build flag.

Configurations/FeatureDefines.xcconfig:
DerivedSources.cpp:
bindings/js/JSHTMLTemplateElementCustom.cpp:

(WebCore::JSHTMLTemplateElement::content):

css/html.css:

(summary::-webkit-details-marker):
(template):
(bdi, output):

dom/ContainerNode.cpp:

(WebCore::isInTemplateContent):
(WebCore::containsConsideringHostElements):
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::parserAppendChild):

dom/Document.cpp:

(WebCore::Document::Document):
(WebCore::Document::~Document):
(WebCore::Document::getCachedLocale):
(WebCore::Document::ensureTemplateDocument):
(WebCore::Document::fonts):

dom/Document.h:

(WebCore::Document::setTemplateDocumentHost):
(WebCore::Document::templateDocumentHost):
(WebCore::Document::hasDisabledFieldsetElement):
(WebCore::Document::textEncoding):
(WebCore::Document::templateDocument):

dom/Element.cpp:

(WebCore::Element::setInnerHTML):

dom/Node.cpp:

(WebCore::Node::containsIncludingHostElements):
(WebCore::Node::pseudoAwarePreviousSibling):

dom/TemplateContentDocumentFragment.h:
editing/MarkupAccumulator.cpp:

(WebCore::MarkupAccumulator::serializeNodesWithNamespaces):

editing/markup.cpp:

(WebCore::createFragmentForInnerOuterHTML):

html/HTMLTagNames.in:
html/HTMLTemplateElement.cpp:

(WebCore::HTMLTemplateElement::didMoveToNewDocument):

html/HTMLTemplateElement.h:
html/HTMLTemplateElement.idl:
html/parser/HTMLConstructionSite.cpp:

(WebCore::insert):
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode):
(WebCore::HTMLConstructionSite::findFosterSite):

html/parser/HTMLElementStack.cpp:

(WebCore::HTMLNames::isScopeMarker):
(WebCore::HTMLNames::isTableScopeMarker):
(WebCore::HTMLNames::isTableBodyScopeMarker):
(WebCore::HTMLNames::isTableRowScopeMarker):
(WebCore::HTMLElementStack::inSelectScope):
(WebCore::HTMLElementStack::hasTemplateInHTMLScope):
(WebCore::HTMLElementStack::htmlElement):

html/parser/HTMLElementStack.h:
html/parser/HTMLPreloadScanner.cpp:

(WebCore::TokenPreloadScanner::scan):

html/parser/HTMLPreloadScanner.h:
html/parser/HTMLStackItem.h:

(WebCore::isSpecialNode):

html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::isParsingTemplateContents):
(WebCore::HTMLTreeBuilder::isParsingFragmentOrTemplateContents):
(WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
(WebCore::HTMLTreeBuilder::processStartTagForInBody):
(WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement):
(WebCore::HTMLTreeBuilder::processTemplateStartTag):
(WebCore::HTMLTreeBuilder::processEndOfFileForInTemplateContents):
(WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
(WebCore::HTMLTreeBuilder::processStartTagForInTable):
(WebCore::HTMLTreeBuilder::processStartTag):
(WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
(WebCore::HTMLTreeBuilder::processEndTagForInCell):
(WebCore::HTMLTreeBuilder::processEndTagForInBody):
(WebCore::HTMLTreeBuilder::processEndTag):
(WebCore::HTMLTreeBuilder::processCharacterBuffer):
(WebCore::HTMLTreeBuilder::processEndOfFile):
(WebCore::HTMLTreeBuilder::processStartTagForInHead):
(WebCore::HTMLTreeBuilder::finished):

html/parser/HTMLTreeBuilder.h:
inspector/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildObjectForNode):

inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::instrumentingAgentsForDocument):

xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::XMLDocumentParser::startElementNs):

Source/WebKit/mac:

Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Configurations/FeatureDefines.xcconfig:

Source/WTF:

wtf/FeatureDefines.h:

Tools:

Removed the build option.

Scripts/webkitperl/FeatureList.pm:

10:07 PM Changeset in webkit [200074] by jiewen_tan@apple.com

2 edits in trunk/Source/WebCore

[iOS] ftp links crash @ WebCore::FTPDirectoryDocumentParser::appendEntry
https://bugs.webkit.org/show_bug.cgi?id=157019
<rdar://problem/24292650>

Reviewed by Chris Dumez.

Create separate Ref<Element> object for every row element instead of reusing
one because Ref<>'s operator=() does not allow assignment after a WTFMove().

html/FTPDirectoryDocument.cpp:

(WebCore::FTPDirectoryDocumentParser::appendEntry):

9:29 PM Changeset in webkit [200073] by rniwa@webkit.org

2 edits in trunk/Tools

Fix text in log files autogenerated by import-w3c-tests
https://bugs.webkit.org/show_bug.cgi?id=157021

Reviewed by Chris Dumez.

s/Webkit/WebKit/ and end each sentence with a period.

Scripts/webkitpy/w3c/test_importer.py:

(TestImporter.write_import_log):

9:22 PM Changeset in webkit [200072] by rniwa@webkit.org

3 edits
57 adds
1 delete in trunk/LayoutTests

Update template element tests
https://bugs.webkit.org/show_bug.cgi?id=154996

Reviewed by Daniel Bates.

LayoutTests/imported/w3c:

Reimported W3C tests for template elements as of d5a4c5bdf8a1837b4fcf50bbd2efd4150ddafa99.
Also moved the parser tests from html-templates to web-platform-tests/html/syntax to match the upstream directory structure.

html-templates: Removed.
html-templates/parsing-html-templates: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table.html: Removed.
html-templates/parsing-html-templates/appending-to-a-template: Removed.
html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes-expected.txt: Removed.
html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document-expected.txt: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document.html: Removed.
html-templates/resources: Removed.
html-templates/resources/end-template-tag-in-body.html: Removed.
html-templates/resources/end-template-tag-in-head.html: Removed.
html-templates/resources/frameset-end-tag.html: Removed.
html-templates/resources/head-template-contents-div-no-end-tag.html: Removed.
html-templates/resources/head-template-contents-table-no-end-tag.html: Removed.
html-templates/resources/html-start-tag.html: Removed.
html-templates/resources/template-child-nodes-div.xhtml: Removed.
html-templates/resources/template-child-nodes-nested.xhtml: Removed.
html-templates/resources/template-contents-attribute.html: Removed.
html-templates/resources/template-contents-body.html: Removed.
html-templates/resources/template-contents-div-no-end-tag.html: Removed.
html-templates/resources/template-contents-empty.html: Removed.
html-templates/resources/template-contents-frameset.html: Removed.
html-templates/resources/template-contents-head.html: Removed.
html-templates/resources/template-contents-html.html: Removed.
html-templates/resources/template-contents-nested.html: Removed.
html-templates/resources/template-contents-table-no-end-tag.html: Removed.
html-templates/resources/template-contents-text.html: Removed.
html-templates/resources/template-contents.html: Removed.
html-templates/resources/template-descendant-body.html: Removed.
html-templates/resources/template-descendant-frameset.html: Removed.
html-templates/resources/template-descendant-head.html: Removed.
html-templates/resources/two-templates.html: Removed.
html-templates/testcommon.js: Removed.
web-platform-tests/html/syntax: Added.
web-platform-tests/html/syntax/parsing: Added.
web-platform-tests/html/syntax/parsing/template: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes.html: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document.html: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/w3c-import.log: Added.

LayoutTests:

platform/mac/TestExpectations:

9:08 PM Changeset in webkit [200071] by commit-queue@webkit.org

2 edits
1 add in trunk/Source/JavaScriptCore

[JSC] Constant folding of UInt32ToNumber is incorrect
https://bugs.webkit.org/show_bug.cgi?id=157011
rdar://problem/25769641

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-25
Reviewed by Geoffrey Garen.

UInt32ToNumber should return the unsigned 32bit value of
its child. The abstract interpreter fails to do that when handling
Int52.

None of the tests caught that because the bytecode generator already
fold the operation if given a constant. If the constant is not visible
from the bytecode generator (for example because it comes from an inlined call),
then the abstract interpreter folding was producing invalid results.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

tests/stress/uint32-to-number-constant-folding.js: Added.

(uint32ToNumberMinusOne):
(uint32ToNumberMinusOnePlusInteger):
(inlineMinusOne):
(uint32ToNumberOnHiddenMinusOne):
(uint32ToNumberOnHiddenMinusOnePlusInteger):
(inlineLargeNegativeNumber1):
(inlineLargeNegativeNumber2):
(inlineLargeNegativeNumber3):
(uint32ToNumberOnHiddenLargeNegativeNumber1):
(uint32ToNumberOnHiddenLargeNegativeNumber2):
(uint32ToNumberOnHiddenLargeNegativeNumber3):

8:53 PM Changeset in webkit [200070] by mmaxfield@apple.com

13 edits in trunk

[Cocoa] Guarantee FontPlatformData's m_cgFont is never nullptr
https://bugs.webkit.org/show_bug.cgi?id=156929

Reviewed by Darin Adler.

Source/WebCore:

After some investigation, it turns out that there is no place where it is meaningful
to pass us a null CoreText font. Therefore, the CoreGraphics font is also never null.

We should simply check for these null values at the ingestion site in order to
make the guarantee internally of having non-null values.

platform/graphics/FontPlatformData.cpp:

(WebCore::FontPlatformData::FontPlatformData): Because the pointer is never null, we
can delete the code which handles that case.

platform/graphics/FontPlatformData.h:
platform/graphics/cocoa/FontPlatformDataCocoa.mm: Ditto.

(WebCore::webFallbackFontFamily): Deleted.
(WebCore::FontPlatformData::setFallbackCGFont): Deleted.

platform/graphics/mac/ComplexTextControllerCoreText.mm:

(WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Asking the
CTRun for its kCTFontAttributeName will always return non-null.

platform/graphics/mac/FontCustomPlatformData.cpp:

(WebCore::FontCustomPlatformData::fontPlatformData): Once we have a font descriptor,
CTFontCreateWithFontDescriptor() will always return non-null. We check if the font
descriptor is null elsewhere.

platform/mac/DragImageMac.mm: The fonts in this file are gotten by asking for the

system font, which will always return non-null.
(WebCore::fontFromNSFont):
(WebCore::widthWithFont):
(WebCore::drawAtPoint):
(WebCore::createDragImageForLink):

Source/WebKit/mac:

Misc/WebKitNSStringExtras.mm:

(-[NSString _web_drawAtPoint:font:textColor:allowingFontSmoothing:]): Drawing
a string with a null font shouldn't do anything.

Misc/WebStringTruncator.mm: We can't truncate a string if we don't have a font

to use.
(+[WebStringTruncator centerTruncateString:toWidth:]):
(+[WebStringTruncator centerTruncateString:toWidth:withFont:]):
(+[WebStringTruncator rightTruncateString:toWidth:withFont:]):
(+[WebStringTruncator widthOfString:font:]):

Tools:

TestWebKitAPI/Tests/mac/StringTruncator.mm:

(TestWebKitAPI::TEST):

8:52 PM Changeset in webkit [200069] by mmaxfield@apple.com

3 edits in trunk/LayoutTests

Cloning a textarea does not clone the textarea's value
https://bugs.webkit.org/show_bug.cgi?id=156637

Reviewed by Chris Dumez.

https://dom.spec.whatwg.org/#concept-node-clone describes that the value
of a node shouldn't be copied when cloning the node.

fast/forms/checkValidity-cloneNode-crash-expected.txt:
fast/forms/checkValidity-cloneNode-crash.html:

8:22 PM Changeset in webkit [200068] by commit-queue@webkit.org

4 edits in trunk/Source

Heap corruption is detected when destructing JSGlobalObject
https://bugs.webkit.org/show_bug.cgi?id=156831

Patch by Fujii Hironori <Fujii Hironori> on 2016-04-25
Reviewed by Mark Lam.

WebKit uses CRT static library on Windows. Each copy of the CRT
library has its own heap manager, allocating memory in one CRT
library and passing the pointer across a DLL boundary to be freed
by a different copy of the CRT library is a potential cause for
heap corruption.

Potential Errors Passing CRT Objects Across DLL Boundaries
<https://msdn.microsoft.com/en-us/library/ms235460(v=vs.140).aspx>

JSGlobalObject::createRareDataIfNeeded is inlined but
JSGlobalObject::~JSGlobalObject is not. Then, the heap of
allocating JSGlobalObjectRareData is WebKit.dll, but deallocating
JavaScriptCore.dll. Adding WTF_MAKE_FAST_ALLOCATED to
JSGlobalObjectRareData ensures heap consistency of it. WTF::Lock
also needs WTF_MAKE_FAST_ALLOCATED because it is allocated from
the inlined constructor of JSGlobalObjectRareData.

Source/JavaScriptCore:

Test: fast/dom/insertedIntoDocument-iframe.html

runtime/JSGlobalObject.h:

Add WTF_MAKE_FAST_ALLOCATED to JSGlobalObjectRareData.

Source/WTF:

wtf/Lock.h: Add WTF_MAKE_FAST_ALLOCATED.

6:00 PM Changeset in webkit [200067] by Matt Baker

15 edits in trunk/Source/WebInspectorUI

Web Inspector: hook up grid row filtering in the new Timelines UI
https://bugs.webkit.org/show_bug.cgi?id=154924
<rdar://problem/24934607>

Reviewed by Timothy Hatcher.

Re-implement timeline data grid filtering that previously existed in the
navigation sidebar. This patch adds support for filter text, scope bars,
and filtering based on ruler selection.

Multi-column filter support is now part of DataGrid. The grid checks compares
filter text against cell data of type string. DataGridNode subclasses may
provide custom string data for columns that format complex objects (such
as SourceCodeLocations). Cells containing data of type number are not
considered for filtering at this time.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid):
(WebInspector.DataGrid.prototype.set filterText):
(WebInspector.DataGrid.prototype.get filterDelegate):
(WebInspector.DataGrid.prototype.set filterDelegate):
(WebInspector.DataGrid.prototype.filterDidChange):
Called internally by the grid whenever the filter text or delegate changes.
Also called by clients that implement a filter delegate, to inform the
grid that a custom filter has changed.

(WebInspector.DataGrid.prototype.hasCustomFilters):
(WebInspector.DataGrid.prototype.matchNodeAgainstCustomFilters):
Calls the filter delegate, if it exists, and provides a hook for
subclasses to provide custom filtering.

(WebInspector.DataGrid.prototype._applyFiltersToNode.matchTextFilter):
(WebInspector.DataGrid.prototype._applyFiltersToNode.makeVisible):
(WebInspector.DataGrid.prototype._applyFiltersToNode):
Filters data grid nodes and fires filter events as needed.
(WebInspector.DataGrid.prototype._hasFilterDelegate):
Helper function.
(WebInspector.DataGrid.prototype._updateVisibleRows):
Exclude hidden nodes from revealed rows.
(WebInspector.DataGrid.prototype._updateFilter):
Filtering entry point, called on an animation frame. Updates visible
rows if any node was filtered/unfiltered.

(WebInspector.DataGridNode):
(WebInspector.DataGridNode.prototype.get filterableData):
Gets an array of filterable strings for the node.
(WebInspector.DataGridNode.prototype.refresh):
Resets cached filterable strings.
(WebInspector.DataGridNode.prototype.filterableDataForColumn):
Can be overridden by subclasses to provide filterable text for complex
cell data, like as objects formatted as document fragments.

UserInterface/Views/LayoutTimelineDataGridNode.js:

(WebInspector.LayoutTimelineDataGridNode.prototype.get data):

UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.LayoutTimelineView.prototype.filterDidChange):
Update highlight after grid filter change.
(WebInspector.LayoutTimelineView.prototype._dataGridSelectedNodeChanged):
Update highlight when selection changes.
(WebInspector.LayoutTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.LayoutTimelineView.prototype.treeElementDeselected): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.NetworkTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/OverviewTimelineView.js:

(WebInspector.OverviewTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.OverviewTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/RenderingFrameTimelineView.js:

(WebInspector.RenderingFrameTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.RenderingFrameTimelineView.prototype.get filterStartTime):
(WebInspector.RenderingFrameTimelineView.prototype.get filterEndTime):
Convert selection indices into filter start and end times.
(WebInspector.RenderingFrameTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
Perform custom filtering on rendering frame duration.
(WebInspector.RenderingFrameTimelineView.prototype._scopeBarSelectionDidChange):
Inform grid of custom filter change.
(WebInspector.RenderingFrameTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode.prototype.filterableDataForColumn):
Use URL string for filtering "name" column.

UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView.prototype.updateFilter):
Forwarding for TimelineView API.
(WebInspector.ScriptClusterTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.ScriptClusterTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Renamed to matchDataGridNodeAgainstCustomFilters.
(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange): Deleted.
Removed FIXME comment. Updating TimelineView times is sufficient to trigger filtering.

UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.filterableDataForColumn):
Use main title and subtitle strings for filtering "name" column.
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
(WebInspector.ScriptTimelineDataGridNode.prototype._subtitle):
Break out for use in filterableDataForColumn.

UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid):
Cleanup variable names.
(WebInspector.TimelineDataGrid.prototype.hasCustomFilters):
Always true because filtering on ruler selection always occurs.
(WebInspector.TimelineDataGrid.prototype.matchNodeAgainstCustomFilters):
Match nodes against scope bar filters.
(WebInspector.TimelineDataGrid.prototype._scopeBarSelectedItemsDidChange):
Inform grid of custom filter change.
(WebInspector.TimelineDataGrid.prototype.treeElementMatchesActiveScopeFilters): Deleted.
Re-implemented as _nodeMatchesActiveScopeFilters.
(WebInspector.TimelineDataGrid.prototype._updateScopeBarForcedVisibility): Deleted.
Old UI. No longer needed.

UserInterface/Views/TimelineDataGridNode.js:

(WebInspector.TimelineDataGridNode.prototype.filterableDataForColumn):
Filter strings for SourceCodeLocation and CallFrame objects.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
Listen for FilterBar changes and TimelineView record filtering.
(WebInspector.TimelineRecordingContentView.prototype._filterDidChange):
Update grid filters when filter bar changes.
(WebInspector.TimelineRecordingContentView.prototype._recordWasFiltered):
Update overview when records are filtered/unfiltered.
(WebInspector.TimelineRecordingContentView.prototype.filterDidChange): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.recordWasFiltered): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters.checkTimeBounds): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Re-implemented in DataGrid.
(WebInspector.TimelineRecordingContentView.prototype._updateTimes): Deleted.
FIXME comment removed. Filtering occurs when TimelineView times are updated.
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged): Deleted.

UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView):
(WebInspector.TimelineView.prototype.get navigationItems):
Used by TimelineRecordingContentView to add scope bar items to the
lower content browser's navigation bar.

(WebInspector.TimelineView.prototype.set startTime):
(WebInspector.TimelineView.prototype.set endTime):
(WebInspector.TimelineView.prototype.set currentTime):
Update grid filter when recording times change.
(WebInspector.TimelineView.prototype.get filterStartTime):
(WebInspector.TimelineView.prototype.get filterEndTime):
Let subclasses (RenderingFrameTimelineView) provide filter start/end times.
(WebInspector.TimelineView.prototype.setupDataGrid):
Register the grid used by the TimelineView subclass, allowing the base
class to hook into common event listeners and provide boilerplate functionality.

(WebInspector.TimelineView.prototype.updateFilter):
For data grid views, updates grid filters and sets new filter text.
(WebInspector.TimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters.checkTimeBounds):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters):
DataGrid filter delegate. Lets subclasses apply custom filters first,
then filters based on ruler selection if needed.

(WebInspector.TimelineView.prototype.filterDidChange):
Hook for subclasses to respond to filter changes.
(WebInspector.TimelineView.prototype._filterTimesDidChange.delayedWork):
(WebInspector.TimelineView.prototype._filterTimesDidChange):
Helper function for coalescing ruler selection updates into a single
filter update.

(WebInspector.TimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.TimelineView.prototype.filterUpdated): Deleted.
No longer needed.

5:50 PM Changeset in webkit [200066] by Chris Dumez

3 edits in trunk/Source/WebCore

Crash under MemoryCache::remove()
https://bugs.webkit.org/show_bug.cgi?id=157000
<rdar://problem/23344660>

Reviewed by Andreas Kling.

MemoryCache::evictResources() was caching the number of resources ('size')
in the cache for a particular sessionID, and then proceed to call
MemoryCache::remove() 'size' times using the first item in the HashMap
each time. This was unsafe because resources may be ref'ing each other
and therefore removing one may cause other resources to get removed as
well. In such case, we would call remove() too many times and crash because
we dereferenced resources.begin()->value (with the HashMap being empty).

This patch avoids the issue by copying the resources to a Vector and
ref'ing them first, before going on to remove each one from the cache.

loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::forEachSessionResource):
(WebCore::MemoryCache::evictResources):

loader/cache/MemoryCache.h:

5:44 PM Changeset in webkit [200065] by Joseph Pecoraro

11 edits
2 adds in trunk

Web Inspector: React.js JSXTransformer produces bogus error locations
https://bugs.webkit.org/show_bug.cgi?id=150010
<rdar://problem/23062233>

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

Show dynamically added <script> elements added to a frame as resources.
For cases where the scripts had source map resources or error messages
we have a root from which to associate them to.

Localizations/en.lproj/localizedStrings.js:

"Script Element %d" tree element title.

UserInterface/Models/Frame.js:

(WebInspector.Frame.prototype.commitProvisionalLoad):
(WebInspector.Frame.prototype.get extraScripts):
(WebInspector.Frame.prototype.addExtraScript):
Have a frame keep a list of its extra scripts.

UserInterface/Models/Script.js:

(WebInspector.Script):
(WebInspector.Script.prototype.get displayName):
(WebInspector.Script.prototype.get dynamicallyAddedScriptElement):
Identify dynamically added script elements and associate them
with the frame, instead of the frame's main resource.

UserInterface/Views/FrameTreeElement.js:

(WebInspector.FrameTreeElement.prototype.onpopulate):
(WebInspector.FrameTreeElement.prototype._extraScriptAdded):
Show named / source mapped dynamic script elements under a frame.

UserInterface/Views/ResourceSidebarPanel.js:

(WebInspector.ResourceSidebarPanel.prototype._scriptWasAdded):
Dynamically added script element Scripts will be added by the frame that
owns them.

UserInterface/Views/ScriptTreeElement.js:

(WebInspector.ScriptTreeElement):
Don't include a subtitle for dynamicallyAddedScriptElement, details match
the frame that owns them.

LayoutTests:

inspector/model/frame-extra-scripts-expected.txt: Added.
inspector/model/frame-extra-scripts.html: Added.

Add a test for a WebInspector.Frame's extraScripts list.

inspector/model/script-resource-relationship-expected.txt
inspector/model/script-resource-relationship.html

Add a test for a dynamicallyAddedScriptElement.
Remove debug logging.

5:44 PM Changeset in webkit [200064] by Joseph Pecoraro

11 edits in trunk/Source/WebInspectorUI

Web Inspector: Line error widget showed in the wrong resource
https://bugs.webkit.org/show_bug.cgi?id=150009
<rdar://problem/23062199>

Reviewed by Timothy Hatcher.

This addresses a few long standing issues:

IssueMessage and ConsoleMessage should not fight eachother
Displayed issue messages now correctly have format string formatting, e.g. console.error("Foo %s", str)
IssueMessage wraps a ConsoleMessage, so we don't duplicate everything
Gives ConsoleMessage a sourceCodeLocation (lazy)
- Since a sourceCodeLocation can have the exact SourceCode, if it was a Script without a Resource, we can only show the error in the Script's editor.

UserInterface/Models/CallFrame.js:

(WebInspector.CallFrame.fromPayload):
Prefer the script identifier lookup first. And from the Script go
to a resource if possible. This allows us to distinguish a location
that should be in a Script that doesn't have a Resource when there
exists a Resource with the same URL. This will soon be the case
for dyanamic <script> elements append to a document.

UserInterface/Controllers/IssueManager.js:

(WebInspector.IssueManager.issueMatchSourceCode):
Consolidate all the different checks to this one function.

(WebInspector.IssueManager.prototype.issueWasAdded):
Create IssueMessages with ConsoleMessages.

(WebInspector.IssueManager.prototype.issuesForSourceCode):
Simplify now that we have the better check.

UserInterface/Controllers/LogManager.js:

(WebInspector.LogManager.prototype.messageWasAdded):
Once a ConsoleMessage has been created (and modified parameters for us)
create the IssueMessage if it was an issue.

UserInterface/Models/ConsoleMessage.js:

(WebInspector.ConsoleMessage.prototype.get sourceCodeLocation):
Lazily create a source code from the best possible location. This can
be the top call frame or the url/line/column combination.

UserInterface/Models/IssueMessage.js:

(WebInspector.IssueMessage):
Creation and most properties just call through to a ConsoleMessage.
The type and text are Issue specific. Anything that uses location
data should use the sourceCodeLocation.

(WebInspector.IssueMessage.prototype.saveIdentityToCookie):
Fix implementation that didn't account for a null sourceCodeLocation.

(WebInspector.IssueMessage.prototype._formatTextIfNecessary):
Basic text format message formatting.

UserInterface/Protocol/ConsoleObserver.js:

(WebInspector.ConsoleObserver.prototype.messageAdded):
No longer call IssueMessage from the observer. Let LogManager trigger issues.

UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.resolvedRepresentedObjectForRepresentedObject):
(WebInspector.ContentView.isViewable):
An IssueMessage represented object for an IssueMessageTreeElement should be
restorable by just going to the sourceCodeLocation it references. This is
identical to a Breakpoint.

UserInterface/Views/IssueTreeElement.js:

(WebInspector.IssueTreeElement.prototype._updateTitles):
(WebInspector.IssueTreeElement):

UserInterface/Views/ResourceContentView.js:

(WebInspector.ResourceContentView.prototype._issueWasAdded):

UserInterface/Views/SourceCodeTextEditor.js:

(WebInspector.SourceCodeTextEditor.prototype._issueWasAdded):
(WebInspector.SourceCodeTextEditor.prototype._addIssue):
(WebInspector.SourceCodeTextEditor.prototype._reinsertAllIssues):
(WebInspector.SourceCodeTextEditor.prototype._matchesIssue): Deleted.
Update to use Issue's sourceCodeLocation or IssueManager's new APIs.

5:23 PM Changeset in webkit [200063] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/layers/no-clipping-overflow-hidden-added-after-transform.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=157007

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

5:13 PM Changeset in webkit [200062] by Chris Dumez

4 edits in trunk/Source/WebCore

Crash under WebCore::MutationObserver::deliverAllMutations()
https://bugs.webkit.org/show_bug.cgi?id=156997
<rdar://problem/16542323>

Reviewed by Ryosuke Niwa.

The crash traces indicate that we may derefence a null pointer when
dereferencing MutationCallback::scriptExecutationContext() in
MutationObserver::canDeliver(). This can happen when the script
execution context gets destroyed as a JSMutationCallback is an
ActiveDOMObject, which is a ContextDestructionObserver.

This patch refactors the code so that MutationObserver::canDeliver()
now simply asks JSMutationCallback if it can invoke its callback.
JSMutationCallback makes this decision using
ActiveDOMCallback::canInvokeCallback() which does a proper null
check of the ScriptExecutationContext. This avoids some code
duplication and fixes the crash.

bindings/js/JSMutationCallback.h:
dom/MutationCallback.h:
dom/MutationObserver.cpp:

(WebCore::MutationObserver::canDeliver):

5:12 PM Changeset in webkit [200061] by beidson@apple.com

2 edits in trunk/Source/WebCore

Fix a flaky test after r200032

fileapi/File.cpp:

(WebCore::File::lastModified): This used to return a date object which did a WTF::timeClip on the double,

but now that we're returning a raw double we need to WTF::timeClip it ourselves.

4:50 PM Changeset in webkit [200060] by ggaren@apple.com

9 edits in trunk/PerformanceTests

bmalloc: Misc improvements to MallocBench
https://bugs.webkit.org/show_bug.cgi?id=157004

Reviewed by Darin Adler.

MallocBench/run-malloc-benchmarks: Added --memory and --memory_warning

modes for focused memory testing.

MallocBench/MallocBench/Benchmark.cpp:

(Benchmark::printReport): Clarified output.

(Benchmark::currentMemoryBytes): Added compressed memory because top
does the same. (It always happens to zero in the benchmarks we run. But
this is good for sanity.)

MallocBench/MallocBench/CommandLine.cpp: Moved up to 8 runs to reduce

variance.

MallocBench/MallocBench/alloc_free.cpp:

(benchmark_alloc_free): Cycle a single allocation in order to stress
the effect of merging on calls to madvise.

MallocBench/MallocBench/big.cpp:

(benchmark_big): Graduated to 8kB-128kB because medium tests up to 8 and
our large allocator doesn't kick in until 64kB.

MallocBench/MallocBench/medium.cpp:

(benchmark_medium): Test all the way down to 1kB because our large
allocator used to service 1kB allocations and 1kB is an interesting
middle size where memory is unusually large but allocation throughput
still matters.

MallocBench/MallocBench/stress.cpp:

(benchmark_stress): Reduced the churn count to match stress_aligned
because this test was taking too long to complete.

MallocBench/MallocBench/stress_aligned.cpp:

(benchmark_stress_aligned): Our new large allocator can handle even
more absurdly large values.

4:41 PM Changeset in webkit [200059] by commit-queue@webkit.org

3 edits in trunk/Tools

[Tools] whitelist all-uppercase JSTokenType enum in JavaScriptCore
https://bugs.webkit.org/show_bug.cgi?id=156976

Patch by Caitlin Potter <caitp@igalia.com> on 2016-04-25
Reviewed by Darin Adler.

Mitigate style-checker spam on bugs which introduce new JavaScript
token types.

Scripts/webkitpy/style/checkers/cpp.py:

(_EnumState.init):
(_EnumState.process_clean_line):

Scripts/webkitpy/style/checkers/cpp_unittest.py:

(NoNonVirtualDestructorsTest.test_enum_casing):

4:39 PM Changeset in webkit [200058] by Chris Dumez

8 edits in trunk/Source/WebCore

[Web IDL] Specify default values for optional parameters of type 'float' / 'unrestricted float'
https://bugs.webkit.org/show_bug.cgi?id=156995

Reviewed by Darin Adler.

Specify default values for optional parameters of type 'float' / 'unrestricted float'
and let the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):

html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::setStrokeColor):
(WebCore::CanvasRenderingContext2D::setFillColor):
(WebCore::CanvasRenderingContext2D::setShadow):
(WebCore::CanvasRenderingContext2D::fillText):
(WebCore::CanvasRenderingContext2D::strokeText):
(WebCore::CanvasRenderingContext2D::drawTextInternal):
(WebCore::CanvasRenderingContext2D::clearShadow): Deleted.
(WebCore::normalizeSpaces): Deleted.
(WebCore::CanvasRenderingContext2D::measureText): Deleted.

html/canvas/CanvasRenderingContext2D.h:
html/canvas/CanvasRenderingContext2D.idl:
testing/Internals.idl:

4:34 PM Changeset in webkit [200057] by Beth Dakin

2 edits in trunk/Source/WebKit/mac

WebEditorClient should properly write to m_rangeForCandidates
https://bugs.webkit.org/show_bug.cgi?id=157003
-and corresponding-
rdar://problem/25910418

Reviewed by Tim Horton.

Actually write to m_rangeForCandidates instead of declaring a local variable
of the same name. :-/

WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::requestCandidatesForSelection):

4:13 PM Changeset in webkit [200056] by Brent Fulgham

6 edits in trunk

Add port 4190 (managesieve) to port blacklist
https://bugs.webkit.org/show_bug.cgi?id=156986
<rdar://problem/9119470>

Reviewed by Daniel Bates.

Source/WebCore:

Tested by security/block-test.html.

platform/URL.cpp:

(WebCore::portAllowed): Add 4190 to the port blacklist.

LayoutTests:

platform/mac/security/block-test-expected.txt
security/block-test-expected.txt:
security/block-test.html:

4:04 PM Changeset in webkit [200055] by Ryan Haddad

73 edits
1 add in trunk/LayoutTests

Rebaseline editing tests for ios-simulator-wk1

Unreviewed test gardening

platform/ios-simulator-wk1/editing/deleting/delete-at-paragraph-boundaries-002-expected.txt:
+71 more

3:40 PM Changeset in webkit [200054] by n_wang@apple.com

3 edits
2 adds in trunk

AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

Source/WebCore:

When we hit test on a slider indicator asking for the value when the parent slider's
accessibility object is not created or the parent slider has been removed, it will cause
crash. Fixed it by adding a check to see if the object is detached from the parent.

Test: accessibility/mac/slider-thumb-value-crash.html

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests:

accessibility/mac/slider-thumb-value-crash-expected.txt: Added.
accessibility/mac/slider-thumb-value-crash.html: Added.

3:40 PM Changeset in webkit [200053] by Simon Fraser

3 edits in trunk/Tools

Fix issues with content-animation performance tests
https://bugs.webkit.org/show_bug.cgi?id=157001

Reviewed by Sam Weinig.

Add patch content for svg-animation.html, and fix the paths in the patch so
it applies correctly.

Add the patch file to the .plan file.

Scripts/webkitpy/benchmark_runner/data/patches/ContentAnimation.patch:
Scripts/webkitpy/benchmark_runner/data/plans/content-animation.plan:

2:58 PM Changeset in webkit [200052] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

WebKitPlaybackSessionModelMediaElement should initialize the interface added by setWebPlaybackSessionInterface() with initial data
https://bugs.webkit.org/show_bug.cgi?id=156996

Reviewed by Beth Dakin.

Notify the interface of the current values in the media element when the model is given an interface.

platform/cocoa/WebPlaybackSessionModelMediaElement.mm:

(WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):

2:38 PM Changeset in webkit [200051] by beidson@apple.com

2 edits in trunk/LayoutTests

Attempt to fix a flaky test after r200032
https://bugs.webkit.org/show_bug.cgi?id=156994

http/tests/local/fileapi/script-tests/file-last-modified-after-delete.js: Missed renaming this along with all the others.

2:13 PM Changeset in webkit [200050] by Chris Dumez

2 edits in trunk/Source/WebKit2

Crash under -[WKWebView _mayAutomaticallyShowVideoPictureInPicture] + 32 (WKWebView.mm:309)
https://bugs.webkit.org/show_bug.cgi?id=156990
<rdar://problem/25904376>

Reviewed by Jer Noble.

In case of WebProcess crash, WebPageProxy::processDidCrash() will call resetState() which
will nullify WebPageProxy::m_videoFullscreenManager. In WebPageProxy::reattachToWebProcess(),
we then call updateViewState() before re-initializing m_videoFullscreenManager, and
updateViewState() ends up calling [WKWebView _mayAutomaticallyShowVideoPictureInPicture]
which dereferences WebPageProxy::m_videoFullscreenManager without null check. This patch
adds a null check for m_videoFullscreenManager in _mayAutomaticallyShowVideoPictureInPicture.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _mayAutomaticallyShowVideoPictureInPicture]):

2:07 PM Changeset in webkit [200049] by Simon Fraser

2 edits
1 add in trunk/PerformanceTests

Add a content animation test that uses SVG animation.
https://bugs.webkit.org/show_bug.cgi?id=156827

Animation/svg-animation.html: Added.
Skipped:

1:59 PM Changeset in webkit [200048] by msaboff@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Crash using @tryGetById in DFG
https://bugs.webkit.org/show_bug.cgi?id=156992

Reviewed by Filip Pizlo.

We need to spill live registers when compiling TryGetById in DFG.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileTryGetById):

tests/stress/regress-156992.js: New test.

(tryMultipleGetByIds):
(test):

1:56 PM Changeset in webkit [200047] by Simon Fraser

9 edits
4 adds in trunk

Toggling animation-play-state can re-start a finished animation
https://bugs.webkit.org/show_bug.cgi?id=156731

Reviewed by Dean Jackson.

Source/WebCore:

After an animation completed, CompositeAnimation::updateKeyframeAnimations() cleared
all state that the animation had run on the element, so changing the value of some
animation property triggered the animation to run again. This is wrong, since animation-name
still applied to the element.

Fix by keeping state for keyframe animations in the Done state in the m_keyframeAnimations
map. This allows for the removal of the index property on KeyframeAnimation.

Tests: animations/change-completed-animation-transform.html

animations/change-completed-animation.html

page/animation/AnimationBase.cpp:

(WebCore::AnimationBase::timeToNextService):

page/animation/AnimationBase.h:

(WebCore::AnimationBase::isAnimatingProperty):

page/animation/CompositeAnimation.cpp: Add animations that should stick around to AnimationNameMap,

and swap with m_keyframeAnimations at the end.
(WebCore::CompositeAnimation::updateKeyframeAnimations):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::getAnimatedStyle):

page/animation/KeyframeAnimation.h:

LayoutTests:

animations/animation-direction-reverse-expected.txt:
animations/animation-direction-reverse.html: This is a progression. The test was detecting a

restarted animation.

animations/change-completed-animation-expected.txt: Added.
animations/change-completed-animation-transform-expected.html: Added.
animations/change-completed-animation-transform.html: Added. Ref test that ensures that the final

state for normal and accelerated animations is correct.

animations/change-completed-animation.html: Added. Tests that changing a property doesn't trigger

another animation, by detecting a second animationstart event.

1:51 PM WebKitGTK/2.12.x edited by berto@igalia.com

(diff)

1:48 PM Changeset in webkit [200046] by berto@igalia.com

2 edits in trunk/Source/WebCore

[GTK] Crashes if DISPLAY is unset
https://bugs.webkit.org/show_bug.cgi?id=156972

Reviewed by Carlos Garcia Campos.

If DISPLAY is unset then m_display will be NULL, crashing WebKit
when XCloseDisplay is called in the PlatformDisplayX11 destructor.

platform/graphics/x11/PlatformDisplayX11.cpp:

(WebCore::PlatformDisplayX11::~PlatformDisplayX11):

1:33 PM Changeset in webkit [200045] by beidson@apple.com

2 edits in trunk/Tools

Tweaking IndexedDB watchlist and adding myself to it.

Scripts/webkitpy/common/config/watchlist:

1:07 PM Changeset in webkit [200044] by Ryan Haddad

2 edits in trunk/Source/WebCore

Update JS bindings test results after r200037

Unreviewed test gardening.

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):

1:06 PM Changeset in webkit [200043] by Simon Fraser

8 edits
2 adds in trunk

play-state not parsed as part of animation shorthand
https://bugs.webkit.org/show_bug.cgi?id=156959

Reviewed by Darin Adler.

Source/WebCore:

We failed to parse animation-play-state as part of the animation shorthand, contrary
to the spec and other browsers.

Fix for both the prefixed and unprefixed properties. There is some compat risk here,
but only changing unprefixed behavior will probably lead to more author confusion.

Test: animations/play-state-in-shorthand.html

css/CSSParser.cpp:

(WebCore::CSSParser::parseAnimationShorthand):

css/CSSPropertyNames.in:
css/StylePropertyShorthand.cpp:

(WebCore::animationShorthandForParsing): Remove the long comment which is no longer relevant
now that the behavior has been written into the spec.

LayoutTests:

animations/animation-shorthand-expected.txt:
animations/animation-shorthand.html:
animations/play-state-in-shorthand-expected.txt: Added.
animations/play-state-in-shorthand.html: Added.
animations/resources/animation-test-helpers.js:

(getPropertyValue):
(comparePropertyValue):

1:06 PM Changeset in webkit [200042] by Simon Fraser

4 edits
2 adds in trunk

Negative animation-delay is treated as 0s
https://bugs.webkit.org/show_bug.cgi?id=141008

Reviewed by Daniel Bates.

Source/WebCore:

Fix keyframe animations which start in the paused state.

Explicitly move such animations from the new to the paused state, and
set m_pauseTime to 0, rather than leaving it at -1. Fix getElapsedTime()
to compute a correct time elapsed time for such animations, which takes
negative delay into account correctly.

Fix assertions which need to account for the new transition of New -> PlayStatePaused.

Test: animations/play-state-start-paused.html

page/animation/AnimationBase.cpp:

(WebCore::AnimationBase::updateStateMachine):
(WebCore::AnimationBase::getElapsedTime):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::animate):

LayoutTests:

Ref test that has an initially-paused animation on 'left' and with a
3d transform.

animations/play-state-start-paused-expected.html: Added.
animations/play-state-start-paused.html: Added.

12:49 PM Changeset in webkit [200041] by Antti Koivisto

393 edits in trunk/Source/WebCore

Inline RenderStyle into RenderElement
https://bugs.webkit.org/show_bug.cgi?id=156981

Reviewed by Andreas Kling.

We can save memory and reduce indirection of style access by inlining RenderStyle to RenderElement.

This patch also makes RenderStyle moveable and switches from std::unique_ptr<RenderStyle> to RenderStyle&&
in many places where ownership is passed.

Modules/plugins/PluginReplacement.h:

(WebCore::PluginReplacement::scriptObject):
(WebCore::PluginReplacement::willCreateRenderer):

Modules/plugins/QuickTimePluginReplacement.h:
Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
(WebCore::QuickTimePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.cpp:

(WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
(WebCore::YouTubePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.h:
css/StyleResolver.cpp:

(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::styleForKeyframe):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::styleForPage):
(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::addToMatchedPropertiesCache):
(WebCore::StyleResolver::applyPropertyToStyle):

dom/Document.cpp:

(WebCore::Document::recalcStyle):
(WebCore::Document::webkitWillEnterFullScreenForElement):
(WebCore::Document::setFullScreenRenderer):

dom/Element.cpp:

(WebCore::Element::rendererIsNeeded):
(WebCore::Element::createElementRenderer):

dom/Element.h:

(WebCore::Element::copyNonAttributePropertiesFromElement):

dom/PseudoElement.cpp:

(WebCore::PseudoElement::resolveCustomStyle):
(WebCore::PseudoElement::didAttachRenderers):
(WebCore::PseudoElement::didRecalcStyle):

html/BaseButtonInputType.cpp:

(WebCore::BaseButtonInputType::appendFormData):
(WebCore::BaseButtonInputType::createInputRenderer):

html/BaseButtonInputType.h:
html/FileInputType.cpp:

(WebCore::FileInputType::handleDOMActivateEvent):
(WebCore::FileInputType::createInputRenderer):

html/FileInputType.h:
html/HTMLAppletElement.cpp:

(WebCore::HTMLAppletElement::rendererIsNeeded):
(WebCore::HTMLAppletElement::createElementRenderer):

...

12:43 PM Changeset in webkit [200040] by dbates@webkit.org

3 edits in trunk/Tools

Unreviewed, rolling out r199916.
https://bugs.webkit.org/show_bug.cgi?id=156989

Might break buildbot when master is restarted (Requested by
Srinivasan Vijayaraghava, Guest100, on #webkit).

Reverted changeset:

"Add JSC test results in json format to a buildbot log"
https://bugs.webkit.org/show_bug.cgi?id=156920
http://trac.webkit.org/changeset/199916

Patch by Commit Queue <commit-queue@webkit.org> on 2016-04-25

12:37 PM Changeset in webkit [200039] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

Stop listening for "media can start" notifications when media player is cleared
https://bugs.webkit.org/show_bug.cgi?id=156985
<rdar://problem/23158505>

Reviewed by Jer Noble.

No new tests, I have not been able to create a test that reliably reproduces this.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadInternal): Add logging.
(WebCore::HTMLMediaElement::selectMediaResource): Assert and return early if there is

no media player.

(WebCore::HTMLMediaElement::clearMediaPlayer): Stop listening for can start notifications.
(WebCore::HTMLMediaElement::visibilityStateChanged): Add logging.
(WebCore::HTMLMediaElement::mediaCanStart): Ditto.

12:08 PM Changeset in webkit [200038] by sbarati@apple.com

8 edits in trunk/Source/JavaScriptCore

We don't have to parse a function's parameters every time if the function is in the source provider cache
https://bugs.webkit.org/show_bug.cgi?id=156943

Reviewed by Filip Pizlo.

This patch makes a few changes to make parsing inner functions
faster.

First, we were always parsing an inner function's parameter
list using the templatized TreeBuiler. This means if our parent scope
was building an AST, we ended up building AST nodes for the inner
function's parameter list even though these nodes would go unused.
This patch fixes that to *always* build an inner function's parameter
list using the SyntaxChecker. (Note that this is consistent now with
always building an inner function's body with a SyntaxChecker.)

Second, we were always parsing an inner function's parameter list
even if we had that function saved in the source provider cache.
I've fixed that bug and made it so that we skip over the parsing
of a function's parameter list when it's in the source provider
cache. We could probably enhance this in the future to skip
over the entirety of a function starting at the "function"
keyword or any other start of the function (depending on
the function type: arrow function, method, etc).

This patch also renames a few fields. First, I fixed a typo
from "tocken" => "token" for a few field names. Secondly,
I renamed a field that was called 'bodyStartColumn' to
'parametersStartColumn' because the field really held the
parameter list's start column.

I'm benchmarking this as a 1.5-2% octane/jquery speedup
on a 15" MBP.

parser/ASTBuilder.h:

(JSC::ASTBuilder::createFunctionExpr):
(JSC::ASTBuilder::createMethodDefinition):
(JSC::ASTBuilder::createArrowFunctionExpr):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createFuncDeclStatement):

parser/Lexer.cpp:

(JSC::Lexer<T>::lex):

parser/Lexer.h:

(JSC::Lexer::currentPosition):
(JSC::Lexer::positionBeforeLastNewline):
(JSC::Lexer::lastTokenLocation):
(JSC::Lexer::setLastLineNumber):
(JSC::Lexer::lastLineNumber):
(JSC::Lexer::prevTerminator):

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::stringForFunctionMode):
(JSC::Parser<LexerType>::parseFunctionParameters):
(JSC::Parser<LexerType>::parseFunctionInfo):

parser/Parser.h:

(JSC::Scope::usedVariablesContains):
(JSC::Scope::forEachUsedVariable):
(JSC::Scope::useVariable):
(JSC::Scope::copyCapturedVariablesToVector):
(JSC::Scope::fillParametersForSourceProviderCache):
(JSC::Scope::restoreFromSourceProviderCache):

parser/ParserFunctionInfo.h:
parser/SourceProviderCacheItem.h:

(JSC::SourceProviderCacheItem::endFunctionToken):
(JSC::SourceProviderCacheItem::usedVariables):
(JSC::SourceProviderCacheItem::SourceProviderCacheItem):

11:38 AM Changeset in webkit [200037] by Chris Dumez

5 edits in trunk/Source/WebCore

[Web IDL] Specify default values for parameters of type 'unsigned short'
https://bugs.webkit.org/show_bug.cgi?id=156967

Reviewed by Darin Adler.

Specify default values for parameters of type 'unsigned short' and let
the bindings generator use WTF::Optional<> for the ones without a
default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter):
(GenerateParametersCheck):

testing/Internals.cpp:

(WebCore::Internals::layerTreeAsText): Deleted.
(WebCore::Internals::displayListForElement): Deleted.
(WebCore::Internals::replayDisplayListForElement): Deleted.

testing/Internals.h:
testing/Internals.idl:

11:38 AM Changeset in webkit [200036] by peavo@outlook.com

11 edits
2 adds in trunk/Source

[Win][IndexedDB] Fix build errors.
https://bugs.webkit.org/show_bug.cgi?id=156713

Reviewed by Alex Christensen.

Fix compile and link errors when building with IndexedDB enabled.

Source/WebCore:

Modules/indexeddb/IDBCursor.h:
Modules/indexeddb/IDBTransaction.cpp:
Modules/indexeddb/server/MemoryBackingStoreTransaction.h:
Modules/indexeddb/server/MemoryIDBBackingStore.h:
PlatformWin.cmake:
platform/win/FileSystemWin.cpp:

(WebCore::hardLinkOrCopyFile):

Source/WebKit:

PlatformWin.cmake:

Source/WebKit/win:

WebView.cpp:

(WebView::notifyPreferencesChanged):

storage: Added.
storage/WebDatabaseProvider.cpp: Added.

(WebDatabaseProvider::indexedDatabaseDirectoryPath):

11:20 AM Changeset in webkit [200035] by ggaren@apple.com

4 edits in trunk/Source/bmalloc

2016-04-25 Geoffrey Garen <ggaren@apple.com>

bmalloc: vm allocations should plant guard pages
https://bugs.webkit.org/show_bug.cgi?id=156937

Rolling back in r199936 with a fix for the memory regression.

10:48 AM Changeset in webkit [200034] by mark.lam@apple.com

37 edits in trunk/Source/JavaScriptCore

Renaming SpecInt32, SpecInt52, MachineInt to SpecInt32Only, SpecInt52Only, AnyInt.
https://bugs.webkit.org/show_bug.cgi?id=156941

Reviewed by Filip Pizlo.

While looking at https://bugs.webkit.org/show_bug.cgi?id=153431, it was decided
that SpecInt32Only, SpecInt52Only, and AnyInt would be better names for
SpecInt32, SpecInt52, and MachineInt. Let's do a bulk rename.

This is only a renaming patch, and deletion of a piece of unused code. There are
no semantic changes.

bindings/ScriptValue.cpp:

(Inspector::jsToInspectorValue):

bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):
(JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
(JSC::typeOfDoubleNegation):
(JSC::typeOfDoubleRounding):

bytecode/SpeculatedType.h:

(JSC::isInt32Speculation):
(JSC::isInt32OrBooleanSpeculation):
(JSC::isInt32SpeculationForArithmetic):
(JSC::isInt32OrBooleanSpeculationForArithmetic):
(JSC::isInt32OrBooleanSpeculationExpectingDefined):
(JSC::isInt52Speculation):
(JSC::isAnyIntSpeculation):
(JSC::isAnyIntAsDoubleSpeculation):
(JSC::isDoubleRealSpeculation):
(JSC::isMachineIntSpeculation): Deleted.
(JSC::isInt52AsDoubleSpeculation): Deleted.
(JSC::isIntegerSpeculation): Deleted.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
(JSC::DFG::AbstractValue::checkConsistency):
(JSC::DFG::AbstractValue::resultType):

dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::validateType):

dfg/DFGArgumentsUtilities.cpp:

(JSC::DFG::emitCodeToGetArgumentsArrayLength):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupToThis):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixIntConvertingEdge):
(JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
(JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
(JSC::DFG::FixupPhase::truncateConstantToInt32):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
(JSC::DFG::FixupPhase::prependGetArrayLength):
(JSC::DFG::FixupPhase::fixupChecksInBlock):

dfg/DFGGraph.h:

(JSC::DFG::Graph::addShouldSpeculateInt32):
(JSC::DFG::Graph::addShouldSpeculateAnyInt):
(JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
(JSC::DFG::Graph::binaryArithShouldSpeculateAnyInt):
(JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
(JSC::DFG::Graph::unaryArithShouldSpeculateAnyInt):
(JSC::DFG::Graph::addShouldSpeculateMachineInt): Deleted.
(JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt): Deleted.
(JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt): Deleted.

dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::initialize):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::noticeOSREntry):

dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToIdentityOn):

dfg/DFGNode.h:

(JSC::DFG::Node::asNumber):
(JSC::DFG::Node::isAnyIntConstant):
(JSC::DFG::Node::asAnyInt):
(JSC::DFG::Node::isBooleanConstant):
(JSC::DFG::Node::shouldSpeculateInt32OrBooleanExpectingDefined):
(JSC::DFG::Node::shouldSpeculateAnyInt):
(JSC::DFG::Node::shouldSpeculateDouble):
(JSC::DFG::Node::shouldSpeculateNumber):
(JSC::DFG::Node::isMachineIntConstant): Deleted.
(JSC::DFG::Node::asMachineInt): Deleted.
(JSC::DFG::Node::shouldSpeculateMachineInt): Deleted.

dfg/DFGOSREntry.cpp:

(JSC::DFG::OSREntryData::dumpInContext):
(JSC::DFG::prepareOSREntry):

dfg/DFGOSREntry.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileArithAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::speculateInt32):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateMisc):
(JSC::DFG::SpeculativeJIT::speculate):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::spill):
(JSC::DFG::SpeculativeJIT::isKnownInteger):
(JSC::DFG::SpeculativeJIT::isKnownCell):
(JSC::DFG::SpeculativeJIT::isKnownNotInteger):
(JSC::DFG::SpeculativeJIT::isKnownNotNumber):
(JSC::DFG::SpeculativeJIT::isKnownNotCell):
(JSC::DFG::SpeculativeJIT::isKnownNotOther):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::blessBoolean):
(JSC::DFG::SpeculativeJIT::convertAnyInt):
(JSC::DFG::SpeculativeJIT::speculateAnyInt):
(JSC::DFG::SpeculativeJIT::speculateDoubleRepAnyInt):
(JSC::DFG::SpeculativeJIT::convertMachineInt): Deleted.
(JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
(JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt): Deleted.

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isNumerical):
(JSC::DFG::isDouble):

dfg/DFGValidate.cpp:
dfg/DFGVariableAccessData.cpp:

(JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
(JSC::DFG::VariableAccessData::couldRepresentInt52Impl):
(JSC::DFG::VariableAccessData::flushFormat):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileInt52Constant):
(JSC::FTL::DFG::LowerDFGToB3::compileInt52Rep):
(JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
(JSC::FTL::DFG::LowerDFGToB3::lowInt32):
(JSC::FTL::DFG::LowerDFGToB3::strictInt52ToInt32):
(JSC::FTL::DFG::LowerDFGToB3::isInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotInt32):
(JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::doubleToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateAnyInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepReal):
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepAnyInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateMachineInt): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepMachineInt): Deleted.

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_profile_type):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_profile_type):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::isInt52):
(JSC::JSValue::isAnyInt):
(JSC::JSValue::asAnyInt):
(JSC::JSValue::isMachineInt): Deleted.
(JSC::JSValue::asMachineInt): Deleted.

runtime/RuntimeType.cpp:

(JSC::runtimeTypeForValue):
(JSC::runtimeTypeAsString):

runtime/RuntimeType.h:
runtime/TypeSet.cpp:

(JSC::TypeSet::dumpTypes):
(JSC::TypeSet::displayName):
(JSC::TypeSet::inspectorTypeSet):
(JSC::TypeSet::toJSONString):

10:33 AM Changeset in webkit [200033] by mitz@apple.com

3 edits in trunk/Source/WebKit2

Fix a couple of mistakes from r199700.

Rubber-stamped by Anders Carlsson.

UIProcess/API/Cocoa/WKPreferencesPrivate.h: Added availability attributes to new properties.
WebKit2.xcodeproj/project.pbxproj: Demoted _WKExperimentalFeatureInternal.h from Private to Project.

10:31 AM Changeset in webkit [200032] by beidson@apple.com

14 edits
3 adds in trunk

Implement latest File object spec (including its constructor).
https://bugs.webkit.org/show_bug.cgi?id=156511

Reviewed by Darin Adler.

Source/WebCore:

Test: fast/files/file-constructor.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::convertValue):

bindings/js/JSDictionary.h:

bindings/js/JSFileCustom.cpp: Added.

(WebCore::constructJSFile):

fileapi/File.cpp:

(WebCore::File::File):
(WebCore::File::lastModified):
(WebCore::File::lastModifiedDate): Deleted.

fileapi/File.h:
fileapi/File.idl:

LayoutTests:

fast/files/file-constructor-expected.txt: Added.
fast/files/file-constructor.html: Added.

http/tests/local/fileapi/file-last-modified-after-delete-expected.txt:
http/tests/local/fileapi/script-tests/file-last-modified-after-delete.js:

http/tests/local/fileapi/file-last-modified-expected.txt:
http/tests/local/fileapi/script-tests/file-last-modified.js:

imported/blink/storage/indexeddb/blob-basics-metadata-expected.txt:

10:03 AM Changeset in webkit [200031] by Antti Koivisto

2 edits in trunk/Source/WebCore

REGRESSION(r156846): Crashes with guard malloc
https://bugs.webkit.org/show_bug.cgi?id=156984

Reviewed by Andreas Kling.

RenderElement::cachedFirstLineStyle() returns pointer to local std::unique_ptr.

rendering/RenderElement.cpp:

(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::firstLineStyle):
(WebCore::firstLineStyleForCachedUncachedType): Deleted.

Don't try to use a single function for the cached and uncached cases. Separate the cases into the calling functions.

9:27 AM Changeset in webkit [200030] by dbates@webkit.org

4 edits
4 adds in trunk

REGRESSION (r196012): Subresource may be blocked by Content Security Policy if it only matches 'self'
https://bugs.webkit.org/show_bug.cgi?id=156935
<rdar://problem/25351286>

Reviewed by Darin Adler.

Source/WebCore:

Fixes an issue where subresource load may be blocked by the Content Security Policy (CSP) if its URL only
matched 'self'. In particular, the load would be blocked if initiated from a document that inherited the
origin of its owner document (e.g. the document contained in <iframe src="about:blank"></iframe>).

Following r196012 we compute and cache 'self' and its protocol on instantiation of a ContentSecurityPolicy
object for use when matching a URL against it. These cached values become out-of-date if the document
subsequently inherits the origin of its owner document. Therefore matches against 'self' will fail and
CSP will block a load if its not otherwise allowed by the policy. Previously we would compute 'self' when
parsing the definition of a source list and compute the protocol for 'self' each time we tried to match a
URL against 'self'. So, 'self' would always be up-to-date with respect to the origin of the document.

Tests: http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html

http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Extract out logic for computing and caching
'self' and its protocol into ContentSecurityPolicy::updateSourceSelf() and make use of this function.
(WebCore::ContentSecurityPolicy::updateSourceSelf): Computes and caches 'self' and its protocol with
respect to the specified SecurityOrigin.
(WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Call ContentSecurityPolicy::updateSourceSelf()
to ensure that we have an up-to-date representation for 'self' and the protocol of 'self' which can
become out-of-date if the document inherited the origin of its owner document.

page/csp/ContentSecurityPolicy.h:

LayoutTests:

Add tests to ensure that we match 'self' correctly in an iframe with an about:blank document.

http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script-expected.txt: Added.
http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html: Added.
http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script-expected.txt: Added.
http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html: Added.

9:26 AM Changeset in webkit [200029] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking media/video-fullscreen-restriction-removed.html as flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=156983

Unreviewed test gardening.

platform/mac/TestExpectations:

8:57 AM Changeset in webkit [200028] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199807 - Crash under WebCore::TextIterator::subrange()
https://bugs.webkit.org/show_bug.cgi?id=156809
<rdar://problem/21102730>

Reviewed by Ryosuke Niwa.

TextIterator::rangeFromLocationAndLength() may return null. However, we
failed to do a null check before calling TextIterator::subrange() with
that range.

No new tests, do not know how to reproduce.

editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::applyAlternativeTextToRange):

8:55 AM Changeset in webkit [200027] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199781 - Potential overflow in RenderLayer::hitTestList()
https://bugs.webkit.org/show_bug.cgi?id=156804

Reviewed by Simon Fraser.

Use size_t type instead of int to iterate over the Vector to make sure
we don't overflow. This is a speculative fix for <rdar://problem/23249479>.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::hitTestList):

8:54 AM Changeset in webkit [200026] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199769 - [Cairo] Crash in GraphicsContext::drawFocusRing when painting is disabled
https://bugs.webkit.org/show_bug.cgi?id=156785

Reviewed by Žan Doberšek.

This happens for example when view state changes to focus and paint is called from
FrameView::updateControlTints() with a graphics context that doesn't have a platform context. Layout test
fast/images/image-map-outline-with-scale-transform.html sometimes crashes because of this.

platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::drawFocusRing): Return early if painting is disabled.

8:53 AM Changeset in webkit [200025] by Carlos Garcia Campos

7 edits in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199759 - bmalloc: fix up overflow checks
https://bugs.webkit.org/show_bug.cgi?id=156780

Reviewed by Mark Lam.

We used to try to avoid overflow in large object math by setting a very
high limit on the largest large object. But that's a bit error-prone
since the check is far away from the math that might overflow -- and
we were missing some cases.

This patch removes the limit and instead checks at each math site.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::tryAllocate):
(bmalloc::Allocator::allocate):
(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::allocateSlowCase): Remove the limit. tryAllocateLarge
will check for overflow for us.

bmalloc/Chunk.h: This ASSERT was just totally wrong.

bmalloc/Heap.cpp:

(bmalloc::Heap::tryAllocateLarge): Check for overflow when adding.

bmalloc/Sizes.h:

bmalloc/VMAllocate.h:

(bmalloc::tryVMAllocate): Check for overflow when adding.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::tryAllocateLargeChunk): Check for overflow when adding.

8:53 AM Changeset in webkit [200024] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199756 - Unreviewed, try to fix an ASSERT seen on the bots.

bmalloc/Heap.cpp: (bmalloc::Heap::tryAllocateLarge): This ASSERT is supposed to be about alignment, not size. Oops.

8:50 AM Changeset in webkit [200023] by Carlos Garcia Campos

20 edits
1 add
10 deletes in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199746 - bmalloc: Merge the large and xlarge allocators
https://bugs.webkit.org/show_bug.cgi?id=156734

Reviewed by Andreas Kling.

This give us better defense against worst case memory usage:

Baseline Patch Δ

Peak Memory:

nimlang 198,132kB 181,468kB ^{1.09x smaller}

It also eliminates inline metadata for large objects, fixing the
regression introduced in r198675, and more:

run-malloc-benchmarks Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Memory at End:

big 10,880kB 3,328kB ^{3.27x smaller

facebook 3,112kB 2,868kB} 1.09x smaller
fragment --parallel 1,848kB 760kB ^{2.43x smaller

fragment_iterate --parallel 4,908kB 776kB} 6.32x smaller
big --parallel 48,076kB 11,892kB ^{4.04x smaller}

Overall memory use looks OK:

run-malloc-benchmarks --memory_warning Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Memory at End:

<arithmetic mean> 13,992kB 13,987kB ^{1.0x smaller}

Overall throughput looks OK:

run-malloc-benchmarks Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Execution Time:

<arithmetic mean> 103ms 104ms ! 1.01x slower

We're a bit slower on the "all-out large allocations on all cores"
benchmark, but I think that's an OK price to pay:

Baseline Patch Δ

Execution Time:

big --parallel 125ms 136ms ! 1.09x slower

This patch net removes 1.5k lines of code. It turns out that large
allocations are rare, and free memory fragments are also rare, so the
combination is super rare, and a simple O(n) algorithm that ensures good
memory behavior is the best option.

Fun fact: In practice, the odds that the old code would save memory
were *worse* than the odds that it would contain a bug that wasted
memory. :)

bmalloc.xcodeproj/project.pbxproj:

bmalloc/Allocator.cpp:

(bmalloc::Allocator::tryAllocate): largeMax is the new xLargeMax since
xLargeMax is gone now.

(bmalloc::Allocator::allocate): I moved the rounding code into allocateLarge,
so we don't have to do it here.

(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::allocateSlowCase):
(bmalloc::Allocator::allocateXLarge): Deleted. No more XLarge case.

bmalloc/Allocator.h:

bmalloc/BeginTag.h: Removed.
bmalloc/BoundaryTag.h: Removed.

bmalloc/Chunk.h:

(bmalloc::ChunkHash::hash): Added a hash function. The best hash function
is a unique and monotonically increasing integer, and that's exactly what
we typically get from the high bits of a Chunk, since the OS allocates
Chunks at unique and increasing addresses.
(bmalloc::Chunk::boundaryTags): Deleted.
(bmalloc::Chunk::objectType): Deleted.
(bmalloc::Chunk::beginTag): Deleted.
(bmalloc::Chunk::endTag): Deleted.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::deallocateSlowCase): We no longer know for sure,
by looking at its bit pattern, whether a pointer is small or large.
Instead, any pointer with large alignment *might* be large, and when
we occasionally encounter such an object, we have to consult a hash
table in the Heap to find out for sure. This turns out to be just as
cheap in practice.

We don't deallocate large objects on the fast path anymore. We can't,
because large objects have out-of-line metadata now.

(bmalloc::Deallocator::deallocateXLarge): Deleted.

bmalloc/Deallocator.h:

(bmalloc::Deallocator::deallocateFastCase): See deallocateSlowCase.

bmalloc/EndTag.h: Removed.
bmalloc/FreeList.cpp: Removed.
bmalloc/FreeList.h: Removed.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallPage): Be sure to track each chunk in
the object type map, so we can distinguish small vs large objects.

(bmalloc::Heap::deallocateSmallLine): No need to check object type
because we know object type now by virtue of being on the small object
path.

(bmalloc::Heap::splitAndAllocate): Be sure to track each chunk in
the object type map, so we can distinguish small vs large objects. Large
objects can split across chunks, so we need to add each large object's
chunk as it is allocated.

(bmalloc::Heap::tryAllocateLarge):
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::isLarge):
(bmalloc::Heap::largeSize):
(bmalloc::Heap::shrinkLarge):
(bmalloc::Heap::deallocateLarge): Merged in existing XLarge logic for
large objects.

(bmalloc::Heap::scavengeXLargeObjects): Deleted.
(bmalloc::Heap::allocateXLarge): Deleted.
(bmalloc::Heap::tryAllocateXLarge): Deleted.
(bmalloc::Heap::xLargeSize): Deleted.
(bmalloc::Heap::shrinkXLarge): Deleted.
(bmalloc::Heap::deallocateXLarge): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::LargeObjectHash::hash):

bmalloc/LargeObject.h: Removed.

bmalloc/Map.h: Added.

(bmalloc::Map::size):
(bmalloc::Map::capacity):
(bmalloc::Map::get):
(bmalloc::Map::set):
(bmalloc::Map::remove):
(bmalloc::Map::shouldGrow):
(bmalloc::Map::shouldShrink):
(bmalloc::Map::find):
(bmalloc::Hash>::rehash): Simple hash table.

bmalloc/Object.h:

bmalloc/ObjectType.cpp:

(bmalloc::objectType):

bmalloc/ObjectType.h:

(bmalloc::mightBeLarge): See deallocateSlowCase.
(bmalloc::isXLarge): Deleted.

bmalloc/SegregatedFreeList.cpp: Removed.
bmalloc/SegregatedFreeList.h: Removed.

bmalloc/Sizes.h: Upped smallMax to 64kB. Upping to 32kB is pretty

reasonable, since sizes between 16kB and 32kB share page sizes. I went
all the way up to 64kB because the GC uses 64kB blocks, and also just
for extra padding to ensure that large allocations are indeed rare.

bmalloc/SortedVector.h: Removed.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::tryAllocateLargeChunk):
(bmalloc::VMHeap::allocateSmallChunk):
(bmalloc::VMHeap::VMHeap): Deleted.
(bmalloc::VMHeap::allocateChunk): Deleted.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::deallocateSmallPage):
(bmalloc::VMHeap::allocateLargeObject): Deleted.
(bmalloc::VMHeap::deallocateLargeObject): Deleted. Nixed all the boundary
tag logic since metadata is out of line now.

bmalloc/VMState.h: Removed. Instead of an abstract state, we track

the precise amount of committed physical pages at the head of a VM
range. This allows us to merge aggressively without triggering an madvise
storm most of the time.

bmalloc/Vector.h:

(bmalloc::Vector<T>::Vector):
(bmalloc::Vector<T>::insert):
(bmalloc::Vector<T>::remove):
(bmalloc::Vector<T>::resize): Filled out some missing helpers.

bmalloc/XLargeMap.cpp:

(bmalloc::XLargeMap::remove):
(bmalloc::XLargeMap::add):
(bmalloc::XLargeMap::removePhysical):
(bmalloc::XLargeMap::takeFree): Deleted.
(bmalloc::XLargeMap::addFree): Deleted.
(bmalloc::XLargeMap::addAllocated): Deleted.
(bmalloc::XLargeMap::getAllocated): Deleted.
(bmalloc::XLargeMap::takeAllocated): Deleted.
(bmalloc::XLargeMap::shrinkToFit): Deleted.
(bmalloc::XLargeMap::takePhysical): Deleted.
(bmalloc::XLargeMap::addVirtual): Deleted.

bmalloc/XLargeMap.h:

(bmalloc::XLargeMap::Allocation::operator<): Deleted. We don't track
object sizes anymore -- just free space. (The Heap tracks object sizes.)
We use plain old linear search for free space. (See intro.)

bmalloc/XLargeRange.h:

(bmalloc::XLargeRange::physicalSize):
(bmalloc::XLargeRange::setPhysicalSize):
(bmalloc::merge):
(bmalloc::XLargeRange::split):
(bmalloc::XLargeRange::vmState): Deleted.
(bmalloc::XLargeRange::setVMState): Deleted. See VMState.h.

8:47 AM Changeset in webkit [200022] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199727 - [Cairo] GraphicsContext::drawFocusRing methods are not consistent to each other
https://bugs.webkit.org/show_bug.cgi?id=156742

Reviewed by Martin Robinson.

We are rendering the focus ring differently depending on whether a path is used or a vector of rectangles. This
is causing that some reftests fail because they assume we always render the focus ring the same way. For example
fast/images/image-map-outline-in-positioned-container.html, when rendering the test
GraphicsContext::drawFocusRing is called with a path, and when rendering the reference it's called with a vector
of rectangles, producing different results.

platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::drawFocusRing): When receiving a vector of rectangles, build a Path from the given
rectangles and call drawFocusRing() with the built path to ensure consistency.

8:46 AM Changeset in webkit [200021] by Carlos Garcia Campos

4 edits
1 add in releases/WebKitGTK/webkit-2.12

Merge r199715 - [GTK] accessibility/gtk/entry-and-password.html is failing since r194847
https://bugs.webkit.org/show_bug.cgi?id=153062

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The changes in r194847 include using WebCore's rendering for the CapsLock indicator.
As a side effect, password inputs gained a TextControlInnerTextElement child from
the Shadow DOM. If we include that child in the accessibility tree, the child will
emit focus and text notifications that suggest the user is no longer in the control.
This can be especially problematic for screen reader users with key echo enabled
when typing in a password input. To fix this, prune TextControlInnerTextElement
children from the accessibility tree for ATK.

No new tests as existing coverage caught this regression. Also modified the
auto-fill-crash.html test whose expectations include the children count for
a text input.

accessibility/atk/AccessibilityObjectAtk.cpp:

(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

LayoutTests:

The auto-fill-crash.html test has expectations which include the children
count for the text input. These expectations were incorrect for ATK where
accessible text inputs lack accessible text children.

accessibility/auto-fill-crash.html: Modified to take platform into account.
platform/gtk/TestExpectations: Unskipped entry-and-password.html.
platform/gtk/accessibility/auto-fill-crash-expected.txt: Added.

8:41 AM Changeset in webkit [200020] by Carlos Garcia Campos

14 edits in releases/WebKitGTK/webkit-2.12

Merge r199703 - [GTK] Possible off-by-one in hyphenation code
https://bugs.webkit.org/show_bug.cgi?id=156661

Patch by Martin Robinson <mrobinson@igalia.com> on 2016-04-18
Reviewed by Michael Catanzaro.

Source/WebCore:

No new tests. This is covered by older tests.

platform/text/hyphen/HyphenationLibHyphen.cpp:

(WebCore::lastHyphenLocation): Fix an off by one error in hyphen location.

LayoutTests:

platform/gtk/TestExpectations: Unskip a test that is now passing.
platform/gtk/fast/text/hyphenate-character-expected.png:
platform/gtk/fast/text/hyphenate-character-expected.txt:
platform/gtk/fast/text/hyphenate-first-word-expected.png:
platform/gtk/fast/text/hyphenate-first-word-expected.txt:
platform/gtk/fast/text/hyphenate-limit-before-after-expected.png:
platform/gtk/fast/text/hyphenate-limit-before-after-expected.txt:
platform/gtk/fast/text/hyphenate-limit-lines-expected.png:
platform/gtk/fast/text/hyphenate-limit-lines-expected.txt:
platform/gtk/fast/text/hyphenate-locale-expected.png:
platform/gtk/fast/text/hyphenate-locale-expected.txt:

8:39 AM Changeset in webkit [200019] by Carlos Garcia Campos

8 edits in releases/WebKitGTK/webkit-2.12

Merge r199696 - Remove support for X-Frame-Options in <meta>
https://bugs.webkit.org/show_bug.cgi?id=156625
<rdar://problem/25748714>

Rubberstamped by Darin Adler.

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Revise messaging based on Darin's comments.

8:34 AM Changeset in webkit [200018] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199670 - [l10n] Updated Greek translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156677

Patch by Tom Tryfonidis <tomtryf@gmail.com> on 2016-04-18
Rubber-stamped by Michael Catanzaro.

el.po:

8:32 AM Changeset in webkit [200017] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199664 - Pending API Request URL is wrong after reloading
https://bugs.webkit.org/show_bug.cgi?id=139342

Reviewed by Darin Adler.

Source/WebKit2:

It happens when reloading a web view loaded with anything but a
URL, because the bf list is not updated for those cases and
WebPageProxy::reload() is setting the current bf list item URL as
pending API request URL. This also causes that progress is
reported wrongly, because
WebPageProxy::decidePolicyForNavigationAction() resets the pending
API request URL when it's different than the requested URL. The
page load transaction causes the progress to be changed, reporting
1.0 (the previous one), but later something < 1.0 is reported
again by the progress tracker.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::reload): Use the current active URL as
pending API request URL, falling back to the current bf list item
URL when empty.

Tools:

Update test case to check that the active URL should remain the
same after a reload.

TestWebKitAPI/Tests/WebKit2/PendingAPIRequestURL.cpp:

(TestWebKitAPI::TEST):

8:31 AM Changeset in webkit [200016] by Carlos Garcia Campos

7 edits
1 add in releases/WebKitGTK/webkit-2.12

Merge r199660 - Pending API request URL no set when loading Data, Alternate HTML or plain text
https://bugs.webkit.org/show_bug.cgi?id=136916

Reviewed by Darin Adler.

Source/WebKit2:

Set pending API request URL for all load methods in
WebPageProxy. This ensures that right after calling those methods,
the active URL is the requested one and that
PageLoadState::isLoading() returns true.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::loadAlternateHTMLString):
(WebKit::WebPageProxy::loadPlainTextString):
(WebKit::WebPageProxy::loadWebArchiveData):

Tools:

Add new test to check that active URL is the requested one right
after calling WKPage load methods.

TestWebKitAPI/PlatformEfl.cmake:
TestWebKitAPI/PlatformGTK.cmake:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2/PendingAPIRequestURL.cpp: Added.

(TestWebKitAPI::TEST):

TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp:

(WebViewTest::loadPlainText): Remove FIXME.
(WebViewTest::loadBytes): Ditto.
(WebViewTest::loadAlternateHTML): Ditto.

8:30 AM Changeset in webkit [200015] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199659 - [GTK] Menu list button doesn't use the text color from the theme
https://bugs.webkit.org/show_bug.cgi?id=118234

Reviewed by Darin Adler.

ManualTests/gtk/theme.html: Add a disabled combo test.

Source/WebCore:

Set the combo box color accroding to the theme when adjusting the menu list style like Mac port does.

rendering/RenderThemeGtk.cpp:

(WebCore::menuListColor):
(WebCore::RenderThemeGtk::adjustMenuListStyle):

8:23 AM Changeset in webkit [200014] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r199653 - [GTK] Test /webkit2/WebKitWebView/mouse-target fails with overlay scrollbars
https://bugs.webkit.org/show_bug.cgi?id=156621

Reviewed by Martin Robinson.

This is a problem of the test itself, we are using an overflow that is not actually scrollable, but that shows
scrollbar troughs when not using overlay scrollbars because it's marked as scrollable. It would be easier to
simply use the main frame scrollbars to test that and it will work no matter of scrollbars are overlay or not.

TestWebKitAPI/Tests/WebKit2Gtk/TestUIClient.cpp:

(testWebViewMouseTarget): Remove the div and move the mouse over the main frame scrollbar to test scrolbars hit test.

8:15 AM Changeset in webkit [200013] by Carlos Garcia Campos

11 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199637 - Localization files with empty Language: block build with gettext 0.19
https://bugs.webkit.org/show_bug.cgi?id=133611

Reviewed by Darin Adler.

Fix the language tags. Note that the build error is not actually important here as it only
occurs with an older version of gettext, but presumably it's bad for the language tags to be
wrong.

as.po:
en_CA.po:
gu.po: Also correct the translation team to Gujarati.
hu.po:
id.po:
ko.po:
lv.po:
pa.po:
ru.po:
sl.po:

8:14 AM Changeset in webkit [200012] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199629 - [GTK] [l10n] Updated Turkish translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156667

Patch by Muhammet Kara <muhammetk@gmail.com> on 2016-04-16
Rubber-stamped by Michael Catanzaro.

tr.po:

8:13 AM Changeset in webkit [200011] by Carlos Garcia Campos

1 edit
1 add in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199624 - Submit the first version of Finnish translation
https://bugs.webkit.org/show_bug.cgi?id=153406

Patch by Jiri Grönroos <jiri.gronroos+l10n@iki.fi> on 2016-04-16
Rubber-stamped by Michael Catanzaro. For FINLAN.

fi.po: Added. Note it's pretty incomplete as of yet.

8:12 AM Changeset in webkit [200010] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199623 - [GTK] [l10n] Updated Bulgarian translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156656

Patch by Zahari Yurukov <zahari.yurukov@gmail.com> on 2016-04-16
Rubber-stamped by Michael Catanzaro.

bg.po:

6:49 AM Changeset in webkit [200009] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199607 - ASSERT when loading github.com
https://bugs.webkit.org/show_bug.cgi?id=156604
<rdar://problem/19890634>

Reviewed by Darin Adler.

Source/WebCore:

HTMLFormControlElement::m_isValid is a cache of the results of the valid() function.
When cloning the node, we were preserving each individual item, but not the state
of the cache. Therefore, the cache and the attributes didn't agree with each other.

Test: fast/forms/checkValidity-cloneNode-crash.html

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement):

LayoutTests:

fast/forms/checkValidity-cloneNode-crash-expected.txt: Added.
fast/forms/checkValidity-cloneNode-crash.html: Added.

6:42 AM Changeset in webkit [200008] by Carlos Garcia Campos

8 edits
6 moves
4 adds
4 deletes in releases/WebKitGTK/webkit-2.12

Merge r199605 - Remove support for X-Frame-Options in <meta>
https://bugs.webkit.org/show_bug.cgi?id=156625
<rdar://problem/25748714>

Reviewed by Darin Adler.

Source/WebCore:

Follow RFC7034 (Section 4), which recommends that 'X-Frame-Options' be ignored when delivered as part of
a '<meta http-equiv="...">' tag. This brings us in line with Firefox, Edge, and Blink.

Tests: http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html

http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Log error message instead of blocking the load.

LayoutTests:

Revise tests to match our desired behavior based on RFC 7034 (Section 4).

http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html:
http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html:
http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html:
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-expected.txt: Removed.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Added.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Copied from LayoutTests/http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html: Removed.
inspector/console/x-frame-options-message-expected.txt: Rebaselined.
platform/win/TestExpectations:

6:31 AM Changeset in webkit [200007] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r199599 - Mark NetworkLoad as FastAllocated
https://bugs.webkit.org/show_bug.cgi?id=156628

Reviewed by Alex Christensen.

Mark NetworkLoad as FastAllocated for performance.

NetworkProcess/NetworkLoad.h:

6:30 AM Changeset in webkit [200006] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199598 - Calling SVGAnimatedPropertyTearOff::animationEnded() will crash if the SVG property is not animating
https://bugs.webkit.org/show_bug.cgi?id=156549

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-04-15
Reviewed by Darin Adler.

A speculative fix for a crash which may happen when calling animationEnded()
of any SVGAnimatedProperty while it is not animating.

svg/SVGAnimatedTypeAnimator.h:

(WebCore::SVGAnimatedTypeAnimator::executeAction):

6:27 AM Changeset in webkit [200005] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r199586 - Tail call optimizations lead to crashes on ARM Thumb + Linux
https://bugs.webkit.org/show_bug.cgi?id=150083

Patch by Zan Dobersek <zdobersek@igalia.com> on 2016-04-15
Reviewed by Csaba Osztrogonác.

assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
data location of the destination, and not the executable address. This is needed for
the ARM Thumb2 platform where both the source and destination addresses of a jump relink
must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().

jit/Repatch.cpp:

(JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().

6:13 AM Changeset in webkit [200004] by Carlos Garcia Campos

8 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199585 - Selection.deleteFromDocument should not leave a selection character
https://bugs.webkit.org/show_bug.cgi?id=151442

Reviewed by Michael Catanzaro.

Source/WebCore:

This is a merge of Blink r172511:
https://codereview.chromium.org/255453003

Let Selection.deleteFromDocument not delete a character when the
selection is a caret.

Selection.deleteFromDocument delete a character when the selection
is a caret.
However, current standard says that Selection.deleteFromDocument
does nothing when the selection is a caret:
https://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#dom-selection-deletefromdocument
Both IE10 and FireFox seem following the spec.

Test: imported/blink/editing/selection/deleteFromDocument-undo-crash.html

page/DOMSelection.cpp:

(WebCore::DOMSelection::deleteFromDocument): Deleted.

LayoutTests:

editing/selection/deleteFromDocument-expected.txt:
editing/selection/deleteFromDocument.html:
imported/blink/editing/selection/deleteFromDocument-undo-crash-expected.txt: Added.
imported/blink/editing/selection/deleteFromDocument-undo-crash.html: Added.
TestExpectations: Skip imported/blink/editing/selection/deleteFromDocument-undo-crash.html in Debug.
platform/gtk/TestExpectations: Unskip imported/blink/editing/selection/deleteFromDocument-crash.html.
platform/win/TestExpectations: Ditto.

6:08 AM Changeset in webkit [200003] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199561 - CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::CachedResource::addClientToSet + 27
https://bugs.webkit.org/show_bug.cgi?id=156602
<rdar://problem/18921091>

Reviewed by Simon Fraser.

Source/WebCore:

The CSS property list-style-image is inherited, so a transition on a parent
might cause a transition on a child. On that child, the value might be between
two generated crossfade images which haven't yet resolved, causing a crash.

Test: transitions/crossfade-transition.html

css/CSSCrossfadeValue.cpp:

(WebCore::CSSCrossfadeValue::blend): Return null if there are no cached images.

page/animation/CSSPropertyAnimation.cpp:

(WebCore::blendFunc): If we don't have an actual image to blend between, fall
out to the default case.

LayoutTests:

Tests that an animation between two inherited crossfade elements will not crash.

transitions/crossfade-transition-expected.txt: Added.
transitions/crossfade-transition.html: Added.

6:04 AM Changeset in webkit [200002] by Carlos Garcia Campos

5 edits
6 adds
2 deletes in releases/WebKitGTK/webkit-2.12

Merge r199553 - Allow listbox content and scrollbar to intrude padding area.
https://bugs.webkit.org/show_bug.cgi?id=128489

Reviewed by Myles C. Maxfield.

Source/WebCore:

Originally when the RenderListBox::controlClipRect method was implemented (see [1]), it used
to allow its content (<option>'s) to intrude padding to get rendered. Overlay scrollbars were also
allowed to paint over the padding area, if necessary.

[2] changed this behavior to restrict list-box'es content within the content box rect (excluding padding and border).

This had two consequences:
1) it made WebKit disallow list-box' content to intrude the padding area, diverging from other vendors.
like Firefox and Chrome.
2) Since overlay scrollbar might get painted over the padding area, if any, [2] could result
in the scrollbar being clipped out if padding-right is set (or padding-left in case of RTL content).

Patch changed WebKit back so that it allows list-box' content and overlay scrollbars to intrude the
padding area, matching other browsers vendors

[1] https://trac.webkit.org/changeset/18819/trunk/WebCore/rendering/RenderListBox.cpp
[2] https://trac.webkit.org/changeset/19037/trunk/WebCore/rendering/RenderListBox.cpp

Tests: fast/forms/listbox-selection-3.html

fast/forms/listbox-padding-clip-selected.html
fast/forms/listbox-padding-clip-expected-mismatch.html (renamed from listbox-padding-clip-overlay-expected.html)
fast/forms/listbox-padding-clip-overlay-expected-mismatch.html (renamed from listbox-padding-clip-expected.html)

rendering/RenderListBox.cpp:

(WebCore::RenderListBox::numVisibleItems): changed to allow list-box items to get rendered on the padding-bottom area.
This matches Firefox and Chrome.
(WebCore::RenderListBox::listIndexAtOffset): relax the check for a given list-box item at a specific offset in the vertical axis.
This means if an list-box item has its content painted into the padding-bottom area, it will be actionable by mouse clicking.
This matches Firefox and Chrome.
(WebCore::RenderListBox::controlClipRect): clips list-box content against the padding box rect rather than the content box rect,
to allow its list-box items' content intrude the padding area.
This matches Firefox and Chrome.

LayoutTests:

fast/forms/listbox-selection-3-expected.txt: Added.
fast/forms/listbox-selection-3.html: Added.
fast/forms/listbox-padding-clip-selected.html: Added.
fast/forms/listbox-padding-clip-selected-expected.html: Added.
fast/forms/listbox-padding-clip-expected-mismatch.html: Renamed from listbox-padding-clip-overlay-expected.html.
fast/forms/listbox-padding-clip-overlay-expected-mismatch.html: Renamed from listbox-padding-clip-expected.html.

6:04 AM Changeset in webkit [200001] by Carlos Garcia Campos

1 edit
4 adds in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r199086 - Test listbox clipping to contents rect
https://bugs.webkit.org/show_bug.cgi?id=156265

Reviewed by Simon Fraser.

These tests create some <select><option></option></select>s with padding.
These list boxes use the zapfino "f" character (because it draws wildly
far outside of its layout box) to create a case where text inside the list
box would naturally intersect with the padding. This overflow should be
clipped so that the padding is undisturbed.

fast/forms/listbox-padding-clip-expected.html: Added.
fast/forms/listbox-padding-clip-overlay-expected.html: Added.
fast/forms/listbox-padding-clip-overlay.html: Added.
fast/forms/listbox-padding-clip.html: Added.
platform/ios-simulator/TestExpectations: Skip on iOS

5:54 AM Changeset in webkit [200000] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199552 - Collapsed border cache invalidation can lead to O(n^{2) during style resolve

https://bugs.webkit.org/show_bug.cgi?id=156570}

Reviewed by Darin Adler.

RenderTable::invalidateCollapsedBorders traverses all cells. It is called when table cell border changes.
This can result in O(n^{2) during style resolve.}

rendering/RenderTable.cpp:

(WebCore::RenderTable::layout):
(WebCore::RenderTable::invalidateCollapsedBorders):

For cell border style change invalidate the hasEmptyCollapsedBorder bits only for the neighbouring cells.
They are the only ones that can be affected.

rendering/RenderTable.h:

(WebCore::RenderTable::collapsedBordersAreValid):
(WebCore::RenderTable::collapsedEmptyBorderIsPresent):
(WebCore::RenderTable::currentBorderValue):

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::styleDidChange):

5:50 AM Changeset in webkit [199999] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199516 - Text on compositing layer with negative letter-spacing is truncated.
https://bugs.webkit.org/show_bug.cgi?id=156550
<rdar://problem/24212140>

Reviewed by Antti Koivisto.

Negative letter-spacing affects the right edge of content's visual overflow (for both RTL and LTR).
This is similar to how normal line layout adjusts it at InlineFlowBox::addTextBoxVisualOverflow().

Source/WebCore:

Test: fast/text/negative-letter-spacing-visual-overflow.html

rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::computeOverflow):
(WebCore::SimpleLineLayout::paintFlow):
(WebCore::SimpleLineLayout::collectFlowOverflow):

LayoutTests:

fast/text/negative-letter-spacing-visual-overflow-expected.html: Added.
fast/text/negative-letter-spacing-visual-overflow.html: Added.

5:48 AM Changeset in webkit [199998] by Carlos Garcia Campos

7 edits
4 adds in releases/WebKitGTK/webkit-2.12

Merge r199512 - Non-resizable text field looks resizable
https://bugs.webkit.org/show_bug.cgi?id=152271

Reviewed by Darin Adler.

Source/WebCore:

The 'resizability' of an HTML element is controlled by its 'resize' CSS property value.
By default it is 'none', but certain HTML elements, including <textarea>, have it
set to 'both' by default (defined in html.css). These values mean no resize at all, and
resizable in both vertical and horizontal axis, respectively.
Additionally, 'vertical' and 'horizontal' values are also valid.

Problem here is that the way WebKit handles the 'resize' property on single line
input elements (e.g. <input>) is different than other engines (read Gecko, Blink and Presto):

Match: WebKit, Firefox, Presto and Blink all force single line input elements to be non-resizable,

regardless of either the 'resize' properly is set or not.

Mismatch: WebKit is the only engine that actually paints the resize control on single line

input elements, even it having no effect.

On WebKit, this happens because the 'resize' property is wrongly implemented as 'inheritable',
differently from other engines. In the way WebKit contructs its RenderTree, 'resize' property
ends up spilling out of <input> and entering its shadow representation, carrying the 'resize'
property on.

Patch fixes this by making the 'resize' properly be non-inherited, matching other vendors
and the spec [1].

[1] https://drafts.csswg.org/css-ui/#resize

Tests: fast/css/resize-not-inherited.html

fast/css/resize-single-line-input-no-paint.html

rendering/style/RenderStyle.h:
rendering/style/StyleRareInheritedData.cpp:

(WebCore::StyleRareInheritedData::StyleRareInheritedData):
(WebCore::StyleRareInheritedData::operator==):

rendering/style/StyleRareInheritedData.h:
rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):

rendering/style/StyleRareNonInheritedData.h:

LayoutTests:

fast/css/resize-not-inherited-expected.html: Added.
fast/css/resize-not-inherited.html: Added.
fast/css/resize-single-line-input-no-paint-expected.html: Added.
fast/css/resize-single-line-input-no-paint.html: Added.

5:36 AM Changeset in webkit [199997] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199385 - Fixed uninitialization of Node::DataUnion with GCC 4.8.
https://bugs.webkit.org/show_bug.cgi?id=156507

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-04-12
Reviewed by Michael Catanzaro.

This change fixes run time crashes caused by access to uninitialized
memory in Node::renderer().

No new tests needed.

dom/Node.h:

5:17 AM Changeset in webkit [199996] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199313 - fast/loader/opaque-base-url.html crashing during mac and ios debug tests
https://bugs.webkit.org/show_bug.cgi?id=156179
<rdar://problem/25507719>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Navigate to about:blank if the provided src of an iframe/frame cannot be
resolved to a valid URL.

Test: fast/loader/iframe-src-invalid-url.html

loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::requestFrame):

LayoutTests:

fast/loader/iframe-src-invalid-url-expected.txt: Added.
fast/loader/iframe-src-invalid-url.html: Added.

5:14 AM Changeset in webkit [199995] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199304 - REGRESSION (r193857): Text selection causes text to disappear.
https://bugs.webkit.org/show_bug.cgi?id=156448
rdar://problem/25578952

Reviewed by Simon Fraser.

Apparently when the end position of the selection range is smaller than the start position, we need
to repaint the entire text as it indicates selection clearing.

Source/WebCore:

Test: fast/text/text-disappear-on-deselect.html

rendering/TextPainter.cpp:

(WebCore::TextPainter::paintText):

LayoutTests:

fast/text/text-disappear-on-deselect-expected.html: Added.
fast/text/text-disappear-on-deselect.html: Added.

5:11 AM Changeset in webkit [199994] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199278 - Fixed compilation of JPEGImageDecoder with libjpeg v9.
https://bugs.webkit.org/show_bug.cgi?id=156445

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-04-09
Reviewed by Michael Catanzaro.

ICU defines TRUE and FALSE macros, breaking libjpeg v9 headers.

No new tests needed.

platform/image-decoders/jpeg/JPEGImageDecoder.h:

5:01 AM Changeset in webkit [199993] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199243 - Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338

Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.

Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.

platform/graphics/filters/FEComposite.cpp:

(WebCore::clampByte):
(WebCore::computeArithmeticPixels):

4:57 AM Changeset in webkit [199992] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r199204 - Clearing the application cache doesn't work.
https://bugs.webkit.org/show_bug.cgi?id=156354
rdar://problem/22369239

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-04-07
Reviewed by Brady Eidson.

Use the correct "ApplicationCache" directory.
Delete the caches, not just the entries.

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::fetchData):
(WebKit::WebsiteDataStore::removeData):

4:21 AM Changeset in webkit [199991] by Carlos Garcia Campos

11 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199181 - Wheel event callback removing the window causes crash in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=150871
<rdar://problem/23418283>

Reviewed by Simon Fraser.

Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

The new test triggered a cross-load side-effect, where wheel event filtering wasn't
reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
which resets the filtering.

Since the Frame destructor invokes EventHandler::clear, which invokes MainFrame methods,
we run the risk of attempting to dereference destroyed MainFrame elements of the current
Frame object. Instead, clear the EventHandler in the MainFrame destructor.

Finally, confirm that the mainFrame member is not being destroyed in the handful of
places that might attempt to access the mainFrame during object destruction (essentially
cleanup methods).

Test: fast/events/wheel-event-destroys-frame.html

loader/FrameLoader.cpp:

(WebCore::FrameLoader::clear): Protect against accessing mainFrame content during destruction.

page/EventHandler.cpp:

(WebCore::EventHandler::clear): Call 'clearLatchedState' instead of endFilteringDeltas.
(WebCore::EventHandler::clearLatchedState): Null-check the filter before calling it.

page/Frame.cpp:

(WebCore::Frame::~Frame): Do not call 'setView' in the destructor for a MainFrame.
(WebCore::Frame::setView): Check for a null event handler before invoking it.
(WebCore::Frame::setMainFrameWasDestroyed): Added. Mark that the MainFrame
member of the Frame is being destroyed (if the current Frame is a MainFrame) and clear
the EventHandler member so that it doesn't attempt to access mainFrame content.
(WebCore::Frame::mainFrame): When accessing the mainFrame member, assert that the
mainFrame is not being destroyed.

page/MainFrame.cpp:

(WebCore::MainFrame::~MainFrame): Set the m_recentWheelEventDeltaFilter to nullptr to
prevent attempts to access it during object destruction. Call the new 'setMainFrameWasDestroyed'
method to reset eventHandler and mark the MainFrame as being in the process of destruction.

page/WheelEventDeltaFilter.cpp:

(WebCore::WheelEventDeltaFilter::filteredDelta): Add logging.

page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent): Add null check.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo): Add logging.

LayoutTests:

fast/events/wheel-event-destroys-frame-expected.txt: Added.
fast/events/wheel-event-destroys-frame.html: Added.
platform/ios-simulator/TestExpectations: Skip wheel-event test on iOS.

4:21 AM Changeset in webkit [199990] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199155 - FrameView::qualifiesAsVisuallyNonEmpty() returns false when loading a Google search results page before search results are loaded, even though the header is visible
https://bugs.webkit.org/show_bug.cgi?id=156339
<rdar://problem/24491381>

Reviewed by Andreas Kling.

Jeff's testing indicates lowering the document height threshold improves things visually during page loading.

page/FrameView.cpp:

(WebCore::FrameView::qualifiesAsVisuallyNonEmpty):

Lower document height threshold to from 200 to 48 pixels.

3:59 AM Changeset in webkit [199989] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199116 - CRASH in AudioDestinationNode::render()
https://bugs.webkit.org/show_bug.cgi?id=156308
<rdar://problem/25468815>

Reviewed by Eric Carlson.

AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
this bad state, ASSERT() and bail out early in this case.

Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.

Modules/webaudio/AudioDestinationNode.cpp:

(WebCore::AudioDestinationNode::render):

platform/audio/ios/AudioDestinationIOS.cpp:

(WebCore::AudioDestinationIOS::render):

3:32 AM Changeset in webkit [199988] by Carlos Garcia Campos

10 edits in releases/WebKitGTK/webkit-2.12

Merge r199110 - REGRESSION(r195463): [GTK] accessibility/roles-computedRoleString.html and accessibility/roles-exposed.html failing
https://bugs.webkit.org/show_bug.cgi?id=153696

Reviewed by Chris Fleizach.

Source/WebCore:

The failures were due to always mapping style format groups to GroupRole, even for
RenderInline objects. The fix is to expose inline style format groups as InlineRole,
add handling of GroupRole style groups to the ATK code, and InlineRole style groups
to the Mac code.

No new tests because we have sufficient coverage. Updated roles-computedRoleString.html
to reflect new exposure.

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::determineAccessibilityRole):

accessibility/atk/WebKitAccessibleWrapperAtk.cpp:

(atkRole):

accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(createAccessibilityRoleMap):
(-[WebAccessibilityObjectWrapper subrole]):

LayoutTests:

Now that RenderInline style format groups are exposed as InlineRole, there is
no longer a corresponding computed role for ins, samp, and var elements. Updated
the roles-computedRoleString.html test and expectations accordingly. Also added
the now-correct results for Gtk for both of the previously-failing tests.

accessibility/roles-computedRoleString-expected.txt: Updated.
accessibility/roles-computedRoleString.html: Updated.
platform/gtk/TestExpectations: Unskip the two tests which are now passing.
platform/gtk/accessibility/roles-computedRoleString-expected.txt: Updated.
platform/gtk/accessibility/roles-exposed-expected.txt: Updated.

3:30 AM Changeset in webkit [199987] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199107 - Implement operator== and operator!= for Optional<>
https://bugs.webkit.org/show_bug.cgi?id=156266

Reviewed by Anders Carlsson.
Source/WTF:

Implement non-member operator== and operator!= variants for Optional<>.

wtf/Optional.h:

(WTF::operator==):
(WTF::operator!=):

Tools:

TestWebKitAPI/Tests/WTF/Optional.cpp:

(TestWebKitAPI::TEST):

3:26 AM Changeset in webkit [199986] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from TextTrack
https://bugs.webkit.org/show_bug.cgi?id=156899

Reviewed by Chris Dumez.

No behavior changes.

html/track/TextTrack.idl: Marking cue and region parameter as nullable.

Also marking cues and activeCues as nullable attributes.

3:23 AM Changeset in webkit [199985] by youenn.fablet@crf.canon.fr

13 edits
3 adds in trunk

Drop [UsePointersEvenForNonNullableObjectArguments] from File API interfaces
https://bugs.webkit.org/show_bug.cgi?id=156898

Reviewed by Chris Dumez.

Source/WebCore:

Making FileReaderSync API API throwing a TypeError in case of null parameters, in lieu of a NOT_FOUND_ERR.
Making FileReader API taking nullable parameters as a temporary fix.

Test: fast/files/workers/worker-file-reader-sync-bad-parameter.html

Modules/websockets/WebSocketChannel.cpp:

(WebCore::WebSocketChannel::processOutgoingFrameQueue): Updated to cope with FileReaderLoader::start taking a Blob&.

fileapi/FileReader.cpp:

(WebCore::FileReader::readAsArrayBuffer): Updated to cope with readInternal taking a Blob&.
(WebCore::FileReader::readAsBinaryString): Ditto.
(WebCore::FileReader::readAsText): Ditto.
(WebCore::FileReader::readAsDataURL): Ditto.
(WebCore::FileReader::readInternal): Updated to cope with FileReaderLoader::start taking a Blob&.

fileapi/FileReader.h:
fileapi/FileReader.idl: Marking the readXX methods as taking a nullable blob parameter to keep compatibility, at least temporarily.
fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start): It now takes a Blob& as input.

fileapi/FileReaderLoader.h:
fileapi/FileReaderSync.cpp:

(WebCore::FileReaderSync::readAsArrayBuffer): Taking a Blob& as input.
(WebCore::FileReaderSync::readAsBinaryString): Ditto.
(WebCore::FileReaderSync::readAsText): Ditto.
(WebCore::FileReaderSync::readAsDataURL): Ditto.
(WebCore::FileReaderSync::startLoading) Ditto.

fileapi/FileReaderSync.h:

(WebCore::FileReaderSync::readAsText): Ditto.

fileapi/FileReaderSync.idl:

LayoutTests:

Checking FileReaderSync send method in case of null or undefined blob parameter.
worker-read-blob-sync.html and worker-read-file-sync check the case of badly typed parameters.
In all cases, TypeError is thrown.

fast/files/workers/resources/worker-file-reader-sync-bad-parameter.js: Added.

(test):

fast/files/workers/worker-file-reader-sync-bad-parameter-expected.txt: Added.
fast/files/workers/worker-file-reader-sync-bad-parameter.html: Added.
fast/files/workers/worker-read-blob-sync-expected.txt: Rebasing expectation.
fast/files/workers/worker-read-file-sync-expected.txt: Ditto.

3:08 AM Changeset in webkit [199984] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199113 - Add ASSERT_WITH_SECURITY_IMPLICATION when a float box is referenced by multiple RootInlineBoxes.
https://bugs.webkit.org/show_bug.cgi?id=156297
<rdar://problem/25580844>

Reviewed by Brent Fulgham.

See http://trac.webkit.org/changeset/199101

No change in functionality.

rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
(WebCore::RenderBlockFlow::reattachCleanLineFloats):
(WebCore::RenderBlockFlow::determineStartPosition):

3:07 AM Changeset in webkit [199983] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199101 - ASSERTION FAILED: !floatingObject->originatingLine() in WebCore::RenderBlockFlow::linkToEndLineIfNeeded
https://bugs.webkit.org/show_bug.cgi?id=153001

Reviewed by Dan Bernstein.

Float boxes are always attached to the line where we see them first.
Float box can only be attached to one line.
RenderBlockFlow can perform partial layout on dirty lines only.

In certain cases, the last dirty line can "pull up" float boxes from the first clean line.
It simply means that due to some layout changes on previous lines now we see those floats on this last dirty line first.
If after placing the float we still find it on the same position, the line below is still considered clean.
Source/WebCore:

Remove the float box from its original line if the line above already placed it.

Test: fast/block/float/float-moves-between-lines.html

rendering/RenderBlockFlow.h:
rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::reattachCleanLineFloats):
(WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
(WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange): Deleted.

LayoutTests:

Remove the float box from its original line if the line above already placed it.

fast/block/float/float-moves-between-lines-expected.txt: Added.
fast/block/float/float-moves-between-lines.html: Added.

3:03 AM Changeset in webkit [199982] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199100 - [GTK] [l10n] Updated Italian translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156283

Patch by Milo Casagrande <milo@milo.name> on 2016-04-06
Rubber-stamped by Michael Catanzaro.

it.po:

2:54 AM Changeset in webkit [199981] by Manuel Rego Casasnovas

5 edits
2 adds in trunk

[css-grid] Fix grid-template-columns|rows computed style with content alignment
https://bugs.webkit.org/show_bug.cgi?id=156793

Reviewed by Darin Adler.

Source/WebCore:

Computed style of grid-template-columns and grid-template-rows properties
was including the distribution offset because of content alignment.
We should subtract that offset, like we do for the case of gaps,
when we're calculating the computed style.

Test: fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html

css/CSSComputedStyleDeclaration.cpp:

(WebCore::valueForGridTrackList):

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::offsetBetweenTracks):
(WebCore::RenderGrid::populateGridPositions): Deleted FIXME.

rendering/RenderGrid.h:

LayoutTests:

fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment-expected.txt: Added.
fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html: Added.

2:50 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:49 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:46 AM Changeset in webkit [199980] by fred.wang@free.fr

19 edits
8 adds
4 deletes in trunk

Refactor RenderMathMLMenclose.
https://bugs.webkit.org/show_bug.cgi?id=155019

Patch by Frederic Wang <fwang@igalia.com> on 2016-04-25
Reviewed by Sergio Villar Senin.

Source/WebCore:

Tests: mathml/presentation/menclose-notation-equivalence.html

mathml/presentation/menclose-notation-values.html

We rewrite RenderMathMLMenclose so that layout functions correctly override the
behavior of RenderMathMLRow. We try and rely on the draft of the MathML in HTML5
implementation note, to make easier to get consistency with other rendering engines
in the future. All notations are now drawn with GraphicContext functions instead of
mixing them with CSS style. To save memory space, the list of known notations are
now saved on a short integer using bit masks instead of a vector of string names.
Finally, we remove support for the radical notation so that we no longer need to
create an anonymous RenderMathMLRoot.

mathml/MathMLMencloseElement.cpp: Remove code for some special notations and just

reimplement parsing of the notation attribute.
(WebCore::MathMLMencloseElement::MathMLMencloseElement): By default, the notation is longdiv.
(WebCore::MathMLMencloseElement::parseAttribute): By default, the list of notation is empty.
If there is no notation attribute, the default value longdiv is used.
Otherwise, we parse the notation attribute and add each notation, using some equivalences
for box, actuarial and madruwb.
(WebCore::MathMLMencloseElement::isPresentationAttribute): Deleted. No need to define
specific style for some notation.
(WebCore::MathMLMencloseElement::finishParsingChildren): Deleted. No need to add an
anonymous square root.
(WebCore::MathMLMencloseElement::collectStyleForPresentationAttribute): Deleted. No need to
define specific style for some notation.
(WebCore::MathMLMencloseElement::longDivLeftPadding): Deleted. RenderMathMLMenclose uses an
arbitrary size instead of measure a glyph.

mathml/MathMLMencloseElement.h: Define simple bit mask for each notation, add a short

integer to store the list of notations together with helper functions. Remove old code.

rendering/mathml/RenderMathMLMenclose.cpp: Rewrite RenderMathMLMenclose so that layout

functions correctly override the behavior of RenderMathMLRow.
(WebCore::RenderMathMLMenclose::RenderMathMLMenclose): Init m_ascent to 0.
(WebCore::RenderMathMLMenclose::ruleThickness): For now, we use the fallback value used by
for other bars. We may refine that in the future.
(WebCore::RenderMathMLMenclose::getSpaceAroundContent): Helper function to retrieve the
space to add around the content, depending on the notations specified. Note that for
notation circle, this spacing depends on the content size.
(WebCore::RenderMathMLMenclose::computePreferredLogicalWidths): Reimplement this function.
This is just adding left/right spacing around the content.
(WebCore::RenderMathMLMenclose::layoutBlock): Reimplement this function. We do the normal
RenderMathMLRow layout, adjust spacing and child position and
calculate m_ascent and m_contentRect.
(WebCore::RenderMathMLMenclose::firstLineBaseline): Implement this function.
We just return m_ascent.
(WebCore::drawLine): Helper function to draw a line using strokePath.
(WebCore::RenderMathMLMenclose::paint): We reimplement this function to draw
all notations using GraphicContext.
(WebCore::RenderMathMLMenclose::addChild): Deleted. No need to manage anonymous renderers.
(WebCore::RenderMathMLMenclose::updateLogicalHeight): Deleted. Height is now calculated
in layoutBlock.
(WebCore::RenderMathMLMenclose::checkNotationalValuesValidity): Deleted.

rendering/mathml/RenderMathMLMenclose.h: Update member definitions.
rendering/mathml/RenderMathMLRoot.cpp: We no longer need anonymous roots.

(WebCore::RenderMathMLRoot::RenderMathMLRoot): Deleted.

rendering/mathml/RenderMathMLRoot.h: We no longer need anonymous roots.
rendering/mathml/RenderMathMLRow.cpp: Allow to get the exact metrics of the chid row,

for use in RenderMathMLRoot.
(WebCore::RenderMathMLRow::computeLineVerticalStretch): rename parameters.
(WebCore::RenderMathMLRow::layoutRowItems): Set parameters to the final ascent, descent and
logical width of the chid row. Set the temporary logical width for RenderMathMenclose before
laying the children out.
(WebCore::RenderMathMLRow::layoutBlock): Rename parameters ; add a dummy logicalWidth
parameter.

rendering/mathml/RenderMathMLRow.h: Make some functions accessible or overridable by

RenderMathMLRoot. Make layoutRowItems return the final ascent, descent and logical width
after the chid row is laid out.

rendering/mathml/RenderMathMLSquareRoot.cpp: We no longer need anonymous roots.

(WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot): Deleted.
(WebCore::RenderMathMLSquareRoot::createAnonymousWithParentRenderer): Deleted.

rendering/mathml/RenderMathMLSquareRoot.h: We no longer need anonymous roots.

LayoutTests:

mathml/presentation/menclose-notation-attribute-set1.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set1-expected.txt: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set2-expected-mismatch.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set2.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-values.html: Added.

This test verifies the rendering of various menclose notations.

mathml/presentation/menclose-notation-equivalence.html: Added.

This test verifies some equivalence for the notation attribute value.

mathml/presentation/menclose-notation-equivalence-expected.html: Added.
mathml/presentation/menclose-notation-radical.html: Update the test now that support for

the radical notation is removed.

mathml/presentation/menclose-notation-radical-expected.html: ditto.
platform/gtk/mathml/presentation/menclose-notation-default-longdiv-expected.png: Update

reference due to small changes in longdiv implementation.

platform/gtk/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto.
platform/mac/mathml/presentation/menclose-notation-default-longdiv-expected.png: ditto.
platform/mac/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto.
platform/ios-simulator/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto
platform/gtk/mathml/presentation/menclose-notation-values-expected.png: Added.
platform/gtk/mathml/presentation/menclose-notation-values-expected.txt: Added.
platform/mac/mathml/presentation/menclose-notation-values-expected.png: Added.
platform/mac/mathml/presentation/menclose-notation-values-expected.txt: Added.
platform/ios-simulator/mathml/presentation/menclose-notation-values-expected.txt: Added.

12:39 AM Changeset in webkit [199979] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.12

Merge r199099 - REGRESSION(r196629): Messages text size only changes for sending text, conversation text size does not change
https://bugs.webkit.org/show_bug.cgi?id=156287
<rdar://problem/24264756>

Reviewed by Andreas Kling.

Source/WebCore:

css/RuleFeature.cpp:

(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
(WebCore::makeAttributeSelectorKey):

Include attribute value to the key. Otherwise we may deduplicate selectors that are not indentical.

(WebCore::RuleFeatureSet::collectFeatures):
(WebCore::RuleFeatureSet::add):

Use HashMap::ensure().

css/RuleFeature.h:

LayoutTests:

fast/css/style-invalidation-attribute-change-descendants-expected.txt:
fast/css/style-invalidation-attribute-change-descendants.html:

12:07 AM WebKitGTK/Gardening/Calendar edited by Carlos Garcia Campos

(diff)

12:04 AM Changeset in webkit [199978] by fred.wang@free.fr

2 edits in trunk/Source/WebCore

Minor refactoring in RenderMathMLOperator
https://bugs.webkit.org/show_bug.cgi?id=156906

Patch by Frederic Wang <fwang@igalia.com> on 2016-04-25
Reviewed by Martin Robinson.

No new tests, this is only minor refactoring that does not change the behavior.

rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack):
We rename the "state" integer to an "expected" enum indicating the next expected part.
(WebCore::RenderMathMLOperator::paintGlyph): We add a missing dot at the end of a sequence.
We also replace ceil(x+1) with ceil(x)+1 to get rid of the temporary variable.

Apr 24, 2016:

11:34 PM Changeset in webkit [199977] by Hunseop Jeong

3 edits in trunk/Source/WebKit2

[EFL] Update the ewk_settings_offline_web_application_cache_enabled_get() expected value after r199854.
https://bugs.webkit.org/show_bug.cgi?id=156968

Reviewed by Gyuyoung Kim.

UIProcess/API/C/WKPreferencesRef.h: Update the comment.
UIProcess/API/efl/tests/test_ewk2_settings.cpp:

(TEST_F):

10:59 PM Changeset in webkit [199976] by Chris Dumez

19 edits
1 delete in trunk/Source/WebCore

[Web IDL] Specify default values for boolean parameters
https://bugs.webkit.org/show_bug.cgi?id=156964

Reviewed by Darin Adler.

Specify default values for boolean parameters in our IDL files and
let the bindings generator use WTF::Optional<> for the ones without
a default value.

CMakeLists.txt:
Modules/indexeddb/IDBKeyRange.cpp:
Modules/indexeddb/IDBKeyRange.h:
Modules/indexeddb/IDBKeyRange.idl:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSBindingsAllInOne.cpp:

bindings/js/JSDOMTokenListCustom.cpp: Removed.

We no longer need these custom bindings as the bindings generator
will now provide the implementation with an Optional<bool>, given
that the parameter has no default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameterType): Deleted.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_method_with_optional_boolean):
(webkit_dom_test_obj_method_with_optional_boolean_is_false):

bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):

bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj methodWithOptionalBoolean:]):
(-[DOMTestObj methodWithOptionalBooleanIsFalse:]):

bindings/scripts/test/TestObj.idl:
dom/Document.h:
dom/Document.idl:
dom/Element.idl:
dom/EventTarget.idl:
html/DOMTokenList.idl:

10:56 PM Changeset in webkit [199975] by Gyuyoung Kim

2 edits in trunk/LayoutTests

[EFL] Some media tests have been failed after bumping gstreamer ver.

Unreviewed EFL gardening. Mark failing tests to timeout or failure.

platform/efl/TestExpectations:

8:09 PM Changeset in webkit [199974] by Matt Baker

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Can't sort by name/source code location columns in Timeline data grids
https://bugs.webkit.org/show_bug.cgi?id=156965
<rdar://problem/25898716>

Reviewed by Timothy Hatcher.

Add support for sorting SourceCodeLocation objects to TimelineDataGrid,
and include a grid delegate so that views can extend sorting logic for
other document fragment columns.

UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
(WebInspector.NetworkTimelineView.prototype.dataGridSortComparator):
Sort "name" column by display name first, then resource URL.

UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView):
(WebInspector.ScriptDetailsTimelineView.prototype.dataGridSortComparator):
Sort "name" column by display name first, then subtitle.

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.get subtitle):
Make subtitle accessible externally for sorting.
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
(WebInspector.ScriptTimelineDataGridNode):

UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid):
(WebInspector.TimelineDataGrid.prototype.get sortDelegate):
(WebInspector.TimelineDataGrid.prototype.set sortDelegate):
Fire a SortChanged event if the delegate changed and the grid is sorted.
(WebInspector.TimelineDataGrid.prototype._sort):
If a sort delegate exists, and it returns a numeric value, skip the
default compare.

(WebInspector.TimelineDataGrid.prototype._sortComparator):
Add support for sorting SourceCodeLocation columns.

6:40 PM Changeset in webkit [199973] by Chris Dumez

2 edits in trunk/LayoutTests/imported/w3c

Unreviewed, revert part of r199970 that shouldn't have been committed.

web-platform-tests/IndexedDB/idbfactory_open9.htm:

6:17 PM WebKitIDL edited by Chris Dumez

Drop [Default] (diff)

6:03 PM Changeset in webkit [199972] by Matt Baker

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Error when selecting a bar in the Frames timeline
https://bugs.webkit.org/show_bug.cgi?id=156960
<rdar://problem/25897955>

Reviewed by Timothy Hatcher.

Fixes timeline grid node selection when record selected in the overview.
Adds general purpose findNode method to DataGrid.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype.findNode):
Basic find function for locating a grid node in linear time.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype._recordSelected):
Remove tree outline references, call generic select method.

UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView.prototype.selectRecord):
If a data grid was set, deselect current selection and select the node
associated with the timeline record.

5:59 PM Changeset in webkit [199971] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Events in JavaScript & Events timeline have no profile children
https://bugs.webkit.org/show_bug.cgi?id=156627
<rdar://problem/25749740>

Reviewed by Timothy Hatcher.

ProfileNodeDataGridNode should handle populate events when expanded.
This was previously done by ProfileNodeTreeElement, which is no longer
used in the Timelines tab.

UserInterface/Views/ProfileDataGridNode.js:

(WebInspector.ProfileDataGridNode.prototype._updateChildrenForModifiers):
(WebInspector.ProfileDataGridNode.prototype._populate):
(WebInspector.ProfileDataGridNode):
DataGridNode sets shouldRefreshChildren to false after populating
child nodes. No need to track with a separate flag.

UserInterface/Views/ProfileNodeDataGridNode.js:

(WebInspector.ProfileNodeDataGridNode):
(WebInspector.ProfileNodeDataGridNode.prototype._populate):

5:27 PM Changeset in webkit [199970] by Chris Dumez

23 edits in trunk

Autogenerated IDBFactory.open() does the wrong thing if you pass an explicit 'undefined' as the second argument
https://bugs.webkit.org/show_bug.cgi?id=156939

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Re-sync tests from upstream b1818929.

IndexedDB-private-browsing/idbfactory_open9-expected.txt:
IndexedDB-private-browsing/idbfactory_open9.html:
web-platform-tests/IndexedDB/idbfactory_open9-expected.txt:
web-platform-tests/IndexedDB/idbfactory_open9.htm:

Source/WebCore:

As per WebIDL, if undefined is passed by JS for an optional parameter then
we should use its default value if it has one, or use the special value
"missing":
http://heycam.github.io/webidl/#es-overloads (step 10.4)

Our bindings generator was already mapping undefined to the parameter's
default value when present. However, it was missing the notion of
"missing" value when there no default value. This patch adds supports
for its by passing Optional<>(Nullopt) to the implementation in such
case. This means that the implementation will need to use WTF::Optional<>
type for parameters that do not have a default value. Thankfully though,
in most cases, we will be able to specify a default value in the IDL
so cases where we will need to use WTF::Optional<> will actually be
rare.

To avoid having to do too much refactoring in this patch, the support
for WTF::Optional is currently blacklisted for most IDL types. I will
gradually stop blacklisting each type in follow-up patches, as I either:

Add default parameter values in our IDL (preferred)
Use WTF::Optional<> in our implementation (when we cannot specify a default value).

This patch fixes a bug with IDBFactory.open()'s second parameter (version)
for which undefined should not throw and indicate that the version
should not be changed. We now use WTF::Optional in the implementation to
distinguish this case and not throw.

No new tests, existing tests were updated / rebaselined.

Modules/indexeddb/IDBFactory.cpp:

(WebCore::IDBFactory::open):
(WebCore::IDBFactory::openInternal): Deleted.

Modules/indexeddb/IDBFactory.h:
bindings/scripts/CodeGeneratorJS.pm:

(ShouldUseWTFOptionalForParameterType):
(GenerateParametersCheck):

fileapi/Blob.idl:
inspector/InspectorIndexedDBAgent.cpp:

LayoutTests:

Update / rebaseline existing test now that passing undefined as second parameter to
IDBFactory.open() no longer throws.

storage/indexeddb/intversion-bad-parameters-expected.txt:
storage/indexeddb/intversion-bad-parameters-private-expected.txt:
storage/indexeddb/resources/intversion-bad-parameters.js:

(deleteSuccess):

10:23 AM Changeset in webkit [199969] by Chris Dumez

145 edits in trunk

[WebIDL] Drop [Default] WebKit-IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=156955

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline some tests now that a different exception type is thrown
for some of our APIs when passing null.

web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Drop [Default] WebKit-IDL extended attribute in favor of the standard
WebIDL syntax for parameters' default value.

Here is what it looks like:
[Default=NullString] optional DOMString a -> optional DOMString a = null
[Default=NullString] optional DOMString? a -> optional DOMString? a = null
[Default=Undefined] optional DOMString a -> optional DOMString a = "undefined"
[Default=Undefined] optional DOMString? a -> optional DOMString? a = null
[Default=Undefined] optional long a -> optional long a = 0
[Default=Undefined] optional bool a -> optional bool a = false
[Default=Undefined] optional unrestricted double a -> optional unrestricted double a = NaN
[Default=Undefined] optional unrestricted float a -> optional unrestricted float a = NaN
[Default=Undefined] optional sequence<DOMString> a -> optional sequence<DOMString> a = []

These do not cause any Web-Exposed behavior change. However, when getting
rid of [Default] started passing more parameters by derefence instead of
pointer (as is expected for parameters not marked as nullable). As a result,
I had to mark a few parameters as nullable in the IDL to maintain the
previous behavior. In some cases, the implementation was already throwing
when passing null. In such cases, I have not marked the type as nullable
so that the generated bindings now throw the exception instead of our
implementation code. In some cases, the exception being thrown is now
different. This is why some of the layout tests had to be rebaselined.

No new tests, existing tests have been rebaselined. No significant Web
exposed behavior change is expected from this patch, beside exceptions
type sometimes being different.

Modules/encryptedmedia/MediaKeys.idl:
Modules/fetch/FetchRequest.idl:
Modules/gamepad/deprecated/GamepadList.idl:
Modules/indexeddb/IDBDatabase.idl:
Modules/mediastream/RTCStatsResponse.idl:
Modules/notifications/Notification.idl:
Modules/speech/SpeechSynthesisUtterance.idl:
Modules/webaudio/AudioNode.idl:
Modules/websockets/WebSocket.idl:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateParametersCheck):

bindings/scripts/IDLAttributes.txt:
bindings/scripts/IDLParser.pm:

(parseDefault):
(parseDefaultValue):

bindings/scripts/test/TestInterface.idl:
bindings/scripts/test/TestNamedConstructor.idl:
bindings/scripts/test/TestObj.idl:
bindings/scripts/test/TestOverrideBuiltins.idl:
css/CSSKeyframesRule.idl:
css/CSSMediaRule.idl:
css/CSSPrimitiveValue.idl:
css/CSSRuleList.idl:
css/CSSStyleDeclaration.idl:
css/CSSStyleSheet.idl:
css/CSSSupportsRule.idl:
css/CSSValueList.idl:
css/MediaList.idl:
css/MediaQueryList.idl:
css/MediaQueryListListener.idl:
css/StyleMedia.idl:
css/StyleSheetList.idl:
css/WebKitCSSFilterValue.idl:
css/WebKitCSSMatrix.idl:
css/WebKitCSSTransformValue.idl:
dom/ClientRectList.idl:
dom/Comment.idl:
dom/CompositionEvent.idl:
dom/CustomEvent.h:
dom/CustomEvent.idl:
dom/DOMImplementation.idl:
dom/DOMStringList.idl:
dom/DataTransferItem.idl:
dom/DataTransferItemList.idl:
dom/DeviceMotionEvent.idl:
dom/DeviceOrientationEvent.idl:
dom/Document.cpp:

(WebCore::Document::adoptNode):

dom/Document.idl:
dom/Element.cpp:

(WebCore::Element::setAttributeNode):
(WebCore::Element::setAttributeNodeNS):
(WebCore::Element::removeAttributeNode):
(WebCore::Element::parseAttributeName): Deleted.

dom/Element.h:
dom/Element.idl:
dom/Event.idl:
dom/HashChangeEvent.idl:
dom/KeyboardEvent.idl:
dom/MessageEvent.idl:
dom/MouseEvent.idl:
dom/MutationEvent.idl:
dom/NamedNodeMap.cpp:

(WebCore::NamedNodeMap::setNamedItem):
(WebCore::NamedNodeMap::setNamedItemNS):
(WebCore::NamedNodeMap::item): Deleted.

dom/NamedNodeMap.h:
dom/NamedNodeMap.idl:
dom/Node.idl:
dom/NodeFilter.idl:
dom/NonElementParentNode.idl:
dom/OverflowEvent.idl:
dom/Range.idl:
dom/Text.idl:
dom/TextEvent.idl:
dom/TouchEvent.idl:
dom/UIEvent.idl:
dom/WheelEvent.idl:
html/DOMFormData.idl:
html/HTMLAllCollection.idl:
html/HTMLAudioElement.idl:
html/HTMLCanvasElement.idl:
html/HTMLCollection.idl:
html/HTMLDocument.idl:
html/HTMLElement.cpp:

(WebCore::HTMLElement::insertAdjacentElement):
(WebCore::contextElementForInsertion): Deleted.

html/HTMLElement.h:
html/HTMLElement.idl:
html/HTMLFormControlsCollection.idl:
html/HTMLInputElement.idl:
html/HTMLMediaElement.idl:
html/HTMLOptionElement.idl:
html/HTMLOptionsCollection.idl:
html/HTMLSelectElement.idl:
html/HTMLTableElement.idl:
html/HTMLTableRowElement.idl:
html/HTMLTableSectionElement.idl:
html/HTMLTextAreaElement.idl:
html/ImageData.idl:
html/canvas/CanvasGradient.idl:
html/canvas/CanvasRenderingContext2D.idl:
html/canvas/DOMPath.idl:
html/canvas/OESVertexArrayObject.idl:
page/DOMSelection.cpp:

(WebCore::DOMSelection::extend):
(WebCore::DOMSelection::getRangeAt): Deleted.

page/DOMSelection.h:
page/DOMSelection.idl:
page/DOMWindow.idl:
page/History.idl:
page/Performance.idl:
page/WindowTimers.idl:
plugins/DOMMimeTypeArray.idl:
plugins/DOMPlugin.idl:
plugins/DOMPluginArray.idl:
storage/StorageEvent.idl:
svg/SVGAnimationElement.idl:
svg/SVGDocument.idl:
svg/SVGElement.idl:
svg/SVGFEDropShadowElement.idl:
svg/SVGFEGaussianBlurElement.idl:
svg/SVGFEMorphologyElement.idl:
svg/SVGFilterElement.idl:
svg/SVGGraphicsElement.idl:
svg/SVGMarkerElement.idl:
svg/SVGPathElement.idl:
svg/SVGSVGElement.idl:
svg/SVGTests.idl:
svg/SVGTextContentElement.idl:
xml/DOMParser.idl:
xml/XMLSerializer.cpp:

(WebCore::XMLSerializer::serializeToString):

xml/XMLSerializer.h:
xml/XMLSerializer.idl:
xml/XPathEvaluator.idl:
xml/XPathExpression.idl:
xml/XPathNSResolver.idl:
xml/XPathResult.idl:
xml/XSLTProcessor.idl:

Tools:

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:

LayoutTests:

Rebaseline some tests now that a different exception type is thrown
for some of our APIs when passing null.

editing/selection/extend-expected.txt:
fast/dom/Element/attr-param-typechecking-expected.txt:
fast/dom/NamedNodeMap-setNamedItem-crash-expected.txt:
fast/dynamic/insertAdjacentElement-expected.txt:

10:07 AM Changeset in webkit [199968] by Yusuke Suzuki

3 edits in trunk/Source/JavaScriptCore

[JSC] Optimize JSON.parse string fast path
https://bugs.webkit.org/show_bug.cgi?id=156953

Reviewed by Mark Lam.

This patch further optimizes the string parsing fast path.
Previously, we generated the WTF::String to hold the ownership of the token's string.
And always copied the token in LiteralParser side.
Instead, we hold the ownership of the token String by the StringBuilder in LiteralParser::Lexer,
and remove the processing in the string parsing fast path.
This patch gives us stable 1 - 2.5% improvement in Kraken json-parse-financial.

Baseline Modified

json-parse-financial 41.383+-0.248 ^{40.894+-0.189} definitely 1.0120x faster

runtime/LiteralParser.cpp:

(JSC::LiteralParser<CharType>::tryJSONPParse):
(JSC::LiteralParser<CharType>::Lexer::lex):
(JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
(JSC::LiteralParser<CharType>::parse):
(JSC::LiteralParser<CharType>::Lexer::lexString): Deleted.

runtime/LiteralParser.h:

(JSC::LiteralParser::tryLiteralParse):
(JSC::LiteralParser::Lexer::currentToken):
(JSC::LiteralParser::Lexer::LiteralParserTokenPtr::LiteralParserTokenPtr):
(JSC::LiteralParser::Lexer::LiteralParserTokenPtr::operator->):

10:05 AM Changeset in webkit [199967] by fpizlo@apple.com

27 edits
5 adds in trunk

[INTL] Implement String.prototype.localeCompare in ECMA-402
https://bugs.webkit.org/show_bug.cgi?id=147607

Patch by Filip Pizlo <fpizlo@apple.com> and Andy VanWagoner <thetalecrafter@gmail.com> on 2016-04-24
Reviewed by Darin Adler.
Source/JavaScriptCore:

Part of this change is just rolling 194394 back in.

The other part is making that not a regression on CDjs. Other than the fact that it uses
bound functions, the problem with this new localeCompare implementation is that it uses
the arguments object. It uses it in a way that *seems* like ArgumentsEliminationPhase
ought to handle, but to my surprise it didn't:

If we have a ForceExit GetByVal on the arguments object, we would previously assume that it escaped. That's false since we just exit at ForceExit. On the other hand we probably should be pruning unreachable paths before we get here, but that's a separate issue. I don't want to play with phase order right now.

If we have a OutOfBounds GetByVal on the arguments object, then the best that would previously happen is that we'd compile it into an in-bounds arguments access. That's quite bad, as Andy's localeCompare illustrates: it uses out-of-bounds access on the arguments object to detect if an argument was passed. This change introduces an OutOfBounds version of GetMyArgumentByVal for this purpose.

This change required registering sane chain watchpoints. In the process, I noticed that the
old way of doing it had a race condition: we might register watchpoints for the structure
that had become insane. This change introduces a double-checking idiom that I believe works
because once the structure becomes insane it can't go back to sane and watchpoints
registration already involves executing the hardest possible fences.

builtins/StringPrototype.js:

(repeat):
(localeCompare):
(search):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPreciseLocalClobberize.h:

(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGValidate.cpp:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):

ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::TypedPointer):
(JSC::FTL::TypedPointer::operator bool):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::operator!): Deleted.

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):

LayoutTests:

js/dom/script-tests/string-prototype-properties.js:
js/dom/string-prototype-properties-expected.txt:
js/regress/locale-compare.html: Added.
js/regress/locale-compare-expected.txt: Added.
js/regress/scripts-tests/locale-compare.js: Added.
js/script-tests/string-localeCompare.js:
js/string-localeCompare-expected.txt:
js/string-localeCompare.html:

9:20 AM Changeset in webkit [199966] by bshafiei@apple.com

5 edits in tags/Safari-602.1.29.1/Source

Versioning.

9:18 AM Changeset in webkit [199965] by bshafiei@apple.com

1 copy in tags/Safari-602.1.29.1

New tag.

6:54 AM Changeset in webkit [199964] by Antti Koivisto

423 edits in trunk/Source/WebCore

RenderStyle should not be reference counted
https://bugs.webkit.org/show_bug.cgi?id=156846

Reviewed by Andreas Kling.

RenderStyle reference counts its substructures. We no longer share RenderStyle objects between normal renderers
so there is no reason to refcount the RenderStyles themselves too. Making it a non-refcounted type clarifies
ownership relations, reduces branchiness and saves some memory.

This patches switches mostly mechanically from Ref/RefPtr<RenderStyle> to std::unique_ptr<RenderStyle>. In
the future RenderStyle can be given regular value semantics.

Modules/plugins/PluginReplacement.h:

(WebCore::PluginReplacement::scriptObject):
(WebCore::PluginReplacement::willCreateRenderer):

Modules/plugins/QuickTimePluginReplacement.h:
Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
(WebCore::QuickTimePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.cpp:

(WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
(WebCore::YouTubePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.h:
css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
(WebCore::ComputedStyleExtractor::useFixedFontDefaultSize):
(WebCore::updateStyleIfNeededForNode):
(WebCore::computeRenderStyleForProperty):
(WebCore::ComputedStyleExtractor::customPropertyValue):
(WebCore::ComputedStyleExtractor::propertyValue):

css/MediaQueryEvaluator.cpp:

(WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
(WebCore::MediaQueryEvaluator::eval):

css/MediaQueryEvaluator.h:

Clarify in code that MediaQueryEvaluator does not own the style.

css/MediaQueryMatcher.cpp:

(WebCore::MediaQueryMatcher::mediaType):
(WebCore::MediaQueryMatcher::documentElementUserAgentStyle):
(WebCore::MediaQueryMatcher::evaluate):
(WebCore::MediaQueryMatcher::matchMedia):
(WebCore::MediaQueryMatcher::styleResolverChanged):
(WebCore::MediaQueryMatcher::prepareEvaluator): Deleted.

css/MediaQueryMatcher.h:
css/StyleMedia.cpp:

(WebCore::StyleMedia::matchMedium):

css/StyleResolver.cpp:

(WebCore::StyleResolver::State::clear):
(WebCore::StyleResolver::State::updateConversionData):
(WebCore::StyleResolver::State::setStyle):
(WebCore::StyleResolver::State::setParentStyle):

State owns the style explicitly set by setParentStyle but not the one given via constructor.

(WebCore::isAtShadowBoundary):
(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::styleForKeyframe):
(WebCore::StyleResolver::keyframeStylesForAnimation):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::styleForPage):
(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::applyMatchedProperties):
(WebCore::StyleResolver::applyPropertyToStyle):

css/StyleResolver.h:

(WebCore::ElementStyle::ElementStyle):
(WebCore::StyleResolver::style):
(WebCore::StyleResolver::parentStyle):
(WebCore::StyleResolver::setOverrideDocumentElementStyle):
(WebCore::StyleResolver::State::document):
(WebCore::StyleResolver::State::element):
(WebCore::StyleResolver::State::style):
(WebCore::StyleResolver::State::takeStyle):
(WebCore::StyleResolver::State::parentStyle):
(WebCore::StyleResolver::State::rootElementStyle):
(WebCore::StyleResolver::State::regionForStyling):
(WebCore::StyleResolver::State::setParentStyle): Deleted.

dom/Document.cpp:

(WebCore::Document::recalcStyle):
(WebCore::Document::updateLayoutIgnorePendingStylesheets):
(WebCore::Document::styleForElementIgnoringPendingStylesheets):
(WebCore::Document::isPageBoxVisible):
(WebCore::Document::pageSizeAndMarginsInPixels):
(WebCore::Document::addAutoSizingNode):
(WebCore::Document::validateAutoSizingNodes):
(WebCore::Document::resetAutoSizingNodes):
(WebCore::Document::setFullScreenRenderer):

dom/Document.h:
dom/Element.cpp:

(WebCore::Element::rendererIsNeeded):
(WebCore::Element::createElementRenderer):
(WebCore::Element::resolveComputedStyle):

dom/Element.h:

(WebCore::Element::copyNonAttributePropertiesFromElement):

dom/ElementRareData.h:

...

page/animation/AnimationBase.h:
page/animation/AnimationController.cpp:

(WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
(WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
(WebCore::AnimationControllerPrivate::computeExtentOfAnimation):
(WebCore::AnimationController::cancelAnimations):
(WebCore::AnimationController::updateAnimations):

std::unique_ptr<RenderStyle& animatedStyle argument is now expected no be initially null and
is only set if a new style is created.

(WebCore::AnimationController::getAnimatedStyleForRenderer):

page/animation/AnimationController.h:
page/animation/AnimationControllerPrivate.h:
page/animation/CompositeAnimation.cpp:

(WebCore::CompositeAnimation::updateTransitions):
(WebCore::CompositeAnimation::updateKeyframeAnimations):
(WebCore::CompositeAnimation::animate):
(WebCore::CompositeAnimation::getAnimatedStyle):

page/animation/CompositeAnimation.h:
page/animation/ImplicitAnimation.cpp:

(WebCore::ImplicitAnimation::ImplicitAnimation):
(WebCore::ImplicitAnimation::shouldSendEventForListener):
(WebCore::ImplicitAnimation::animate):
(WebCore::ImplicitAnimation::getAnimatedStyle):
(WebCore::ImplicitAnimation::onAnimationEnd):
(WebCore::ImplicitAnimation::reset):

page/animation/ImplicitAnimation.h:
page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
(WebCore::KeyframeAnimation::animate):
(WebCore::KeyframeAnimation::getAnimatedStyle):

page/animation/KeyframeAnimation.h:
rendering/RenderAttachment.cpp:

(WebCore::RenderAttachment::RenderAttachment):

rendering/RenderAttachment.h:
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::RenderBlock):
(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::clone):
(WebCore::RenderBlock::updateFirstLetterStyle):
(WebCore::RenderBlock::createFirstLetterRenderer):

rendering/RenderBlock.h:
rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::MarginInfo::MarginInfo):
(WebCore::RenderBlockFlow::RenderBlockFlow):

rendering/RenderBlockFlow.h:
rendering/RenderBox.cpp:

(WebCore::skipBodyBackground):
(WebCore::RenderBox::RenderBox):

rendering/RenderBox.h:
rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::suspendAnimations):
(WebCore::RenderBoxModelObject::RenderBoxModelObject):

rendering/RenderBoxModelObject.h:
rendering/RenderButton.cpp:

(WebCore::RenderButton::RenderButton):
(WebCore::RenderButton::setupInnerStyle):

rendering/RenderButton.h:
rendering/RenderCombineText.h:
rendering/RenderDeprecatedFlexibleBox.cpp:

(WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):

rendering/RenderDeprecatedFlexibleBox.h:
rendering/RenderDetailsMarker.cpp:

(WebCore::RenderDetailsMarker::RenderDetailsMarker):

rendering/RenderDetailsMarker.h:
rendering/RenderElement.cpp:

(WebCore::controlStatesRendererMap):
(WebCore::RenderElement::RenderElement):
(WebCore::RenderElement::~RenderElement):
(WebCore::RenderElement::createFor):
(WebCore::firstLineStyleForCachedUncachedType):
(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::initializeStyle):
(WebCore::RenderElement::setStyle):
(WebCore::RenderElement::propagateStyleToAnonymousChildren):
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::getCachedPseudoStyle):

Return plain pointer as the cache owns the style.

(WebCore::RenderElement::getUncachedPseudoStyle):

return std::unique_ptr<RenderStyle>

(WebCore::RenderElement::selectionColor):
(WebCore::RenderElement::selectionPseudoStyle):
(WebCore::RenderElement::selectionBackgroundColor):

rendering/RenderElement.h:

(WebCore::RenderElement::hasInitializedStyle):
(WebCore::RenderElement::style):
(WebCore::RenderElement::element):
(WebCore::RenderElement::setStyleInternal):

rendering/RenderEmbeddedObject.cpp:

...

(WebCore::RenderImage::imageResource):

rendering/RenderInline.cpp:

(WebCore::RenderInline::RenderInline):
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

Continuations now get their own RenderStyles.

(WebCore::RenderInline::addChildIgnoringContinuation):
(WebCore::RenderInline::clone):

rendering/RenderInline.h:
rendering/RenderLayer.cpp:

(WebCore::RenderLayer::currentTransform):
(WebCore::RenderLayer::calculateClipRects):

rendering/RenderLayer.h:

...

rendering/style/KeyframeList.cpp:

(WebCore::KeyframeList::operator==):
(WebCore::KeyframeList::insert):

KeyframeValue is now movable but not copyable type. Adjust accordingly.

rendering/style/KeyframeList.h:

(WebCore::KeyframeValue::KeyframeValue):
(WebCore::KeyframeValue::setKey):
(WebCore::KeyframeValue::style):
(WebCore::KeyframeValue::setStyle):
(WebCore::KeyframeList::animationName):
(WebCore::KeyframeList::addProperty):
(WebCore::KeyframeList::containsProperty):

rendering/style/RenderStyle.cpp:

(WebCore::defaultStyle):
(WebCore::RenderStyle::create):
(WebCore::RenderStyle::createDefaultStyle):
(WebCore::RenderStyle::createAnonymousStyleWithDisplay):
(WebCore::RenderStyle::clone):
(WebCore::RenderStyle::createStyleInheritingFromPseudoStyle):

Return std::unique_ptr<RenderStyle> instead of Ref<RenderStyle>.

(WebCore::RenderStyle::RenderStyle):
(WebCore::RenderStyle::~RenderStyle):
(WebCore::resolveAlignmentData):
(WebCore::RenderStyle::operator==):
(WebCore::RenderStyle::hasUniquePseudoStyle):
(WebCore::RenderStyle::getCachedPseudoStyle):
(WebCore::RenderStyle::addCachedPseudoStyle):
(WebCore::RenderStyle::isStyleAvailable): Deleted.

rendering/style/RenderStyle.h:

(WebCore::RenderStyle::setStyleType):
(WebCore::RenderStyle::cachedPseudoStyles):
(WebCore::RenderStyle::initialIsolation):
(WebCore::RenderStyle::isPlaceholderStyle):
(WebCore::RenderStyle::setIsPlaceholderStyle):

Add placeholder style bit to rareNonInheritedData. We no longer rely on RenderStyle identity for this test.

(WebCore::RenderStyle::noninheritedFlagsMemoryOffset):

rendering/style/SVGRenderStyle.cpp:

(WebCore::defaultSVGStyle):
(WebCore::SVGRenderStyle::createDefaultStyle):

rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):
(WebCore::StyleRareNonInheritedData::contentDataEquivalent):

rendering/style/StyleRareNonInheritedData.h:

...

(WebCore::findRenderingRoot):
(WebCore::findRenderingRoots):
(WebCore::RenderTreeUpdater::commit):

Style::Update is no longer const as we move the styles from it to the render tree.

(WebCore::pseudoStyleCacheIsInvalid):
(WebCore::RenderTreeUpdater::updateElementRenderer):
(WebCore::moveToFlowThreadIfNeeded):
(WebCore::RenderTreeUpdater::createRenderer):
(WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

style/RenderTreeUpdater.h:
style/StyleResolveForDocument.cpp:

(WebCore::Style::resolveForDocument):

style/StyleResolveForDocument.h:
style/StyleSharingResolver.cpp:

(WebCore::Style::elementHasDirectionAuto):
(WebCore::Style::SharingResolver::resolve):

style/StyleSharingResolver.h:
style/StyleTreeResolver.cpp:

(WebCore::Style::ensurePlaceholderStyle):

Set the placeholder.

(WebCore::Style::TreeResolver::Parent::Parent):
(WebCore::Style::TreeResolver::pushScope):
(WebCore::Style::TreeResolver::pushEnclosingScope):
(WebCore::Style::TreeResolver::popScope):

Set and clear StyleResolver overrideDocumentElementStyle as needed. It is owned by the TreeResolver.

(WebCore::Style::TreeResolver::styleForElement):

Clone the placeholder style.

(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::TreeResolver::pushParent):
(WebCore::Style::TreeResolver::resolveComposedTree):
(WebCore::Style::TreeResolver::resolve):

Adopt to the std::unique_ptr and ElementStyle move semantics.

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):

style/StyleUpdate.cpp:

(WebCore::Style::Update::elementUpdate):
(WebCore::Style::Update::textUpdate):
(WebCore::Style::Update::elementStyle):
(WebCore::Style::Update::addElement):
(WebCore::Style::Update::addText):

style/StyleUpdate.h:

(WebCore::Style::Update::roots):
(WebCore::Style::Update::document):

svg/SVGAElement.cpp:

(WebCore::SVGAElement::svgAttributeChanged):
(WebCore::SVGAElement::createElementRenderer):

...

5:45 AM Changeset in webkit [199963] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from MediaControlsHost
https://bugs.webkit.org/show_bug.cgi?id=156903

Reviewed by Chris Dumez.

No change of behavior.

Modules/mediacontrols/MediaControlsHost.idl: Marking some parameters as nullable.

5:45 AM Changeset in webkit [199962] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from WebGLRenderingContext
https://bugs.webkit.org/show_bug.cgi?id=156909

Reviewed by Chris Dumez.

No change of behavior.

Marking a lot of method parameters as nullable.

html/canvas/WebGLRenderingContextBase.idl:

5:37 AM Changeset in webkit [199961] by youenn.fablet@crf.canon.fr

4 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from WebSocket
https://bugs.webkit.org/show_bug.cgi?id=156897

Reviewed by Chris Dumez.

No change of behavior.

Updating WebSocket::send methods to take references, except for ArrayBufferView, which is not yet supported by the binding generator.

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::send):

Modules/websockets/WebSocket.h:
Modules/websockets/WebSocket.idl:

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed