Context Navigation

adoptNode() changes css class to lowercase for document loaded with XHR responseType = "document"
https://bugs.webkit.org/show_bug.cgi?id=159555
<rdar://problem/27252541>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When adopting an Element from another document which has a different quirks mode,
case-sensitivity for id and class attributes differs and we need to correctly
update members such as ElementData::m_classNames or ElementData::m_idForStyleResolution.

To address the issue, have Element override didMoveToNewDocument() and call
attributeChanged() for id and class attributes.

Test: fast/dom/Document/adoptNode-quirks-mismatch.html

dom/Element.cpp:

(WebCore::Element::didMoveToNewDocument):

dom/Element.h:

LayoutTests:

Add test coverage for id and class attributes.

fast/dom/Document/adoptNode-quirks-mismatch-expected.txt: Added.
fast/dom/Document/adoptNode-quirks-mismatch.html: Added.
fast/dom/Document/resources/document-quirks-class.html: Added.
fast/dom/Document/resources/document-quirks-id.html: Added.

7:24 PM Changeset in webkit [203017] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Command-Shift-S in the Styles sidebar should always show the save dialog
https://bugs.webkit.org/show_bug.cgi?id=156858
<rdar://problem/25859098>

Reviewed by Timothy Hatcher.

UserInterface/Views/CSSStyleDeclarationSection.js:

(WebInspector.CSSStyleDeclarationSection):

7:14 PM Changeset in webkit [203016] by dbates@webkit.org

3 edits in trunk/Source/WebCore

Cleanup: Remove use of PassRefPtr from class HTMLTableElement
https://bugs.webkit.org/show_bug.cgi?id=159587

Reviewed by Chris Dumez.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::setCaption): Take a rvalue reference to a RefPtr instead of a PassRefPtr.
(WebCore::HTMLTableElement::setTHead): Take a rvalue reference to a RefPtr instead of a PassRefPtr. Also
fix a style nit; add curly braces around the for-loop body since its body is more than a single line.
(WebCore::HTMLTableElement::createTHead): Use Ref::copyRef() instead of Ref::ptr() to pass the instantiated
table section to better convey that we are passing a copy of the table section.
(WebCore::HTMLTableElement::createCaption): Ditto.

html/HTMLTableElement.h:

6:29 PM Changeset in webkit [203015] by sbarati@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

We may add a ReadOnly property without setting the corresponding bit on Structure
https://bugs.webkit.org/show_bug.cgi?id=159542
<rdar://problem/27084591>

Reviewed by Benjamin Poulain.

The reason this usually is OK is due to happenstance. Often, instances that putDirectWithoutTransition
also happen to have a static property table. Having a static property table causes the
HasReadOnlyOrGetterSetterPropertiesExcludingProto on the structure to be set. However,
there are times where an object calls putDirectWithoutTransition, and it doesn't have a
static property hash table. The fix is simple, putDirectWithTransition needs to set the
HasReadOnlyOrGetterSetterPropertiesExcludingProto if it puts a ReadOnly property.

runtime/JSObject.h:

(JSC::JSObject::putDirectWithoutTransition):

tests/stress/proper-property-store-with-prototype-property-that-is-not-writable.js: Added.

(assert):

5:43 PM Changeset in webkit [203014] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit2

When WKWebView prepares the session state blob, we should be able to filter it.
https://bugs.webkit.org/show_bug.cgi?id=159410

Add a SPI to WKWebView so that a client can decide how to filter backforward items
when WKWebView perparing session state.

Patch by Yongjun Zhang <yongjun_zhang@apple.com> on 2016-07-08
Reviewed by Brady Eidson.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _sessionStateWithFilter:]): When preparing session state, check each
backforward item against the filter block.

UIProcess/API/Cocoa/WKWebViewPrivate.h: Add the SPI _sessionStateWithFilter:

5:28 PM Changeset in webkit [203013] by dbates@webkit.org

4 edits in trunk/Source/WebCore

Move shouldInheritSecurityOriginFromOwner() from URL to Document
https://bugs.webkit.org/show_bug.cgi?id=158987

Reviewed by Alex Christensen.

The URL class should not have knowledge of the concept of an origin or the semantics of origin
inheritance as these are higher level concepts. We should make URL::shouldInheritSecurityOriginFromOwner()
a static non-member, non-friend function of Document because its implements the origin semantics
for a Document object as described in section Origin of the HTML5 spec., <https://html.spec.whatwg.org/multipage/browsers.html#origin> (8 July 2016).
These semantics only apply to Documents.

No functionality changed. So, no new tests.

dom/Document.cpp:

(WebCore::shouldInheritSecurityOriginFromOwner): Added.
(WebCore::Document::initSecurityContext): Modified to call WebCore::shouldInheritSecurityOriginFromOwner().
(WebCore::Document::initContentSecurityPolicy): Ditto.

platform/URL.cpp:

(WebCore::URL::shouldInheritSecurityOriginFromOwner): Deleted.

platform/URL.h:

5:24 PM Changeset in webkit [203012] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

ASSERTION FAILED: Heap::isMarked(cell) in SlotVisitor::appendToMarkStack(JSC::JSCell *)
https://bugs.webkit.org/show_bug.cgi?id=159588

Reviewed by Geoffrey Garen.

We were jettisoning a CodeBlock during GC that won't survive and its owning script
won't survive either. We can't install any code on the owning script as that involves
a write barrier that will "pull" the script back into the remembered set. Badness would
ensue. Added an early return in CodeBlock::jettison() when we are garbage collecting
and the owning script isn't marked.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::jettison):

5:19 PM Changeset in webkit [203011] by dbates@webkit.org

2 edits in trunk/Source/WebCore

Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
https://bugs.webkit.org/show_bug.cgi?id=159583
<rdar://problem/27255292>

In HTMLTableElement::createTFoot() I inadvertently made use of WTFMove() to move the instantiated
HTMLTableSectionElement into the argument passed to setTFoot(). We should use Ref::copyRef() instead
because we want this function to return the instantiated table section.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::createTFoot):

5:15 PM Changeset in webkit [203010] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit2

Mail messages don't start loading until scrolling completes
https://bugs.webkit.org/show_bug.cgi?id=159585
<rdar://problem/27088405>

Reviewed by Andy Estes.

UIProcess/Network/CustomProtocols/mac/CustomProtocolManagerProxyMac.mm:

(-[WKCustomProtocolLoader initWithCustomProtocolManagerProxy:customProtocolID:request:connection:]):
When scrolling, NSDefaultRunLoopMode isn't run, but NSRunLoopCommonModes are.
CFNetwork uses NSDefaultRunLoopMode if we tell NSURLConnection to "start immediately",
but we can instead schedule our NSURLConnection into NSRunLoopCommonModes
and start it ourselves, ensuring that it will be able to do work while scrolling is happening.

5:04 PM Changeset in webkit [203009] by dbates@webkit.org

11 edits in trunk

Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
https://bugs.webkit.org/show_bug.cgi?id=159583
<rdar://problem/27255292>

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

Update expected result now that we append the HTML tfoot element to the end of the table.

web-platform-tests/html/semantics/tabular-data/the-table-element/tFoot-expected.txt:

Source/WebCore:

he HTML standard has long since been revised to describe that assignment to property table.tFoot
or invoking table.createTFoot() will append the HTML tfoot element to the end of the table. This
behavior is defined in <https://html.spec.whatwg.org/multipage/tables.html#dom-table-tfoot> (8 July 2016)
and <https://html.spec.whatwg.org/multipage/tables.html#dom-table-createtfoot> for the property
table.tFoot and table.createTFoot(), respectively. This change makes our behavior match the
behavior in Mozilla Firefox, Microsoft Edge, Microsoft Internet Explorer 8 and later.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::setTFoot): Append <tfoot> to the end of the table. Use RefPtr<>&& instead of PassRefPtr.
(WebCore::HTMLTableElement::createTFoot): Use RefPtr<>&& instead of PassRefPtr.

html/HTMLTableElement.h:

LayoutTests:

Update expected results now that we append the HTML tfoot element to the end of the table.

platform/efl/tables/mozilla/bugs/bug30418-expected.txt:
platform/gtk/tables/mozilla/bugs/bug30418-expected.txt:
platform/ios-simulator/tables/mozilla/bugs/bug30418-expected.txt:
platform/mac/tables/mozilla/bugs/bug30418-expected.txt:
platform/win/tables/mozilla/bugs/bug30418-expected.txt:

4:49 PM Changeset in webkit [203008] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

Crash in layout test /media/video-buffered-range-contains-currentTime.html
https://bugs.webkit.org/show_bug.cgi?id=159109
<rdar://problem/26535750>

Reviewed by Alex Christensen.

Protect against _dataTasks being mutated and accessed on multiple simultaneous threads with a Lock.

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession dealloc]):
(-[WebCoreNSURLSession taskCompleted:]):
(-[WebCoreNSURLSession finishTasksAndInvalidate]):
(-[WebCoreNSURLSession invalidateAndCancel]):
(-[WebCoreNSURLSession getTasksWithCompletionHandler:]):
(-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]):
(-[WebCoreNSURLSession dataTaskWithRequest:]):
(-[WebCoreNSURLSession dataTaskWithURL:]):

4:38 PM Changeset in webkit [203007] by bshafiei@apple.com

1 copy in tags/Safari-601.7.7

New tag.

3:58 PM Changeset in webkit [203006] by mark.lam@apple.com

59 edits in trunk/Source/JavaScriptCore

Move CallFrame header info from JSStack.h to CallFrame.h
https://bugs.webkit.org/show_bug.cgi?id=159549

Reviewed by Geoffrey Garen.

CallFrame.h is a much better location for CallFrame header info.

Replaced CallFrame::init() with ExecState::initGlobalExec() because normal
CallFrames are setup by a different mechanism now. Only the globalExec is still
using it. So, might as well change it to be specifically for the globalExec.

Removed the use of JSStack::containsAddress() in ExecState::initGlobalExec()
because it is not relevant to the globalExec.

Also removed some unused code: JSStack::gatherConservativeRoots() and
JSStack::sanitizeStack() is never called for JIT builds.

bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generateImpl):

bytecode/VirtualRegister.h:

(JSC::VirtualRegister::isValid):
(JSC::VirtualRegister::isLocal):
(JSC::VirtualRegister::isArgument):
(JSC::VirtualRegister::isHeader):
(JSC::VirtualRegister::isConstant):
(JSC::VirtualRegister::toLocal):
(JSC::VirtualRegister::toArgument):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstruct):

bytecompiler/BytecodeGenerator.h:

(JSC::CallArguments::thisRegister):
(JSC::CallArguments::argumentRegister):
(JSC::CallArguments::stackOffset):
(JSC::CallArguments::argumentCountIncludingThis):
(JSC::CallArguments::argumentsNode):
(JSC::BytecodeGenerator::registerFor):

bytecompiler/NodesCodegen.cpp:

(JSC::emitHomeObjectForCallee):
(JSC::emitGetSuperFunctionForConstruct):
(JSC::CallArguments::CallArguments):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGArgumentsUtilities.cpp:

(JSC::DFG::argumentsInvolveStackSlot):
(JSC::DFG::emitCodeToGetArgumentsArrayLength):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::get):
(JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
(JSC::DFG::ByteCodeParser::flush):
(JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
(JSC::DFG::ByteCodeParser::getArgumentCount):
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::isLiveInBytecode):

dfg/DFGGraph.h:

(JSC::DFG::Graph::forAllLocalsLiveInBytecode):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntry):
(JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
(JSC::DFG::JITCompiler::compileFunction):

dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::emitStoreCallSiteIndex):

dfg/DFGOSRAvailabilityAnalysisPhase.cpp:

(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):

dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

dfg/DFGOSRExitCompiler.cpp:

(JSC::DFG::OSRExitCompiler::emitRestoreArguments):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::reifyInlinedCallFrames):

dfg/DFGOSRExitCompilerCommon.h:

(JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):

dfg/DFGPreciseLocalClobberize.h:

(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitGetLength):
(JSC::DFG::SpeculativeJIT::emitGetCallee):
(JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

ftl/FTLLink.cpp:

(JSC::FTL::link):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileGetCallee):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentCountIncludingThis):
(JSC::FTL::DFG::LowerDFGToB3::compileGetScope):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
(JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenPrologue):
(JSC::FTL::DFG::LowerDFGToB3::getArgumentsLength):
(JSC::FTL::DFG::LowerDFGToB3::getCurrentCallee):
(JSC::FTL::DFG::LowerDFGToB3::getArgumentsStart):
(JSC::FTL::DFG::LowerDFGToB3::callPreflight):

ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

ftl/FTLSlowPathCall.h:

(JSC::FTL::callOperation):

interpreter/CallFrame.cpp:

(JSC::ExecState::initGlobalExec):
(JSC::CallFrame::callSiteBitsAreBytecodeOffset):
(JSC::CallFrame::callSiteAsRawBits):
(JSC::CallFrame::unsafeCallSiteAsRawBits):
(JSC::CallFrame::callSiteIndex):
(JSC::CallFrame::setCurrentVPC):
(JSC::CallFrame::callSiteBitsAsBytecodeOffset):

interpreter/CallFrame.h:

(JSC::CallSiteIndex::CallSiteIndex):
(JSC::ExecState::calleeAsValue):
(JSC::ExecState::callee):
(JSC::ExecState::unsafeCallee):
(JSC::ExecState::codeBlock):
(JSC::ExecState::unsafeCodeBlock):
(JSC::ExecState::scope):
(JSC::ExecState::setCallerFrame):
(JSC::ExecState::setScope):
(JSC::ExecState::argumentCount):
(JSC::ExecState::argumentCountIncludingThis):
(JSC::ExecState::argumentOffset):
(JSC::ExecState::argumentOffsetIncludingThis):
(JSC::ExecState::offsetFor):
(JSC::ExecState::noCaller):
(JSC::ExecState::setArgumentCountIncludingThis):
(JSC::ExecState::setCallee):
(JSC::ExecState::setCodeBlock):
(JSC::ExecState::setReturnPC):
(JSC::ExecState::argIndexForRegister):
(JSC::ExecState::callerFrameAndPC):
(JSC::ExecState::unsafeCallerFrameAndPC):
(JSC::ExecState::init): Deleted.

interpreter/Interpreter.cpp:

(JSC::Interpreter::dumpRegisters):

interpreter/Interpreter.h:

(JSC::calleeFrameForVarargs):

interpreter/JSStack.h:

(JSC::JSStack::containsAddress):
(JSC::JSStack::gatherConservativeRoots): Deleted.
(JSC::JSStack::sanitizeStack): Deleted.

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::jitAssertArgumentCountSane):
(JSC::AssemblyHelpers::emitRandomThunk):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::restoreReturnAddressBeforeReturn):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
(JSC::AssemblyHelpers::emitPutToCallFrameHeader):
(JSC::AssemblyHelpers::emitPutToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::emitPutPayloadToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::emitPutTagToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::calleeFrameSlot):

jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenProloguePacket):

jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::dump):
(JSC::CallFrameShuffler::extendFrameIfNeeded):
(JSC::CallFrameShuffler::prepareForSlowPath):
(JSC::CallFrameShuffler::prepareForTailCall):
(JSC::CallFrameShuffler::prepareAny):

jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot):
(JSC::CallFrameShuffler::setCalleeJSValueRegs):
(JSC::CallFrameShuffler::assumeCalleeIsCell):
(JSC::CallFrameShuffler::numLocals):
(JSC::CallFrameShuffler::getOld):
(JSC::CallFrameShuffler::setOld):
(JSC::CallFrameShuffler::firstOld):
(JSC::CallFrameShuffler::lastOld):
(JSC::CallFrameShuffler::isValidOld):
(JSC::CallFrameShuffler::argCount):
(JSC::CallFrameShuffler::getNew):

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

jit/JIT.h:
jit/JITCall.cpp:

(JSC::JIT::compileSetupVarargsFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):

jit/JITCall32_64.cpp:

(JSC::JIT::compileSetupVarargsFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):

jit/JITInlines.h:

(JSC::JIT::getConstantOperand):
(JSC::JIT::emitPutIntToCallFrameHeader):
(JSC::JIT::updateTopCallFrame):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_get_scope):
(JSC::JIT::emit_op_argument_count):
(JSC::JIT::emit_op_get_rest_length):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTINativeCall):
(JSC::JIT::emit_op_get_scope):

jit/JSInterfaceJIT.h:

(JSC::JSInterfaceJIT::emitJumpIfNotType):
(JSC::JSInterfaceJIT::emitGetFromCallFrameHeaderPtr):
(JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
(JSC::JSInterfaceJIT::emitPutCellToCallFrameHeader):

jit/SetupVarargsFrame.cpp:

(JSC::emitSetVarargsFrame):
(JSC::emitSetupVarargsFrameFastCase):

jit/SpecializedThunkJIT.h:

(JSC::SpecializedThunkJIT::SpecializedThunkJIT):

jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):
(JSC::arityFixupGenerator):
(JSC::boundThisNoArgsFunctionCallGenerator):

llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::genericCall):
(JSC::LLInt::varargsSetup):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::arityCheckFor):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSGlobalObject.h:
runtime/StackAlignment.h:

(JSC::roundArgumentCountToAlignFrame):
(JSC::roundLocalRegisterCountForFramePointerOffset):
(JSC::logStackAlignmentRegisters):

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::startFunction):
(JSC::WASMFunctionCompiler::endFunction):
(JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
(JSC::WASMFunctionCompiler::callAndUnboxResult):

wasm/WASMFunctionSyntaxChecker.h:

(JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):

2:06 PM Changeset in webkit [203005] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Prevent fullscreen video dimension state from being reset after configuring.
https://bugs.webkit.org/show_bug.cgi?id=159578

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-07-08
Reviewed by Jer Noble.

This change moves setVideoElement() to after setMediaElement(), since setMediaElement() resets the
mediaState, undoing the configuration done by setVideoElement().

This change is fragile, but minimal. The proper, more comprehinsive fix will come later from
https://bugs.webkit.org/show_bug.cgi?id=159580.

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(WebVideoFullscreenControllerContext::setUpFullscreen):

1:52 PM Changeset in webkit [203004] by Chris Dumez

3 edits
6 adds in trunk

Object.defineProperty() should maintain existing getter / setter if not overridden in the new descriptor
https://bugs.webkit.org/show_bug.cgi?id=159576
<rdar://problem/27242197>

Reviewed by Mark Lam.

Source/JavaScriptCore:

Object.defineProperty() should maintain existing getter / setter if not
overridden in the new descriptor. Previously, if the property is a had
a custom getter / setter, and if the new descriptor only had a setter
(or only a getter), JSC would clear the existing getter (or setter).
This behavior did not match the EcmaScript specification or Firefox /
Chrome. This patch fixes the issue.

This fixes searching and search suggestions on www.iciba.com.

runtime/JSObject.cpp:

(JSC::validateAndApplyPropertyDescriptor):

LayoutTests:

Add test coverage.

js/dom/customAccessor-defineProperty-expected.txt: Added.
js/dom/customAccessor-defineProperty.html: Added.
js/dom/customAccessor-defineProperty_getterOnly-expected.txt: Added.
js/dom/customAccessor-defineProperty_getterOnly.html: Added.
js/dom/customAccessor-defineProperty_setterOnly-expected.txt: Added.
js/dom/customAccessor-defineProperty_setterOnly.html: Added.

1:14 PM Changeset in webkit [203003] by aestes@apple.com

35 edits
20 adds
18 deletes in trunk

[Content Filtering] Load blocked pages more like other error pages are loaded
https://bugs.webkit.org/show_bug.cgi?id=159485
<rdar://problem/26014076>

Reviewed by Brady Eidson.

Source/WebCore:

Content filter blocked pages were being loaded by cancelling the provisional load of the
page that was blocked and then scheduling a navigation to the content filter error page.
Some clients would not expect a new, Web process-initiated provisional navigation to start
after a cancellation, though, and this would put them in a bad state.

This patch changes blocked page loading to behave more like loading other error pages.
Specifically:

didFailProvisionalLoad is dispatched with a new, non-cancellation error code.
The blocked page is loaded immediately after dispatching didFailProvisionalLoad, which prevents FrameLoader from creating a new back-forward list item for the substitute data load.
A substitute data load initiated by the client for the blocked URL is ignored if ContentFilter will display its own error page.
A file: URL is used instead of a custom scheme for the base URL of the blocked page, since some clients expect this.

Updated existing tests to capture frame load delegate callbacks and the back forward list.
Added new API tests: ContentFiltering.LoadAlternate*.

English.lproj/Localizable.strings: Added a WebKitErrorFrameLoadBlockedByContentFilter description.
Resources/ContentFilterBlockedPage.html: Added.
WebCore.xcodeproj/project.pbxproj: Added ContentFilterBlockedPage.html as a frameowrk resource.
loader/ContentFilter.cpp:

(WebCore::ContentFilter::continueAfterWillSendRequest): Protected m_documentLoader,
since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
(WebCore::ContentFilter::stopFilteringMainResource): Only set m_state to Stopped if not
already Blocked, so that we don't forget this ContentFilter was blocked when calling
cancelMailResourceLoad() in didDecide().
(WebCore::ContentFilter::continueAfterResponseReceived): Protected m_documentLoader,
since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
(WebCore::ContentFilter::continueAfterDataReceived): Ditto.
(WebCore::ContentFilter::continueAfterNotifyFinished): Ditto.
(WebCore::ContentFilter::didDecide): Moved code from DocumentLoader::contentFilterDidBlock() to here.
Created a blockedByContentFilterError() and called cancelMainResourceLoad().
(WebCore::blockedPageURL): Returned a file: URL to ContentFilterBlockedPage.html in WebCore.framework.
(WebCore::ContentFilter::continueAfterSubstituteDataRequest): If the substitute data load
is for the same failingURL as the currently-displayed blocked page, ignore it.
(WebCore::ContentFilter::handleProvisionalLoadFailure): Load the blocked page if m_state is Blocked
and the ResourceError matches the error we used when previously calling cancelMainResourceLoad().
(WebCore::ContentFilter::unblockHandler): Deleted.
(WebCore::ContentFilter::replacementData): Deleted.
(WebCore::ContentFilter::unblockRequestDeniedScript): Deleted.

loader/ContentFilter.h:
loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::contentFilter): Returned m_contentFilter.
(WebCore::DocumentLoader::installContentFilterUnblockHandler): Deleted.
(WebCore::DocumentLoader::contentFilterDidBlock): Deleted.

loader/DocumentLoader.h:
loader/EmptyClients.h: Added a default implementation of blockedByContentFilterError().
loader/FrameLoader.cpp:

(WebCore::FrameLoader::load): If m_loadType was already RedirectWithLockedBackForwardList
and we are loading subsitute data for a failing URL, continue to use RedirectWithLockedBackForwardList.
This prevents a new back-forward list item from being created when loading a blocked page in a subframe.
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):
Called ContentFilter::handleProvisionalLoadFailure() after dispatchDidFailProvisionalLoad().
(WebCore::FrameLoader::blockedByContentFilterError): Called FrameLoaderClient::blockedByContentFilterError().

loader/FrameLoader.h:
loader/FrameLoaderClient.h:
loader/NavigationScheduler.cpp:

(WebCore::ScheduledSubstituteDataLoad::ScheduledSubstituteDataLoad): Deleted.
(WebCore::NavigationScheduler::scheduleSubstituteDataLoad): Deleted.

loader/NavigationScheduler.h:
loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy): Ignored a substitute data load for a
failing URL if ContentFilter::continueAfterSubstituteDataRequest() returns false.

Source/WebKit/mac:

Misc/WebKitErrors.h: Defined WebKitErrorFrameLoadBlockedByContentFilter.
Misc/WebKitErrors.m:

(registerErrors): Registered WebKitErrorDescriptionFrameLoadBlockedByContentFilter.

WebCoreSupport/WebFrameLoaderClient.h:
WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::blockedByContentFilterError): Returned a ResourceError for WebKitErrorFrameLoadBlockedByContentFilter.

Source/WebKit2:

Shared/API/c/WKErrorRef.h: Defined kWKErrorCodeFrameLoadBlockedByContentFilter.
UIProcess/Cocoa/WebProcessProxyCocoa.mm:

(WebKit::WebProcessProxy::platformPathsWithAssumedReadAccess): Added the resource directories
of WebCore.framework and WebKit.framework as paths with assumed read access.

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::hasAssumedReadAccessToURL): Checked platformPathsWithAssumedReadAccess()
as well as m_localPathsWithAssumedReadAccess.
(WebKit::WebProcessProxy::platformPathsWithAssumedReadAccess): Added a non-Cocoa implementation.

UIProcess/WebProcessProxy.h:
WebProcess/WebCoreSupport/WebErrors.h:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::blockedByContentFilterError): Called WebKit::blockedByContentFilterError().

WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:

(WebKit::blockedByContentFilterError): Returned a ResourceError for kWKErrorCodeFrameLoadBlockedByContentFilter.

Tools:

Added API tests for WebView and WKWebView to verify that alternate HTML loaded in response
to a content filtering provisional navigation failure is ignored in preference of
ContentFilter's own error page.

TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/ContentFiltering.mm:

(-[LoadAlternateNavigationDelegate webView:didFailProvisionalNavigation:withError:]):
(-[LoadAlternateNavigationDelegate webView:didFinishNavigation:]):
(loadAlternateTest):
(TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/ContentFilteringPlugIn.mm:

(-[MockContentFilterEnabler initWithCoder:]):

TestWebKitAPI/Tests/mac/ContentFiltering.mm: Added.

(-[LoadAlternateFrameLoadDelegate webView:didFailProvisionalLoadWithError:forFrame:]):
(-[LoadAlternateFrameLoadDelegate webView:didFinishLoadForFrame:]):
(TestWebKitAPI::loadAlternateTest):
(TestWebKitAPI::TEST):

LayoutTests:

Changed allow-* and block-* tests from ref tests to text tests so that they can capture
frame load delegate callbacks and the back forward list.

contentfiltering/allow-after-add-data-expected.html: Removed.
contentfiltering/allow-after-add-data-expected.txt: Added.
contentfiltering/allow-after-finished-adding-data-expected.html: Removed.
contentfiltering/allow-after-finished-adding-data-expected.txt: Added.
contentfiltering/allow-after-response-expected.html: Removed.
contentfiltering/allow-after-response-expected.txt: Added.
contentfiltering/allow-after-will-send-request-expected.html: Removed.
contentfiltering/allow-after-will-send-request-expected.txt: Added.
contentfiltering/allow-never-expected.html: Removed.
contentfiltering/allow-never-expected.txt: Added.
contentfiltering/block-after-add-data-expected.html: Removed.
contentfiltering/block-after-add-data-expected.txt: Added.
contentfiltering/block-after-add-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-add-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-response-expected.html: Removed.
contentfiltering/block-after-response-expected.txt: Added.
contentfiltering/block-after-response-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-response-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-expected.html: Removed.
contentfiltering/block-after-will-send-request-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.txt: Added.
contentfiltering/block-never-expected.html: Removed.
contentfiltering/block-never-expected.txt: Added.
contentfiltering/resources/contentfiltering.js: Added testRunner calls to dump as text,

dump frame load callbacks, and dump the back forward list. Changed from loading data: URLs
to file: URLs in the test iframe.

12:40 PM Changeset in webkit [203002] by mmaxfield@apple.com

5 edits
2 adds in trunk

[Font Loading] The callback passed to document.fonts.ready should always be called
https://bugs.webkit.org/show_bug.cgi?id=158884

Reviewed by Dean Jackson.

Source/WebCore:

The boolean was simply not being reset when loads start.

Test: fast/text/font-face-set-ready-fire.html

css/FontFaceSet.cpp:

(WebCore::FontFaceSet::startedLoading):

css/FontFaceSet.h:

LayoutTests:

TestExpectations:
fast/text/font-face-set-ready-fire-expected.txt: Added.
fast/text/font-face-set-ready-fire.html: Added.

12:01 PM Changeset in webkit [203001] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix 32-bit build.

PluginProcess/mac/PluginProcessShim.mm:

11:56 AM Changeset in webkit [203000] by msaboff@apple.com

3 edits in trunk/Source/JavaScriptCore

Dumping the object graph doesn't work with verbose GC logging
https://bugs.webkit.org/show_bug.cgi?id=159569

Reviewed by Mark Lam.

The current object graph logging code tries to revisits the graph. This doesn't work
correctly and asking around it isn't used. The only way to dump the true object graph
is to log while we GC and that has obvious performance implications.
Therefore I eliminated GCLogging::dumpObjectGraph() and related code.

heap/GCLogging.cpp:

(JSC::GCLogging::levelAsString):
(JSC::LoggingFunctor::LoggingFunctor): Deleted.
(JSC::LoggingFunctor::~LoggingFunctor): Deleted.
(JSC::LoggingFunctor::operator()): Deleted.
(JSC::LoggingFunctor::log): Deleted.
(JSC::LoggingFunctor::reviveCells): Deleted.
(JSC::LoggingFunctor::returnValue): Deleted.
(JSC::GCLogging::dumpObjectGraph): Deleted.

heap/Heap.cpp:

(JSC::Heap::didFinishCollection):

11:52 AM Changeset in webkit [202999] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline fast/shadow-dom/trusted-event-scoped-flags.html for ios-simulator after r202953.

Unreviewed test gardening.

platform/ios-simulator/fast/shadow-dom/trusted-event-scoped-flags-expected.txt:

11:52 AM Changeset in webkit [202998] by andersca@apple.com

4 edits in trunk/Source/WebKit2

REGRESSION (r196321): Adobe Reader DC + Safari : Zoom level pulldown is not displayed at the correct position
https://bugs.webkit.org/show_bug.cgi?id=159531
rdar://problem/26382579

Reviewed by Tim Horton.

There's code in the Adobe Acrobat framework that checks if the main bundle identifier is "com.apple.WebKit.PluginProcess"
and assumes that it's running inside the Adobe Reader app if it's something else. Since we're now using the XPC service
for all plug-ins, the bundle identifier is "com.apple.WebKit.Plugin.64", so the Acrobat framework assumes it's running in the app
and doesn't use any special tricks to show the popup menu.

Work around this by shimming CFStringCompare, and looking for the exact conditions when this can happen and return kCFCompareEqualTo
when all conditions are true.

PluginProcess/mac/PluginProcessMac.mm:

(WebKit::isAdobeAcrobatAddress):
(WebKit::stringCompare):
(WebKit::initializeShim):
(WebKit::PluginProcess::platformInitializeProcess):

PluginProcess/mac/PluginProcessShim.h:
PluginProcess/mac/PluginProcessShim.mm:

(WebKit::shimCFStringCompare):

11:48 AM Changeset in webkit [202997] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

speculateTypedArrayIsNotNeutered has an inverted speculation
https://bugs.webkit.org/show_bug.cgi?id=159571

Reviewed by Mark Lam.

For some confusing reason FTLLowerDFGToB3 takes the condition the
speculation wants to be false. This issue caused
typedarray-access-monomorphic-neutered.js to fail on the bots.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):

11:34 AM Changeset in webkit [202996] by beidson@apple.com

2 edits in trunk/Source/WebKit2

Unreviewed: Fix case-sensitive filesystem build.

UIProcess/Storage/LocalStorageDatabaseTracker.cpp:

11:22 AM Changeset in webkit [202995] by commit-queue@webkit.org

35 edits
18 adds
20 deletes in trunk

Unreviewed, rolling out r202944.
https://bugs.webkit.org/show_bug.cgi?id=159570

caused some tests to crash under GuardMalloc (Requested by
estes on #webkit).

Reverted changeset:

"[Content Filtering] Load blocked pages more like other error
pages are loaded"
https://bugs.webkit.org/show_bug.cgi?id=159485
http://trac.webkit.org/changeset/202944

11:01 AM Changeset in webkit [202994] by jdiggs@igalia.com

4 edits in trunk/LayoutTests

AX: Eliminate test noise from roles-computedRoleString.html
https://bugs.webkit.org/show_bug.cgi?id=159563

Reviewed by Chris Fleizach.

Ensure we hide all the content, as the test intends to do.

accessibility/roles-computedRoleString-expected.txt: Updated.
accessibility/roles-computedRoleString.html: Updated.
platform/gtk/accessibility/roles-computedRoleString-expected.txt: Updated.

10:54 AM Changeset in webkit [202993] by Keith Rollin

4 edits in trunk/Source/WebKit2

Add always-on logging for downloads
https://bugs.webkit.org/show_bug.cgi?id=159521
<rdar://problem/26630645>

Reviewed by Alex Christensen.

Add logging statements that track when a download starts, when it
first receives data, and when the download is done (due to completion,
cancelation, or failure).

NetworkProcess/Downloads/Download.cpp:

(WebKit::Download::Download):
(WebKit::Download::didReceiveResponse):
(WebKit::Download::didReceiveData):
(WebKit::Download::didFinish):
(WebKit::Download::didFail):
(WebKit::Download::didCancel):
(WebKit::Download::isAlwaysOnLoggingAllowed):

NetworkProcess/Downloads/Download.h:

(WebKit::Download::Download):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):

10:54 AM Changeset in webkit [202992] by mark.lam@apple.com

16 edits in trunk/Source/JavaScriptCore

Rename jsCPUStackLimit to osStackLimitWithReserve and jsEmulatedStackLimit to cloopStackLimit.
https://bugs.webkit.org/show_bug.cgi?id=159544

Reviewed by Geoffrey Garen.

This patch does the following refactoring:

Rename jsCPUStackLimit to osStackLimitWithReserve.
Rename jsEmulatedStackLimit to cloopStackLimit.
Remove llintStackLimit (which previously is either an alias for jsCPUStackLimit or jsEmulatedStackLimit depending on whether we have a JIT or C Loop build). Instead, we'll change the LLINT to conditionally use the osStackLimitWithReserve or cloopStackLimit.

There are no semantic changes.

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

interpreter/JSStack.cpp:

(JSC::JSStack::JSStack):
(JSC::JSStack::growSlowCase):
(JSC::JSStack::lowAddress):
(JSC::JSStack::highAddress):

interpreter/JSStack.h:
interpreter/JSStackInlines.h:

(JSC::JSStack::ensureCapacityFor):
(JSC::JSStack::shrink):
(JSC::JSStack::grow):
(JSC::JSStack::setCLoopStackLimit):
(JSC::JSStack::setJSEmulatedStackLimit): Deleted.

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

jit/SetupVarargsFrame.cpp:

(JSC::emitSetupVarargsFrameFastCase):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/RegExp.cpp:

(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

runtime/VM.cpp:

(JSC::VM::updateStackLimit):

runtime/VM.h:

(JSC::VM::reservedZoneSize):
(JSC::VM::osStackLimitWithReserve):
(JSC::VM::addressOfOSStackLimitWithReserve):
(JSC::VM::cloopStackLimit):
(JSC::VM::setCLoopStackLimit):
(JSC::VM::isSafeToRecurse):
(JSC::VM::jsCPUStackLimit): Deleted.
(JSC::VM::addressOfJSCPUStackLimit): Deleted.
(JSC::VM::jsEmulatedStackLimit): Deleted.
(JSC::VM::setJSEmulatedStackLimit): Deleted.

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::startFunction):

10:52 AM Changeset in webkit [202991] by commit-queue@webkit.org

2 edits in trunk/Tools

Remove mrobinson from the MathML watchlist
https://bugs.webkit.org/show_bug.cgi?id=159559

Patch by Martin Robinson <mrobinson@igalia.com> on 2016-07-08
Reviewed by Philippe Normand.

Scripts/webkitpy/common/config/watchlist: Remove my email from the watchlist.

10:48 AM Changeset in webkit [202990] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.3

New tag.

10:45 AM Changeset in webkit [202989] by bshafiei@apple.com

7 edits in branches/safari-602.1.40-branch/Source

Merged r202987. rdar://problem/27244394

10:42 AM Changeset in webkit [202988] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking some mathml tests as timeouts after r202983.

Unreviewed test gardening.

TestExpectations:

10:17 AM Changeset in webkit [202987] by commit-queue@webkit.org

7 edits in trunk/Source

Unreviewed, rolling out r202799.
https://bugs.webkit.org/show_bug.cgi?id=159568

Caused build failure (Requested by perarne on #webkit).

Reverted changeset:

"[Win] DLLs are missing version information."
https://bugs.webkit.org/show_bug.cgi?id=159349
http://trac.webkit.org/changeset/202799

10:15 AM Changeset in webkit [202986] by commit-queue@webkit.org

15 edits in trunk/Source/JavaScriptCore

Built-in generator should generate files with a default copyright
https://bugs.webkit.org/show_bug.cgi?id=159561

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-08
Reviewed by Alex Christensen.

Scripts/builtins/builtins_model.py:

(BuiltinsCollection._parse_copyright_lines): Adding default copyright to the parsed copyrights.

Scripts/builtins/builtins_templates.py:

(BuiltinsGeneratorTemplates): Adding a default copyright.

Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result: Rebasing with added default copyright.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Ditto.

10:11 AM Changeset in webkit [202985] by Antti Koivisto

3 edits
3 adds in trunk

Regression(r201805): Crash with <use> resource that has Vary header
https://bugs.webkit.org/show_bug.cgi?id=159560
<rdar://problem/27034208>

Reviewed by Chris Dumez.

Source/WebCore:

In some situations (SVG <use> element for example) we may try to load resources from frameless documents.
Such loads always fail. The new vary header verification code path tried to access the frame earlier without
null check.

Test: http/tests/cache/vary-frameless-document.html

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::failBeforeStarting):
(WebCore::addAdditionalRequestHeadersToRequest):

Null check frame.
Also move the resource type check here so all callers get the same behavior.

(WebCore::CachedResource::addAdditionalRequestHeaders):
(WebCore::CachedResource::load):
(WebCore::CachedResource::varyHeaderValuesMatch):

LayoutTests:

http/tests/cache/resources/svg-defs-vary.php: Added.
http/tests/cache/vary-frameless-document-expected.txt: Added.
http/tests/cache/vary-frameless-document.html: Added.

10:03 AM Changeset in webkit [202984] by beidson@apple.com

7 edits
2 adds in trunk

Clearing LocalStorage doesn't also delete -wal and -shm files.
<rdar://problem/27206772> and https://bugs.webkit.org/show_bug.cgi?id=159566

Reviewed by Brent Fulgham.
Also helpfully picked over by Andy "Never Forgets" Estes.

Source/WebCore:

Covered by new API test.

WebCore.xcodeproj/project.pbxproj:

platform/sql/SQLiteFileSystem.h:

Source/WebKit2:

UIProcess/Storage/LocalStorageDatabaseTracker.cpp:

(WebKit::LocalStorageDatabaseTracker::removeDatabaseWithOriginIdentifier):

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageClear.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageClear.mm: Added.

9:42 AM Changeset in webkit [202983] by Ryan Haddad

4 edits
2 deletes in trunk

Unreviewed, rolling out r202945.
https://bugs.webkit.org/show_bug.cgi?id=159565

The test for this change is failing on all platforms.
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"[Font Loading] The callback passed to document.fonts.ready
should always be called"
https://bugs.webkit.org/show_bug.cgi?id=158884
http://trac.webkit.org/changeset/202945

Patch by Commit Queue <commit-queue@webkit.org> on 2016-07-08

9:27 AM Changeset in webkit [202982] by keith_miller@apple.com

16 edits
3 adds in trunk

TypedArrays need more isNeutered checks.
https://bugs.webkit.org/show_bug.cgi?id=159231

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

According to the ES6 spec if a user tries to get, set, or define a
property on a neutered TypedArray we should throw an
exception. Currently, if a user tries to get an out of bounds
access on a TypedArray we will always OSR. This makes handling
the exception easy as all we need to do is make out of bounds gets
in PolymorphicAccess go to the slow path, which will then throw
the appropriate exception. For the case of set, we need ensure we
don't OSR on each out of bounds put since, for some confusing
reason, people do this. Thus, for GetByVal in the DFG/FTL if the
user accesses out of bounds we then need to check if the view has
been neutered. If it is neutered then we will OSR.

Additionally, this patch adds a bunch of isNeutered checks to
various prototype functions for TypedArray, which are needed for
correctness.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):

dfg/DFGSpeculativeJIT.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):

jit/JITPropertyAccess.cpp:

(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):

runtime/JSArrayBufferView.h:
runtime/JSCJSValue.h:

(JSC::encodedJSUndefined):
(JSC::encodedJSValue):

runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError):
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
(JSC::JSGenericTypedArrayView<Adaptor>::put):
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
(JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex):

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncCopyWithin):
(JSC::genericTypedArrayViewProtoFuncFill):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncJoin):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewProtoFuncSubarray):

tests/stress/fold-typed-array-properties.js:
tests/stress/typedarray-access-monomorphic-neutered.js: Added.

(check):
(test):
(testFTL):

tests/stress/typedarray-access-neutered.js: Added.

(check):
(test):

tests/stress/typedarray-functions-with-neutered.js:

(defaultForArg):
(callWithArgs):
(checkArgumentsForType):
(checkArguments):

tests/stress/typedarray-view-string-properties-neutered.js: Added.

(call):
(test):

LayoutTests:

Update tests that assert that we can access indexed properties on
a neutered TypedArray.

fast/canvas/webgl/script-tests/arraybuffer-transfer-of-control.js:

(assertViewClosed):

js/dom/dfg-typed-array-neuter-expected.txt:
js/dom/script-tests/dfg-typed-array-neuter.js:

8:52 AM Changeset in webkit [202981] by nael.ouedraogo@crf.canon.fr

15 edits in trunk/Source/WebCore

ExecState should be passed by reference in JS bindings generator for custom constructors
https://bugs.webkit.org/show_bug.cgi?id=159357

Reviewed by Youenn Fablet.

Pass ExecState as a reference instead of pointer in JS bindings
code for custom constructors.

bindings/js/JSAudioContextCustom.cpp:

(WebCore::constructJSAudioContext):

bindings/js/JSBlobCustom.cpp:

(WebCore::constructJSBlob):

bindings/js/JSDOMFormDataCustom.cpp:

(WebCore::constructJSDOMFormData):
(WebCore::JSDOMFormData::append):

bindings/js/JSDataCueCustom.cpp:

(WebCore::constructJSDataCue):

bindings/js/JSFileCustom.cpp:

(WebCore::constructJSFile):

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement):

bindings/js/JSMediaSessionCustom.cpp:

(WebCore::constructJSMediaSession):

bindings/js/JSMutationObserverCustom.cpp:

(WebCore::constructJSMutationObserver):

bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::constructJSReadableStreamController):
(WebCore::constructJSReadableStreamReader):

bindings/js/JSWebKitPointCustom.cpp:

(WebCore::constructJSWebKitPoint):

bindings/js/JSWorkerCustom.cpp:

(WebCore::constructJSWorker):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateConstructorDefinition):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::construct):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:

8:48 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

8:48 AM Changeset in webkit [202980] by Chris Dumez

7 edits in trunk

Expose crossOrigin attribute as a static property in HTMLMediaElement
https://bugs.webkit.org/show_bug.cgi?id=159459

Patch by Olivier Blin <Olivier Blin> on 2016-07-08
Reviewed by Chris Dumez.

The crossOrigin attribute is already used for MediaResourceLoader
(r119742 and r175050), but it was not exposed as a static property.

This fixes VR360 support in Dailymotion, since it uses the "in"
operator to detect if crossOrigin is supported by the
HTMLVideoElement, in order to enable VR360.

No new tests, rebaselined existing tests, 150 WPT tests are fixed.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setCrossOrigin):
(WebCore::HTMLMediaElement::crossOrigin):

html/HTMLMediaElement.h:
html/HTMLMediaElement.idl:

8:30 AM Changeset in webkit [202979] by fred.wang@free.fr

14 edits
13 adds in trunk

Use Fraction* parameters from the OpenType MATH table
https://bugs.webkit.org/show_bug.cgi?id=155639

Source/WebCore:

Patch by Frederic Wang <fwang@igalia.com> on 2016-03-20
Reviewed by Brent Fulgham.

We improve the RenderMathMLFraction so minimal vertical shifts and gaps
from the MATH table (or arbitrary fallback) are used for fractions.
We also change the interpretation of "thick" and "thin" linethickness values
to match Gecko's behavior and the one suggested in the MathML in HTML5 implementation note.

Test: imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1.html

rendering/mathml/MathMLStyle.cpp:

(WebCore::MathMLStyle::updateStyleIfNeeded): set NeedsLayout after displaystyle change
so that dynamic MathML tests still work.

rendering/mathml/RenderMathMLFraction.cpp:

(WebCore::RenderMathMLFraction::RenderMathMLFraction): Init LayoutUnit members to zero.
(WebCore::RenderMathMLFraction::updateFromElement):
Set new members for fraction gaps and shifts using Fraction* constants or some fallback
values. Change the interpretation of "thick" and "thin".
(WebCore::RenderMathMLFraction::layoutBlock): Use new constants affecting vertical
positions of numerator and denominator.
(WebCore::RenderMathMLFraction::paint): Use m_ascent to set the vertical position
of the fraction bar.
(WebCore::RenderMathMLFraction::firstLineBaseline): We just return m_ascent.

rendering/mathml/RenderMathMLFraction.h: Make updateFromElement public so that

it can be used in MathMLStyle. Add LayoutUnit members for the ascent of the fraction
and for minimal shifts/gaps values.

LayoutTests:

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

We import a test from the MathML in HTML5 test suite to verify Fraction* parameters.
We also do some small test adjustments.

TestExpectations: We disable fractions-positions.html for now until it is replaced with a more reliable test.
imported/mathml-in-html5/fonts/math/fraction-axisheight7000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatordisplaystylegapmin5000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatordisplaystyleshiftdown6000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatorgapmin4000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatorshiftdown3000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratordisplaystylegapmin8000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratordisplaystyleshiftup2000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratorgapmin9000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratorshiftup11000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-rulethickness10000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1.html: Added.
mathml/presentation/fractions-linethickness-expected.html: Adjust the test to interpret

"thick" and "thin" as suggested the MathML in HTML5 implementation note.

mathml/presentation/stretchy-depth-height-symmetric.html: Increase error tolerance.
platform/gtk/mathml/presentation/roots-expected.png: Handle small rendering changes.
platform/gtk/mathml/presentation/roots-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/roots-expected.txt: Ditto.
platform/mac/mathml/presentation/roots-expected.txt: Ditto.

8:03 AM Changeset in webkit [202978] by Konstantin Tokarev

3 edits in trunk/Tools

Removed Qt leftovers from Tools.
https://bugs.webkit.org/show_bug.cgi?id=159557

Reviewed by Csaba Osztrogonác.

BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:

Removed 'qt' platform config.

Scripts/webkitpy/common/net/bugzilla/bug.py:

Deleted non-functional e-mail address.

6:16 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

6:05 AM Changeset in webkit [202977] by fred.wang@free.fr

12 edits
10 adds in trunk

Use Radical* constants from the OpenType MATH table.
https://bugs.webkit.org/show_bug.cgi?id=155638

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

Test: mathml/mathml-in-html5/root-parameters-1.html

We make the radical vertical gap depends on displaystyle.
This is the only remaining step to use all the Radical* constants from the MATH table.
We also introduce a ruleThicknessFallback function for future use.

rendering/mathml/RenderMathMLBlock.h:

(WebCore::RenderMathMLBlock::ruleThicknessFallback): Add this helper function since that
calculation is used in several places.

rendering/mathml/RenderMathMLRoot.cpp:

(WebCore::RenderMathMLRoot::updateStyle): Reorganize the way we set constant parameters,
add more comments and take into account the displaystyle for the vertical gap.

LayoutTests:

Import a test from the MathML in HTML5 test suite to verify all the Radical* parameters.
For test RadicalDegreeBottomRaisePercent, WebKit's drawing of one of the radical sign
is weird. This causes unexpected height of the radical and a fortiori wrong vertical
position of the index. For now, we tweak that height to make the test pass.

imported/mathml-in-html5/fonts/radical-degreebottomraisepercent25-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-displaystyleverticalgap7000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-extraascender3000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-kernafterdegreeminus5000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-kernbeforedegree4000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-rulethickness8000.woff: Added.
imported/mathml-in-html5/fonts/radical-verticalgap6000-rulethickness1000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/radicals/root-parameters-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/radicals/root-parameters-1.html: Added.
platform/gtk/mathml/radical-fallback-expected.png: Updated to take into account new rendering.
platform/gtk/mathml/radical-fallback-expected.txt: Ditto.
platform/mac/mathml/presentation/mo-stretch-expected.txt: Ditto.
platform/mac/mathml/presentation/roots-expected.txt: Ditto.
platform/mac/mathml/radical-fallback-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/mo-stretch-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/roots-expected.txt: Ditto.
platform/ios-simulator/mathml/radical-fallback-expected.txt: Ditto.

5:22 AM Changeset in webkit [202976] by commit-queue@webkit.org

4 edits in trunk

Unreviewed, rolling out r202967.
https://bugs.webkit.org/show_bug.cgi?id=159556

This patch caused crashes in https tests on Windows (Requested
by perarne on #webkit).

Reverted changeset:

"[Win] The test http/tests/security/contentSecurityPolicy
/upgrade-insecure-requests/basic-upgrade.https.html is
failing."
https://bugs.webkit.org/show_bug.cgi?id=159510
http://trac.webkit.org/changeset/202967

3:42 AM Changeset in webkit [202975] by commit-queue@webkit.org

20 edits
4 adds
4 deletes in trunk

Generate WebCore builtin wrapper files
https://bugs.webkit.org/show_bug.cgi?id=159461

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-08
Reviewed by Brian Burg.

Source/JavaScriptCore:

Updating builtin generator to generate wrapper files used in WebCore (See WebCore change log).
Rebasing builtins generator test results according generator changes by activating wrapper file generation for
WebCore builtins tests.

CMakeLists.txt:
DerivedSources.make:
JavaScriptCore.xcodeproj/project.pbxproj:
Scripts/builtins/builtins.py: Adding new generators.
Scripts/builtins/builtins_generate_internals_wrapper_header.py: Added to generate WebCoreJSBuiltinInternals.h.
Scripts/builtins/builtins_generate_internals_wrapper_implementation.py: Added to generate WebCoreJSBuiltinInternals.cpp.
Scripts/builtins/builtins_generate_wrapper_header.py: Added to generate WebCoreJSBuiltins.h.
Scripts/builtins/builtins_generate_wrapper_implementation.py: Added to generate WebCoreJSBuiltins.cpp.
Scripts/generate-js-builtins.py: Adding new option to activate generation of the wrapper files.

(generate_bindings_for_builtins_files):

Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:

Source/WebCore:

No change of behavior.

Updating build system to handle new built-in generators without modifying WebCoreJSBuiltins* files.
The generator is now passed all built-ins at once so that wrapper files can be generated.
Removing WebCoreJSBuiltins* checked-in wrapper files.

CMakeLists.txt:
DerivedSources.make:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::addBuiltinGlobals):

bindings/js/JSDOMGlobalObject.h:
bindings/js/WebCoreJSBuiltinInternals.cpp: Removed.
bindings/js/WebCoreJSBuiltinInternals.h: Removed.
bindings/js/WebCoreJSBuiltins.cpp: Removed.
bindings/js/WebCoreJSBuiltins.h: Removed.

Tools:

Scripts/webkitpy/codegen/main.py:

(BuiltinsGeneratorTests.generate_from_js_builtins): Adding generate_wrapper option.
(BuiltinsGeneratorTests.run_tests): Using this option in WebCore test cases.

3:11 AM Changeset in webkit [202974] by Manuel Rego Casasnovas

14 edits
2 adds in trunk

[css-grid] Inline size is never indefinite during layout
https://bugs.webkit.org/show_bug.cgi?id=159253

Reviewed by Sergio Villar Senin.

Source/WebCore:

The issue is that the inline size of the grid container
is only indefinite while we're computing the intrinsic sizes.
During layout we should be able to resolve the percentage tracks
against that size. This makes Grid Layout compatible with regular blocks
regarding how inline percentages are resolved.

The patch passes the SizingOperation enum to RenderGrid::gridTrackSize().
That way we can know if we're computing the intrinsic sizes or not.

Test: fast/css-grid-layout/grid-container-percentage-columns.html

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::computeTrackSizesForDirection):
(WebCore::RenderGrid::computeIntrinsicLogicalWidths):
(WebCore::RenderGrid::computeIntrinsicLogicalHeight):
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::gridTrackSize):
(WebCore::RenderGrid::minSizeForChild):
(WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::tracksAreWiderThanMinTrackBreadth):
(WebCore::RenderGrid::rawGridTrackSize): Deleted.

rendering/RenderGrid.h:

LayoutTests:

Created a new test verifying the expected behavior. Updated the results
in a few tests too.

fast/css-grid-layout/grid-columns-rows-get-set-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/grid-columns-rows-get-set.html:
fast/css-grid-layout/grid-container-percentage-columns-expected.txt: Added.
fast/css-grid-layout/grid-container-percentage-columns.html: Added.
fast/css-grid-layout/named-grid-line-get-set-expected.txt:
fast/css-grid-layout/named-grid-line-get-set.html:
fast/css-grid-layout/percent-track-breadths-regarding-container-size-expected.txt:
fast/css-grid-layout/percent-track-breadths-regarding-container-size.html:

The results of this test now show some FAIL messages becase of a bug in
RenderBox::hasDefiniteLogicalHeight() (http://webkit.org/b/159251).

fast/css-grid-layout/resources/grid-columns-rows-get-set-multiple.js:
fast/css-grid-layout/resources/grid-columns-rows-get-set.js:

2:37 AM Changeset in webkit [202973] by fred.wang@free.fr

8 edits
7 adds in trunk

Use OpenType MATH constant AxisHeight.
https://bugs.webkit.org/show_bug.cgi?id=133567

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

We make RenderMathMLOperator and RenderMathMLTable use the OpenType MATH constant AxisHeight.
These are the only remaining cases to handle since RenderMathMLFraction already uses that constant.

Tests: imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html

imported/mathml-in-html5/mathml/presentation-markup/tables/table-axis-height.html

rendering/mathml/RenderMathMLBlock.cpp: Make RenderMathMLTable use the math axis

for its vertical alignment and update a bit the comments.
(WebCore::axisHeight): Move the code in a static function that can be called by
RenderMathMLBlock and RenderMathMLTable.
(WebCore::RenderMathMLBlock::mathAxisHeight): Use axisHeight.
(WebCore::RenderMathMLTable::firstLineBaseline): Ditto.

rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::stretchTo):

LayoutTests:

Import tests from the MathML in HTML5 test suite to verify the AxisHeight parameter.

imported/mathml-in-html5/fonts/math/axisheight5000-verticalarrow14000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/tables/table-axis-height.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-expected.txt: Added.

1:57 AM Changeset in webkit [202972] by Manuel Rego Casasnovas

6 edits in trunk

[css-grid] Disallow repeat() in grid-template shorthand
https://bugs.webkit.org/show_bug.cgi?id=159200

Reviewed by Sergio Villar Senin.

Source/WebCore:

As discussed on www-style, "repeat()" notation shouldn't be allowed
in the ASCII branch of the grid-template shorthand.
https://lists.w3.org/Archives/Public/www-style/2016May/0193.html

The patch uses an enum to invalidate "repeat()" when parsing
the grid-template shorthand.

Test: fast/css-grid-layout/grid-template-shorthand-get-set.html

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateColumns): Add enum.
(WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns): Pass "DisallowRepeat"
when calling parseGridTemplateColumns().
(WebCore::CSSParser::parseGridTrackList): Use enum to allow/disallow repeat.

css/CSSParser.h: Define the new enum and modify method signatures to use it,

setting it to "AllowRepeat" by default.

LayoutTests:

Modified test to follow the new behavior including new cases.

fast/css-grid-layout/grid-template-shorthand-get-set-expected.txt:
fast/css-grid-layout/grid-template-shorthand-get-set.html:

12:35 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

12:17 AM Changeset in webkit [202971] by jiewen_tan@apple.com

4 edits in trunk/Source

Define DYLD_MACOSX_VERSION_10_12
https://bugs.webkit.org/show_bug.cgi?id=159525
<rdar://problem/26250296>

Reviewed by Brent Fulgham.

Source/WebKit/mac:

WebView/WebView.mm:

(shouldConvertInvalidURLsToBlank):
Replace 0x000A0C00 with DYLD_MACOSX_VERSION_10_12.

Source/WTF:

wtf/spi/darwin/dyldSPI.h:

12:15 AM Changeset in webkit [202970] by fred.wang@free.fr

10 edits
14 adds in trunk

Add support for movablelimits.
https://bugs.webkit.org/show_bug.cgi?id=155542

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

Tests: mathml/presentation/displaystyle-1.html

mathml/presentation/displaystyle-2.html
mathml/presentation/displaystyle-3.html
mathml/presentation/mo-movablelimits-default.html
mathml/presentation/mo-movablelimits-dynamic.html
mathml/presentation/mo-movablelimits.html

mathml/MathMLTextElement.cpp:

(WebCore::MathMLTextElement::parseAttribute): Take into account change of movablelimits.

rendering/mathml/MathMLOperatorDictionary.h: Remove FIXME comment.
rendering/mathml/MathMLStyle.cpp:

(WebCore::MathMLStyle::updateStyleIfNeeded): Force relayout and width computation when a
displaystyle value change.

rendering/mathml/RenderMathMLOperator.h:

(WebCore::RenderMathMLOperator::shouldMoveLimits): Helper function to test if the operator
should have his limits moved when used as a base of munder/mover/munderover.

rendering/mathml/RenderMathMLScripts.cpp: Allow munderover/munder/mover elements to use

this class and take the same behavior as the corresponding msubsup/msub/sup except for
the *scriptshift attributes.
(WebCore::RenderMathMLScripts::RenderMathMLScripts):
(WebCore::RenderMathMLScripts::getBaseAndScripts):
(WebCore::RenderMathMLScripts::computePreferredLogicalWidths):
(WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
(WebCore::RenderMathMLScripts::layoutBlock):

rendering/mathml/RenderMathMLScripts.h: Allow some members to be accessible/overridden

by RenderMathMLUnderOver and add munderover/munder/mover in the kind.

rendering/mathml/RenderMathMLUnderOver.cpp:

(WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver): We use the code from
RenderMathMLScripts to initialize m_kind.
(WebCore::RenderMathMLUnderOver::shouldMoveLimits): New function to determine if the base
should move its limits.
(WebCore::RenderMathMLUnderOver::computePreferredLogicalWidths): We use the code from
RenderMathMLScripts when the base should move its limits.
(WebCore::RenderMathMLUnderOver::layoutBlock): We use the code from RenderMathMLScripts when
the base should move its limits. Also improve the early return for invalid markup.
(WebCore::RenderMathMLUnderOver::unembellishedOperator): Deleted. We use the code from RenderMathMLScripts.
(WebCore::RenderMathMLUnderOver::firstLineBaseline): Deleted. We use the code from RenderMathMLScripts.

rendering/mathml/RenderMathMLUnderOver.h: We now inherit from RenderMathMLScripts and can

just remove members that exist in the parent. We define shouldMoveLimits() to determine
when the layout should be done the same as RenderMathMLScripts. For now, we try and be
safe with the rest of the code by continuing to claim that we are not a RenderMathMLScripts.

LayoutTests:

We import some reftests from Mozilla and write more tests in order to verify the effect of
movablelimits. We also adjust one existing test due to change in how munderover handles
invalid markup.

mathml/presentation/displaystyle-1.html: Added. Imported from Mozilla. This verifies the

inheritance of displaystyle via its effect on movablelimits.

mathml/presentation/displaystyle-1-expected.html: Added.
mathml/presentation/displaystyle-2.html: Added. Imported from Mozilla. Test the effect of

displaystyle on munder, mover and munderover with a movablelimits base.

mathml/presentation/displaystyle-2-expected.html: Added.
mathml/presentation/displaystyle-3.html: Added. Imported from Mozilla. Test dynamic change

of displaystyle via its effect on movablelimits.

mathml/presentation/displaystyle-3-expected.html: Added.
mathml/presentation/mo-movablelimits-default.html: Added. Test that the default

movablelimits value from the operator dictionary is correctly read.

mathml/presentation/mo-movablelimits-default-expected.html: Added.
mathml/presentation/mo-movablelimits-dynamic.html: Added. Imported from Mozilla.

Test dynamic change of movablelimits.

mathml/presentation/mo-movablelimits-dynamic-expected.html: Added.
mathml/presentation/mo-movablelimits.html: Added. Basic test to check the effect of

movablelimits on munder.

mathml/presentation/mo-movablelimits-expected.html: Added.
mathml/presentation/underover-scriptshifts.html: Added. This verifies that script shifts

do not have any effect on munderover/mover/munder elements when their limits are rendered
as postscripts.

mathml/presentation/underover-scriptshifts-expected.html: Added.

12:05 AM Changeset in webkit [202969] by Hunseop Jeong

2 edits
1 delete in trunk/Tools

[EFL] Fix build when media-stream is enabled.
https://bugs.webkit.org/show_bug.cgi?id=159206

Bump up the openwebrtc to find the correct package.

Reviewed by Gyuyoung Kim.

efl/jhbuild.modules:
efl/patches/openwebrtc-clang-warning-fix.patch: Removed.

Jul 7, 2016:

11:32 PM Changeset in webkit [202968] by Gyuyoung Kim

23 edits in trunk/Source/WebCore

Clean up PassRefPtr in Modules/webaudio
https://bugs.webkit.org/show_bug.cgi?id=159540

Reviewed by Alex Christensen.

Purge PassRefPtr in webaudio directory.

No new tests, no behavior changes.

Modules/webaudio/AsyncAudioDecoder.h:
Modules/webaudio/AudioBasicProcessorNode.h:
Modules/webaudio/AudioBuffer.h:
Modules/webaudio/AudioBufferSourceNode.h:
Modules/webaudio/AudioListener.h:
Modules/webaudio/AudioParam.h:
Modules/webaudio/AudioParamTimeline.h:

(WebCore::AudioParamTimeline::ParamEvent::ParamEvent):

Modules/webaudio/AudioProcessingEvent.cpp:

(WebCore::AudioProcessingEvent::AudioProcessingEvent):

Modules/webaudio/AudioProcessingEvent.h:

(WebCore::AudioProcessingEvent::create):

Modules/webaudio/ChannelMergerNode.h:
Modules/webaudio/ChannelSplitterNode.h:
Modules/webaudio/GainNode.h:
Modules/webaudio/MediaElementAudioSourceNode.h:
Modules/webaudio/MediaStreamAudioDestinationNode.h:
Modules/webaudio/MediaStreamAudioSource.cpp:

(WebCore::MediaStreamAudioSource::addAudioConsumer):

Modules/webaudio/MediaStreamAudioSource.h:
Modules/webaudio/OfflineAudioCompletionEvent.cpp:

(WebCore::OfflineAudioCompletionEvent::create):
(WebCore::OfflineAudioCompletionEvent::OfflineAudioCompletionEvent):

Modules/webaudio/OfflineAudioCompletionEvent.h:
Modules/webaudio/OfflineAudioDestinationNode.h:
Modules/webaudio/OscillatorNode.h:
Modules/webaudio/PeriodicWave.h:
Modules/webaudio/ScriptProcessorNode.h:

11:28 PM Changeset in webkit [202967] by pvollan@apple.com

4 edits in trunk

[Win] The test http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade.https.html is failing.
https://bugs.webkit.org/show_bug.cgi?id=159510

Reviewed by Brent Fulgham.

Source/WebCore:

On Windows, validate certificate chain even when any https certificate is allowed.

platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::ResourceHandle::createCFURLConnection):

Tools:

Allow any https certificate when running tests.

DumpRenderTree/win/DumpRenderTree.cpp:

(runTest):

11:25 PM Changeset in webkit [202966] by commit-queue@webkit.org

8 edits
6 adds in trunk

padStart/padEnd with Infinity produces unexpected result
https://bugs.webkit.org/show_bug.cgi?id=159543

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-07
Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

builtins/GlobalOperations.js:

(globalPrivate.toLength):
Fix style.

builtins/StringPrototype.js:

(padStart):
(padEnd):
After all observable operations, and after empty string has been handled,
throw an out of memory error if the resulting string would be greater
than the maximum string size.

tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:

(shouldThrow): Deleted.

tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:

(shouldThrow):
(testMeta):

tests/es6/String.prototype_methods_String.prototype.padEnd.js:

(shouldThrow):
(TestToLength):
(TestMemoryLimits):
(TestMeta): Deleted.

tests/es6/String.prototype_methods_String.prototype.padStart.js:

(shouldThrow):
(TestToLength):
(TestMemoryLimits):
Replace incorrect shouldThrow(..., errorType) with explicit shouldThrow(..., errorMessage).
The old shouldThrow would incorrectly succeed if the expected error type was just "Error".
Now we explicitly check the error message.

LayoutTests:

js/script-tests/string-padend.js: Added.

(thisObject.toString):
(lengthObject.valueOf):
(fillObject.toString):

js/script-tests/string-padstart.js: Added.

(thisObject.toString):
(lengthObject.valueOf):
(fillObject.toString):

js/string-padend-expected.txt: Added.
js/string-padend.html: Added.
js/string-padstart-expected.txt: Added.
js/string-padstart.html: Added.

Add some basic String.prototype.padStart/padEnd test coverage
that is not just in the JavaScriptCore/tests/es6 directory.

11:23 PM Changeset in webkit [202965] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

11:22 PM Changeset in webkit [202964] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.2

New tag.

11:21 PM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

11:17 PM Changeset in webkit [202963] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

11:16 PM Changeset in webkit [202962] by fred.wang@free.fr

12 edits
16 adds in trunk

Bug 155792 - Basic implementation of mpadded
https://bugs.webkit.org/show_bug.cgi?id=155792

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Brent Fulgham.

Source/WebCore:

We implement a basic support for the mpadded element.
We support most of the attribute values except pseudo-units or negative values.

Tests: mathml/presentation/mpadded-1-2.html

mathml/presentation/mpadded-1.html
mathml/presentation/mpadded-2.html
mathml/presentation/mpadded-3.html
mathml/presentation/mpadded-unsupported-values.html
mathml/presentation/mpadded-dynamic.html

CMakeLists.txt: Add RenderMathMLPadded to the build system.
WebCore.xcodeproj/project.pbxproj: Ditto.
mathml/MathMLInlineContainerElement.cpp:

(WebCore::MathMLInlineContainerElement::createElementRenderer): Create the renderer
for mpadded.

mathml/mathattrs.in: Add voffset attribute.
mathml/mathtags.in: Make mpadded use MathMLInlineContainerElement.
rendering/RenderObject.h:

(WebCore::RenderObject::isRenderMathMLPadded): Define isRenderMathMLPadded.

rendering/mathml/RenderMathMLPadded.cpp: Added.

We do a simple implementation by overriding the behavior of RenderMathMLRow and forcing
relayout after attribute or style change.
(WebCore::RenderMathMLPadded::RenderMathMLPadded):
(WebCore::RenderMathMLPadded::computePreferredLogicalWidths):
(WebCore::RenderMathMLPadded::layoutBlock):
(WebCore::RenderMathMLPadded::updateFromElement):
(WebCore::RenderMathMLPadded::styleDidChange):
(WebCore::RenderMathMLPadded::firstLineBaseline):

rendering/mathml/RenderMathMLPadded.h: Added.

LayoutTests:

We import mpadded tests from Mozilla test suite.
We also add some tests for dynamic changes of mpadded attributes and to verify
that the mpadded element behaves as if it had an inferred <mrow>.
Finally, we check that fallback properly for negative and pseudo-unit values that
we do not support yet.

mathml/presentation/inferred-mrow-baseline.html: Check baseline for mpadded.
mathml/presentation/inferred-mrow-baseline-expected.txt: Ditto.
mathml/presentation/inferred-mrow-stretchy.html: Check stretching of operators for mpadded.
mathml/presentation/inferred-mrow-stretchy-expected.txt: Ditto.
mathml/presentation/mpadded-dynamic.html: Added. Verify dynamic change of mpadded attributes.
mathml/presentation/mpadded-dynamic-expected.html: Added. Ditto.
mathml/presentation/mpadded-unsupported-values.html: Added. Check negative and pseudo-unit values.
mathml/presentation/mpadded-unsupported-values-expected.html: Added.
mathml/presentation/mpadded-1-2-expected.html: Added.
mathml/presentation/mpadded-1-2.html: Added.
mathml/presentation/mpadded-1-expected.html: Added.
mathml/presentation/mpadded-1.html: Added.
mathml/presentation/mpadded-2-expected.html: Added.
mathml/presentation/mpadded-2.html: Added.
mathml/presentation/mpadded-3-expected.html: Added.
mathml/presentation/mpadded-3.html: Added.

10:51 PM Changeset in webkit [202961] by fred.wang@free.fr

7 edits
2 adds in trunk/Source/WebCore

Move MathML-specific code into a separate accessibility class
https://bugs.webkit.org/show_bug.cgi?id=159213

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Chris Fleizach.

Currently, MathML accessibility is completely handled in the generic AccessibilityRenderObject
and it's sometimes messy and unconvenient. Hence we move most of the MathML-specific code
into a separate AccessibilityMathMLElement class to facilitate future work and maintenance.

No new tests, already covered by existing tests.

CMakeLists.txt: Add new AccessibilityMathMLElement module.
WebCore.xcodeproj/project.pbxproj: Ditto.
accessibility/AccessibilityAllInOne.cpp: Ditto.
accessibility/AXObjectCache.cpp: Add MathML headers and create AccessibilityMathMLElement.

(WebCore::createFromRenderer): Create AccessibilityMathMLElement for MathML elements and
anonymous operators created by the mfenced element.

accessibility/AccessibilityMathMLElement.cpp: Added. This class handles all the MathML

elements as well as the anonymous operators created by the mfenced element. A boolean is
passed to the constructor to indicate whether we are in the latter case.
(WebCore::AccessibilityMathMLElement::AccessibilityMathMLElement):
(WebCore::AccessibilityMathMLElement::~AccessibilityMathMLElement):
(WebCore::AccessibilityMathMLElement::create):
(WebCore::AccessibilityMathMLElement::determineAccessibilityRole): Move handling of specific
MathElementRole and DocumentMathRole here.
(WebCore::AccessibilityMathMLElement::textUnderElement): Move retrieval of text from the
anonymous operators here.
(WebCore::AccessibilityMathMLElement::stringValue): Ditto.
(WebCore::AccessibilityMathMLElement::isIgnoredElementWithinMathTree): Move the determination
of ignored math elements here.
(WebCore::AccessibilityMathMLElement::isMathFraction): Moved from AccessibilityRenderObject.
(WebCore::AccessibilityMathMLElement::isMathFenced): Ditto.
(WebCore::AccessibilityMathMLElement::isMathSubscriptSuperscript): Ditto.
(WebCore::AccessibilityMathMLElement::isMathRow): Ditto.
(WebCore::AccessibilityMathMLElement::isMathUnderOver): Ditto.
(WebCore::AccessibilityMathMLElement::isMathSquareRoot): Ditto.
(WebCore::AccessibilityMathMLElement::isMathToken): Ditto.
(WebCore::AccessibilityMathMLElement::isMathRoot): Ditto.
(WebCore::AccessibilityMathMLElement::isMathOperator): Ditto.
(WebCore::AccessibilityMathMLElement::isAnonymousMathOperator): Move the determination of
anonymous operators here. We now just return the boolean passed at creation time.
(WebCore::AccessibilityMathMLElement::isMathFenceOperator): Moved from
AccessibilityRenderObject.
(WebCore::AccessibilityMathMLElement::isMathSeparatorOperator): Ditto.
(WebCore::AccessibilityMathMLElement::isMathText): Ditto.
(WebCore::AccessibilityMathMLElement::isMathNumber): Ditto.
(WebCore::AccessibilityMathMLElement::isMathIdentifier): Ditto.
(WebCore::AccessibilityMathMLElement::isMathMultiscript): Ditto.
(WebCore::AccessibilityMathMLElement::isMathTable): Ditto.
(WebCore::AccessibilityMathMLElement::isMathTableRow): Ditto.
(WebCore::AccessibilityMathMLElement::isMathTableCell): Ditto.
(WebCore::AccessibilityMathMLElement::isMathScriptObject): Ditto.
(WebCore::AccessibilityMathMLElement::isMathMultiscriptObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathRadicandObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathRootIndexObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathNumeratorObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathDenominatorObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathUnderObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathOverObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathBaseObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathSubscriptObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathSuperscriptObject): Ditto.
(WebCore::AccessibilityMathMLElement::mathFencedOpenString): Ditto.
(WebCore::AccessibilityMathMLElement::mathFencedCloseString): Ditto.
(WebCore::AccessibilityMathMLElement::mathPrescripts): Ditto.
(WebCore::AccessibilityMathMLElement::mathPostscripts): Ditto.
(WebCore::AccessibilityMathMLElement::mathLineThickness): Ditto.

accessibility/AccessibilityMathMLElement.h: Added.
accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::isIgnoredElementWithinMathTree): The cases of
AccessibilityMathMLElement objects are now handled in the derived class. We remove the case
of text node since the MathML code no longer creates anonymous text nodes after r202420.
Anonymous block inserted into RenderMathMLBlocks to honor CSS rules are not AccessibilityMathMLElements
and it does not seem safe to modify AXObjectCache::createFromRenderer to force that. Hence
we still need to be handle them here.
(WebCore::AccessibilityRenderObject::textUnderElement): This code is moved into AccessibilityMathMLElement.
(WebCore::AccessibilityRenderObject::stringValue): Ditto.
(WebCore::AccessibilityRenderObject::determineAccessibilityRole): Ditto.
(WebCore::AccessibilityRenderObject::isMathElement): Deleted.
(WebCore::AccessibilityRenderObject::isMathFraction): Deleted.
(WebCore::AccessibilityRenderObject::isMathFenced): Deleted.
(WebCore::AccessibilityRenderObject::isMathSubscriptSuperscript): Deleted.
(WebCore::AccessibilityRenderObject::isMathRow): Deleted.
(WebCore::AccessibilityRenderObject::isMathUnderOver): Deleted.
(WebCore::AccessibilityRenderObject::isMathSquareRoot): Deleted.
(WebCore::AccessibilityRenderObject::isMathToken): Deleted.
(WebCore::AccessibilityRenderObject::isMathRoot): Deleted.
(WebCore::AccessibilityRenderObject::isMathOperator): Deleted.
(WebCore::AccessibilityRenderObject::isAnonymousMathOperator): Deleted.
(WebCore::AccessibilityRenderObject::isMathFenceOperator): Deleted.
(WebCore::AccessibilityRenderObject::isMathSeparatorOperator): Deleted.
(WebCore::AccessibilityRenderObject::isMathText): Deleted.
(WebCore::AccessibilityRenderObject::isMathNumber): Deleted.
(WebCore::AccessibilityRenderObject::isMathIdentifier): Deleted.
(WebCore::AccessibilityRenderObject::isMathMultiscript): Deleted.
(WebCore::AccessibilityRenderObject::isMathTable): Deleted.
(WebCore::AccessibilityRenderObject::isMathTableRow): Deleted.
(WebCore::AccessibilityRenderObject::isMathTableCell): Deleted.
(WebCore::AccessibilityRenderObject::isMathScriptObject): Deleted.
(WebCore::AccessibilityRenderObject::isMathMultiscriptObject): Deleted.
(WebCore::AccessibilityRenderObject::mathRadicandObject): Deleted.
(WebCore::AccessibilityRenderObject::mathRootIndexObject): Deleted.
(WebCore::AccessibilityRenderObject::mathNumeratorObject): Deleted.
(WebCore::AccessibilityRenderObject::mathDenominatorObject): Deleted.
(WebCore::AccessibilityRenderObject::mathUnderObject): Deleted.
(WebCore::AccessibilityRenderObject::mathOverObject): Deleted.
(WebCore::AccessibilityRenderObject::mathBaseObject): Deleted.
(WebCore::AccessibilityRenderObject::mathSubscriptObject): Deleted.
(WebCore::AccessibilityRenderObject::mathSuperscriptObject): Deleted.
(WebCore::AccessibilityRenderObject::mathFencedOpenString): Deleted.
(WebCore::AccessibilityRenderObject::mathFencedCloseString): Deleted.
(WebCore::AccessibilityRenderObject::mathPrescripts): Deleted.
(WebCore::AccessibilityRenderObject::mathPostscripts): Deleted.
(WebCore::AccessibilityRenderObject::mathLineThickness): Deleted.

accessibility/AccessibilityRenderObject.h: Remove declarations of functions that are now

overridden in AccessibilityMathMLElement. Make isIgnoredElementWithinMathTree virtual so that
it can be reimplemented in AccessibilityMathMLElement.

10:40 PM Changeset in webkit [202960] by fred.wang@free.fr

14 edits
1 copy
10 adds in trunk

Implement an internal style property for displaystyle.
https://bugs.webkit.org/show_bug.cgi?id=133845

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Brent Fulgham.

Source/WebCore:

Tests: mathml/opentype/large-operators-displaystyle-dynamic.html

mathml/opentype/large-operators-displaystyle.html

This is based on a patch by Alejandro G. Castro <alex@igalia.com>

CMakeLists.txt: Add MathMLStyle to the build system.
WebCore.xcodeproj/project.pbxproj: ditto.
mathml/MathMLInlineContainerElement.cpp:

(WebCore::MathMLInlineContainerElement::parseAttribute): Resolve the mathml style when the
displaystyle attribute changes on the mtable or mstyle elements.

mathml/MathMLInlineContainerElement.h: Define parseAttribute.
mathml/MathMLMathElement.cpp:

(WebCore::MathMLMathElement::MathMLMathElement): Indicate that we have custom style.
(WebCore::MathMLMathElement::parseAttribute): Resolve the mathml style when the display or
displaystyle attributes change on the math element.
(WebCore::MathMLMathElement::didAttachRenderers): Resolve the mathml style when one
renderer is attached.

mathml/MathMLMathElement.h: Declare parseAttribute and didAttachRenderers.
mathml/mathattrs.in: Declare the display and displaystyle attributes.
rendering/mathml/MathMLStyle.cpp: Added.

(WebCore::MathMLStyle::MathMLStyle): New class to handle custom MathML style.
(WebCore::MathMLStyle::create):
(WebCore::MathMLStyle::setDisplayStyle): Helper function to take the displaystyle from
the specified rendered.
(WebCore::MathMLStyle::resolveMathMLStyleTree): Helper function to resolve the custom
MathML style in renderer subtree.
(WebCore::MathMLStyle::getMathMLParentNode): Helper function to get a MathML ancestor of
the specified renderer.
(WebCore::MathMLStyle::updateStyleIfNeeded): Helper function to update the style of the
specified renderer if needed.
(WebCore::MathMLStyle::resolveMathMLStyle): Resolve the MathML style of a given renderer.
For displaystyle, we inherit the value of the parent except for the cases mentioned in the
MathML recommendation.

rendering/mathml/MathMLStyle.h: New class header for custom MathML style.

Only displaystyle is supported for now.

rendering/mathml/RenderMathMLBlock.cpp: Add a member and getter for custom MathML style.

(WebCore::RenderMathMLBlock::RenderMathMLBlock):

rendering/mathml/RenderMathMLBlock.h: ditto.

(WebCore::RenderMathMLBlock::mathMLStyle):

rendering/mathml/RenderMathMLMath.h: Add definition to use the syntax is<RenderMathMLMath>.
rendering/mathml/RenderMathMLOperator.h:

(WebCore::RenderMathMLOperator::isLargeOperatorInDisplayStyle): Do not rerturn true when
the operator is not in displaystyle.

rendering/mathml/RenderMathMLRoot.h: Make updateStyle public, so that it can be called

by MathMLStyle::updateStyleIfNeeded.

rendering/mathml/RenderMathMLUnderOver.h: Add definition to use the syntax

is<RenderMathMLUnderOver>.

LayoutTests:

This is based on a patch by Alejandro G. Castro <alex@igalia.com>

Add two new tests to verify that the displaystyle property is correctly inherited
on various MathML elements.
large-operators-displaystyle verifies that large operators are only drawn bigger when
the displaystyle is true.
large-operators-displaystyle-dynamic verifies the same displaystyle is calculated when
the display and displaystyle attributes are changed dynamically.

mathml/opentype/large-operators-displaystyle-dynamic-expected.html: Added.
mathml/opentype/large-operators-displaystyle-dynamic.html: Added.
mathml/opentype/large-operators-displaystyle-expected.txt: Added.
imported/mathml-in-html5/fonts/math/largeop-displayoperatorminheight5000.woff: Added.
imported/mathml-in-html5/mathml/relations/css-styling/displaystyle-1.html: Added.
imported/mathml-in-html5/mathml/relations/css-styling/displaystyle-1-expected.txt: Added.

10:20 PM Changeset in webkit [202959] by fred.wang@free.fr

5 edits in trunk/LayoutTests

Rebaseline some MathML tests on Windows after r202934

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07

platform/win/mathml/opentype/opentype-stretchy-expected.txt:
platform/win/mathml/opentype/vertical-expected.txt:
platform/win/mathml/presentation/mo-stretch-expected.txt:
platform/win/mathml/presentation/roots-expected.txt:

10:14 PM Changeset in webkit [202958] by fred.wang@free.fr

5 edits in trunk/LayoutTests

Rebaseline MathML pixels tests
https://bugs.webkit.org/show_bug.cgi?id=159348

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07

platform/efl/mathml/opentype/opentype-stretchy-expected.txt:
platform/efl/mathml/opentype/vertical-expected.txt:
platform/efl/mathml/presentation/mo-stretch-expected.txt:
platform/efl/mathml/presentation/roots-expected.txt:

10:12 PM Changeset in webkit [202957] by Beth Dakin

5 edits in trunk

API Test DoNotLeakWebView.ViewThatLoadsEditableArea times out on macOS Sierra
https://bugs.webkit.org/show_bug.cgi?id=159532
-and corresponding-
rdar://problem/27177179

Reviewed by Tim Horton.

Source/WebKit/mac:

WebView/WebView.mm:

(-[WebView showCandidates:forString:inRect:forSelectedRange:view:completionHandler:]):
(-[WebView forceRequestCandidatesForTesting]):
(-[WebView shouldRequestCandidates]):

WebView/WebViewPrivate.h:

Tools:

TestWebKitAPI/Tests/mac/ViewWithEditableAreaLeak.mm:

(-[DoNotLeakFrameLoadDelegate webView:didFinishLoadForFrame:]):

9:10 PM Changeset in webkit [202956] by benjamin@webkit.org

3 edits
3 adds in trunk

[JSC] String.prototype[Symbol.iterator] needs a name
https://bugs.webkit.org/show_bug.cgi?id=159541

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

A man needs a name.
Spec: https://tc39.github.io/ecma262/#sec-string.prototype-@@iterator

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):

LayoutTests:

js/script-tests/string-iterator.js: Added.
js/string-iterator-expected.txt: Added.
js/string-iterator.html: Added.

8:47 PM Changeset in webkit [202955] by msaboff@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

REGRESSION(184445): Need to insert a StoreBarrier when we don't know child's epoch
https://bugs.webkit.org/show_bug.cgi?id=159537

Reviewed by Benjamin Poulain.

We weren't checking the case of a child node with a null epoch. The problem surfaces
when the base node of a PutByVal variant has a non-null epoch, because it represents an
allocation in the current function, while the child of the same node has an unknown epoch.
Added a check that the child node is not null before comparing the epochs of the base and
child nodes.

The added test creates the problem circumstance by doing a full GC to place an array in
remembered space, allocating a new object followed by an eden GC. The new object is
only referenced by the array and therefore won't be visited Without the store barrier.
The test may crash or more likely get the wrong answer with the bug.

dfg/DFGStoreBarrierInsertionPhase.cpp:
tests/stress/regress-159537.js: Added test.

(MyNumber):
(MyNumber.prototype.plusOne):
(bar):
(foo):
(test):

8:13 PM Changeset in webkit [202954] by commit-queue@webkit.org

7 edits in trunk

Unexpected "Out of memory" error for "x".repeat(-1)
https://bugs.webkit.org/show_bug.cgi?id=159529

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-07
Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

builtins/StringPrototype.js:

(globalPrivate.repeatSlowPath):
(repeat):
Move the @toInteger and range checking to the always path,
since the spec does say it should always happen. Also remove
the duplication of the fast path here.

runtime/StringPrototype.cpp:

(JSC::repeatCharacter):
Remove unused function.

(JSC::stringProtoFuncRepeatCharacter):
ASSERT if given a negative number. This is a private function
only used internally.

tests/stress/string-repeat-edge-cases.js:

(shouldThrow):
Update expected error message.

LayoutTests:

Extended test coverage for:

function properties
fast path with invalid counts
observable side effects for fast path which were wrong before

js/script-tests/string-repeat.js:
js/string-repeat-expected.txt:

6:57 PM Changeset in webkit [202953] by rniwa@webkit.org

24 edits in trunk

Replace scoped flag in Event by composed flag
https://bugs.webkit.org/show_bug.cgi?id=158415

Reviewed by Chris Dumez.

Source/WebCore:

Replace scoped flag with composed flag and negate its meaning per the latest spec:
https://dom.spec.whatwg.org/#dom-event-composed
https://github.com/w3c/webcomponents/issues/513

In the old spec, every event was assumed to be "composed" (crosses shadow boundaries)
by default and there was scoped flag which prevented the event from crossing bondaries,
and there was a handful of events for which scoped was set true when dispatched by UA.

In the new spec, every event is assumed to be "scoped" and a handful of user-initiated
events set composed flag to true, which is also exposed in EventInit dictionary.
relatedTargetScoped flag has been removed. New behavior is identical to when this flag
was set to true.

No new tests since existing tests are updated to test the new flag and behavior.

dom/CompositionEvent.cpp:

(WebCore::CompositionEvent::isCompositionEvent): Added.

dom/CompositionEvent.h:
dom/Event.cpp:

(WebCore::Event::Event): Initialize m_composed. Also re-ordered m_type and m_isInitialized
for better packing.
(WebCore::Event::composed): Renamed from Event::composed. We return true whenever composed
is set to true in EventInit, or the engine is dispatching an user-initiated event listed in:
https://github.com/w3c/webcomponents/issues/513#issuecomment-224183937
as well as keypress, cut, paste, and, copy as discussed in:
https://github.com/w3c/webcomponents/issues/513#issuecomment-230988170
(WebCore::Event::isCompositionEvent): Added.

dom/Event.h:

(WebCore::Event::composed): Added.
(WebCore::Event::scoped): Deleted.
(WebCore::Event::relatedTargetScoped): Deleted.
(WebCore::Event): Reordered m_type and m_isInitialized for better packing. Added m_composed
and removed m_scoped and m_relatedTargetScoped.

dom/Event.idl:
dom/EventPath.cpp:

(WebCore::shouldEventCrossShadowBoundary): Returns true if the event did not originate from
a shadow tree (this event entered the current shadow tree via a slot so we need to proceed with
the normal bubble path outside the shadow tree) or composed flag is set true.
(WebCore::EventPath::EventPath): m_event no longer exists, which was only used to get the value
of relatedTargetScoped which has been removed.
(WebCore::EventPath::setRelatedTarget): Behave as if relatedTargetScoped is always set true
since the flag has been removed.

dom/EventPath.h:
dom/FocusEvent.cpp:

(WebCore::FocusEvent::relatedTargetScoped): Deleted.

dom/FocusEvent.h:
dom/MouseEvent.cpp:

(WebCore::MouseEvent::relatedTargetScoped): Deleted.

dom/MouseEvent.h:

LayoutTests:

Updated the tests to reflect the rename of scoped to composed and the negation of its semantics.
Now every Event is assumed to be scoped / non-composed by default, and we need to explicitly set
composed to true in order for events to cross shadow boundaries.

Also, every Event behaves as if related target is assumed to be scoped in the old terminology
althoug the flag no longer exists.

fast/shadow-dom/Extensions-to-Event-Interface-expected.txt:
fast/shadow-dom/Extensions-to-Event-Interface.html: Removed a test case that was testing

relatedTargetScoped to false since this flag no longer exists.

fast/shadow-dom/MouseEvent-prototype-offsetX-offsetY.html:
fast/shadow-dom/event-inside-shadow-tree.html:
fast/shadow-dom/event-inside-slotted-node.html:
fast/shadow-dom/event-with-related-target.html:
fast/shadow-dom/trusted-event-scoped-flags-expected.txt:
fast/shadow-dom/trusted-event-scoped-flags.html:
fast/xmlhttprequest/xmlhttprequest-get-expected.txt:
http/tests/workers/worker-importScriptsOnError-expected.txt:
inspector/model/remote-object-get-properties-expected.txt:

6:56 PM Changeset in webkit [202952] by Chris Dumez

6 edits in trunk

tdody.deleteRow(-1) and tr.deleteCell(-1) should not throw when there are no rows / cells
https://bugs.webkit.org/show_bug.cgi?id=159527
<rdar://problem/27232261>

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/semantics/tabular-data/the-tbody-element/deleteRow-expected.txt:
web-platform-tests/html/semantics/tabular-data/the-tr-element/deleteCell-expected.txt:

Source/WebCore:

tdody.deleteRow(-1) and tr.deleteCell(-1) should not throw when there
are no rows / cells:

Firefox and Chrome do not throw but WebKit was throwing.

No new tests, rebaselined existing tests.

html/HTMLTableRowElement.cpp:

(WebCore::HTMLTableRowElement::deleteCell):

html/HTMLTableSectionElement.cpp:

(WebCore::HTMLTableSectionElement::deleteRow):

6:15 PM Changeset in webkit [202951] by Chris Dumez

5 edits in trunk

HTMLTitleElement.text should only account for direct children Text nodes
https://bugs.webkit.org/show_bug.cgi?id=159536

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/semantics/document-metadata/the-title-element/title.text-01-expected.txt:
web-platform-tests/html/semantics/document-metadata/the-title-element/title.text-02-expected.txt:

Source/WebCore:

HTMLTitleElement.text should only account for direct children Text nodes:

Firefox and Chrome match the specification. However, WebKit accounted for all
Text nodes that are descendants, not just children. This patch aligns our
behavior with the specification and other browsers.

No new tests, rebaselined existing tests.

html/HTMLTitleElement.cpp:

(WebCore::HTMLTitleElement::text):

5:20 PM Changeset in webkit [202950] by dino@apple.com

7 edits in trunk

REGRESSION(r200769): animations are no longer overridden
https://bugs.webkit.org/show_bug.cgi?id=159450
<rdar://problem/27120570>

Reviewed by Zalan Bujtas.

Source/WebCore:

The change in r200769 removed a lot of the prefixing variant
handling, but unfortunately we can't be completely rid
of it until we alias the prefixed transitions and animations
to the non-prefixed form. For example, setting the prefixed
shorthand has to reset the non-prefixed longhands.

The fix was to explicitly call the variant forms when
parsing such longhands, and make sure that MutableStyleProperties
removes all prefixed variants when removing shorthands.

The existing test was amended to cover this case:
fast/css/shorthand-omitted-initial-value-overrides-shorthand.html

css/CSSParser.cpp:

(WebCore::CSSParser::parseAnimationShorthand):
(WebCore::CSSParser::addPropertyWithPrefixingVariant):
(WebCore::CSSParser::parseTransitionShorthand):

css/CSSParser.h:
css/StyleProperties.cpp:

(WebCore::MutableStyleProperties::removeShorthandProperty):

LayoutTests:

Update an existing test to exercise a prefixed form applying
to non-prefixed longhands.

fast/css/shorthand-omitted-initial-value-overrides-shorthand-expected.txt:
fast/css/shorthand-omitted-initial-value-overrides-shorthand.html:

5:12 PM Changeset in webkit [202949] by achristensen@apple.com

2 edits in trunk/Source/WebCore

Fix CMake build.

PlatformMac.cmake:

4:58 PM Changeset in webkit [202948] by mmaxfield@apple.com

3 edits in trunk/LayoutTests

Test gardening after r202826
https://bugs.webkit.org/show_bug.cgi?id=159538
<rdar://problem/27197375>

Unreviewed.

editing/style/text-indent.html:
platform/mac-wk1/TestExpectations:

4:58 PM Changeset in webkit [202947] by achristensen@apple.com

2 edits in trunk/Source/WebCore

Fix CMake build.

PlatformMac.cmake:

4:48 PM Changeset in webkit [202946] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.1

New tag.

4:34 PM Changeset in webkit [202945] by fred.wang@free.fr

4 edits
2 adds in trunk

[Font Loading] The callback passed to document.fonts.ready should always be called
https://bugs.webkit.org/show_bug.cgi?id=158884

Reviewed by Dean Jackson.

Source/WebCore:

The boolean was simply not being reset when loads start.

Test: fast/text/font-face-set-ready-fire.html

css/FontFaceSet.cpp:

(WebCore::FontFaceSet::startedLoading):

css/FontFaceSet.h:

LayoutTests:

fast/text/font-face-set-ready-fire-expected.txt: Added.
fast/text/font-face-set-ready-fire.html: Added.

4:26 PM Changeset in webkit [202944] by aestes@apple.com

35 edits
20 adds
18 deletes in trunk

[Content Filtering] Load blocked pages more like other error pages are loaded
https://bugs.webkit.org/show_bug.cgi?id=159485
<rdar://problem/26014076>

Reviewed by Brady Eidson.

Source/WebCore:

This patch changes blocked page loading to behave more like loading other error pages.
Specifically:

didFailProvisionalLoad is dispatched with a new, non-cancellation error code.
The blocked page is loaded immediately after dispatching didFailProvisionalLoad, which prevents FrameLoader from creating a new back-forward list item for the substitute data load.
A substitute data load initiated by the client for the blocked URL is ignored if ContentFilter will display its own error page.
A file: URL is used instead of a custom scheme for the base URL of the blocked page, since some clients expect this.

Updated existing tests to capture frame load delegate callbacks and the back forward list.
Added new API tests: ContentFiltering.LoadAlternate*.

English.lproj/Localizable.strings: Added a WebKitErrorFrameLoadBlockedByContentFilter description.
Resources/ContentFilterBlockedPage.html: Added.
WebCore.xcodeproj/project.pbxproj: Added ContentFilterBlockedPage.html as a frameowrk resource.
loader/ContentFilter.cpp:

(WebCore::ContentFilter::stopFilteringMainResource): Only set m_state to Stopped if not
already Blocked, so that we don't forget this ContentFilter was blocked when calling
cancelMailResourceLoad() in didDecide().
(WebCore::ContentFilter::didDecide): Moved code from DocumentLoader::contentFilterDidBlock() to here.
Created a blockedByContentFilterError() and called cancelMainResourceLoad().
(WebCore::blockedPageURL): Returned a file: URL to ContentFilterBlockedPage.html in WebCore.framework.
(WebCore::ContentFilter::continueAfterSubstituteDataRequest): If the substitute data load
is for the same failingURL as the currently-displayed blocked page, ignore it.
(WebCore::ContentFilter::handleProvisionalLoadFailure): Load the blocked page if m_state is Blocked
and the ResourceError matches the error we used when previously calling cancelMainResourceLoad().
(WebCore::ContentFilter::unblockHandler): Deleted.
(WebCore::ContentFilter::replacementData): Deleted.
(WebCore::ContentFilter::unblockRequestDeniedScript): Deleted.

loader/ContentFilter.h:
loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::contentFilter): Returned m_contentFilter.
(WebCore::DocumentLoader::installContentFilterUnblockHandler): Deleted.
(WebCore::DocumentLoader::contentFilterDidBlock): Deleted.

loader/DocumentLoader.h:
loader/EmptyClients.h: Added a default implementation of blockedByContentFilterError().
loader/FrameLoader.cpp:

loader/FrameLoader.h:
loader/FrameLoaderClient.h:
loader/NavigationScheduler.cpp:

(WebCore::ScheduledSubstituteDataLoad::ScheduledSubstituteDataLoad): Deleted.
(WebCore::NavigationScheduler::scheduleSubstituteDataLoad): Deleted.

loader/NavigationScheduler.h:
loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy): Ignored a substitute data load for a
failing URL if ContentFilter::continueAfterSubstituteDataRequest() returns false.

Source/WebKit/mac:

Misc/WebKitErrors.h: Defined WebKitErrorFrameLoadBlockedByContentFilter.
Misc/WebKitErrors.m:

(registerErrors): Registered WebKitErrorDescriptionFrameLoadBlockedByContentFilter.

WebCoreSupport/WebFrameLoaderClient.h:
WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::blockedByContentFilterError): Returned a ResourceError for WebKitErrorFrameLoadBlockedByContentFilter.

Source/WebKit2:

Shared/API/c/WKErrorRef.h: Defined kWKErrorCodeFrameLoadBlockedByContentFilter.
UIProcess/Cocoa/WebProcessProxyCocoa.mm:

(WebKit::WebProcessProxy::platformPathsWithAssumedReadAccess): Added the resource directories
of WebCore.framework and WebKit.framework as paths with assumed read access.

UIProcess/WebProcessProxy.cpp:

UIProcess/WebProcessProxy.h:
WebProcess/WebCoreSupport/WebErrors.h:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::blockedByContentFilterError): Called WebKit::blockedByContentFilterError().

WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:

(WebKit::blockedByContentFilterError): Returned a ResourceError for kWKErrorCodeFrameLoadBlockedByContentFilter.

Tools:

TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/ContentFiltering.mm:

(-[LoadAlternateNavigationDelegate webView:didFailProvisionalNavigation:withError:]):
(-[LoadAlternateNavigationDelegate webView:didFinishNavigation:]):
(loadAlternateTest):
(TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/ContentFilteringPlugIn.mm:

(-[MockContentFilterEnabler initWithCoder:]):

TestWebKitAPI/Tests/mac/ContentFiltering.mm: Added.

LayoutTests:

Changed allow-* and block-* tests from ref tests to text tests so that they can capture
frame load delegate callbacks and the back forward list.

contentfiltering/allow-after-add-data-expected.html: Removed.
contentfiltering/allow-after-add-data-expected.txt: Added.
contentfiltering/allow-after-finished-adding-data-expected.html: Removed.
contentfiltering/allow-after-finished-adding-data-expected.txt: Added.
contentfiltering/allow-after-response-expected.html: Removed.
contentfiltering/allow-after-response-expected.txt: Added.
contentfiltering/allow-after-will-send-request-expected.html: Removed.
contentfiltering/allow-after-will-send-request-expected.txt: Added.
contentfiltering/allow-never-expected.html: Removed.
contentfiltering/allow-never-expected.txt: Added.
contentfiltering/block-after-add-data-expected.html: Removed.
contentfiltering/block-after-add-data-expected.txt: Added.
contentfiltering/block-after-add-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-add-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-response-expected.html: Removed.
contentfiltering/block-after-response-expected.txt: Added.
contentfiltering/block-after-response-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-response-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-expected.html: Removed.
contentfiltering/block-after-will-send-request-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.txt: Added.
contentfiltering/block-never-expected.html: Removed.
contentfiltering/block-never-expected.txt: Added.
contentfiltering/resources/contentfiltering.js: Added testRunner calls to dump as text,

dump frame load callbacks, and dump the back forward list. Changed from loading data: URLs
to file: URLs in the test iframe.

4:22 PM Changeset in webkit [202943] by benjamin@webkit.org

4 edits
3 adds in trunk

[JSC] Array.prototype[Symbol.unscopables] should have the "includes" property
https://bugs.webkit.org/show_bug.cgi?id=159504

Reviewed by Keith Miller.

Source/JavaScriptCore:

The property "includes" was missing.
Spec: https://tc39.github.io/ecma262/#sec-array.prototype-@@unscopables

runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):

tests/stress/unscopables.js:

LayoutTests:

js/array-unscopables-properties-expected.txt: Added.
js/array-unscopables-properties.html: Added.
js/script-tests/array-unscopables-properties.js: Added.

4:06 PM Changeset in webkit [202942] by Ryan Haddad

2 edits in trunk/LayoutTests

Land test expectations for rdar://problem/27197375.

platform/mac-wk1/TestExpectations:

4:01 PM Changeset in webkit [202941] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking media/video-main-content-allow-then-deny.html as failing on ElCapitan+
https://bugs.webkit.org/show_bug.cgi?id=159533

Unreviewed test gardening.

platform/mac/TestExpectations:

3:59 PM Changeset in webkit [202940] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Followup to r202939.
https://bugs.webkit.org/show_bug.cgi?id=159526

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::didFailLoading):
We need the correct destination id when sending a message.

3:42 PM Changeset in webkit [202939] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Fix crash when sending failure message to closed WebProcess
https://bugs.webkit.org/show_bug.cgi?id=159526
<rdar://problem/26767037>

Reviewed by Brady Eidson.

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::didFailLoading):
Check to see if there is a connection before using it to send a message.
Sometimes it was null.
I think this could be tested if we had real network loading from TestWebKitAPI
by cancelling slow loads and closing WebProcesses around the same time, but no such infrastructure exists yet.

3:37 PM Changeset in webkit [202938] by achristensen@apple.com

2 edits in trunk/Source/WebKit/win

Fix Windows build after r202930.
https://bugs.webkit.org/show_bug.cgi?id=158776

WebView.cpp:

(WebView::initWithFrame):

3:36 PM Changeset in webkit [202937] by Chris Dumez

20 edits
5 deletes in trunk

td / th should be exposed as HTMLTableCellElement objects
https://bugs.webkit.org/show_bug.cgi?id=159518
<rdar://problem/27225436>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C tests now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/semantics/interfaces-expected.txt:

Source/WebCore:

td / th should be exposed as HTMLTableCellElement objects:

We were using HTMLTableDataCellElement / HTMLTableHeaderCellElement
sub-types.

Firefox and Chrome match the current specification.

We actually introduced these types recently via Bug 148859 to align
with an older version of the HTML specification. However, it seems the
specification has been updated to match Firefox / Chrome in the mean
time.

Since we have not shipped those subtypes yet, the compatibility risk is
low.

No new tests, rebaselined existing tests.

CMakeLists.txt:
DerivedSources.cpp:
DerivedSources.make:
WebCore.xcodeproj/project.pbxproj:
html/HTMLElementsAllInOne.cpp:
html/HTMLTableCellElement.cpp:

(WebCore::HTMLTableCellElement::create):
(WebCore::HTMLTableCellElement::scope):
(WebCore::HTMLTableCellElement::setScope):
(WebCore::HTMLTableCellElement::setRowSpanForBindings): Deleted.

html/HTMLTableCellElement.h:
html/HTMLTableCellElement.idl:
html/HTMLTableDataCellElement.h: Removed.
html/HTMLTableDataCellElement.idl: Removed.
html/HTMLTableHeaderCellElement.cpp: Removed.
html/HTMLTableHeaderCellElement.h: Removed.
html/HTMLTableHeaderCellElement.idl: Removed.
html/HTMLTableRowElement.cpp:

(WebCore::HTMLTableRowElement::insertCell):

html/HTMLTagNames.in:

3:15 PM Changeset in webkit [202936] by sbarati@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

ToThis constant folding in DFG is incorrect when the structure indicates that toThis is overridden
https://bugs.webkit.org/show_bug.cgi?id=159501
<rdar://problem/27109354>

Reviewed by Mark Lam.

We *cannot* constant fold ToThis when the structure of an object
indicates that toThis() is overridden. isToThisAnIdentity() inside
AbstractInterpreterInlines accidentally wrote the opposite rule.
The rule was written as we can constant fold ToThis only when
toThis() is overridden. To fix the bug, we must write the rule
as isToThisAnIdentity() can only be true as long as the structure
set indicates that no structures override toThis().

We could probably get more clever in the future and notice
when we're dealing with a constant |this| values. For example,
a ToThis might occur on a constant JSLexicalEnvironment. We could
implement the rules of JSLexicalEnvironment's toThis() implementation
inside AI/constant folding.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::isToThisAnIdentity):

tests/stress/to-this-on-constant-lexical-environment.js: Added.

(foo.bar):
(foo.inner):
(foo):

3:05 PM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:49 PM Changeset in webkit [202935] by beidson@apple.com

4 edits
5 adds in trunk

Modern IDB: When IDBDatabase objects are garbage collected, they don't close their server connection.
<rdar://problem/25910345> and https://bugs.webkit.org/show_bug.cgi?id=159523

Reviewed by Alex Christensen.

Source/WebCore:

Tests: storage/indexeddb/modern/gc-closes-database-private.html

storage/indexeddb/modern/gc-closes-database.html

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::IDBDatabase): New logging.
(WebCore::IDBDatabase::~IDBDatabase): Close server connection.
(WebCore::IDBDatabase::fireVersionChangeEvent): New logging.
(WebCore::IDBDatabase::dispatchEvent): New logging.

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::openDatabase): New logging.

LayoutTests:

storage/indexeddb/modern/gc-closes-database-expected.txt: Added.
storage/indexeddb/modern/gc-closes-database-private-expected.txt: Added.
storage/indexeddb/modern/gc-closes-database-private.html: Added.
storage/indexeddb/modern/gc-closes-database.html: Added.
storage/indexeddb/modern/resources/gc-closes-database.js: Added.

2:48 PM Changeset in webkit [202934] by fred.wang@free.fr

36 edits in trunk

Refactor layout functions to avoid using flexbox in MathML
https://bugs.webkit.org/show_bug.cgi?id=153991

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Brent Fulgham.

Source/WebCore:

No new tests, already covered by existing tests.

css/mathml.css:

(math): Change inline mathematical formulas from inline-flex to inline.
(math[display="block"]): Change display mathematical formulas from flex to block and
remove flexbox property justify-content.
(ms, mspace, mtext, mi, mn, mo, mrow, mfenced, mfrac, msub, msup, msubsup, mmultiscripts,

mprescripts, none, munder, mover, munderover, msqrt, mroot, merror, mphantom, mstyle)
menclose, semantics, mpadded, maction): In order to render properly, all children of the
classes derived from RenderMathMLBlock must now be block-level. So we add more elements in
this list and update the display property.

(mtd > *): However, we use inline-block for children of the cell so that the text-align

property is taken into account.

rendering/RenderBox.cpp:

(WebCore::RenderBox::computeLogicalWidthInRegion): Add a special case for RenderMathMLBlock
to preserve the old behavior.
(WebCore::RenderBox::sizesLogicalWidthToFitContent): Ditto.

rendering/RenderFlexibleBox.h: No need to override layoutBlock anymore.
rendering/mathml/RenderMathMLBlock.cpp: Include LayoutRepainter header for use in layoutBlock.

(WebCore::RenderMathMLBlock::RenderMathMLBlock): Inherit from RenderBlock and ensure that
our children are block-level.
(WebCore::RenderMathMLBlock::~RenderMathMLBlock): Added.
(WebCore::RenderMathMLBlock::baselinePosition): If the baselinefirstLineBaseline() is
undefined, just returns 0.
(WebCore::RenderMathMLBlock::paint): Call RenderBlock::paint.
(WebCore::RenderMathMLBlock::layoutItems): Implement a simplified version of
RenderFlexibleBox::layoutItems where we assume horizontal layout for all children.
(WebCore::RenderMathMLBlock::layoutBlock): Add a basic implementation based on
RenderFlexibleBox::layoutBlock.
(WebCore::RenderMathMLBlock::renderName): Deleted. There is now a simple implementation in the header.

rendering/mathml/RenderMathMLBlock.h: Use RenderBlock instead of RenderFlexibleBox and

define layout functions. Define avoidsFloats and canDropAnonymousBlockChild to preserve
the old behavior and remove isFlexibleBoxImpl.

rendering/mathml/RenderMathMLFenced.cpp:

(WebCore::RenderMathMLFenced::createMathMLOperator): Use block for anonymous RenderMathMLOperator.

rendering/mathml/RenderMathMLRow.cpp:

(WebCore::RenderMathMLRow::layoutRowItems): No need to handle the flexbox case anymore.
(WebCore::RenderMathMLRow::paintChildren): Deleted. We now just use RenderBlock::paintChildren.

rendering/mathml/RenderMathMLRow.h:
rendering/mathml/RenderMathMLFraction.cpp:

(WebCore::RenderMathMLFraction::paintChildren): Deleted. We now just use RenderBlock::paintChildren.

rendering/mathml/RenderMathMLFraction.h:
rendering/mathml/RenderMathMLRoot.cpp:

(WebCore::RenderMathMLRoot::paintChildren): Deleted. We now just use RenderBlock::paintChildren.

rendering/mathml/RenderMathMLRoot.h:
rendering/mathml/RenderMathMLScripts.cpp:

(WebCore::RenderMathMLScripts::paintChildren): Deleted. We now just use RenderBlock::paintChildren.

rendering/mathml/RenderMathMLScripts.h:
rendering/mathml/RenderMathMLUnderOver.cpp:

(WebCore::RenderMathMLUnderOver::paintChildren): Deleted. We now just use RenderBlock::paintChildren.

rendering/mathml/RenderMathMLUnderOver.h:

LayoutTests:

Update expectations of some MathML tests to take into account the
removal of some line breaks and a better computation of the width of
MathML expressions with vertical stretchy operators.

mathml/presentation/stretchy-depth-height-expected.txt:
platform/gtk/mathml/opentype/opentype-stretchy-expected.png:
platform/gtk/mathml/opentype/opentype-stretchy-expected.txt:
platform/gtk/mathml/opentype/vertical-expected.png:
platform/gtk/mathml/opentype/vertical-expected.txt:
platform/gtk/mathml/presentation/mo-stretch-expected.png:
platform/gtk/mathml/presentation/mo-stretch-expected.txt:
platform/gtk/mathml/presentation/roots-expected.png:
platform/gtk/mathml/presentation/roots-expected.txt:
platform/ios-simulator/mathml/opentype/opentype-stretchy-expected.png:
platform/ios-simulator/mathml/opentype/opentype-stretchy-expected.txt:
platform/ios-simulator/mathml/presentation/mo-stretch-expected.txt:
platform/mac/mathml/opentype/opentype-stretchy-expected.png:
platform/mac/mathml/opentype/opentype-stretchy-expected.txt:
platform/mac/mathml/presentation/mo-stretch-expected.png:
platform/mac/mathml/presentation/mo-stretch-expected.txt:
accessibility/mac/mathml-elements-expected.txt:
imported/blink/fast/text/output-isolate-at-end-of-line-crash-expected.txt:

2:28 PM Changeset in webkit [202933] by commit-queue@webkit.org

5 edits
2 adds in trunk

Web Inspector, regression: JS/JSON pretty-printing sporadically broken in STP8
https://bugs.webkit.org/show_bug.cgi?id=159511
<rdar://problem/27218435>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-07
Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

UserInterface/Workers/Formatter/FormatterWorker.js:

(FormatterWorker.prototype.formatJavaScript):
Attempt to format invalid JSON that can be evaluated to an object.

LayoutTests:

inspector/formatting/formatting-json-expected.txt: Added.
inspector/formatting/formatting-json.html: Added.

2:26 PM Changeset in webkit [202932] by timothy@apple.com

5 edits in trunk/Source/WebInspectorUI

Web Inspector: scrolled Snapshot list is reset to top and drawn blank after switching back from Snapshot Comparison view
https://bugs.webkit.org/show_bug.cgi?id=158218
rdar://problem/26545000

Reviewed by Brian Burg.

UserInterface/Views/ClusterContentView.js:

(WebInspector.ClusterContentView.prototype.get scrollableElements): Added.
A default implementation for all cluster views.

UserInterface/Views/DOMStorageContentView.js:

(WebInspector.DOMStorageContentView.prototype.get scrollableElements): Deleted.
This was duplicated in the class, removed one.

UserInterface/Views/HeapAllocationsTimelineView.js:

(WebInspector.HeapAllocationsTimelineView): Initialize _snapshotListScrollTop.
(WebInspector.HeapAllocationsTimelineView.prototype.get scrollableElements): Added. Return elements
based on what is showing.

(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotList): Restore the scroll position
of the DataGrid after it is added to the view.

(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotTimelineRecord): Save the scroll position
of the DataGrid before it is removed from the view.

UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView.prototype.get scrollableElements): Deleted. Handled by the base class now.

2:24 PM Changeset in webkit [202931] by Antti Koivisto

7 edits
2 adds in trunk

REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
https://bugs.webkit.org/show_bug.cgi?id=159519

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/inline/trailing-floats-inline-crash.html

rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::checkFloatsInCleanLine):

Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.

rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
If it is combined with br the existing invalidation that invalidates the next and previous line may
not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.

rendering/RootInlineBox.h:

(WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):

rendering/TrailingFloatsRootInlineBox.h:
rendering/style/RenderStyle.h:

(WebCore::RenderStyle::deletionHasBegun):

Expose the bit in debug.

LayoutTests:

fast/inline/trailing-floats-inline-crash-expected.txt: Added.
fast/inline/trailing-floats-inline-crash.html: Added.

2:09 PM Changeset in webkit [202930] by commit-queue@webkit.org

42 edits
2 copies
1 move in trunk/Source

Use SocketProvider to create WebSocketChannels
https://bugs.webkit.org/show_bug.cgi?id=158776

Patch by Alex Christensen <achristensen@webkit.org> on 2016-07-07
Reviewed by Brent Fulgham.

Source/WebCore:

This patch should have no change in behavior except making an InvalidStateError in
conditions where we should not be able to do networking, like in a detached frame.
It just replaces ThreadableWebSocketChannel::create with SocketProvider::createWebSocketChannel
which does the same thing as ThreadableWebSocketChannel::create for Mac and
Windows WebKit1. The WebKit2 implementation is the same right now, but it will
be replaced by a proxy that will do the WebSocket operations in the NetworkProcess.

Modules/websockets/ThreadableWebSocketChannel.cpp: Removed.
Modules/websockets/ThreadableWebSocketChannel.h:

(WebCore::ThreadableWebSocketChannel::ThreadableWebSocketChannel):

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::connect):

Modules/websockets/WebSocketChannel.h:
Modules/websockets/WorkerThreadableWebSocketChannel.h:
WebCore.xcodeproj/project.pbxproj:
dom/Document.cpp:

(WebCore::Document::idbConnectionProxy):
(WebCore::Document::socketProvider):
(WebCore::Document::canNavigate):

dom/Document.h:

(WebCore::Document::notifyRemovePendingSheetIfNeeded):

dom/ScriptExecutionContext.h:
inspector/InspectorOverlay.cpp:

(WebCore::InspectorOverlay::overlayPage):

loader/EmptyClients.cpp:

(WebCore::EmptyEditorClient::registerRedoStep):
(WebCore::EmptySocketProvider::createWebSocketChannel):

loader/EmptyClients.h:
page/Page.h:
page/PageConfiguration.cpp:

(WebCore::PageConfiguration::PageConfiguration):

page/PageConfiguration.h:
page/SocketProvider.h:

(WebCore::SocketProvider::~SocketProvider):

svg/graphics/SVGImage.cpp:

(WebCore::SVGImage::dataChanged):

workers/DedicatedWorkerGlobalScope.cpp:

(WebCore::DedicatedWorkerGlobalScope::create):
(WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope):

workers/DedicatedWorkerGlobalScope.h:
workers/DedicatedWorkerThread.cpp:

(WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
(WebCore::DedicatedWorkerThread::createWorkerGlobalScope):
(WebCore::DedicatedWorkerThread::runEventLoop):

workers/DedicatedWorkerThread.h:
workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::WorkerGlobalScope):
(WebCore::WorkerGlobalScope::disableEval):
(WebCore::WorkerGlobalScope::socketProvider):
(WebCore::WorkerGlobalScope::idbConnectionProxy):

workers/WorkerGlobalScope.h:

(WebCore::WorkerGlobalScope::script):

workers/WorkerMessagingProxy.cpp:

(WebCore::WorkerMessagingProxy::startWorkerGlobalScope):

workers/WorkerThread.cpp:

(WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
(WebCore::WorkerThread::WorkerThread):
(WebCore::WorkerThread::idbConnectionProxy):
(WebCore::WorkerThread::socketProvider):

workers/WorkerThread.h:

(WebCore::WorkerThread::workerGlobalScope):

Source/WebKit:

PlatformMac.cmake:
PlatformWin.cmake:
WebKit.xcodeproj/project.pbxproj:

Source/WebKit/mac:

Misc/WebSocketProvider.mm: Copied from Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp.

(WebSocketProvider::createWebSocketChannel):
(WebCore::ThreadableWebSocketChannel::create): Deleted.

Misc/WebSocketProvider.h:
WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(-[WebView initSimpleHTMLDocumentWithStyle:frame:preferences:groupName:]):

Source/WebKit/win:

WebSocketProvider.cpp: Copied from Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp.

(WebSocketProvider::createWebSocketChannel):
(WebCore::ThreadableWebSocketChannel::create): Deleted.

WebSocketProvider.h:

Source/WebKit2:

CMakeLists.txt:
WebKit2.xcodeproj/project.pbxproj:
WebProcess/Network/WebSocketProvider.cpp: Copied from Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp.

(WebKit::WebSocketProvider::createWebSocketChannel):
(WebCore::ThreadableWebSocketChannel::create): Deleted.

WebProcess/Network/WebSocketProvider.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::m_shouldDispatchFakeMouseMoveEvents):

1:53 PM Changeset in webkit [202929] by Ryan Haddad

3 edits
4 deletes in trunk

Unreviewed, rolling out r202905 and r202911.
https://bugs.webkit.org/show_bug.cgi?id=159522

This test is fails on El Capitan and Sierra WK1 (Requested by
ryanhaddad on #webkit).

Reverted changesets:

"Add a test for media control dropoff"
https://bugs.webkit.org/show_bug.cgi?id=151287
http://trac.webkit.org/changeset/202905

"Add a test for media control dropoff"
https://bugs.webkit.org/show_bug.cgi?id=151287
http://trac.webkit.org/changeset/202911

Patch by Commit Queue <commit-queue@webkit.org> on 2016-07-07

1:13 PM Changeset in webkit [202928] by bshafiei@apple.com

2 edits in branches/safari-602.1.40-branch/Source/WebCore

Merged r202923. rdar://problem/27221109

12:32 PM Changeset in webkit [202927] by commit-queue@webkit.org

22 edits in trunk/Source

<img> with a wide gamut PDF does not display using a wide gamut color space
https://bugs.webkit.org/show_bug.cgi?id=158983
<rdar://problem/25720247>

Patch by Antoine Quint <Antoine Quint> on 2016-07-07
Reviewed by Dean Jackson.

Source/WebCore:

Calls to ImageBuffer::createCompatibleBuffer() that do not provide an explicit
color space will now infer the color space from the provided graphics context
on platforms using CG. The method signature that takes in a GraphicsContext
without a color space is now split into a CG-specified implementation and a
Cairo one to avoid having diverging platform code in ImageBuffer.cpp.

Some call sites need to provide an explicit color space still, so we add a new
ImageBuffer::createCompatibleBuffer() that allows for that while inferring
sizing and scaling from a GraphicsContext.

All signatures of ImageBuffer::createCompatibleBuffer() are losing the
hasAlpha parameter which was always ignored. All call sites that were using
hasAlpha have been updated.

In addition, we make all the IOSurface and IOSurfacePool code, which is
CG-specific, use the plaform-specific type CGColorSpaceRef instead of ColorSpace
so that we may pick up on the color space copied over from the graphics context
in the CG-specific implementation of ImageBuffer::createCompatibleBuffer().

html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawTextInternal):

platform/graphics/BitmapImage.cpp:

(WebCore::BitmapImage::drawPattern):

platform/graphics/GradientImage.cpp:

(WebCore::GradientImage::drawPattern):

platform/graphics/ImageBuffer.cpp:

(WebCore::ImageBuffer::createCompatibleBuffer):

platform/graphics/ImageBuffer.h:
platform/graphics/NamedImageGeneratedImage.cpp:

(WebCore::NamedImageGeneratedImage::drawPattern):

platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBuffer::createCompatibleBuffer):

platform/graphics/cg/IOSurfacePool.cpp:

(WebCore::surfaceMatchesParameters):
(WebCore::IOSurfacePool::takeSurface):

platform/graphics/cg/IOSurfacePool.h:
platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::createCompatibleBuffer):
(WebCore::ImageBuffer::ImageBuffer):

platform/graphics/cocoa/IOSurface.h:
platform/graphics/cocoa/IOSurface.mm:

(WebCore::IOSurface::surfaceFromPool):
(WebCore::IOSurface::create):
(WebCore::IOSurface::createFromSendRight):
(WebCore::IOSurface::createFromSurface):
(WebCore::IOSurface::createFromImage):
(WebCore::IOSurface::IOSurface):
(WebCore::IOSurface::ensurePlatformContext):

platform/mac/ThemeMac.mm:

(WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):

platform/spi/cg/CoreGraphicsSPI.h:
rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::paintFillLayerExtended):

rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::paintProgressBar):

rendering/svg/SVGRenderingContext.cpp:

(WebCore::SVGRenderingContext::bufferForeground):

svg/graphics/SVGImage.cpp:

(WebCore::SVGImage::drawPatternForContainer):

Source/WebKit2:

ColorSpace parameters have been replaced with CGColorSpaceRef parameters for IOSurface.

Shared/mac/RemoteLayerBackingStore.mm:

(WebKit::RemoteLayerBackingStore::decode):
(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _takeViewSnapshot]):
(-[WKWebView _snapshotRect:intoImageOfWidth:completionHandler:]):

12:03 PM Changeset in webkit [202926] by benjamin@webkit.org

5 edits in trunk

[JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
https://bugs.webkit.org/show_bug.cgi?id=159505

Reviewed by Mark Lam.

Source/JavaScriptCore:

The code was using (value)|0 which is effectively a ToInt32.
This fails on large integers and +-Infinity.

Spec: https://tc39.github.io/ecma262/#sec-array.prototype.includes

builtins/ArrayPrototype.js:

(includes):

LayoutTests:

js/array-includes-expected.txt:
js/script-tests/array-includes.js:

12:00 PM Changeset in webkit [202925] by andersca@apple.com

1 edit in trunk/Source/WebKit2/ChangeLog

Use the correct radar number.

11:57 AM Changeset in webkit [202924] by Beth Dakin

3 edits in trunk/Source/WebCore

All fullscreen videos should be able the control the controls manager
https://bugs.webkit.org/show_bug.cgi?id=159496
-and corresponding-
rdar://problem/27009446

Reviewed by Eric Carlson.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::fullscreenModeChanged):

html/MediaElementSession.cpp:

(WebCore::MediaElementSession::canControlControlsManager):

11:53 AM Changeset in webkit [202923] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

Crash due to HTMLMediaElement at JavaScriptCore: JSC::JSLockHolder::JSLockHolder
https://bugs.webkit.org/show_bug.cgi?id=159517
<rdar://problem/27221109>

Reviewed by Eric Carlson.

When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
elements which get this interruption have pending promises created during a previous call to
play(), these promises get rejected.

However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
are in an inconsistent state: their script execution context (the document) has been
destroyed, leading to the crash in JSLockHolder.

When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
clear the list of pending Promises.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::contextDestroyed):

11:47 AM Changeset in webkit [202922] by andersca@apple.com

6 edits in trunk/Source/WebKit2

Memory corruption destroying PaymentCoordinator
https://bugs.webkit.org/show_bug.cgi?id=159516
rdar://problem/27222857

Reviewed by Tim Horton.

Introduce a new MessageReceiverMap::removeMessageReceiver that takes a MessageReceiver
and removes all traces of it in the message receiver map. Use it in the WebPaymentCoordinator destructor.

Platform/IPC/MessageReceiverMap.cpp:

(IPC::MessageReceiverMap::removeMessageReceiver):

Platform/IPC/MessageReceiverMap.h:
Shared/ChildProcess.cpp:

(WebKit::ChildProcess::removeMessageReceiver):

Shared/ChildProcess.h:
WebProcess/ApplePay/WebPaymentCoordinator.cpp:

(WebKit::WebPaymentCoordinator::~WebPaymentCoordinator):

11:30 AM Changeset in webkit [202921] by bshafiei@apple.com

12 edits in branches/safari-602.1.40-branch/Source

Merge patch for rdar://problem/27175583.

11:26 AM Changeset in webkit [202920] by pvollan@apple.com

2 edits in trunk/Tools

Unreviewed: add myself to the reviewers list.

Scripts/webkitpy/common/config/contributors.json:

11:01 AM Changeset in webkit [202919] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

11:00 AM Changeset in webkit [202918] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

Facebook videos without audio tracks will sometimes cause playback controls to appear.
https://bugs.webkit.org/show_bug.cgi?id=159437

Reviewed by Eric Carlson.

Because updatePlaybackControlsManager() will cause the session manager to walk through all
the outstanding sessions asking if it canControlControlsManager(), some sessions will say
they can control the controls manager if we are currently processing a user gesture. This is
obviously not intended (there may be a user gesture to un-mute video 1, but an unrelated
video 2 should not be allowed to use that use gesture to fulfill its own requirements.)

So in those situations where conditions may have changed and updatePlaybackControlsManager()
needs to be called, instead schedule the update for the next run loop.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setMuted):
(WebCore::HTMLMediaElement::layoutSizeChanged):
(WebCore::HTMLMediaElement::updatePlayState):
(WebCore::HTMLMediaElement::createMediaPlayer):
(WebCore::HTMLMediaElement::scheduleUpdatePlaybackControlsManager):

html/HTMLMediaElement.h:

10:30 AM Changeset in webkit [202917] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

Unreviewed build fix after r202908. Fix the webPlaybackSessionInterfaceMac @property.

platform/mac/WebPlaybackControlsManager.h:
platform/mac/WebPlaybackControlsManager.mm:

10:27 AM Changeset in webkit [202916] by benjamin@webkit.org

3 edits
3 adds in trunk

[JSC] String.prototype.normalize should have a length of zero
https://bugs.webkit.org/show_bug.cgi?id=159506

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

Spec: https://tc39.github.io/ecma262/#sec-string.prototype.normalize
The argument is optional, the length should be zero.

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):

LayoutTests:

js/script-tests/string-normalize.js: Added.

(listener.toString):

js/string-normalize-expected.txt: Added.
js/string-normalize.html: Added.

10:23 AM Changeset in webkit [202915] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

10:20 AM Changeset in webkit [202914] by bshafiei@apple.com

1 copy in branches/safari-602.1.40-branch

New Branch.

10:19 AM Changeset in webkit [202913] by pvollan@apple.com

2 edits in trunk/Tools

[Win] The test http/tests/loading/main-resource-delegates-on-back-navigation.html is failing.
https://bugs.webkit.org/show_bug.cgi?id=159509

Reviewed by Alex Christensen.

We should always insert the url in the url map when identifierForInitialRequest
is called. Otherwise we can end up with identifiers not having an entry in the
url map when urls are written to the test output file.

DumpRenderTree/win/ResourceLoadDelegate.cpp:

(ResourceLoadDelegate::identifierForInitialRequest):

10:19 AM Changeset in webkit [202912] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40

New tag.

9:24 AM Changeset in webkit [202911] by eric.carlson@apple.com

1 edit
2 adds in trunk/LayoutTests

Add a test for media control dropoff
https://bugs.webkit.org/show_bug.cgi?id=151287
<rdar://problem/23544666>

Unreviewed El Capitan-specific test results after r202905.

platform/mac-elcapitan/media/controls: Added.
platform/mac-elcapitan/media/controls/inline-elements-dropoff-order-expected.txt: Added.

9:24 AM Changeset in webkit [202910] by commit-queue@webkit.org

6 edits in trunk

[Fetch API] Response constructor should throw in case of bad reason phrase
https://bugs.webkit.org/show_bug.cgi?id=159508

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-07
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/response/response-error-expected.txt:

Source/WebCore:

Covered by rebased test.

Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::initializeWith): Validating reason phrase with new routine.
Throwing a TypeError in case of error.

platform/network/HTTPParsers.cpp:

(WebCore::isValidReasonPhrase): Added to validate reason phrase according
https://tools.ietf.org/html/rfc7230#section-3.1.2

platform/network/HTTPParsers.h:

9:03 AM Changeset in webkit [202909] by commit-queue@webkit.org

4 edits in trunk

[Fetch API] Response.redirect should throw a RangeError in case of bad status code
https://bugs.webkit.org/show_bug.cgi?id=159507

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-07
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/response/response-static-redirect-expected.txt:

Source/WebCore:

Covered by rebased test.

Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::redirect): Throw a RangeError in case of bad status.

9:00 AM Changeset in webkit [202908] by jer.noble@apple.com

5 edits in trunk/Source/WebCore

Ownership between WebPlaybackSessionInterfaceMac and WebPlaybackControlsManager is backwards.
https://bugs.webkit.org/show_bug.cgi?id=159441

Reviewed by Eric Carlson.

The WebPlaybackControlsManager should own the WebPlaybackSessionInterfaceMac, and not
vice versa.

platform/mac/WebPlaybackControlsManager.h:
platform/mac/WebPlaybackControlsManager.mm:

(-[WebPlaybackControlsManager webPlaybackSessionInterfaceMac]):
(-[WebPlaybackControlsManager setWebPlaybackSessionInterfaceMac:]):

platform/mac/WebPlaybackSessionInterfaceMac.h:
platform/mac/WebPlaybackSessionInterfaceMac.mm:

(WebCore::WebPlaybackSessionInterfaceMac::playBackControlsManager):

7:29 AM Changeset in webkit [202907] by fred.wang@free.fr

2 edits
2 adds
1 delete in trunk/LayoutTests

Replace reftest scripts-height.html with script tests
https://bugs.webkit.org/show_bug.cgi?id=159423

We import a test from the MathML in HTML5 test suite to replace the test scripts-height.html
and make results more reliable, explicit and accurate. This avoids the failure on iOS.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Martin Robinson.

imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-4-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-4.html: Added.
mathml/presentation/scripts-height.html: Removed.
platform/ios-simulator/TestExpectations: Remove failure expectation.

7:26 AM Changeset in webkit [202906] by fred.wang@free.fr

3 edits
4 adds
1 delete in trunk/LayoutTests

Replace multiscripts-positions.html reftest with script tests
https://bugs.webkit.org/show_bug.cgi?id=159418

We import more tests from the MathML in HTML5 test suite to replace
and extend the reftest testing metrics in the mmultiscripts element.
This allows to make such tests work on OS X and iOS.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Martin Robinson.

imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-2-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-2.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-3-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-3.html: Added.
mathml/presentation/multiscripts-positions.html: Removed.
platform/ios-simulator/TestExpectations: Remove failure for multiscripts-positions.
platform/mac/TestExpectations: Ditto.

7:21 AM Changeset in webkit [202905] by eric.carlson@apple.com

3 edits
4 adds in trunk

Add a test for media control dropoff
https://bugs.webkit.org/show_bug.cgi?id=151287
<rdar://problem/23544666>

Reviewed by Antoine Quint.

Source/WebCore:

Test: media/controls/inline-elements-dropoff-order.html

Modules/mediacontrols/mediaControlsApple.js: Expose more state to testing.

LayoutTests:

media/controls/inline-elements-dropoff-order-expected.txt: Added.
media/controls/inline-elements-dropoff-order.html: Added.
platform/mac-yosemite/media/controls: Added.
platform/mac-yosemite/media/controls/inline-elements-dropoff-order-expected.txt: Added.

7:20 AM Changeset in webkit [202904] by fred.wang@free.fr

8 edits
2 adds in trunk/LayoutTests

Rewrite the tests of scripts-subsup.html
https://bugs.webkit.org/show_bug.cgi?id=159202

The tests for script metrics in scripts-subsup.html are very unreliable and difficult to
debug. They currently fail on all platforms. We remove them and import a test from the
MathML in HTML5 test suite that verifies equivalent features in a more reliable and
understandable way. The equivalence test for msubsup and empty script is not preserved as
the current code does not actually try to achieve this equivalence.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Martin Robinson.

imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/subsup-1.html: Added.
mathml/presentation/scripts-subsup-expected.html: Remove the tests for metrics.
mathml/presentation/scripts-subsup.html: Ditto.
platform/gtk/TestExpectations: Remove failure for scripts-subsup.html.
platform/ios-simulator-wk1/TestExpectations: Ditto.
platform/ios-simulator/TestExpectations: Ditto.
platform/mac/TestExpectations: Ditto.
platform/win/TestExpectations: Ditto.

7:09 AM Changeset in webkit [202903] by fred.wang@free.fr

7 edits in trunk/LayoutTests

Improve test mathml/presentation/tokenElements-background-color.html
https://bugs.webkit.org/show_bug.cgi?id=130693

We use the Ahem font to make tokenElements-background-color.html more reliable. However, we
remove the case of italic m because Ahem does not contain the required character U+1D45A.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Martin Robinson.

mathml/presentation/tokenElements-background-color-expected.html:
mathml/presentation/tokenElements-background-color.html:
platform/ios-simulator-wk1/TestExpectations:
platform/ios-simulator-wk2/TestExpectations:
platform/mac/TestExpectations:
platform/win/TestExpectations:

7:01 AM Changeset in webkit [202902] by fred.wang@free.fr

1 edit
1 move in trunk/LayoutTests

Fix the name of mathml-in-dashboard-expected.txt for iOS.

Unreviewed test gardening.

platform/ios-simulator/mathml/mathml-in-dashboard-expected.txt: Renamed from LayoutTests/platform/ios-simulator/mathml/mathml-in-dashboard-actual.txt.

6:04 AM Changeset in webkit [202901] by commit-queue@webkit.org

4 edits in trunk/Source/WebCore

[GTK] Painting a video into a canvas doesn't work when accelerated compositing is enabled
https://bugs.webkit.org/show_bug.cgi?id=159405

Patch by Miguel Gomez <magomez@igalia.com> on 2016-07-07
Reviewed by Xabier Rodriguez-Calvar.

Implement video frame painting to the canvas when accelerated compositing is enabled.

Already covered by existent tests.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::handleMessage):
Replace custom enumeration for the video rotation with the ImageOrientation class.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
Replace the orientation value comparison with ImageOrientation::usesWidthAsHeight().
(WebCore::MediaPlayerPrivateGStreamerBase::paint):
Perform the frame painting taking into account the video orientation tag.
(WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):
Rotate the native image before returning it.
(WebCore::MediaPlayerPrivateGStreamerBase::setVideoSourceOrientation):
Replace custom enumeration for the video rotation with the ImageOrientation class.
(WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase): Deleted.
Remove orientation initialization.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

Remove custom enumeration for the video orientation.

4:57 AM Changeset in webkit [202900] by fred.wang@free.fr

5 edits in trunk/LayoutTests

Tweak mathml/presentation/semantics.html to make it pass on iOS
https://bugs.webkit.org/show_bug.cgi?id=159457

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-07
Reviewed by Sergio Villar Senin.

mathml/presentation/semantics-expected.html: Force a line break between the two tests.
mathml/presentation/semantics.html: Ditto.
platform/ios-simulator-wk1/TestExpectations: Remove failure expectation.
platform/ios-simulator-wk2/TestExpectations: Ditto.

1:32 AM Changeset in webkit [202899] by Csaba Osztrogonác