⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Jul 21, 2016:

10:36 PM MathML/Early_2016_Refactoring edited by fred.wang@free.fr
(diff)
10:33 PM Changeset in webkit [203553] by fred.wang@free.fr
  • 19 edits
    2 copies in trunk/Source/WebCore

Move parsing of accentunder and accent attributes from renderer to element classes
​https://bugs.webkit.org/show_bug.cgi?id=159625

Patch by Frederic Wang <​fwang@igalia.com> on 2016-07-21
Reviewed by Brent Fulgham.

We introduce a new MathMLUnderOverElement that is used for elements munder, mover and
munderover in order to create RenderMathMLUnderOver and parse and expose the values of the
accent and accentunder attributes. This is one more step toward moving MathML attribute
parsing to the DOM (bug 156536). We also do minor clean-up for this and previous renderer
classes that no longer do attribute parsing: the MathMLNames namespace is no longer necessary
and constructors can take a more accurate element type.

No new tests, already covered by existing test.

  • CMakeLists.txt: Add MathMLUnderOverElement files.
  • WebCore.xcodeproj/project.pbxproj: Ditto.
  • mathml/MathMLAllInOne.cpp: Ditto.
  • mathml/MathMLElement.cpp:

(WebCore::MathMLElement::cachedBooleanAttribute): Add parsing of boolean attributes.

  • mathml/MathMLElement.h: New type and helper functions for boolean attributes.
  • mathml/MathMLInlineContainerElement.cpp:

(WebCore::MathMLInlineContainerElement::createElementRenderer): Remove handling of
under/over/underover elements.

  • mathml/MathMLScriptsElement.cpp:

(WebCore::MathMLScriptsElement::MathMLScriptsElement): Remove inline keyword to avoid link
errors now that MathMLUnderOverElement overrides that class.

  • mathml/MathMLScriptsElement.h: Allow MathMLUnderOverElement to override this class.
  • mathml/MathMLUnderOverElement.cpp:

(WebCore::MathMLUnderOverElement::MathMLUnderOverElement):
(WebCore::MathMLUnderOverElement::create):
(WebCore::MathMLUnderOverElement::accent): Helper function to access the accent value.
(WebCore::MathMLUnderOverElement::accentUnder): Helper function to access the accentunder value.
(WebCore::MathMLUnderOverElement::parseAttribute): Make accent and accentunder dirty.
(WebCore::MathMLUnderOverElement::createElementRenderer): Create RenderMathMLUnderOver

  • mathml/MathMLUnderOverElement.h:
  • mathml/mathtags.in: Map under/over/underover to MathMLUnderOverElement.
  • rendering/mathml/RenderMathMLFraction.cpp: Remove MathMLNames and make the constructor

take a MathMLFractionElement.
(WebCore::RenderMathMLFraction::RenderMathMLFraction):

  • rendering/mathml/RenderMathMLFraction.h:
  • rendering/mathml/RenderMathMLPadded.cpp: Remove MathMLNames and make the constructor

take a MathMLPaddedElement.
(WebCore::RenderMathMLPadded::RenderMathMLPadded):

  • rendering/mathml/RenderMathMLPadded.h:
  • rendering/mathml/RenderMathMLScripts.cpp: Remove MathMLNames and make the constructor

take a MathMLScriptsElement. Also rename scriptsElement() to element().
(WebCore::RenderMathMLScripts::RenderMathMLScripts):
(WebCore::RenderMathMLScripts::element):
(WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
(WebCore::RenderMathMLScripts::scriptsElement): Deleted.

  • rendering/mathml/RenderMathMLScripts.h:
  • rendering/mathml/RenderMathMLUnderOver.cpp: Remove MathMLNames and make the constructor

take a RenderMathMLUnderOver.
(WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
(WebCore::RenderMathMLUnderOver::element):
(WebCore::RenderMathMLUnderOver::hasAccent): Use the helper functions for accent and accentunder.

  • rendering/mathml/RenderMathMLUnderOver.h:
9:51 PM Changeset in webkit [203552] by Chris Dumez
  • 5 edits in trunk

Parameter to Node.isSameNode() / isEqualNode() should be mandatory
​https://bugs.webkit.org/show_bug.cgi?id=160070

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Parameter to Node.isSameNode() / isEqualNode() should be mandatory as
per the specification:

Chrome and Firefox agree with the specification (although Firefox does
not support isSameNode()).

No new tests, rebaselined existing tests.

  • dom/Node.idl:
9:45 PM Changeset in webkit [203551] by mitz@apple.com
  • 2 edits in trunk/Tools

[Mac] webkitdirs.pm contains unused code to support outdated OS X and Xcode versions
​https://bugs.webkit.org/show_bug.cgi?id=160072

Reviewed by Andy Estes.

  • Scripts/webkitdirs.pm:

(readXcodeUserDefault): Changed to take a defaults key rather than a suffix. Removed support

for old Xcode versions.

(determineBaseProductDir): Removed support for old Xcode versions. Updated for the change

to readXcodeUserDefault.

(debugger): Deleted. This was only used for Darwin, where LLDB is now the only supported

debugger.

(determineDebugger): Ditto.
(checkRequiredSystemConfig): Updated to require at least OS X Yosemite v10.10.5 and Xcode

7.0.

(printHelpAndExitForRunAndDebugWebKitAppIfNeeded): Removed --use-gdb and --use-lldb

switches.

(execMacWebKitAppForDebugging): Removed support for GDB.

8:29 PM Changeset in webkit [203550] by Chris Dumez
  • 5 edits in trunk

Parameter to Document.createEvent() should be mandatory
​https://bugs.webkit.org/show_bug.cgi?id=160065

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Parameter to Document.createEvent() should be mandatory as per the
specification:

We already throw anyway when the parameter is omitted because we use
"undefined" as event type, which is invalid. However, we throw the
wrong exception.

Firefox and Chrome agree with the specification here.

No new tests, rebaselined existing tests.

  • dom/Document.idl:
8:00 PM Changeset in webkit [203549] by BJ Burg
  • 2 edits in trunk/Source/WebCore

REGRESSION(r62549): Objective-C DOM bindings sometimes fail to regenerate when CodeGenerator.pm is modified
​https://bugs.webkit.org/show_bug.cgi?id=160031

Reviewed by Darin Adler.

This bug was caused by a refactoring 6 years ago. Not all uses of a variable
were renamed, so the ObjC bindings target pattern was not specifying any
build scripts as target dependencies.

  • DerivedSources.make: Standardize on {COMMON,JS,DOM}_BINDINGS_SCRIPTS.
7:43 PM Changeset in webkit [203548] by Darin Adler
  • 2 edits in trunk/Source/WebCore

Remove unneeded content attribute name "playsinline"
​https://bugs.webkit.org/show_bug.cgi?id=160069

Reviewed by Chris Dumez.

  • html/HTMLVideoElement.idl: Removed explicit content attribute name on Reflect

attribute since it is the same as the name that the code generator will generate.

7:42 PM Changeset in webkit [203547] by Chris Dumez
  • 6 edits in trunk

Make parameters to Element.getElementsBy*() operations mandatory
​https://bugs.webkit.org/show_bug.cgi?id=160060

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Make parameters to Element.getElementsBy*() operations mandatory to
match the specification:

Firefox and Chrome agree with the specification so the compatibility
risk should be low.

It makes very little sense to call these operations without parameter,
especially considering WebKit uses the string "undefined" if the
parameter is omitted.

No new tests, rebaselined existing tests.

  • dom/Element.idl:

LayoutTests:

Drop cases that were calling the operation without parameter.

  • fast/dom/getElementsByClassName/dumpHTMLCollection-expected.txt:
  • fast/dom/getElementsByClassName/dumpHTMLCollection.html:
7:21 PM Changeset in webkit [203546] by Chris Dumez
  • 16 edits in trunk

Make parameters mandatory for attribute-related API on Element
​https://bugs.webkit.org/show_bug.cgi?id=160059

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Make parameters mandatory for attribute-related API on Element to match
the specification:

Firefox and Chrome agree with the specification. Calling this API
without the parameters does not make much sense, especially considering
WebKit uses the string "undefined" when the parameter is omitted.

No new tests, rebaselined existing tests.

  • dom/Element.idl:

LayoutTests:

Update existing layout tests to reflect the behavior change.

  • fast/dom/Element/script-tests/setAttributeNS-namespace-err.js:
  • fast/dom/Element/setAttributeNS-namespace-err-expected.txt:
  • fast/dom/HTMLHrElement/hr-color-noshade-attribute.html:
  • fast/dom/attribute-downcast-right.html:
  • fast/images/style-access-during-imageChanged-style-freeze.html:
  • fast/selectors/read-only-read-write-input-basics.html:
  • fast/selectors/read-only-read-write-textarea-basics.html:
  • media/video-playsinline-expected.txt:
  • media/video-playsinline.html:
6:40 PM Changeset in webkit [203545] by mmaxfield@apple.com
  • 24 edits in trunk

Remove support for deprecated SPI inlineMediaPlaybackRequiresPlaysInlineAttribute
​https://bugs.webkit.org/show_bug.cgi?id=160066

Reviewed by Dean Jackson.

Source/WebCore:

r203520 deprecated inlineMediaPlaybackRequiresPlaysInlineAttribute in favor of
allowsInlineMediaPlaybackWithPlaysInlineAttribute and
allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute. The old
inlineMediaPlaybackRequiresPlaysInlineAttribute is SPI and was never released
to the public. Therefore, it can be removed safely.

No new tests because there is no behavior change.

  • page/Settings.cpp:
  • page/Settings.in:
  • testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup): Deleted.
(WebCore::InternalSettings::Backup::restoreTo): Deleted.
(WebCore::InternalSettings::setInlineMediaPlaybackRequiresPlaysInlineAttribute): Deleted.

  • testing/InternalSettings.h:
  • testing/InternalSettings.idl:

Source/WebKit/mac:

  • WebView/WebPreferenceKeysPrivate.h:
  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]): Deleted.
(-[WebPreferences inlineMediaPlaybackRequiresPlaysInlineAttribute]): Deleted.
(-[WebPreferences setInlineMediaPlaybackRequiresPlaysInlineAttribute:]): Deleted.

  • WebView/WebPreferencesPrivate.h:
  • WebView/WebView.mm:

(-[WebView _preferencesChanged:]): Deleted.

Source/WebKit2:

  • Shared/WebPreferencesDefinitions.h:
  • UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetInlineMediaPlaybackRequiresPlaysInlineAttribute): Deleted.
(WKPreferencesGetInlineMediaPlaybackRequiresPlaysInlineAttribute): Deleted.

  • UIProcess/API/C/WKPreferencesRefPrivate.h:
  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]): Deleted.

  • UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]): Deleted.
(-[WKWebViewConfiguration copyWithZone:]): Deleted.
(-[WKWebViewConfiguration _inlineMediaPlaybackRequiresPlaysInlineAttribute]): Deleted.
(-[WKWebViewConfiguration _setInlineMediaPlaybackRequiresPlaysInlineAttribute:]): Deleted.

  • UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences): Deleted.

Tools:

  • DumpRenderTree/mac/DumpRenderTree.mm:

(setDefaultsToConsistentValuesForTesting): Deleted.

  • TestWebKitAPI/Tests/WebKit2Cocoa/RequiresUserActionForPlayback.mm:

(RequiresUserActionForPlaybackTest::SetUp): Deleted.

  • WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues): Deleted.

  • WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::initializeWebViewConfiguration): Deleted.

6:01 PM Changeset in webkit [203544] by sbarati@apple.com
  • 4 edits in trunk/Source/JavaScriptCore

callOperation(.) variants in the DFG that explicitly take a tag/payload register should take a JSValueRegs instead
​https://bugs.webkit.org/show_bug.cgi?id=160007

Reviewed by Filip Pizlo.

This patch is the first step in my plan to remove all callOperation(.) variants
in the various JITs and to unify them using a couple template variations.
The steps are as follows:

  1. Replace all explicit tag/payload pairs with JSValueRegs in the DFG
  2. Replace all explicit tag/payload pairs with JSValueRegs in the baseline
  3. remove callOperation(.) variants and teach setupArgumentsWithExecState about JSValueRegs.
  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileGetDynamicVar):
(JSC::DFG::SpeculativeJIT::compilePutDynamicVar):
(JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):

5:48 PM Changeset in webkit [203543] by dino@apple.com
  • 3 edits
    3 adds in trunk

REGRESSION (r202927): The internal size of the ImageBuffer is scaled twice by the context scaleFactor
​https://bugs.webkit.org/show_bug.cgi?id=159981
<rdar://problem/27429465>

Reviewed by Myles Maxfield.

Source/WebCore:

The change to propagate color spaces through ImageBuffers created an
alternate version of createCompatibleBuffer. This version accidentally
attempted to take the display resolution (i.e. hidpi) into account
when creating the buffer, which meant it was being applied twice.

The fix is simply to remove that logic. The caller of the method
will take the resolution into account, the same way they did
with the old createCompatibleBuffer method.

Test: fast/hidpi/pdf-image-scaled.html

  • platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::createCompatibleBuffer): Don't calculate
a resolution - just use the value of 1.0.

LayoutTests:

  • fast/hidpi/pdf-image-scaled-expected.html: Added.
  • fast/hidpi/pdf-image-scaled.html: Added.
  • fast/hidpi/resources/circle.pdf: Added.
5:44 PM Changeset in webkit [203542] by wilander@apple.com
  • 3 edits
    3 adds in trunk

Block mixed content synchronous XHR
​https://bugs.webkit.org/show_bug.cgi?id=105462
<rdar://problem/13666424>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/mixedContent/insecure-xhr-sync-in-main-frame.html

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::loadRequest):

LayoutTests:

  • http/tests/security/mixedContent/insecure-xhr-sync-in-main-frame-expected.txt: Added.
  • http/tests/security/mixedContent/insecure-xhr-sync-in-main-frame.html: Added.
  • http/tests/security/mixedContent/resources/insecure-xhr-sync-in-main-frame-window.html: Added.
5:11 PM Changeset in webkit [203541] by commit-queue@webkit.org
  • 4 edits
    1 add in trunk

[iOS] Apps using WKWebView will crash if they set the scroll view's delegate and don't nil it out later
​https://bugs.webkit.org/show_bug.cgi?id=159980
rdar://problem/27450825

Patch by Chelsea Pugh <​cpugh@apple.com> on 2016-07-21
Reviewed by Dan Bernstein.

Source/WebKit2:

The root cause of this crash is that we are not abiding the UIScrollView API that the scroll view
delegate property should be weak. If setters of this delegate do not know that, since the WKWebView
exposes the scroll view as a UIScrollView, they may forget to nil out the delegate they set and will
then crash.

  • UIProcess/ios/WKScrollView.mm:

(-[WKScrollViewDelegateForwarder methodSignatureForSelector:]): Get a RetainPtr holding the
external delegate and use where needed.
(-[WKScrollViewDelegateForwarder respondsToSelector:]): Ditto.
(-[WKScrollViewDelegateForwarder forwardInvocation:]): Ditto.
(-[WKScrollViewDelegateForwarder forwardingTargetForSelector:]): Ditto. When returning a reference
to the external delegate, get a retained and autoreleased reference so the caller needn't release
the object when done.
(-[WKScrollView delegate]): Ditto.
(-[WKScrollView _updateDelegate]): Get a RetainPtr holding the external delegate that can be
used throughout this method. Use the RetainPtr to get the external delegate for setting super's
delegate as well as creating the delegate forwarder.
(-[WKScrollView setDelegate:]): Get a RetainPtr holding the external delegate and use its value for
comparison to the object we are setting the external delegate to.

Tools:

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/ios/WKScrollViewDelegateCrash.mm: Added.

(-[TestDelegateForScrollView dealloc]): Update delegateIsDeallocated to true so that we can tell
when our delegate has hit -dealloc.
(TestWebKitAPI::TEST): Ensure that after an object has been set as the scroll view's delegate,
and has then been deallocated, that the scroll view's delegate is nil and the deallocated delegate
will not be messaged.

4:55 PM Changeset in webkit [203540] by mmaxfield@apple.com
  • 3 edits in trunk/Tools

Follow-up patch to r203520
​https://bugs.webkit.org/show_bug.cgi?id=159967
<rdar://problem/26964090>

Unreviewed.

  • DumpRenderTree/mac/DumpRenderTree.mm:

(setDefaultsToConsistentValuesForTesting):

  • WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):

4:52 PM Changeset in webkit [203539] by Chris Dumez
  • 8 edits in trunk

Make parameters to Document.getElementsBy*() operations mandatory
​https://bugs.webkit.org/show_bug.cgi?id=160050

Reviewed by Daniel Bates.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Make parameters to Document.getElementsBy*() operations mandatory to
match the specification:

Firefox and Chrome agree with the specification so the compatibility
risk should be low.

It makes very little sense to call these operations without parameter,
especially considering WebKit uses the string "undefined" if the
parameter is omitted.

No new tests, rebaselined existing tests.

  • dom/Document.idl:

LayoutTests:

Drop cases that were calling the operation without parameter.

  • fast/dom/getElementsByClassName/dumpHTMLCollection-expected.txt:
  • fast/dom/getElementsByClassName/dumpHTMLCollection.html:
4:47 PM Changeset in webkit [203538] by n_wang@apple.com
  • 3 edits
    2 adds in trunk

AX: aria-label not being used correctly in accessible name calculation of heading
​https://bugs.webkit.org/show_bug.cgi?id=160009

Reviewed by Chris Fleizach.

Source/WebCore:

Actually we are exposing the correct information for heading objects. On macOS,
VoiceOver should handle the logic that picks the right information to speak.
On iOS, VoiceOver is speaking the static text child instead of the heading object.
So we should set the accessibilityLabel of the static text based on the parent's
alternate label.

Test: accessibility/ios-simulator/heading-with-aria-label.html

  • accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper _accessibilityTraitsFromAncestors]):

LayoutTests:

  • accessibility/ios-simulator/heading-with-aria-label-expected.txt: Added.
  • accessibility/ios-simulator/heading-with-aria-label.html: Added.
4:41 PM Changeset in webkit [203537] by sbarati@apple.com
  • 40 edits
    7 adds in trunk/Source

op_add/ValueAdd should be an IC in all JIT tiers
​https://bugs.webkit.org/show_bug.cgi?id=159649

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

This patch makes Add an IC inside all JIT tiers. It does so in a
simple, but effective, way. We will try to generate an int+int add
that will repatch itself if its type checks fail. Sometimes though,
we have runtime type data saying that the add won't be int+int.
In those cases, we will just generate a full snippet that doesn't patch itself.
Other times, we may generate no inline code and defer to making a C call. A lot
of this patch is just refactoring ResultProfile into what we're now calling ArithProfile.
ArithProfile does everything ResultProfile used to do, and more. It records simple type
data about the LHS/RHS operands it sees. This allows us to determine if an op_add
has only seen int+int operands, etc. ArithProfile will also contain the ResultType
for the LHS/RHS that the parser feeds into op_add. ArithProfile now fits into 32-bits.
This means instead of having a side table like we did for ResultProfile, we just
inject the ArithProfile into the bytecode instruction stream. This makes asking
for ArithProfile faster; we no longer need to lock around this operation.

The size of an Add has gone down on average, but we can still do better.
We still generate a lot of code because we generate calls to the slow path.
I think we can make this better by moving the slow path to a shared thunk
system. This patch mostly lays the foundation for future improvements to Add,
and a framework to move all other arithmetic operations to be typed-based ICs.

Here is some data I took on the average op_add/ValueAdd size on various benchmarks:

| JetStream | Speedometer | Unity 3D |

------| -------------

Old | 189 bytes | 169 bytes | 192 bytes |

------| -------------

New | 148 bytes | 124 bytes | 143 bytes |

---------------------------------------------------

Making an arithmetic IC is now easy. The JITMathIC class will hold a snippet
generator as a member variable. To make a snippet an IC, you need to implement
a generateInline(.) method, which generates the inline IC. Then, you need to
generate the IC where you used to generate the snippet. When generating the
IC, we need to inform JITMathIC of various data like we do with StructureStubInfo.
We need to tell it about where the slow path starts, where the slow path call is, etc.
When generating a JITMathIC, it may tell you that it didn't generate any code inline.
This is a request to the user of JITMathIC to just generate a C call along the
fast path. JITMathIC may also have the snippet tell it to just generate the full
snippet instead of the int+int path along the fast path.

In subsequent patches, we can improve upon how we decide to generate int+int or
the full snippet. I tried to get clever by having double+double, double+int, int+double,
fast paths, but they didn't work out nearly as well as the int+int fast path. I ended up
generating a lot of code when I did this and ended up using more memory than just generating
the full snippet. There is probably some way we can be clever and generate specialized fast
paths that are more successful than what I tried implementing, but I think that's worth deferring
this to follow up patches once the JITMathIC foundation has landed.

This patch also fixes a bug inside the slow path lambdas in the DFG.
Before, it was not legal to emit an exception check inside them. Now,
it is. So it's now easy to define arbitrary late paths using the DFG
slow path lambda API.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/ArithProfile.cpp: Added.

(JSC::ArithProfile::emitObserveResult):
(JSC::ArithProfile::shouldEmitSetDouble):
(JSC::ArithProfile::emitSetDouble):
(JSC::ArithProfile::shouldEmitSetNonNumber):
(JSC::ArithProfile::emitSetNonNumber):
(WTF::printInternal):

  • bytecode/ArithProfile.h: Added.

(JSC::ObservedType::ObservedType):
(JSC::ObservedType::sawInt32):
(JSC::ObservedType::isOnlyInt32):
(JSC::ObservedType::sawNumber):
(JSC::ObservedType::isOnlyNumber):
(JSC::ObservedType::sawNonNumber):
(JSC::ObservedType::isOnlyNonNumber):
(JSC::ObservedType::isEmpty):
(JSC::ObservedType::bits):
(JSC::ObservedType::withInt32):
(JSC::ObservedType::withNumber):
(JSC::ObservedType::withNonNumber):
(JSC::ObservedType::withoutNonNumber):
(JSC::ObservedType::operator==):
(JSC::ArithProfile::ArithProfile):
(JSC::ArithProfile::fromInt):
(JSC::ArithProfile::lhsResultType):
(JSC::ArithProfile::rhsResultType):
(JSC::ArithProfile::lhsObservedType):
(JSC::ArithProfile::rhsObservedType):
(JSC::ArithProfile::setLhsObservedType):
(JSC::ArithProfile::setRhsObservedType):
(JSC::ArithProfile::tookSpecialFastPath):
(JSC::ArithProfile::didObserveNonInt32):
(JSC::ArithProfile::didObserveDouble):
(JSC::ArithProfile::didObserveNonNegZeroDouble):
(JSC::ArithProfile::didObserveNegZeroDouble):
(JSC::ArithProfile::didObserveNonNumber):
(JSC::ArithProfile::didObserveInt32Overflow):
(JSC::ArithProfile::didObserveInt52Overflow):
(JSC::ArithProfile::setObservedNonNegZeroDouble):
(JSC::ArithProfile::setObservedNegZeroDouble):
(JSC::ArithProfile::setObservedNonNumber):
(JSC::ArithProfile::setObservedInt32Overflow):
(JSC::ArithProfile::setObservedInt52Overflow):
(JSC::ArithProfile::addressOfBits):
(JSC::ArithProfile::observeResult):
(JSC::ArithProfile::lhsSawInt32):
(JSC::ArithProfile::lhsSawNumber):
(JSC::ArithProfile::lhsSawNonNumber):
(JSC::ArithProfile::rhsSawInt32):
(JSC::ArithProfile::rhsSawNumber):
(JSC::ArithProfile::rhsSawNonNumber):
(JSC::ArithProfile::observeLHSAndRHS):
(JSC::ArithProfile::bits):
(JSC::ArithProfile::hasBits):
(JSC::ArithProfile::setBit):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpRareCaseProfile):
(JSC::CodeBlock::dumpArithProfile):
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::addStubInfo):
(JSC::CodeBlock::addJITAddIC):
(JSC::CodeBlock::findStubInfo):
(JSC::CodeBlock::resetJITData):
(JSC::CodeBlock::shrinkToFit):
(JSC::CodeBlock::dumpValueProfiles):
(JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset):
(JSC::CodeBlock::arithProfileForBytecodeOffset):
(JSC::CodeBlock::arithProfileForPC):
(JSC::CodeBlock::couldTakeSpecialFastCase):
(JSC::CodeBlock::dumpResultProfile): Deleted.
(JSC::CodeBlock::resultProfileForBytecodeOffset): Deleted.
(JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset): Deleted.
(JSC::CodeBlock::ensureResultProfile): Deleted.

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::stubInfoBegin):
(JSC::CodeBlock::stubInfoEnd):
(JSC::CodeBlock::couldTakeSlowCase):
(JSC::CodeBlock::numberOfResultProfiles): Deleted.

  • bytecode/MethodOfGettingAValueProfile.cpp:

(JSC::MethodOfGettingAValueProfile::emitReportValue):

  • bytecode/MethodOfGettingAValueProfile.h:

(JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):

  • bytecode/ValueProfile.cpp:

(JSC::ResultProfile::emitDetectNumericness): Deleted.
(JSC::ResultProfile::emitSetDouble): Deleted.
(JSC::ResultProfile::emitSetNonNumber): Deleted.
(WTF::printInternal): Deleted.

  • bytecode/ValueProfile.h:

(JSC::getRareCaseProfileBytecodeOffset):
(JSC::ResultProfile::ResultProfile): Deleted.
(JSC::ResultProfile::bytecodeOffset): Deleted.
(JSC::ResultProfile::specialFastPathCount): Deleted.
(JSC::ResultProfile::didObserveNonInt32): Deleted.
(JSC::ResultProfile::didObserveDouble): Deleted.
(JSC::ResultProfile::didObserveNonNegZeroDouble): Deleted.
(JSC::ResultProfile::didObserveNegZeroDouble): Deleted.
(JSC::ResultProfile::didObserveNonNumber): Deleted.
(JSC::ResultProfile::didObserveInt32Overflow): Deleted.
(JSC::ResultProfile::didObserveInt52Overflow): Deleted.
(JSC::ResultProfile::setObservedNonNegZeroDouble): Deleted.
(JSC::ResultProfile::setObservedNegZeroDouble): Deleted.
(JSC::ResultProfile::setObservedNonNumber): Deleted.
(JSC::ResultProfile::setObservedInt32Overflow): Deleted.
(JSC::ResultProfile::setObservedInt52Overflow): Deleted.
(JSC::ResultProfile::addressOfFlags): Deleted.
(JSC::ResultProfile::addressOfSpecialFastPathCount): Deleted.
(JSC::ResultProfile::detectNumericness): Deleted.
(JSC::ResultProfile::hasBits): Deleted.
(JSC::ResultProfile::setBit): Deleted.
(JSC::getResultProfileBytecodeOffset): Deleted.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitBinaryOp):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::methodOfGettingAValueProfileFor):

  • dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::exceptionCheck):

  • dfg/DFGSlowPathGenerator.h:

(JSC::DFG::SlowPathGenerator::generate):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
(JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
(JSC::DFG::SpeculativeJIT::compileValueAdd):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
(JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):
(JSC::DFG::SpeculativeJIT::callOperation):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToB3::compileStrCat):

  • jit/CCallHelpers.h:

(JSC::CCallHelpers::setupArgumentsWithExecState):
(JSC::CCallHelpers::setupArguments):

  • jit/JIT.h:
  • jit/JITAddGenerator.cpp:

(JSC::JITAddGenerator::generateInline):
(JSC::JITAddGenerator::generateFastPath):

  • jit/JITAddGenerator.h:

(JSC::JITAddGenerator::JITAddGenerator):
(JSC::JITAddGenerator::didEmitFastPath): Deleted.
(JSC::JITAddGenerator::endJumpList): Deleted.
(JSC::JITAddGenerator::slowPathJumpList): Deleted.

  • jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_jless):
(JSC::JIT::emitSlow_op_urshift):
(JSC::getOperandTypes):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitSlow_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emitSlow_op_mul):
(JSC::JIT::emit_op_sub):
(JSC::JIT::emitSlow_op_sub):

  • jit/JITDivGenerator.cpp:

(JSC::JITDivGenerator::generateFastPath):

  • jit/JITDivGenerator.h:

(JSC::JITDivGenerator::JITDivGenerator):

  • jit/JITInlines.h:

(JSC::JIT::callOperation):

  • jit/JITMathIC.h: Added.

(JSC::JITMathIC::doneLocation):
(JSC::JITMathIC::slowPathStartLocation):
(JSC::JITMathIC::slowPathCallLocation):
(JSC::JITMathIC::generateInline):
(JSC::JITMathIC::generateOutOfLine):
(JSC::JITMathIC::finalizeInlineCode):

  • jit/JITMathICForwards.h: Added.
  • jit/JITMathICInlineResult.h: Added.
  • jit/JITMulGenerator.cpp:

(JSC::JITMulGenerator::generateFastPath):

  • jit/JITMulGenerator.h:

(JSC::JITMulGenerator::JITMulGenerator):

  • jit/JITOperations.cpp:
  • jit/JITOperations.h:
  • jit/JITSubGenerator.cpp:

(JSC::JITSubGenerator::generateFastPath):

  • jit/JITSubGenerator.h:

(JSC::JITSubGenerator::JITSubGenerator):

  • jit/Repatch.cpp:

(JSC::readCallTarget):
(JSC::ftlThunkAwareRepatchCall):
(JSC::tryCacheGetByID):
(JSC::repatchGetByID):
(JSC::appropriateGenericPutByIdFunction):
(JSC::tryCachePutByID):
(JSC::repatchPutByID):
(JSC::tryRepatchIn):
(JSC::repatchIn):
(JSC::linkSlowFor):
(JSC::resetGetByID):
(JSC::resetPutByID):
(JSC::repatchCall): Deleted.

  • jit/Repatch.h:
  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • parser/ResultType.h:

(JSC::ResultType::ResultType):
(JSC::ResultType::isInt32):
(JSC::ResultType::definitelyIsNumber):
(JSC::ResultType::definitelyIsString):
(JSC::ResultType::definitelyIsBoolean):
(JSC::ResultType::mightBeNumber):
(JSC::ResultType::isNotNumber):
(JSC::ResultType::forBitOp):
(JSC::ResultType::bits):
(JSC::OperandTypes::OperandTypes):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):
(JSC::updateArithProfileForBinaryArithOp):
(JSC::updateResultProfileForBinaryArithOp): Deleted.

  • tests/stress/op-add-exceptions.js: Added.

(assert):
(f1):
(f2):
(f3):
(let.oException.valueOf):
(foo):
(ident):
(bar):

Source/WebCore:

  • ForwardingHeaders/jit/JITMathICForwards.h: Added.
4:32 PM Changeset in webkit [203536] by Ryan Haddad
  • 1 edit
    1 copy
    1 add
    1 delete in trunk/LayoutTests

Move expected.txt file for editing/deleting/delete-emoji.html from mac-elcapitan to mac-yosemite

Unreviewed test gardening.

  • platform/mac-yosemite/editing/deleting/delete-emoji-expected.txt: Renamed from LayoutTests/platform/mac-elcapitan/editing/deleting/delete-emoji-expected.txt.
3:56 PM Changeset in webkit [203535] by Chris Dumez
  • 18 edits in trunk

Make parameters mandatory for Document.create*() operations
​https://bugs.webkit.org/show_bug.cgi?id=160047

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Make parameters mandatory for Document.create*() operations:
createTextNode(), createComment(), createCDataSection(),
createAttribute() and createProcessingInstruction().

This matches the specification:

Firefox and Chrome both agree with the specification so the
compatibility risk should be low. Also WebKit uses the string
"undefined" when the parameter is omitted, which is not very
helpful.

No new tests, rebaselined existing tests.

  • dom/Document.idl:

LayoutTests:

Update existing tests to reflect the behavior change.

  • compositing/geometry/assert-marquee-timer.html:
  • editing/style/bold-with-dom-changes.html:
  • fast/dom/MutationObserver/observe-characterdata.html:
  • fast/dom/normalize-attributes-mutation-event-crash.html:
  • fast/dom/null-chardata-crash.html:
  • fast/dom/wrapper-classes-expected.txt:
  • fast/dom/wrapper-classes.html:
  • fast/forms/basic-textareas.html:
  • fast/inspector-support/uncaught-dom1-exception-expected.txt:
  • fast/inspector-support/uncaught-dom1-exception.html:
3:49 PM Changeset in webkit [203534] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html as flaky on mac
​https://bugs.webkit.org/show_bug.cgi?id=160056

Unreviewed test gardening.

  • platform/mac/TestExpectations:
3:34 PM Changeset in webkit [203533] by mmaxfield@apple.com
  • 3 edits
    2 copies
    1 move
    1 add in trunk

[macOS] Caret placement occurs in the middle of new emoji group candidates
​https://bugs.webkit.org/show_bug.cgi?id=160008
<rdar://problem/27430111>

Reviewed by Simon Fraser.

Source/WTF:

r203330 added support for new emoji group candidates. This patch updates the rules
governing caret placement around these new emoji groups.

  • wtf/text/TextBreakIterator.cpp:

(WTF::cursorMovementIterator):

LayoutTests:

Update expected results.

The new emoji support is behind the ADDITIONAL_EMOJI_SUPPORT guard, which
means it only occurs on El Capitan and higher. Similarly, these new rules
are not used for iOS.

  • editing/deleting/delete-emoji-expected.txt: Deleted.
  • platform/mac/editing/deleting/delete-emoji-expected.txt: Added.
  • platform/mac-elcapitan/editing/deleting/delete-emoji-expected.txt: Added.
  • platform/ios-simulator/editing/deleting/delete-emoji-expected.txt: Added.
3:16 PM Changeset in webkit [203532] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Land test expectations for rdar://problem/27475162.

  • platform/mac/TestExpectations:
2:31 PM Changeset in webkit [203531] by Chris Dumez
  • 6 edits
    2 adds in trunk

Fix null handling of SVGAngle/SVGLength.valueAsString attribute
​https://bugs.webkit.org/show_bug.cgi?id=160025

Reviewed by Ryosuke Niwa.

Source/WebCore:

Fix null handling of SVGAngle/SVGLength.valueAsString attribute
to match the specification:

In particular, this patch drops [TreatNullAs=EmptyString] IDL
extended attribute from this attribute. This is not supposed
to change behavior given that both "" and "null" are invalid
numbers and the specification says to throw a SYNTAX_ERR in
this case.

However, WebKit currently ignores assignments to "" instead
of throwing. As a result, assigning to null will now throw
instead of being ignored. The compatibility risk should be
low because both Firefox and Chrome throw when assigning
null.

I did not change the behavior when assigning to "" because
it is a bit out of scope for this patch and browsers to not
seem to agree:

  • Firefox throws
  • Chrome set value to "0"
  • WebKit ignores the assignment

The specification seems to agree with Firefox as far as I
can tell given that "" is not a valid number as per:

Test: svg/dom/valueAsString-null.html

  • svg/SVGAngle.idl:
  • svg/SVGLength.idl:

LayoutTests:

Add test coverage.

  • svg/dom/svg-element-attribute-js-null-expected.txt:
  • svg/dom/svg-element-attribute-js-null.xhtml:
  • svg/dom/valueAsString-null-expected.txt: Added.
  • svg/dom/valueAsString-null.html: Added.

There are a couple of failures in this test because WebKit ignores
assignments to "" instead of throwing. Firefox passes all the checks.

2:25 PM Changeset in webkit [203530] by Chris Dumez
  • 7 edits in trunk

Fix null handling of HTMLFontElement.color
​https://bugs.webkit.org/show_bug.cgi?id=160036

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-obsolete-expected.txt:

Source/WebCore:

Fix null handling of HTMLFontElement.color to match the specification:

We are supposed to treat null as the empty string. Both Firefox and
Chrome agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLFontElement.idl:

LayoutTests:

Update existing test to reflect behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:25 PM Changeset in webkit [203529] by Chris Dumez
  • 7 edits in trunk

Fix null handling for several HTMLTableElement attributes
​https://bugs.webkit.org/show_bug.cgi?id=160041

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Fix null handling for several HTMLTableElement attributes to match the
specification:

The attributes in question are 'bicolor', 'cellSpacing' and
'cellPadding'. We are supposed to treat null as the empty string for
these attributes.

Firefox and Chrome both agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLTableElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:23 PM Changeset in webkit [203528] by Chris Dumez
  • 8 edits in trunk

Fix null handling for HTMLObjectElement.border
​https://bugs.webkit.org/show_bug.cgi?id=160040

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-embedded-expected.txt:

Source/WebCore:

Fix null handling for HTMLObjectElement.border to match the specification:

We are supposed to treat null as the empty string.

Both Firefox and Chrome agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLObjectElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:22 PM Changeset in webkit [203527] by Chris Dumez
  • 8 edits in trunk

Fix null handling for td.bgColor / tr.bgColor
​https://bugs.webkit.org/show_bug.cgi?id=160043

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Fix null handling for td.bgColor / tr.bgColor to match the
specification:

We are supposed to treat null as the empty string.

Firefox and Chrome both agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLTableCellElement.idl:
  • html/HTMLTableRowElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:19 PM Changeset in webkit [203526] by dbates@webkit.org
  • 3 edits in trunk/LayoutTests

Test platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe.html is flaky
​https://bugs.webkit.org/show_bug.cgi?id=160002

Reviewed by Alexey Proskuryakov.

The file platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe.html tests loading
plugin content from the main frame and from a subframe. Depending on timing the plugin
content loaded in the subframe may complete before plugin content loaded in the main frame.
We should test loading plugin content in a subframe after perform all main frame sub-tests
so as to ensure a well-defined sub-test order.

Add logic to ensure that an embedded YouTube flash video loaded in a subframe actually creates
a shadow DOM. Additionally, simplify the test logic by making use window.jsTestIsAsync/finishJSTest()
to mark the test as asynchronous and notify test completion instead of calling
window.testRunner.{waitUntilDone, notifyDone}(), remove the call to
testRunner.dumpAsText() (js-test-pre.js calls this for us), remove all of the DOM elements
used in the test to avoid noise in the expected results, and fix some style nits.

  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe-expected.txt:
  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe.html:
2:11 PM Changeset in webkit [203525] by Chris Dumez
  • 7 edits in trunk

Fix null handling for several HTMLBodyElement attributes
​https://bugs.webkit.org/show_bug.cgi?id=160044

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-sections-expected.txt:

Source/WebCore:

Fix null handling for several HTMLBodyElement attributes to match the
specification:

The attributes in question are: 'text', 'link', 'vlink', 'alink' and
'bgcolor'.

We are supposed to treat null as the empty string for these attributes.

Firefox and Chrome both agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLBodyElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:10 PM Changeset in webkit [203524] by Chris Dumez
  • 8 edits in trunk

Fix null handling for HTMLIFrameElement.marginWidth / marginHeight
​https://bugs.webkit.org/show_bug.cgi?id=160037

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-embedded-expected.txt:

Source/WebCore:

Fix null handling for HTMLIFrameElement.marginWidth / marginHeight to
match the specification:

We are supposed to treat null as the empty string. Both Firefox and
Chrome agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLIFrameElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:09 PM Changeset in webkit [203523] by Chris Dumez
  • 8 edits in trunk

Fix null handling for HTMLImageElement.border
​https://bugs.webkit.org/show_bug.cgi?id=160039

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

  • web-platform-tests/html/dom/reflection-embedded-expected.txt:

Source/WebCore:

Fix null handling for HTMLImageElement.border to match the specification:

We are supposed to treat null as the empty string.

Both Firefox and Chrome agree with the specification.

No new tests, rebaselined existing tests.

  • html/HTMLImageElement.idl:

LayoutTests:

Update existing test to reflect the behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
2:06 PM Changeset in webkit [203522] by dbates@webkit.org
  • 9 edits in trunk

REGRESSION: Plugin replaced YouTube Flash videos always have the same width
​https://bugs.webkit.org/show_bug.cgi?id=159998
<rdar://problem/27462285>

Reviewed by Simon Fraser.

Source/WebCore:

Fixes an issue where the width of a plugin replaced YouTube video loaded via an HTML embed
element would always have the same width regardless of value of the width attribute.

For YouTube Flash videos the YouTube plugin replacement substitutes a shadow DOM subtree
for the default renderer of an HTML embed element. The root of this shadow DOM subtree
is an HTML div element. Currently we set inline styles on this <div> when it is instantiated.
In particular, we set inline display and position to "inline-block" and "relative", respectively,
and set an invalid height and width (we specify a font weight value instead of a CSS length value

  • this causes an ASSERT_NOT_REACHED() assertion failure in StyleBuilderConverter::convertLengthSizing()

in a debug build). These styles never worked as intended and we ultimately created an inline
renderer (ignoring display "inline-block") that had auto width and height. Instead it is sufficient
to remove all these inline styles and create a RenderBlockFlow renderer for this <div> so that it
renders as a block, non-replaced element to achieve the intended illusion that the <embed> is a
single element.

  • html/shadow/YouTubeEmbedShadowElement.cpp: Remove unused header HTMLEmbedElement.h and include

header RenderBlockFlow.h. Also update copyright in license block.
(WebCore::YouTubeEmbedShadowElement::YouTubeEmbedShadowElement): Remove inline styles as these
never worked as intended.
(WebCore::YouTubeEmbedShadowElement::createElementRenderer): Override; create a block-flow
renderer for us so that we layout as a block, non-replaced element.

  • html/shadow/YouTubeEmbedShadowElement.h:

LayoutTests:

Unskip existing iOS layout tests, update tests and expected results.

  • platform/ios-simulator/TestExpectations:
  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe-expected.txt: Updated expected result based on the

changes to test youtube-flash-plugin-iframe.html.

  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe-no-height-or-width-expected.txt: Updated expected result

based on the changes to test youtube-flash-plugin-iframe-no-height-or-width.html.

  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe-no-height-or-width.html: Modified to check the

width of each embedded YouTube video to ensure that we respect it (if specified).

  • platform/ios-simulator/ios/plugin/youtube-flash-plugin-iframe.html: Substitute pseudo id -webkit-plugin-replacement

for -apple-youtube-shadow-iframe as the later was renamed to the former in <​https://trac.webkit.org/changeset/168442>.
Fix misspelling of the word "embed" in a comment.

2:05 PM Changeset in webkit [203521] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking inspector/codemirror/prettyprinting-javascript.html as a flaky timeout on mac debug.
​https://bugs.webkit.org/show_bug.cgi?id=160048

Unreviewed test gardening.

Added TestExpectation and reordered alphabetically.

  • platform/mac/TestExpectations:
1:19 PM Changeset in webkit [203520] by mmaxfield@apple.com
  • 26 edits
    2 deletes in trunk

[iPhone] Playing a video on tudou.com plays only sound, no video
​https://bugs.webkit.org/show_bug.cgi?id=159967
<rdar://problem/26964090>

Reviewed by Jon Lee, Jeremy Jones, and Anders Carlsson.

Source/WebCore:

WebKit recently starting honoring the playsinline and webkit-playsinline
attribute on iPhones. However, because these attributes previously did
nothing, some sites (such as Todou) were setting them on their content
and expecting that they are not honored. In this specific case, the
video is absolutely positioned to be 1 pixel x 1 pixel.

Previously, with iOS 9, apps could set the allowsInlineMediaPlayback
property on their WKWebView, which would honor the webkit-playsinline
attribute. Safari on iPhones didn't do this.

In order to not break these existing apps, it's important that the
allowsInlineMediaPlayback preference still allows webkit-playsinline
videos to play inline in apps using WKWebView. However, in Safari, these
videos should play fullscreen. (Todou videos have webkit-playsinline
but not playsinline.)

Therefore, in Safari, videos with playsinline should be inline, but
videos with webkit-playsinline should be fullscreen. In apps using
WKWebViews, if the app sets allowsInlineMediaPlayback, then videos with
playsinline should be inline, and videos with webkit-playsinline should
also be inline. Videos on iPad and Mac should all be inline by default.

We can create some truth tables for the cases which need to be covered:

All apps on Mac / iPad:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Inline
Present | Not present | Inline
Not Present | Present | Inline
Present | Present | Inline

Safari on iPhone:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Fullscreen
Present | Not present | Inline
Not Present | Present | Fullscreen
Present | Present | Inline

App on iPhone which sets allowsInlineMediaPlayback:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Fullscreen
Present | Not present | Inline
Not Present | Present | Inline
Present | Present | Inline

The way to distinguish Safari from another app is to create an SPI
boolean preference which Safari can set. This is already how the
iPhone and iPad are differentiated using the requiresPlayInlineAttribute
which Safari sets but other apps don't. However, this preference is
no longer sufficient because Safari should now be discriminating
between the playsinline and webkit-playsinline attributes. Therefore,
this preference should be extended to two boolean preferences, which
this patch adds:

allowsInlineMediaPlaybackWithPlaysInlineAttribute
allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute

Safari on iPhone will set
allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to true,
and allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to
false. Other apps on iPhone will get their defaults values (because they
are SPI) which means they will both be true. On iPad and Mac, apps will
use the defaults values where both are false.

This patch adds support for these two preferences, but does not remove
the existing inlineMediaPlaybackRequiresPlaysInlineAttribute preference.
I will remove the exising preference as soon as I update Safari to migrate
off of it.

Test: media/video-playsinline.html

  • html/MediaElementSession.cpp:

(WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):

  • page/Settings.cpp:
  • page/Settings.in:
  • testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):

  • testing/InternalSettings.h:
  • testing/InternalSettings.idl:

Source/WebKit/mac:

Add the two preferences to WebPreferences.

  • WebView/WebPreferenceKeysPrivate.h:
  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences allowsInlineMediaPlaybackWithPlaysInlineAttribute]):
(-[WebPreferences setAllowsInlineMediaPlaybackWithPlaysInlineAttribute:]):
(-[WebPreferences allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute]):
(-[WebPreferences setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute:]):

  • WebView/WebPreferencesPrivate.h:
  • WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:

Add the two preferences to WKWebViewConfiguration and WKPreferences to cover both
the Obj-C API and the C SPI.

  • Shared/WebPreferencesDefinitions.h:
  • UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WKPreferencesGetAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WKPreferencesSetAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):
(WKPreferencesGetAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):

  • UIProcess/API/C/WKPreferencesRefPrivate.h:
  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):

  • UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration _allowsInlineMediaPlaybackWithPlaysInlineAttribute]):
(-[WKWebViewConfiguration _setAllowsInlineMediaPlaybackWithPlaysInlineAttribute:]):
(-[WKWebViewConfiguration _allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute]):
(-[WKWebViewConfiguration _setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute:]):

  • UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

Tools:

Migrate tests to use new SPI.

  • TestWebKitAPI/Tests/WebKit2Cocoa/RequiresUserActionForPlayback.mm:

(RequiresUserActionForPlaybackTest::SetUp):

  • WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::initializeWebViewConfiguration):

LayoutTests:

  • media/video-playsinline.html: Updated.
  • media/video-webkit-playsinline-expected.txt: Removed.
  • media/video-webkit-playsinline.html: Removed.
1:04 PM Changeset in webkit [203519] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Marking accessibility/mac/value-change/value-change-user-info-contenteditable.html as flaky on El Capitan WK2
​https://bugs.webkit.org/show_bug.cgi?id=160042

Unreviewed test gardening.

  • platform/mac-wk2/TestExpectations:
12:41 PM Changeset in webkit [203518] by rniwa@webkit.org
  • 2 edits in trunk/Source/WebCore

Crash accessing null renderer inside WebCore::DeleteSelectionCommand::doApply
​https://bugs.webkit.org/show_bug.cgi?id=160011

Reviewed by Chris Dumez.

Add a null pointer check for renderer() call.

Unfortunately no new tests since we don't have a reproduction.

  • editing/DeleteSelectionCommand.cpp:

(WebCore::DeleteSelectionCommand::doApply):

12:04 PM Changeset in webkit [203517] by Chris Dumez
  • 13 edits in trunk

The 2 first parameters to DOMImplementation.createDocument() should be mandatory
​https://bugs.webkit.org/show_bug.cgi?id=160030

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

  • web-platform-tests/dom/interfaces-expected.txt:
  • web-platform-tests/dom/nodes/DOMImplementation-createDocument-expected.txt:

Source/WebCore:

The 2 first parameters to DOMImplementation.createDocument() should be mandatory
as per the specification:

Firefox and Chrome both agree with the specification. However, those
parameters were marked as optional in WebKit. Calling this function
without parameters would create a document element whose tag is the
string "undefined", which does not seem helpful. This patch thus
aligns our behavior with the specification and other browsers.

No new tests, rebaselined existing tests.

  • dom/DOMImplementation.idl:

LayoutTests:

Rebaseline / update existing test to reflect the behavior change.

  • fast/css/zoom-on-unattached.html:
  • fast/dom/DOMImplementation/createDocument-namespace-err-expected.txt:
  • fast/dom/DOMImplementation/script-tests/createDocument-namespace-err.js:
  • fast/dom/HTMLLinkElement/prefetch-detached.html:
  • fast/dom/node-move-to-new-document-crash-main.html:
  • fast/forms/change-form-element-document-crash.html:
11:40 AM Changeset in webkit [203516] by Chris Dumez
  • 5 edits in trunk/Source/WebCore

Kill legacy valueToStringWithNullCheck() utility function
​https://bugs.webkit.org/show_bug.cgi?id=159991

Reviewed by Sam Weinig.

Kill legacy valueToStringWithNullCheck() utility function. Treating null as
a null string is legacy behavior so drop this function so that people are
not tempted to use it. We should be using either:

  1. JSValue::toWTFString() for non-nullable DOMStrings
  2. valueToStringWithUndefinedOrNullCheck() for nullable DOMStrings
  3. valueToStringTreatingNullAsEmptyString() for strings with [TreatNullAs=EmptyString]

No new tests, no web-exposed behavior change.

  • bindings/js/JSDOMBinding.cpp:

(WebCore::valueToStringWithNullCheck): Deleted.

  • bindings/js/JSDOMBinding.h:
  • bindings/js/JSHTMLFrameElementCustom.cpp:

(WebCore::JSHTMLFrameElement::setLocation):

  • html/HTMLFrameElement.idl:
11:23 AM Changeset in webkit [203515] by Ryan Haddad
  • 2 edits in branches/safari-602-branch/LayoutTests

Merge r203506. rdar://problem/27353750

11:20 AM Changeset in webkit [203514] by Alan Bujtas
  • 2 edits in trunk/Source/WebCore

Do not keep invalid IOSurface in ImageBufferData.
​https://bugs.webkit.org/show_bug.cgi?id=160005
<rdar://problem/27208636>

Reviewed by Simon Fraser.

When we fail to initialize the IOSurface for the accelerated context, we switch over to
the non-accelerated code path. Since ImageBufferData::surface is used to indicate whether
the graphics context is in accelerated mode, we need to reset it when the initialization fails.

Unable to create a test case.

  • platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::ImageBuffer):

11:17 AM Changeset in webkit [203513] by bshafiei@apple.com
  • 4 edits
    1 add in branches/safari-602-branch

Merge r203508. rdar://problem/27392691

11:08 AM Changeset in webkit [203512] by Csaba Osztrogonác
  • 54 edits in trunk

Clarify testing mode names in run-jsc-stress-tests
​https://bugs.webkit.org/show_bug.cgi?id=160021

Reviewed by Mark Lam.

Default should mean really default, not default with disabled FTL, renamed

  • runMozillaTestDefault to runMozillaTestNoFTL
  • runMozillaTestDefaultFTL to runMozillaTestDefault
  • runDefault to runNoFTL
  • runDefaultFTL to runDefault
  • runLayoutTestDefault to runLayoutTestNoFTL
  • runLayoutTestDefaultFTL to runLayoutTestDefault
  • runNoisyTestDefault to runNoisyTestNoFTL
  • runNoisyTestDefaultFTL to runNoisyTestDefault

Source/JavaScriptCore:

  • tests/mozilla/mozilla-tests.yaml:
  • tests/stress/lift-tdz-bypass-catch.js:
  • tests/stress/obscure-error-message-dont-crash.js:
  • tests/stress/shadow-chicken-disabled.js:

Tools:

  • Scripts/run-jsc-stress-tests:

LayoutTests:

  • js/regress/script-tests/DataView-custom-properties.js:
  • js/regress/script-tests/HashMap-put-get-iterate-keys.js:
  • js/regress/script-tests/HashMap-put-get-iterate.js:
  • js/regress/script-tests/HashMap-string-put-get-iterate.js:
  • js/regress/script-tests/array-nonarray-polymorhpic-access.js:
  • js/regress/script-tests/basic-set.js:
  • js/regress/script-tests/bug-153431.js:
  • js/regress/script-tests/destructuring-arguments.js:
  • js/regress/script-tests/destructuring-swap.js:
  • js/regress/script-tests/inline-arguments-local-escape.js:
  • js/regress/script-tests/method-on-number.js:
  • js/regress/script-tests/new-array-buffer-push.js:
  • js/regress/script-tests/new-array-push.js:
  • js/regress/script-tests/poly-stricteq.js:
  • js/regress/script-tests/polymorphic-array-call.js:
  • js/regress/script-tests/regexp-prototype-is-not-instance.js:
  • js/regress/script-tests/regexp-prototype-search-observable-side-effects.js:
  • js/regress/script-tests/regexp-prototype-search-observable-side-effects2.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js:
  • js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js:
  • js/regress/script-tests/regexp-prototype-test-observable-side-effects.js:
  • js/regress/script-tests/regexp-prototype-test-observable-side-effects2.js:
  • js/regress/script-tests/string-equality.js:
  • js/regress/script-tests/string-prototype-search-observable-side-effects.js:
  • js/regress/script-tests/string-prototype-search-observable-side-effects2.js:
  • js/regress/script-tests/string-prototype-search-observable-side-effects3.js:
  • js/regress/script-tests/string-prototype-search-observable-side-effects4.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects2.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js:
  • js/regress/script-tests/string-prototype-split-observable-side-effects4.js:
  • js/regress/script-tests/string-repeat-arith.js:
  • js/regress/script-tests/string-sub.js:
  • js/slow-stress/script-tests/destructuring-arguments-length.js:
10:54 AM Changeset in webkit [203511] by Chris Dumez
  • 5 edits in trunk

playsInline IDL attribute has the wrong casing
​https://bugs.webkit.org/show_bug.cgi?id=160029
<rdar://problem/27474031>

Reviewed by Jon Lee.

Source/WebCore:

Fix case from video.playsinline to video.playsInline in order to match
the specification:

It still reflects the "playsinline" content attribute though, as per
the specification:

No new tests, updated existing test.

  • html/HTMLVideoElement.idl:

LayoutTests:

Update test to use the correct case.

  • media/video-playsinline-expected.txt:
  • media/video-playsinline.html:
10:24 AM WebKitGTK/Gardening/Calendar edited by clopez@igalia.com
(diff)
10:23 AM WebKitGTK/Gardening/Calendar edited by clopez@igalia.com
(diff)
10:20 AM Changeset in webkit [203510] by Chris Dumez
  • 3 edits
    2 adds in trunk

Drop [TreatNullAs=EmptyString] from CanvasRenderingContext2D.globalCompositeOperation
​https://bugs.webkit.org/show_bug.cgi?id=160026

Reviewed by Sam Weinig.

Source/WebCore:

Drop [TreatNullAs=EmptyString] from CanvasRenderingContext2D.globalCompositeOperation
attribute as it does not match the specification:

It does not change web-exposed behavior because assigning to "" or "null"
gets ignored as those are not valid operations.

Test: fast/canvas/context-globalCompositeOperation-null.html

  • html/canvas/CanvasRenderingContext2D.idl:

LayoutTests:

Add test coverage.

  • fast/canvas/context-globalCompositeOperation-null-expected.txt: Added.
  • fast/canvas/context-globalCompositeOperation-null.html: Added.
10:12 AM Changeset in webkit [203509] by clopez@igalia.com
  • 8 edits in trunk/LayoutTests

[GTK] Gardening: Layout tests expectations updates and test rebaselines.

Unreviewed.

  • TestExpectations: js/regress-139548.html is ~10x slower since r203142.
  • fast/mediastream/RTCPeerConnection-add-removeTrack-expected.txt: Rebaseline after r203333.
  • fast/mediastream/RTCPeerConnection-addIceCandidate-expected.txt: Rebaseline after r203333.
  • fast/mediastream/RTCPeerConnection-setLocalDescription-offer-expected.txt: Rebaseline after r203333.
  • fast/mediastream/RTCPeerConnection-setRemoteDescription-offer-expected.txt: Rebaseline after r203333.
  • platform/efl/TestExpectations: workers/bomb.html is slow.
  • platform/gtk/TestExpectations: workers/bomb.html is slow, media/media-source/media-source-small-gap.html timeouts and new failure on platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html.
10:01 AM Changeset in webkit [203508] by commit-queue@webkit.org
  • 4 edits
    1 add in trunk

WebBackForwardList's currentIndex could get out of bounds when filtering items.
​https://bugs.webkit.org/show_bug.cgi?id=159986

Source/WebKit2:

When generating a new BackForwardListState object, if we filter out multiple items in the list, the currentIndex could get
out of bounds.

Patch by Yongjun Zhang <​yongjun_zhang@apple.com> on 2016-07-21
Reviewed by Dan Bernstein.

  • UIProcess/WebBackForwardList.cpp:

(WebKit::WebBackForwardList::backForwardListState): Make currentIndex point to the last item if it is out of bounds.

Tools:

Add a test to verify filtering out 2 items from a 3-item list will set the currentIndex
to 0.

Patch by Yongjun Zhang <​yongjun_zhang@apple.com> on 2016-07-21
Reviewed by Dan Bernstein.

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKit2/WKBackForwardList.mm: Added.

(-[WKBackForwardListTestNavigationDelegate webView:didFinishNavigation:]):
(TEST):

9:59 AM Changeset in webkit [203507] by commit-queue@webkit.org
  • 3 edits in trunk/Source/WebKit2

Web Automation: Allow JavaScript evaluation to return an InvalidElementState error
​https://bugs.webkit.org/show_bug.cgi?id=160015
<rdar://problem/27434529>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-21
Reviewed by Brian Burg.

  • UIProcess/Automation/Automation.json:
  • WebProcess/Automation/WebAutomationSessionProxy.cpp:

(WebKit::WebAutomationSessionProxy::evaluateJavaScriptFunction):

9:21 AM Changeset in webkit [203506] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Update test expectations for rdar://problem/27353750.

  • platform/mac/TestExpectations:
9:05 AM Changeset in webkit [203505] by Carlos Garcia Campos
  • 3 edits in trunk/Source/WebCore

[GTK][Threaded Compositor] Overlay scrollbars shouldn't be a requirement of the threaded compositor
​https://bugs.webkit.org/show_bug.cgi?id=160020

Reviewed by Michael Catanzaro.

It has been a requirement only because we didn't really know why frame scrollbars were not rendered when using
the threaded compositor. The reason is that RenderView doesn't use layers for FrameView scrollbars by default,
unless using overlay scrollbars. When using the threaded compositor we really need layers for the FrameView
scrollbars even when not using overlay scrollbars.

  • platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Stop enforcing overlay scrollbars when threaded compositor is enabled.

  • rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::shouldCompositeOverflowControls): Always use layers for scrollbars when
threaded compositor is enabled.

9:02 AM Changeset in webkit [203504] by Carlos Garcia Campos
  • 7 edits in trunk/Source/WebKit2

[GTK][Threaded Compositor] WTR generates fully white images for pixel tests most of the time
​https://bugs.webkit.org/show_bug.cgi?id=160016

Reviewed by Žan Doberšek.

WTR sends a force repaint message to the web process before taking a snapshot of the web view. With the threaded
compositor, the UI process is notified about the force repaint callback before the contents have been actually
painted. We need to ensure that the contents are rendered before the UI process is notified.

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:

(WebKit::ThreadedCompositor::forceRepaint): Synchronously render the layer tree.

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h:
  • UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewRenderAcceleratedCompositingResults): Always mark the redirected window surface as dirty before
rendering, since it can be modified by the web process at any time.

  • UIProcess/gtk/RedirectedXCompositeWindow.cpp:

(WebKit::XDamageNotifier::add):
(WebKit::RedirectedXCompositeWindow::RedirectedXCompositeWindow): Do not mark the surface as dirty on every
damage since the view will do it before rendering.

  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:

(WebKit::ThreadedCoordinatedLayerTreeHost::forceRepaint): Call ThreadedCompositor::forceRepaint().

  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:
9:01 AM Changeset in webkit [203503] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebCore

[Cairo] Fix a crash in fast/canvas/canvas-getImageData-invalid-result-buffer-crash.html
​https://bugs.webkit.org/show_bug.cgi?id=160014

Reviewed by Michael Catanzaro.

In r202887 some null checks were added for JSArray::createUninitialized (and related) but not for the
ImageBuffer cairo implementation.

  • platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::getImageData): Return early if Uint8ClampedArray::createUninitialized() returns nullptr.

6:03 AM Changeset in webkit [203502] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebCore

[GTK] The GSTREAMER_GL path in MediaPlayerPrivateGStreamerBase::paintToTextureMapper() is missing a mutex lock
​https://bugs.webkit.org/show_bug.cgi?id=160018

Patch by Miguel Gomez <​magomez@igalia.com> on 2016-07-21
Reviewed by Philippe Normand.

Lock the video sample mutex while accessing it.

Covered by existent tests.

  • platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper):

4:36 AM Changeset in webkit [203501] by jfernandez@igalia.com
  • 1 edit
    12 adds in trunk/LayoutTests

[css-grid] Handle min-content/max-content with orthogonal flows
​https://bugs.webkit.org/show_bug.cgi?id=159294

Reviewed by Darin Adler.

New layout tests to evaluate basic positioning and sizing using orthogonal flows.

  • fast/css-grid-layout/grid-item-positioning-with-orthogonal-flows-expected.txt: Added.
  • fast/css-grid-layout/grid-item-positioning-with-orthogonal-flows.html: Added.
  • fast/css-grid-layout/grid-item-sizing-with-orthogonal-flows-expected.txt: Added.
  • fast/css-grid-layout/grid-item-sizing-with-orthogonal-flows.html: Added.
  • fast/css-grid-layout/grid-item-spanning-and-orthogonal-flows-expected.txt: Added.
  • fast/css-grid-layout/grid-item-spanning-and-orthogonal-flows.html: Added.
  • fast/css-grid-layout/grid-track-sizing-with-orthogonal-flows-expected.txt: Added.
  • fast/css-grid-layout/grid-track-sizing-with-orthogonal-flows.html: Added.
  • fast/css-grid-layout/grid-track-sizing-with-percentages-and-orthogonal-flows-expected.txt: Added.
  • fast/css-grid-layout/grid-track-sizing-with-percentages-and-orthogonal-flows.html: Added.
12:35 AM Changeset in webkit [203500] by Carlos Garcia Campos
  • 3 edits in trunk/Source/WebKit2

[GTK] White page when loaded tab is visited until it's hovered when AC mode is always on
​https://bugs.webkit.org/show_bug.cgi?id=159512

Reviewed by Michael Catanzaro.

The redirected window is always mapped, but offscreen, to ensure that the web process can always render
there. When the web process renders something into the offscreen window, we receive a damage event in the UI
process and queue a redraw of the web view. However, when the web view is not mapped, even if we still receive
the damage events, the web view redraws are ignored until the view is mapped again (gtk_widget_queue_draw()
returns early when the widget is not visible). The redirected window updates its pixmap on demand when the
surface is requested, which happens when the web view draws its contents. So when the web view becames visible,
the redirected window creates a new pixmap and surface (the first time or if the web view was resized), that we
initialize to avoid artifacts when the web process hasn't render anything yet. That initialization is actually
overwriting anything rendered into the redirected window while the view was unmapped. That's why see white pages
the first time, and previous contents after a resize, and we don't see the actual contents until the web process
renders again and we reuse the existing pixmap. The white page didn't happen for tabs with accelerated content,
because in those cases the web process was rendering a new frame every 16ms, but instead there was a flickering
effect due to the current frame being overwritten when the view is mapped until the next frame.
So, instead of lazily create and initialize the redirected window pixmap and surface, we should always create
the new pixmap as soon as the window is created or resized (and not empty) This fixes the issues but also makes
resizing the window a bit smoother when AC mode is enabled.

  • UIProcess/gtk/RedirectedXCompositeWindow.cpp:

(WebKit::RedirectedXCompositeWindow::RedirectedXCompositeWindow): Create the pixmap and surface if the window is
not empty.
(WebKit::RedirectedXCompositeWindow::resize): Ditto.
(WebKit::RedirectedXCompositeWindow::createNewPixampAndPixampSurface): Create the pixmap and surface.
(WebKit::RedirectedXCompositeWindow::surface): Deleted.

  • UIProcess/gtk/RedirectedXCompositeWindow.h:

(WebKit::RedirectedXCompositeWindow::surface):

12:33 AM Changeset in webkit [203499] by Yusuke Suzuki
  • 23 edits
    2 copies
    9 adds in trunk/Source/JavaScriptCore

[ES7] Introduce exponentiation expression
​https://bugs.webkit.org/show_bug.cgi?id=159969

Reviewed by Saam Barati.

This patch implements the exponentiation expression, e.g. x ** y.
The exponentiation expression is introduced in ECMA262 2016 and ECMA262 2016
is already released. So this is not the draft spec.

The exponentiation expression has 2 interesting points.

  1. Right associative

To follow the Math expression, operator is right associative.
When we execute x ** y ** z, this is handled as x ** (y ** z), not (x ** y) ** z.
This patch introduces the right associativity to the binary operator and handles it
in the operator precedence parser in Parser.cpp.

  1. LHS of the exponentiation expression is UpdateExpression

ExponentiationExpression[Yield]:

UnaryExpression?Yield
UpdateExpression?Yield ExponentiationExpression?Yield

As we can see, the left hand side of the ExponentiationExpression is UpdateExpression, not UnaryExpression.
It means that +x ** y becomes a syntax error. This is intentional. Without superscript in JS,
-x**y is confusing between -(x ** y) and (-x) ** y. So ECMA262 intentionally avoids UnaryExpression here.
If we need to use a negated value, we need to write parentheses explicitly e.g. (-x) ** y.
In this patch, we ensure that the left hand side is not an unary expression by checking an operator in
parseBinaryExpression. This works since ** has the highest operator precedence in the binary operators.

We introduce a new bytecode, op_pow. That simply works as similar as the other binary operators.
And it is converted to ArithPow in DFG and handled in DFG and FTL.
In this patch, we take the approach just introducing a new bytecode instead of calling Math.pow.
This is because we would like to execute ToNumber in the caller side, not in the callee (Math.pow) side.
And we don't want to compile into the following.

lhsNumber = to_number (lhs)
rhsNumber = to_number (rhs)
call Math.pow(lhsNumber, rhsNumber)

We ensure that this patch passes all the test262 tests related to the exponentiation expression.

The only sensitive part to the performance is the parser changes.
So we measured the code-load performance and it is neutral in my x64 Linux box (hanayamata).

Collected 30 samples per benchmark/VM, with 30 VM invocations per benchmark. Emitted a call to
gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used
the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark
execution times with 95% confidence intervals in milliseconds.

baseline patched

closure 0.60499+-0.00250 0.60180+-0.00244
jquery 7.89175+-0.02433 ? 7.91287+-0.04759 ?

<geometric> 2.18499+-0.00523 2.18207+-0.00689 might be 1.0013x faster

  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

  • bytecompiler/NodesCodegen.cpp:

(JSC::emitReadModifyAssignment):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

  • jit/JIT.h:
  • jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_pow):

  • llint/LowLevelInterpreter.asm:
  • parser/ASTBuilder.h:

(JSC::ASTBuilder::operatorStackShouldReduce):
(JSC::ASTBuilder::makePowNode):
(JSC::ASTBuilder::makeMultNode):
(JSC::ASTBuilder::makeDivNode):
(JSC::ASTBuilder::makeModNode):
(JSC::ASTBuilder::makeSubNode):
(JSC::ASTBuilder::makeBinaryNode):
(JSC::ASTBuilder::operatorStackHasHigherPrecedence): Deleted.

  • parser/Lexer.cpp:

(JSC::Lexer<T>::lex):

  • parser/NodeConstructors.h:

(JSC::PowNode::PowNode):

  • parser/Nodes.h:
  • parser/Parser.cpp:

(JSC::Parser<LexerType>::parseAssignmentExpression):
(JSC::isUnaryOpExcludingUpdateOp):
(JSC::Parser<LexerType>::parseBinaryExpression):
(JSC::isUnaryOp): Deleted.

  • parser/ParserTokens.h:

(JSC::isUpdateOp):
(JSC::isUnaryOp):

  • parser/SyntaxChecker.h:

(JSC::SyntaxChecker::operatorStackPop):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/CommonSlowPaths.h:
  • tests/stress/pow-basics.js: Added.

(valuesAreClose):
(mathPowDoubleDouble1):
(mathPowDoubleInt1):
(test1):
(mathPowDoubleDouble2):
(mathPowDoubleInt2):
(test2):
(mathPowDoubleDouble3):
(mathPowDoubleInt3):
(test3):
(mathPowDoubleDouble4):
(mathPowDoubleInt4):
(test4):
(mathPowDoubleDouble5):
(mathPowDoubleInt5):
(test5):
(mathPowDoubleDouble6):
(mathPowDoubleInt6):
(test6):
(mathPowDoubleDouble7):
(mathPowDoubleInt7):
(test7):
(mathPowDoubleDouble8):
(mathPowDoubleInt8):
(test8):
(mathPowDoubleDouble9):
(mathPowDoubleInt9):
(test9):
(mathPowDoubleDouble10):
(mathPowDoubleInt10):
(test10):
(mathPowDoubleDouble11):
(mathPowDoubleInt11):
(test11):

  • tests/stress/pow-coherency.js: Added.

(pow42):
(build42AsDouble.opaqueAdd):
(build42AsDouble):
(powDouble42):
(clobber):
(pow42NoConstantFolding):
(powDouble42NoConstantFolding):

  • tests/stress/pow-evaluation-order.js: Added.

(shouldBe):
(throw.new.Error):

  • tests/stress/pow-expects-update-expression-on-lhs.js: Added.

(testSyntax):
(testSyntaxError):
(throw.new.Error):
(let.token.of.tokens.testSyntax.pow):
(testSyntax.pow):

  • tests/stress/pow-integer-exponent-fastpath.js: Added.

(valuesAreClose):
(mathPowDoubleDoubleTestExponentFifty):
(mathPowDoubleIntTestExponentFifty):
(testExponentFifty):
(mathPowDoubleDoubleTestExponentTenThousands):
(mathPowDoubleIntTestExponentTenThousands):
(testExponentTenThousands):

  • tests/stress/pow-nan-behaviors.js: Added.

(testIntegerBaseWithNaNExponentStatic):
(mathPowIntegerBaseWithNaNExponentDynamic):
(testIntegerBaseWithNaNExponentDynamic):
(testFloatingPointBaseWithNaNExponentStatic):
(mathPowFloatingPointBaseWithNaNExponentDynamic):
(testFloatingPointBaseWithNaNExponentDynamic):
(testNaNBaseStatic):
(mathPowNaNBaseDynamic1):
(mathPowNaNBaseDynamic2):
(mathPowNaNBaseDynamic3):
(mathPowNaNBaseDynamic4):
(testNaNBaseDynamic):
(infiniteExponentsStatic):
(mathPowInfiniteExponentsDynamic1):
(mathPowInfiniteExponentsDynamic2):
(mathPowInfiniteExponentsDynamic3):
(mathPowInfiniteExponentsDynamic4):
(infiniteExponentsDynamic):

  • tests/stress/pow-simple.js: Added.

(shouldBe):
(throw.new.Error):

  • tests/stress/pow-stable-results.js: Added.

(opaquePow):
(isIdentical):

  • tests/stress/pow-to-number-should-be-executed-in-code-side.js: Added.

(shouldBe):
(throw.new.Error):

  • tests/stress/pow-with-constants.js: Added.

(exponentIsZero):
(testExponentIsZero):
(exponentIsOne):
(testExponentIsOne):
(powUsedAsSqrt):
(testPowUsedAsSqrt):
(powUsedAsOneOverSqrt):
(testPowUsedAsOneOverSqrt):
(powUsedAsSquare):
(testPowUsedAsSquare):
(intIntConstantsSmallNumbers):
(intIntConstantsLargeNumbers):
(intIntSmallConstants):
(intDoubleConstants):
(doubleDoubleConstants):
(doubleIntConstants):
(testBaseAndExponentConstantLiterals):
(exponentIsIntegerConstant):
(testExponentIsIntegerConstant):
(exponentIsDoubleConstant):
(testExponentIsDoubleConstant):
(exponentIsInfinityConstant):
(testExponentIsInfinityConstant):
(exponentIsNegativeInfinityConstant):
(testExponentIsNegativeInfinityConstant):

  • tests/stress/pow-with-never-NaN-exponent.js: Added.

(exponentIsNonNanDouble1):
(exponentIsNonNanDouble2):
(testExponentIsDoubleConstant):

  • tests/test262.yaml:
12:29 AM Changeset in webkit [203498] by commit-queue@webkit.org
  • 6 edits in trunk/Source/WebCore

[Threaded Compositor] Flickering when zooming in/out in maps.google.com
​https://bugs.webkit.org/show_bug.cgi?id=154069

Patch by Miguel Gomez <​magomez@igalia.com> on 2016-07-21
Reviewed by Carlos Garcia Campos.

Add a new extra buffer to GraphicsContext3D when using the Threaded Compositor,
so it doesn't have to reuse the buffers that are still waiting for composition.

Covered by existing tests.

  • platform/graphics/GraphicsContext3D.h:

Add a new texture to use for the rendering. Remove the compositor fbo we were using.

  • platform/graphics/cairo/GraphicsContext3DCairo.cpp:

(WebCore::GraphicsContext3D::GraphicsContext3D):
Initialize the new texture and remove the previous fbo related code.
(WebCore::GraphicsContext3D::~GraphicsContext3D):
Properly destroy the new texture and remove the previous fbo related code.

  • platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:

(WebCore::GraphicsContext3D::reshapeFBOs):
Allocate the new texture and remove the previous fbo allocation.

  • platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:

(WebCore::GraphicsContext3D::prepareTexture):
Use a single fbo with three textures instead of two fbos with a texture each.
Rotate the three textures usage so:

  • m_texture becomes m_compositorTexture to be pushed to the compositor.
  • m_intermediateTexture becomes m_texture to receive the next rendering.
  • m_compositorTexture becomes m_intermediateTexture.

And add a glFlush() to ensure that the gl commands are sent to the pipeline.

  • platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:

(WebCore::GraphicsContext3D::reshapeFBOs):
Allocate the new texture.

12:25 AM Changeset in webkit [203497] by Carlos Garcia Campos
  • 7 edits in trunk/Source

[GTK][Threaded Compositor] Web view background colors don't work
​https://bugs.webkit.org/show_bug.cgi?id=159465

Reviewed by Michael Catanzaro.

Source/WebCore:

  • rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::createPrimaryGraphicsLayer): Initialize frame view layer opacity for platforms not
using the tiled cache layer.

Source/WebKit2:

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:

(WebKit::ThreadedCompositor::setDrawsBackground): Set m_drawsBackground in compositing thread and schedule a
layer flush.
(WebKit::ThreadedCompositor::renderLayerTree): Clear the area when not rendering backgrounds.

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h:
  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:

(WebKit::ThreadedCoordinatedLayerTreeHost::pageBackgroundTransparencyChanged): Notify the compositor.

  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:
12:18 AM Changeset in webkit [203496] by Carlos Garcia Campos
  • 7 edits in trunk

[GTK] Web view background colors don't work in accelerated compositing mode
​https://bugs.webkit.org/show_bug.cgi?id=159455

Reviewed by Michael Catanzaro.

Source/WebKit2:

In non AC mode it's the drawing area backing store the one drawing the background, and the web process just
renders into a transparent bitmap. In AC mode we need to make the redirected window pixmap transparent for the
web process to render there, and let the web view fill the background color before rendering the redirected
window pixmap on top. To be able to make the redirected window surface transparent, we need to ensure the parent
window has an RGBA visual, even when setting a fully opaque background, because we still need the web process
to render on the transparent xwindow.

  • UIProcess/API/gtk/WebKitWebView.cpp: Update documentation of webkit_web_view_set_background_color() since now

it's required to set the RGBA visual even for opaque colors in case AC mode is enabled.

  • UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewRenderAcceleratedCompositingResults): When a background color has been set, fill it before
rendering the redirected window surface.

  • UIProcess/gtk/RedirectedXCompositeWindow.cpp:

(WebKit::RedirectedXCompositeWindow::RedirectedXCompositeWindow): Mark the surface as dirty after every damage
event, since the web process has modified it.
(WebKit::RedirectedXCompositeWindow::surface): Initialize the surface after creating it, to avoid flickering and
rendering artifacts when waiting for the first damage event from the web process.

  • WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:

(WebKit::LayerTreeHostGtk::compositeLayersToContext): Use a fully transparent color to clear the context when the page
is resized or when a view background color has been set.

Tools:

Set always RGBA visual to the view widget when setting a background color.

  • MiniBrowser/gtk/BrowserWindow.c:

(browser_window_set_background_color):

12:04 AM Changeset in webkit [203495] by Carlos Garcia Campos
  • 4 edits in trunk/Source/WebKit2

[GTK] Avoid the redirected window resize when the view is realized in AC mode
​https://bugs.webkit.org/show_bug.cgi?id=159463

Reviewed by Michael Catanzaro.

We are always creating the redirected window at 1x1 and then resizing it if we are in AC mode. When the view is
realized and AC mode is already enabled, which happens for example when AC mode is forced, or when the threaded
compositor is enabled, we could just pass the initial size to the redirected window constructor to create the
XWindow at the right size.

  • UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseResizeRedirectedWindow): We no longer need to pass the device scale factor, since the
RedirectedXCompositeWindow already knows it.
(webkitWebViewBaseRealize): Pass the WebPageProxy and an initial size to the RedirectedXCompositeWindow
constructor instead of the parent GdkWindow. If AC mode is disabled, the initial size will be empty. With the
WebPageProxy the redirected window has access to the device scale factor and view widget to get the parent
GdkWindow.
(deviceScaleFactorChanged): Resize the redirected window when device scale factor changes.

  • UIProcess/gtk/RedirectedXCompositeWindow.cpp:

(WebKit::RedirectedXCompositeWindow::create):
(WebKit::RedirectedXCompositeWindow::RedirectedXCompositeWindow):
(WebKit::RedirectedXCompositeWindow::resize):
(WebKit::RedirectedXCompositeWindow::surface):
(WebKit::RedirectedXCompositeWindow::~RedirectedXCompositeWindow):

  • UIProcess/gtk/RedirectedXCompositeWindow.h:

Jul 20, 2016:

11:51 PM Changeset in webkit [203494] by commit-queue@webkit.org
  • 11 edits
    1 add in trunk

[XHR] Cache response JS object in case of arraybuffer and blob response types
​https://bugs.webkit.org/show_bug.cgi?id=128903

Patch by Youenn Fablet <​youenn@apple.com> on 2016-07-20
Reviewed by Alex Christensen.

Source/WebCore:

Covered by existing and modified tests.

Making response getter a JS builtin that caches response in @response private slot.
Handling invalidation of cached response with @responseCacheIsValid new private method.
Handling creation of cached response with @retrieveResponse new private method which reuses most of
JSXMLHttpRequest::response previous code.

Caching of responses is activated whenever load ended without any error for blob and arraybuffer response types.

Caching of response for document is also activated in case the response getter is used but not if responseXML getter is used.

  • CMakeLists.txt: Adding XMLHttpRequest.js.
  • DerivedSources.make: Ditto.
  • bindings/js/JSXMLHttpRequestCustom.cpp:

(WebCore::JSXMLHttpRequest::retrieveResponse): Implements creation of to-be-cached response.
(WebCore::JSXMLHttpRequest::response): Deleted.

  • bindings/js/WebCoreBuiltinNames.h: Adding new private names.
  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::didCacheResponse): Renamed from didCacheResponseJSON as all response types are now cached.
(WebCore::XMLHttpRequest::didCacheResponseJSON): Deleted.

  • xml/XMLHttpRequest.h:
  • xml/XMLHttpRequest.idl:

LayoutTests:

  • http/tests/xmlhttprequest/onabort-response-getters-expected.txt:
  • http/tests/xmlhttprequest/onabort-response-getters.html:
11:41 PM Changeset in webkit [203493] by Carlos Garcia Campos
  • 4 edits in trunk/Source/WebKit2

[GTK][Threaded Compositor] Web Process crash when the page is closed before the web view is realized
​https://bugs.webkit.org/show_bug.cgi?id=159918

Reviewed by Michael Catanzaro.

When the web view is unrealized, we send a sync message to the web process to destroy the native surface handle
for compositing, and then we actually destroy the redirected window. But if the page is closed explicitly before
the web view is unrealized, the drawing area proxy is destroyed so that when the web view is unrealized we can't
notify the web process that keeps trying to render to a now deleted window handle. That produces a BadDrawable
X error and the web process crashes.

  • UIProcess/API/gtk/PageClientImpl.cpp:

(WebKit::PageClientImpl::pageClosed): Call webkitWebViewBasePageClosed().

  • UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBasePageClosed): If the web view is still realized, destroy the native surface handle and the
redirected window.

  • UIProcess/API/gtk/WebKitWebViewBasePrivate.h: Add webkitWebViewBasePageClosed().
11:38 PM Changeset in webkit [203492] by fred.wang@free.fr
  • 1 edit
    10 adds in trunk/Websites/webkit.org

Unreviewed, new demo files for an up-coming blog post.

Patch by Frederic Wang <​fwang@igalia.com> on 2016-07-20

  • demos/mathml/demo2016/LICENSE-amiri.txt: Added.
  • demos/mathml/demo2016/LICENSE-latinmodern-math.txt: Added.
  • demos/mathml/demo2016/LICENSE-libertinusmath.txt: Added.
  • demos/mathml/demo2016/README.txt: Added.
  • demos/mathml/demo2016/amiri-regular.woff: Added.
  • demos/mathml/demo2016/index.html: Added.
  • demos/mathml/demo2016/latinmodern-math.woff: Added.
  • demos/mathml/demo2016/libertinusmath-regular.woff: Added.
  • demos/mathml/demo2016/webfonts.css: Added.

(@namespace url('​http://www.w3.org/1999/xhtml');):
(@font-face):
(m|math, m|mtext):
(m|math.libertinus):
(m|math.arabic):

11:23 PM Changeset in webkit [203491] by fpizlo@apple.com
  • 14 edits
    14 adds in trunk

Switching on symbols should be fast
​https://bugs.webkit.org/show_bug.cgi?id=158892

Reviewed by Keith Miller.
Source/JavaScriptCore:


This does two things: fixes some goofs in our lowering of symbol equality and adds a new phase
to B3 to infer switch statements from linear chains of branches.

This changes how we compile equality to Symbols to constant-fold the load of the Symbol's UID.
This is necessary for making switches on Symbols inferrable. This also gives us the ability to
efficiently compile strict equality comparisons of SymbolUse and UntypedUse.

This adds a new phase to B3, which finds chains of branches that test for (in)equality on the
same value and constants, and turns them into a Switch. This can turn O(n) code into
O(log n) code, or even O(1) code if the switch cases are dense.

This can make a big difference in JS. Say you write a switch in which the case statements are
variable resolutions. The bytecode generator cannot use a bytecode switch in this case, since
we're required to evaluate the resolutions in order. But in DFG IR, we will often turn those
variable resolutions into constants, since we do that for any immutable singleton. This means
that B3 will see a chain of Branches: the else case of one Branch will point to a basic block
that does nothing but Branch on equality on the same value as the first Branch.

The inference algorithm is quite simple. The basic building block is the ability to summarize
a block's switch behavior. For a block that ends in a switch, this is just the collection of
switch cases. For a block that ends in a branch, we recognize Branch(Equal(value, const)),
Branch(NotEqual(value, const)), and Branch(value). Each of these are summarized as if they
were one-case switches. We infer a new switch if both some block and its sole predecessor
can be described as switches on the same value, nothing shady is going on (like loops), and
the block in question does no work other than this switch. In that case, the block is killed
and its cases (which we get from the summary) are added to the predecessor's switch. This
algorithm runs to fixpoint.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • b3/B3Generate.cpp:

(JSC::B3::generateToAir):

  • b3/B3InferSwitches.cpp: Added.

(JSC::B3::inferSwitches):

  • b3/B3InferSwitches.h: Added.
  • b3/B3Procedure.h:

(JSC::B3::Procedure::cfg):

  • b3/B3ReduceStrength.cpp:
  • b3/B3Value.cpp:

(JSC::B3::Value::performSubstitution):
(JSC::B3::Value::isFree):
(JSC::B3::Value::dumpMeta):

  • b3/B3Value.h:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCheckIdent):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::lowSymbol):
(JSC::FTL::DFG::LowerDFGToB3::lowSymbolUID):
(JSC::FTL::DFG::LowerDFGToB3::lowNonNullObject):

LayoutTests:

  • js/regress/bigswitch-indirect-expected.txt: Added.
  • js/regress/bigswitch-indirect-symbol-expected.txt: Added.
  • js/regress/bigswitch-indirect-symbol-or-undefined-expected.txt: Added.
  • js/regress/bigswitch-indirect-symbol-or-undefined.html: Added.
  • js/regress/bigswitch-indirect-symbol.html: Added.
  • js/regress/bigswitch-indirect.html: Added.
  • js/regress/implicit-bigswitch-indirect-symbol-expected.txt: Added.
  • js/regress/implicit-bigswitch-indirect-symbol.html: Added.
  • js/regress/script-tests/bigswitch-indirect-symbol-or-undefined.js: Added.

(foo):

  • js/regress/script-tests/bigswitch-indirect-symbol.js: Added.

(foo):

  • js/regress/script-tests/bigswitch-indirect.js: Added.

(foo):

  • js/regress/script-tests/implicit-bigswitch-indirect-symbol.js: Added.

(foo):

11:12 PM Changeset in webkit [203490] by commit-queue@webkit.org
  • 14 edits in trunk/Source/WebCore

Remove crossOriginRequestPolicy from ThreadableLoaderOptions
​https://bugs.webkit.org/show_bug.cgi?id=159417

Patch by Youenn Fablet <​youenn@apple.com> on 2016-07-20
Reviewed by Alex Christensen.

No observable change.

  • Modules/fetch/FetchLoader.cpp:

(WebCore::FetchLoader::start): DenyCrossOriginRequests -> FetchOptions::Mode::SameOrigin.

  • fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start): DenyCrossOriginRequests -> FetchOptions::Mode::SameOrigin.

  • inspector/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::loadResource): AllowCrossOriginRequests -> FetchOptions::Mode::NoCors.

  • loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
(WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest): UseAccessControl -> FetchOptions::Mode::Cors.
(WebCore::DocumentThreadableLoader::redirectReceived): Ditto.
(WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
(WebCore::DocumentThreadableLoader::loadRequest): Use NoCors as option passed to ResourceLoader. This allows
desactivating ResourceLoader CORS checks as they are done in DocumentThreadableLoader right now. In the future,
these checks should be moved to ResourceLoader and DocumentThreadableLoader should directly pass the fetch mode
option.
(WebCore::DocumentThreadableLoader::isAllowedRedirect): AllowCrossOriginRequests -> FetchOptions::Mode::NoCors.

  • loader/ThreadableLoader.cpp:

(WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Removing CrossOriginRequestPolicy.

  • loader/ThreadableLoader.h: Ditto.
  • loader/WorkerThreadableLoader.cpp:

(WebCore::LoaderTaskOptions::LoaderTaskOptions): Ditto.

  • page/EventSource.cpp:

(WebCore::EventSource::connect): UseAccessControl -> FetchOptions::Mode::Cors.

  • workers/Worker.cpp:

(WebCore::Worker::create): DenyCrossOriginRequests -> FetchOptions::Mode::SameOrigin.

  • workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::importScripts): AllowCrossOriginRequests -> FetchOptions::Mode::NoCors.

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously):
(WebCore::WorkerScriptLoader::loadAsynchronously):

  • workers/WorkerScriptLoader.h:
  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::createRequest):

11:09 PM Changeset in webkit [203489] by commit-queue@webkit.org
  • 4 edits in trunk/Tools

Bots should run built-ins generator tests
​https://bugs.webkit.org/show_bug.cgi?id=159971

Patch by Youenn Fablet <​youenn@apple.com> on 2016-07-20
Reviewed by Alexey Proskuryakov.

  • BuildSlaveSupport/build.webkit.org-config/master.cfg:

(RunBuiltinsTests): New step to run built-in generator tests.
(TestFactory.init): Adding an additional step for bultin generator tests.

  • BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py: Rebasing expectations.
  • BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotIteration.js: Adding additional step for proper display.
10:24 PM Changeset in webkit [203488] by fpizlo@apple.com
  • 9 edits
    1 add in trunk/Source/JavaScriptCore

FTL snippet generators should be able to request a different register for output and input
​https://bugs.webkit.org/show_bug.cgi?id=160010
rdar://problem/27439330

Reviewed by Saam Barati.

The BitOr and BitXor snippet generators have problems if the register for the right input is
the same as the register for the result. We could fix those generators, but I'm not convinced
that the other snippet generators don't have this bug. So, the approach that this patch takes
is to teach the FTL to request that B3 to use a different register for the result than for
any input to the snippet patchpoint.

Air already has the ability to let any instruction do an EarlyDef, which means exactly this.
But B3 did not expose this via ValueRep. This patch exposes this in ValueRep as
SomeEarlyRegister. That's most of the change.

This adds a testb3 test for SomeEarlyRegister and a regression test for this particular
problem. The regression test failed on trunk JSC before this.

  • b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

  • b3/B3PatchpointSpecial.cpp:

(JSC::B3::PatchpointSpecial::forEachArg):
(JSC::B3::PatchpointSpecial::admitsStack):

  • b3/B3StackmapSpecial.cpp:

(JSC::B3::StackmapSpecial::forEachArgImpl):
(JSC::B3::StackmapSpecial::isArgValidForRep):

  • b3/B3Validate.cpp:
  • b3/B3ValueRep.cpp:

(JSC::B3::ValueRep::addUsedRegistersTo):
(JSC::B3::ValueRep::dump):
(WTF::printInternal):

  • b3/B3ValueRep.h:

(JSC::B3::ValueRep::ValueRep):
(JSC::B3::ValueRep::reg):
(JSC::B3::ValueRep::isAny):
(JSC::B3::ValueRep::isReg):
(JSC::B3::ValueRep::isSomeRegister): Deleted.

  • b3/testb3.cpp:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
(JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
(JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):

  • tests/stress/ftl-bit-xor-right-result-interference.js: Added.
8:30 PM Changeset in webkit [203487] by Chris Dumez
  • 5 edits
    2 adds in trunk

Fix null handling of several Document attributes
​https://bugs.webkit.org/show_bug.cgi?id=159997

Reviewed by Ryosuke Niwa.

Source/WebCore:

Fix null handling of the following Document attributes: title, cookie
and domain.

In WebKit, they were all marked as [TreatNullAs=EmptyString], which
does not match the specification:

Details for each attribute:

  • title: null is now treated as the string "null", thus setting the document title to "null". This matches Firefox and Chrome.
  • cookie: adds a "null" cookie instead of being a no-op. This matches

both Firefox and Chrome.

  • domain: Calls setDomain(String("null")) instead of

setDomain(String()). This throws an exception because "null"
is not a suffix of the effective domain name. The behavior
is the same in Firefox and Chrome. Previously, we were
already throwing an exception since setting the domain to
the empty string throws, as per the specification.

Test: http/testsdom/document-attributes-null-handling.html

  • dom/Document.idl:

LayoutTests:

Add test coverage.

  • http/tests/dom/document-attributes-null-handling-expected.txt: Added.
  • http/tests/dom/document-attributes-null-handling.html: Added.
  • fast/dom/document-attribute-js-null-expected.txt:
  • fast/dom/document-attribute-js-null.html:
8:25 PM Changeset in webkit [203486] by rniwa@webkit.org
  • 5 edits in trunk/Websites/perf.webkit.org

Perf dashboard always re-generate measurement set JSON
​https://bugs.webkit.org/show_bug.cgi?id=159951

Reviewed by Chris Dumez.

The bug was caused by manifest.json reporting the last modified date of a measurement set in floating point,
and a measurement set JSON reporting it as an integer. Fixed the bug by always using an integer.

  • public/api/measurement-set.php:

(main): Return 404 when the results is empty.
(MeasurementSetFetcher::execute_query): Use "extract(epoch from commit_time)" like ManifestGenerator to improve
the generation speed. This is ~10% runtime improvement.
(MeasurementSetFetcher::format_map): Updated to reflect the above change.
(MeasurementSetFetcher::parse_revisions_array): Ditto.

  • public/include/manifest.php:

(ManifestGenerator::platforms): Fixed the bug by coercing lastModified to integer (instead of float).

  • server-tests/api-measurement-set-tests.js: Added a test case for returning empty results, and a test case for

making sure lastModified dates in manifest.json and measurement sets match.

  • tools/js/remote.js:

(RemoteAPI.prototype.sendHttpRequest): Reject the promise when HTTP status code is not 200.

7:09 PM Changeset in webkit [203485] by aakash_jain@apple.com
  • 2 edits in trunk/Tools

Revert temporary fix r203417
​https://bugs.webkit.org/show_bug.cgi?id=160001

Reviewed by Alexey Proskuryakov.

  • EWSTools/start-queue-mac.sh: Revert the temporary fix.
5:45 PM Changeset in webkit [203484] by commit-queue@webkit.org
  • 23 edits
    2 adds in trunk

Unreviewed, rolling out r203471.
​https://bugs.webkit.org/show_bug.cgi?id=160003

many iOS-simulator tests are failing (Requested by litherum on
#webkit).

Reverted changeset:

"[iPhone] Playing a video on tudou.com plays only sound, no
video"
​https://bugs.webkit.org/show_bug.cgi?id=159967
​http://trac.webkit.org/changeset/203471

5:36 PM Changeset in webkit [203483] by Simon Fraser
  • 2 edits in trunk/Source/WebKit2

REGRESSION (r203189): Webpage snapshots are partially or fully blank when edge swiping back
​https://bugs.webkit.org/show_bug.cgi?id=160000
rdar://problem/27455589

Reviewed by Zalan Bujtas.

r203189 triggered a call to -_updateContentRectsWithState: in the middle of a swipe,
during which we'd compute the visible rect of the view as having zero width, causing us
to not create tiles.

-_navigationGestureDidBegin already snapshots the visibleContentRect in _frozenVisibleContentRect,
but -_visibleContentRect then clipped that with ancestor views, causing the issue.

Fix by having -_visibleContentRect just return _frozenVisibleContentRect if we have one.

  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _visibleContentRect]):

5:23 PM Changeset in webkit [203482] by rniwa@webkit.org
  • 3 edits in trunk/Source/WebCore

iOS: Cannot paste images in RTF content
​https://bugs.webkit.org/show_bug.cgi?id=159964
<rdar://problem/27442806>

Reviewed by Enrica Casucci.

The bug was caused by setDefersLoading(true) not deferring image loading for the parsed fragment.
Worked around this bug by disabling image loading while parsing the document fragment.

  • editing/ios/EditorIOS.mm:

(WebCore::Editor::createFragmentAndAddResources):

5:15 PM Changeset in webkit [203481] by beidson@apple.com
  • 4 edits in trunk/Source/WebCore

Address a small FIXME in IDB code.
​https://bugs.webkit.org/show_bug.cgi?id=159999

Reviewed by Andy Estes.

No new tests (No behavior change).

  • Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::IDBRequest):

  • Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::IDBResourceIdentifier::IDBResourceIdentifier): Deleted.

  • Modules/indexeddb/shared/IDBResourceIdentifier.h:
4:28 PM Changeset in webkit [203480] by beidson@apple.com
  • 7 edits in trunk/Source/WebCore

Remove some "modernFoo"s from IndexedDB code.
​https://bugs.webkit.org/show_bug.cgi?id=159985

Reviewed by Andy Estes.

No new tests (No known behavior change).

  • Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::IDBCursor):
(WebCore::IDBCursor::~IDBCursor):
(WebCore::IDBCursor::sourcesDeleted):
(WebCore::IDBCursor::effectiveObjectStore):
(WebCore::IDBCursor::transaction):
(WebCore::IDBCursor::direction):
(WebCore::IDBCursor::update):
(WebCore::IDBCursor::advance):
(WebCore::IDBCursor::continueFunction):
(WebCore::IDBCursor::uncheckedIterateCursor):
(WebCore::IDBCursor::deleteFunction):
(WebCore::IDBCursor::setGetResult):

  • Modules/indexeddb/IDBIndex.cpp:

(WebCore::IDBIndex::IDBIndex):
(WebCore::IDBIndex::~IDBIndex):
(WebCore::IDBIndex::hasPendingActivity):
(WebCore::IDBIndex::name):
(WebCore::IDBIndex::objectStore):
(WebCore::IDBIndex::keyPath):
(WebCore::IDBIndex::unique):
(WebCore::IDBIndex::multiEntry):
(WebCore::IDBIndex::openCursor):
(WebCore::IDBIndex::doCount):
(WebCore::IDBIndex::openKeyCursor):
(WebCore::IDBIndex::doGet):
(WebCore::IDBIndex::doGetKey):
(WebCore::IDBIndex::markAsDeleted):

  • Modules/indexeddb/IDBIndex.h:
  • Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::transaction):
(WebCore::IDBObjectStore::deleteFunction): Deleted.
(WebCore::IDBObjectStore::modernDelete): Deleted.

  • Modules/indexeddb/IDBObjectStore.h:
  • bindings/js/JSIDBIndexCustom.cpp:

(WebCore::JSIDBIndex::visitAdditionalChildren):

4:28 PM Changeset in webkit [203479] by aakash_jain@apple.com
  • 2 edits in trunk/Tools

REGRESSION(r148588): ews classes might get garbage collected
​https://bugs.webkit.org/show_bug.cgi?id=159990

Reviewed by Ryosuke Niwa.

  • Scripts/webkitpy/tool/commands/init.py: Store the loaded ews classes

in a variable so that they do not get garbage collected.

4:24 PM Changeset in webkit [203478] by commit-queue@webkit.org
  • 2 edits
    2 adds in trunk/Tools

Add API test for layout constraints after exit fullscreen
​https://bugs.webkit.org/show_bug.cgi?id=159900

Patch by Jeremy Jones <​jeremyj@apple.com> on 2016-07-20
Reviewed by Jon Lee.

Added Fullscreen.LaytoutConstraints API test.
Tests fix from ​https://bugs.webkit.org/show_bug.cgi?id=159731

This test compares layout constraints on the web view before and after fullscreen to make sure
they are preserved.

  • TestWebKitAPI/Tests/WebKit2Cocoa/FullscreenLayoutConstraints.html: Added.
  • TestWebKitAPI/Tests/WebKit2Cocoa/FullscreenLayoutConstraints.mm: Added.

(-[FullscreenStateChangeMessageHandler userContentController:didReceiveScriptMessage:]):
(TestWebKitAPI::TEST):

4:23 PM Changeset in webkit [203477] by Ryan Haddad
  • 2 edits in trunk/Tools

Disable two failing API tests.

Unreviewed test gardening.

  • TestWebKitAPI/Tests/mac/CandidateTests.mm:

(TestWebKitAPI::TEST):

4:14 PM Changeset in webkit [203476] by jiewen_tan@apple.com
  • 5 edits
    2 adds in trunk/LayoutTests

Fix timeout of imported/w3c/WebCryptoAPI/idlharness.html
​https://bugs.webkit.org/show_bug.cgi?id=159979

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Add missing resources.

  • WebCryptoAPI/idlharness-expected.txt:
  • WebCryptoAPI/idlharness.html:
  • resources/WebIDLParser.js: Added.

(tokenise):
(WebIDLParseError):
(WebIDLParseError.prototype.toString):
(error):
(consume):
(ws):
(all_ws):
(integer_type):
(float_type):
(primitive_type):
(const_value):
(type_suffix):
(single_type):
(union_type):
(type):
(argument):
(argument_list):
(type_pair):
(simple_extended_attr):
(extended_attrs):
(default_):
(const_):
(inheritance):
(operation_rest):
(callback):
(attribute):
(return_type):
(operation):
(identifiers):
(serialiser):
(iterable_type):
(readonly_iterable_type):
(iterable):
(interface_):
(partial):
(dictionary):
(exception):
(enum_):
(parse):

  • resources/idlharness.js: Added.

(constValue):
(minOverloadLength):
(throwOrReject):
(awaitNCallbacks):
(return.fround):
(fround):
(self.IdlArray):
(IdlArray.prototype.add_idls):
(IdlArray.prototype.add_untested_idls):
(IdlArray.prototype.internal_add_idls):
(IdlArray.prototype.add_objects):
(IdlArray.prototype.prevent_multiple_testing):
(IdlArray.prototype.recursively_get_implements):
(exposed_in):
(IdlArray.prototype.test):
(IdlArray.prototype.assert_type_is):
(IdlObject):
(IdlObject.prototype.test):
(IdlObject.prototype.has_extended_attribute):
(IdlInterface):
(IdlInterface.prototype.is_callback):
(IdlInterface.prototype.has_constants):
(IdlInterface.prototype.is_global):
(IdlInterface.prototype.test):
(IdlInterface.prototype.test_self):
(IdlInterface.prototype.test_member_const):
(IdlInterface.prototype.test_member_attribute):
(IdlInterface.prototype.test_member_operation):
(IdlInterface.prototype.do_member_operation_asserts):
(IdlInterface.prototype.test_member_stringifier):
(IdlInterface.prototype.test_members):
(IdlInterface.prototype.test_object):
(IdlInterface.prototype.test_primary_interface_of):
(IdlInterface.prototype.test_interface_of):
(IdlInterface.prototype.has_stringifier):
(IdlInterface.prototype.do_interface_attribute_asserts):
(IdlInterfaceMember):
(create_suitable_object):
(IdlEnum):
(IdlTypedef):

LayoutTests:

Remove the skip tuple of the test.

4:07 PM Changeset in webkit [203475] by Chris Dumez
  • 3 edits
    2 adds in trunk

Stop using valueToStringWithNullCheck() in JSCSSStyleDeclaration::putDelegate()
​https://bugs.webkit.org/show_bug.cgi?id=159982

Reviewed by Ryosuke Niwa.

Source/WebCore:

valueToStringWithNullCheck() treats null as the null String() which is
legacy / non standard behavior. The specification says we should treat
null as the empty string:

Therefore, we should be using valueToStringTreatingNullAsEmptyString() instead.

In practice, there is no web-exposed behavior change because
MutableStyleProperties::setProperty() removes the property wether the
value is the null String or the empty String.

This behavior is correct since the specification says that we should
remove the property if the value is the empty string:

I added test coverage to make sure we behave according to specification.
This test is passing in Firefox, Chrome and in WebKit (before and after
my change).

Test: fast/css/CSSStyleDeclaration-property-setter.html

  • bindings/js/JSCSSStyleDeclarationCustom.cpp:

(WebCore::JSCSSStyleDeclaration::putDelegate):

LayoutTests:

Add layout test coverage for JSCSSStyleDeclaration::putDelegate(),
covering cases like setting to null or the empty String, to make
sure we behave according to specification.

  • fast/css/CSSStyleDeclaration-property-setter-expected.txt: Added.
  • fast/css/CSSStyleDeclaration-property-setter.html: Added.
4:06 PM Changeset in webkit [203474] by Chris Dumez
  • 7 edits in trunk

Fix null handling of HTMLFrameElement.marginWidth / marginHeight
​https://bugs.webkit.org/show_bug.cgi?id=159987

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

  • web-platform-tests/html/dom/reflection-obsolete-expected.txt:

Source/WebCore:

Fix null handling of HTMLFrameElement.marginWidth / marginHeight:

We are supposed to treat null as the empty string but we treat it as
the string "null".

Firefox and Chrome both match the specification.

No new tests, updated existing tests.

  • html/HTMLFrameElement.idl:

LayoutTests:

Update existing test to reflect the expected behavior change.

  • fast/dom/element-attribute-js-null-expected.txt:
  • fast/dom/element-attribute-js-null.html:
3:56 PM Changeset in webkit [203473] by Wenson Hsieh
  • 2 edits in trunk/Source/WebCore

Pausing autoplayed media should not remove all restrictions for that media element
​https://bugs.webkit.org/show_bug.cgi?id=159988

Reviewed by Jon Lee.

Localizes the removal of behavior restrictions introduced in r203464 upon pausing an
autoplaying video to just affect the hiding or showing of the media controller. This
prevents pages from using Javascript to start playing autoplaying videos that have
been paused by the user.

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::pause):

3:45 PM Changeset in webkit [203472] by bshafiei@apple.com
  • 2 edits in branches/safari-602-branch/Tools

Merge follow-up patch for rdar://problem/27360961.

3:41 PM Changeset in webkit [203471] by mmaxfield@apple.com
  • 23 edits
    2 deletes in trunk

[iPhone] Playing a video on tudou.com plays only sound, no video
​https://bugs.webkit.org/show_bug.cgi?id=159967
<rdar://problem/26964090>

Reviewed by Jon Lee.

Source/WebCore:

WebKit recently starting honoring the playsinline and webkit-playsinline
attribute on iPhones. However, because these attributes previously did
nothing, some sites (such as Todou) were setting them on their content
and expecting that they are not honored. In this specific case, the
video is absolutely positioned to be 1 pixel x 1 pixel.

Previously, with iOS 9, apps could set the allowsInlineMediaPlayback
property on their WKWebView, which would honor the webkit-playsinline
attribute. Safari on iPhones didn't do this.

In order to not break these existing apps, it's important that the
allowsInlineMediaPlayback preference still allows webkit-playsinline
videos to play inline in apps using WKWebView. However, in Safari, these
videos should play fullscreen. (Todou videos have webkit-playsinline
but not playsinline.)

Therefore, in Safari, videos with playsinline should be inline, but
videos with webkit-playsinline should be fullscreen. In apps using
WKWebViews, if the app sets allowsInlineMediaPlayback, then videos with
playsinline should be inline, and videos with webkit-playsinline should
also be inline. Videos on iPad and Mac should all be inline by default.

We can create some truth tables for the cases which need to be covered:

All apps on Mac / iPad:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Inline
Present | Not present | Inline
Not Present | Present | Inline
Present | Present | Inline

Safari on iPhone:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Fullscreen
Present | Not present | Inline
Not Present | Present | Fullscreen
Present | Present | Inline

App on iPhone which sets allowsInlineMediaPlayback:
Presence of playsinline | Presence of webkit-playsinline | Result
========================|================================|===========
Not present | Not present | Fullscreen
Present | Not present | Inline
Not Present | Present | Inline
Present | Present | Inline

The way to distinguish Safari from another app is to create an SPI
boolean preference which Safari can set. This is already how the
iPhone and iPad are differentiated using the requiresPlayInlineAttribute
which Safari sets but other apps don't. However, this preference is
no longer sufficient because Safari should now be discriminating
between the playsinline and webkit-playsinline attributes. Therefore,
this preference should be extended to two boolean preferences, which
this patch adds:

allowsInlineMediaPlaybackWithPlaysInlineAttribute
allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute

Safari on iPhone will set
allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to true,
and allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to
false. Other apps on iPhone will get their defaults values (because they
are SPI) which means they will both be true. On iPad and Mac, apps will
use the defaults values where both are false.

This patch adds support for these two preferences, but does not remove
the existing inlineMediaPlaybackRequiresPlaysInlineAttribute preference.
I will remove the exising preference as soon as I update Safari to migrate
off of it.

Test: media/video-playsinline.html

  • html/MediaElementSession.cpp:

(WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):

  • page/Settings.cpp:
  • page/Settings.in:
  • testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):

  • testing/InternalSettings.h:
  • testing/InternalSettings.idl:

Source/WebKit/mac:

Add the two preferences to WebPreferences.

  • WebView/WebPreferenceKeysPrivate.h:
  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences allowsInlineMediaPlaybackWithPlaysInlineAttribute]):
(-[WebPreferences setAllowsInlineMediaPlaybackWithPlaysInlineAttribute:]):
(-[WebPreferences allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute]):
(-[WebPreferences setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute:]):

  • WebView/WebPreferencesPrivate.h:
  • WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:

Add the two preferences to WKWebViewConfiguration and WKPreferences to cover both
the Obj-C API and the C SPI.

  • Shared/WebPreferencesDefinitions.h:
  • UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WKPreferencesGetAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
(WKPreferencesSetAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):
(WKPreferencesGetAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):

  • UIProcess/API/C/WKPreferencesRefPrivate.h:
  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):

  • UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration _allowsInlineMediaPlaybackWithPlaysInlineAttribute]):
(-[WKWebViewConfiguration _setAllowsInlineMediaPlaybackWithPlaysInlineAttribute:]):
(-[WKWebViewConfiguration _allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute]):
(-[WKWebViewConfiguration _setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute:]):

  • UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

LayoutTests:

  • media/video-playsinline.html: Updated.
  • media/video-webkit-playsinline-expected.txt: Removed.
  • media/video-webkit-playsinline.html: Removed.
3:03 PM Changeset in webkit [203470] by Chris Dumez
  • 5 edits in trunk/Source/WebCore

Get rid of custom bindings code for XMLHttpRequest.open()
​https://bugs.webkit.org/show_bug.cgi?id=159984

Reviewed by Ryosuke Niwa.

Get rid of custom bindings code for XMLHttpRequest.open() as the
bindings generator is able to generate it.

Relevant specification:

The issue is that legacy content prevents treating the 'async' argument
being undefined identical from it being omitted. However, this can be
achieved by using overloading in IDL, like in the specification.

No new tests, already covered by the following tests:

  • http/tests/xmlhttprequest/basic-auth.html
  • http/tests/xmlhttprequest/open-async-overload.html
  • bindings/js/JSXMLHttpRequestCustom.cpp:

(WebCore::SendFunctor::SendFunctor): Deleted.
(WebCore::SendFunctor::line): Deleted.
(WebCore::SendFunctor::column): Deleted.
(WebCore::SendFunctor::url): Deleted.
(WebCore::SendFunctor::operator()): Deleted.

  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::open):

  • xml/XMLHttpRequest.h:
  • xml/XMLHttpRequest.idl:
2:21 PM Changeset in webkit [203469] by commit-queue@webkit.org
  • 83 edits in trunk/Source/WebCore

Mark overriden methods in WebCore/svg final classes as final
​https://bugs.webkit.org/show_bug.cgi?id=159966

Patch by Rawinder Singh <​rawinder.singh-webkit@cisra.canon.com.au> on 2016-07-20
Reviewed by Michael Catanzaro.

Update WebCore/svg classes so that overriden methods in final classes are marked final.

  • svg/SVGAElement.h:
  • svg/SVGAltGlyphDefElement.h:
  • svg/SVGAltGlyphItemElement.h:
  • svg/SVGAnimateTransformElement.h:
  • svg/SVGAnimatedColor.h:
  • svg/SVGCircleElement.h:
  • svg/SVGClipPathElement.h:
  • svg/SVGCursorElement.h:
  • svg/SVGDefsElement.h:
  • svg/SVGDescElement.h:
  • svg/SVGEllipseElement.h:
  • svg/SVGFEMergeNodeElement.h:
  • svg/SVGFilterElement.h:
  • svg/SVGFontElement.h:
  • svg/SVGFontFaceElement.h:
  • svg/SVGFontFaceFormatElement.h:
  • svg/SVGFontFaceNameElement.h:
  • svg/SVGFontFaceSrcElement.h:
  • svg/SVGFontFaceUriElement.h:
  • svg/SVGForeignObjectElement.h:
  • svg/SVGGElement.h:
  • svg/SVGGlyphElement.h:
  • svg/SVGGlyphRefElement.h:
  • svg/SVGHKernElement.h:
  • svg/SVGImageElement.h:
  • svg/SVGLineElement.h:
  • svg/SVGMPathElement.h:
  • svg/SVGMaskElement.h:
  • svg/SVGMetadataElement.h:
  • svg/SVGMissingGlyphElement.h:
  • svg/SVGPathBuilder.h:
  • svg/SVGPathByteStreamBuilder.h:
  • svg/SVGPathByteStreamSource.h:
  • svg/SVGPathElement.h:
  • svg/SVGPathSegArcAbs.h:
  • svg/SVGPathSegArcRel.h:
  • svg/SVGPathSegClosePath.h:
  • svg/SVGPathSegCurvetoCubicAbs.h:
  • svg/SVGPathSegCurvetoCubicRel.h:
  • svg/SVGPathSegCurvetoCubicSmoothAbs.h:
  • svg/SVGPathSegCurvetoCubicSmoothRel.h:
  • svg/SVGPathSegCurvetoQuadraticAbs.h:
  • svg/SVGPathSegCurvetoQuadraticRel.h:
  • svg/SVGPathSegCurvetoQuadraticSmoothAbs.h:
  • svg/SVGPathSegCurvetoQuadraticSmoothRel.h:
  • svg/SVGPathSegLinetoAbs.h:
  • svg/SVGPathSegLinetoHorizontalAbs.h:
  • svg/SVGPathSegLinetoHorizontalRel.h:
  • svg/SVGPathSegLinetoRel.h:
  • svg/SVGPathSegLinetoVerticalAbs.h:
  • svg/SVGPathSegLinetoVerticalRel.h:
  • svg/SVGPathSegListBuilder.h:
  • svg/SVGPathSegListSource.h:
  • svg/SVGPathSegMovetoAbs.h:
  • svg/SVGPathSegMovetoRel.h:
  • svg/SVGPathStringSource.h:
  • svg/SVGPathTraversalStateBuilder.h:
  • svg/SVGPatternElement.h:
  • svg/SVGRectElement.h:
  • svg/SVGScriptElement.h:
  • svg/SVGStopElement.h:
  • svg/SVGStyleElement.h:
  • svg/SVGSwitchElement.h:
  • svg/SVGTRefElement.cpp:
  • svg/SVGTitleElement.h:
  • svg/SVGToOTFFontConversion.cpp:
  • svg/SVGUnknownElement.h:
  • svg/SVGVKernElement.h:
  • svg/SVGViewElement.h:
  • svg/SVGZoomEvent.h:
  • svg/animation/SVGSMILElement.cpp:
  • svg/graphics/SVGImage.h:
  • svg/graphics/SVGImageClients.h:
  • svg/graphics/SVGImageForContainer.h:
  • svg/graphics/filters/SVGFEImage.h:
  • svg/graphics/filters/SVGFilter.h:
  • svg/properties/SVGAnimatedEnumerationPropertyTearOff.h:
  • svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
  • svg/properties/SVGAnimatedPropertyTearOff.h:
  • svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
  • svg/properties/SVGMatrixTearOff.h:
  • svg/properties/SVGPathSegListPropertyTearOff.h:
1:28 PM Changeset in webkit [203468] by Wenson Hsieh
  • 2 edits in trunk/Tools

Fix the build after 41dade3

1:03 PM Changeset in webkit [203467] by ChangSeok Oh
  • 2 edits in trunk/Source/WebKit2

Fix a linking failure caused by NetworkCache::Data::~Data()
​https://bugs.webkit.org/show_bug.cgi?id=159931

Linking is failed with clang 3.6. It says WebKit::NetworkCache::Data::~Data is undefined.
It is fixed by adding a destructor for NetworkCache::Data.

Reviewed by Alex Christensen.

  • NetworkProcess/cache/NetworkCacheData.h:

(WebKit::NetworkCache::Data::~Data):

1:00 PM Changeset in webkit [203466] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WTF

Remove unnecessary if check from ParkingLot.cpp
​https://bugs.webkit.org/show_bug.cgi?id=159961

Patch by Rajeev Misra <​rajeevmisraforapple@gmail.com> on 2016-07-20
Reviewed by Alex Christensen.

A good practice is to have as less conditional statement
or special cases as possible in code. This change
simply removes a unnecessary "if" statement for
condition which was already evaluated by switch/case
and thus there was no need to evaluate again.

  • wtf/ParkingLot.cpp:
12:42 PM Changeset in webkit [203465] by beidson@apple.com
  • 19 edits in trunk/Source/WebCore

Transition most IDB interfaces from ScriptExecutionContext to ExecState.
​https://bugs.webkit.org/show_bug.cgi?id=159975

Reviewed by Alex Christensen.

No new tests (No known behavior change).

  • Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::continueFunction):
(WebCore::IDBCursor::deleteFunction):

  • Modules/indexeddb/IDBCursor.h:
  • Modules/indexeddb/IDBCursor.idl:
  • Modules/indexeddb/IDBDatabase.idl:
  • Modules/indexeddb/IDBFactory.cpp:

(WebCore::IDBFactory::cmp):

  • Modules/indexeddb/IDBFactory.h:
  • Modules/indexeddb/IDBFactory.idl:
  • Modules/indexeddb/IDBIndex.cpp:

(WebCore::IDBIndex::openCursor):
(WebCore::IDBIndex::count):
(WebCore::IDBIndex::doCount):
(WebCore::IDBIndex::openKeyCursor):
(WebCore::IDBIndex::get):
(WebCore::IDBIndex::doGet):
(WebCore::IDBIndex::getKey):
(WebCore::IDBIndex::doGetKey):

  • Modules/indexeddb/IDBIndex.h:
  • Modules/indexeddb/IDBIndex.idl:
  • Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::only): Deleted.

  • Modules/indexeddb/IDBKeyRange.h:
  • Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::openCursor):
(WebCore::IDBObjectStore::get):
(WebCore::IDBObjectStore::putOrAdd):
(WebCore::IDBObjectStore::deleteFunction):
(WebCore::IDBObjectStore::doDelete):
(WebCore::IDBObjectStore::modernDelete):
(WebCore::IDBObjectStore::clear):
(WebCore::IDBObjectStore::createIndex):
(WebCore::IDBObjectStore::count):
(WebCore::IDBObjectStore::doCount):

  • Modules/indexeddb/IDBObjectStore.h:
  • Modules/indexeddb/IDBObjectStore.idl:
  • Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::requestOpenCursor):
(WebCore::IDBTransaction::doRequestOpenCursor):
(WebCore::IDBTransaction::requestGetRecord):
(WebCore::IDBTransaction::requestGetValue):
(WebCore::IDBTransaction::requestGetKey):
(WebCore::IDBTransaction::requestIndexRecord):
(WebCore::IDBTransaction::requestCount):
(WebCore::IDBTransaction::requestDeleteRecord):
(WebCore::IDBTransaction::requestClearObjectStore):
(WebCore::IDBTransaction::requestPutOrAdd):

  • Modules/indexeddb/IDBTransaction.h:
  • inspector/InspectorIndexedDBAgent.cpp:
12:25 PM Changeset in webkit [203464] by Wenson Hsieh
  • 5 edits
    1 add in trunk

Media controls don't appear when pausing a small autoplaying video
​https://bugs.webkit.org/show_bug.cgi?id=159972
<rdar://problem/27180657>

Reviewed by Beth Dakin.

Source/WebCore:

When pausing an autoplaying video, remove behavior restrictions for the
initial user gesture and show media controls.

New WebKit API test. See VideoControlsManagerSingleSmallAutoplayingVideo.

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::pause):

Tools:

Adds a new test that verifies media controls show up when pausing a small autoplayed video. Also adds mechanisms
for simulating basic user interaction in VideoControlsManager.

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKit2Cocoa/VideoControlsManager.mm:

(-[WKWebView mouseDownAtPoint:]):
(-[DidPlayMessageHandler userContentController:didReceiveScriptMessage:]):
(-[OnLoadMessageHandler initWithWKWebView:handler:]):
(-[OnLoadMessageHandler userContentController:didReceiveScriptMessage:]):
(TestWebKitAPI::TEST):

  • TestWebKitAPI/Tests/WebKit2Cocoa/autoplaying-video-with-audio.html: Added.
12:21 PM Changeset in webkit [203463] by Chris Dumez
  • 7 edits in trunk

Fix null handling of HTMLMediaElement.mediaGroup
​https://bugs.webkit.org/show_bug.cgi?id=159974

Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

  • web-platform-tests/html/dom/reflection-embedded-expected.txt:

Source/WebCore:

Fix null handling of HTMLMediaElement.mediaGroup to match the specification:

null is supposed to be treated as the String "null". This patch aligns
our behavior with the specification. I tested Firefox and Chrome but both
do not have this attribute on HTMLMediaElement.

Also remove support for [TreatNullAs=LegacyNullString] from our bindings
generator as HTMLMediaElement.mediaGroup was the last user.

No new tests, rebaselined existing test.

  • bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):

  • bindings/scripts/IDLAttributes.txt:
  • html/HTMLMediaElement.idl:
11:59 AM Changeset in webkit [203462] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebKit2

Explain the default value of WKWebViewConfiguration's ignoresViewportScaleLimits
​https://bugs.webkit.org/show_bug.cgi?id=159978
<rdar://problem/27453189>

Reviewed by Dan Bernstein.

  • UIProcess/API/Cocoa/WKWebViewConfiguration.h:

This defaults to NO.

11:10 AM Changeset in webkit [203461] by mitz@apple.com
  • 8 copies
    1 add in releases/Apple/Safari Technology Preview 9

Added a tag for Safari Technology Preview release 9.

11:01 AM Changeset in webkit [203460] by Chris Dumez
  • 4 edits
    2 adds in trunk

CSSStyleDeclaration.setProperty() should be able to unset "important" on a property
​https://bugs.webkit.org/show_bug.cgi?id=159959

Reviewed by Alexey Proskuryakov.

Source/WebCore:

CSSStyleDeclaration.setProperty() should be able to unsert "important"
on a property as per the latest specification:

Firefox and Chrome match the specification here but WebKit was ignoring calls
to setProperty() if there is already an "important" property wit this name
and if the new property does not have the "important" flag set.

This behavior was added a long time ago via Bug 60007. However, it does not
match the latest specification or other browsers.

Test: fast/css/CSSStyleDeclaration-setProperty-unset-important.html

  • css/StyleProperties.cpp:

(WebCore::MutableStyleProperties::addParsedProperty):
Drop code that was added via Bug 60007 as this behavior no longer matches the
specification or other browsers. The layout test added in Bug 60007 fails in
other browsers and was updated in this patch to match the specification.

LayoutTests:

  • fast/css/CSSStyleDeclaration-setProperty-unset-important-expected.txt: Added.
  • fast/css/CSSStyleDeclaration-setProperty-unset-important.html: Added.

Add layout test coverage.

  • fast/css/important-js-override.html:

The test covered our 'wrong' behavior and was failing in Firefox / Chrome.
I updated the test to match the behavior in the specification. The test
now passed in Chrome and Firefox.

10:55 AM Changeset in webkit [203459] by Ryan Haddad
  • 13 edits
    2 deletes in trunk

Unreviewed, rolling out r203423.
​https://bugs.webkit.org/show_bug.cgi?id=159977

The test for this change is failing on Mac Release WK2
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"HTMLVideoElement frames do not update on iOS when src is a
MediaStream blob"
​https://bugs.webkit.org/show_bug.cgi?id=159833
​http://trac.webkit.org/changeset/203423

Patch by Commit Queue <​commit-queue@webkit.org> on 2016-07-20

10:54 AM Changeset in webkit [203458] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Land test expectations for rdar://problem/27434307.

  • platform/mac/TestExpectations:
10:18 AM Changeset in webkit [203457] by pvollan@apple.com
  • 2 edits in trunk/Tools

[Win] MathML fonts are not found.
​https://bugs.webkit.org/show_bug.cgi?id=159920

Reviewed by Alex Christensen.

When looking up a font in the registry, use the /v option of the Windows 'reg query' command to query
for a specific registry key value.

  • Scripts/webkitdirs.pm:

(fontExists):

9:44 AM WebKitGTK/2.12.x edited by clopez@igalia.com
(diff)
9:37 AM Changeset in webkit [203456] by Chris Dumez
  • 4 edits
    2 adds in trunk

Fix null handling of HTMLSelectElement.value attribute
​https://bugs.webkit.org/show_bug.cgi?id=159925

Reviewed by Benjamin Poulain.

Source/WebCore:

Fix null handling of HTMLSelectElement.value attribute:

We were treating null as the null String which would end up setting
selectedIndex to -1. However, we should treat null as the String "null"
which would set the selectedIndex to the index of the <option> element
whose value is "null".

Firefox and Chrome match the specification.

Test: fast/dom/HTMLSelectElement/value-null-handling.html

  • html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::setValue):

  • html/HTMLSelectElement.idl:

LayoutTests:

Add layout test coverage. I have verified that this test is passing in
both Firefox and Chrome.

  • fast/dom/HTMLSelectElement/value-null-handling-expected.txt: Added.
  • fast/dom/HTMLSelectElement/value-null-handling.html: Added.
8:50 AM Changeset in webkit [203455] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Consolidating duplicate TestExpectations for fast/images/animated-png.html.

Unreviewed test gardening.

  • platform/mac/TestExpectations:
8:41 AM Changeset in webkit [203454] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Pausing when Debugger tab is closed opens tab in wrong state
​https://bugs.webkit.org/show_bug.cgi?id=159946
<rdar://problem/27429886>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-20
Reviewed by Timothy Hatcher.

  • UserInterface/Views/DebuggerSidebarPanel.js:

(WebInspector.DebuggerSidebarPanel):
At the end of construction, update the UI to match the current state
of the world. Such as updating the UI if we are paused, or if the
Timeline is capturing and we are temporarily disabling breakpoints.

8:40 AM Changeset in webkit [203453] by commit-queue@webkit.org
  • 5 edits in trunk/Tools

Improve prepare-ChangeLog for @media blocks
​https://bugs.webkit.org/show_bug.cgi?id=159907

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-20
Reviewed by Timothy Hatcher.

  • Scripts/prepare-ChangeLog:

(get_selector_line_ranges_for_css):
Get a range for @media blocks just like a selector.

Start Line = line with '{'
End line = line with '}'
Name = "@media ..."

  • Scripts/webkitperl/prepare-ChangeLog_unittest/resources/css_unittests_warning-expected.txt:

Improved error messages for unbalanced portions.

  • Scripts/webkitperl/prepare-ChangeLog_unittest/resources/css_unittests-expected.txt:
  • Scripts/webkitperl/prepare-ChangeLog_unittest/resources/css_unittests.css:

(.media-query::before):
(@media only screen and (max-width: 980px)):
(.media-query a):
(@media (-webkit-min-device-pixel-ratio: 2)):
(.both a):
(.both b):
(.media-query b):
(.media-query::after):

7:50 AM Changeset in webkit [203452] by msaboff@apple.com
  • 6 edits
    1 add in trunk/Source/JavaScriptCore

CrashOnOverflow in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets
​https://bugs.webkit.org/show_bug.cgi?id=159954

Reviewed by Benjamin Poulain.

YarrPatternConstructor::setupAlternativeOffsets() is using the checked arithmetic class
Checked<>, for offset calculations. However the default use will just crash on
overflow. Instead we should stop processing and propagate the error up the call stack.

Consolidated explicit error string with the common RegExp parsing error logic.
Moved that logic to YarrPattern as that seems like a better common place to put it.

  • jit/JITOperations.cpp:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

  • tests/stress/regress-159954.js: New test.
  • yarr/YarrParser.h:

(JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
(JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
(JSC::Yarr::Parser::Parser):
(JSC::Yarr::Parser::isIdentityEscapeAnError):
(JSC::Yarr::Parser::parseEscape):
(JSC::Yarr::Parser::parseCharacterClass):
(JSC::Yarr::Parser::parseParenthesesBegin):
(JSC::Yarr::Parser::parseParenthesesEnd):
(JSC::Yarr::Parser::parseQuantifier):
(JSC::Yarr::Parser::parseTokens):
(JSC::Yarr::Parser::parse):

  • yarr/YarrPattern.cpp:

(JSC::Yarr::YarrPatternConstructor::disjunction):
(JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
(JSC::Yarr::YarrPatternConstructor::setupOffsets):
(JSC::Yarr::YarrPattern::errorMessage):
(JSC::Yarr::YarrPattern::compile):

  • yarr/YarrPattern.h:

(JSC::Yarr::YarrPattern::reset):

6:07 AM Changeset in webkit [203451] by Carlos Garcia Campos
  • 2 edits in trunk/Source/WebKit2

[Linux] MemoryPressureMonitor fallback code to get memory available in older linux kernels doesn't work
​https://bugs.webkit.org/show_bug.cgi?id=159970

Reviewed by Antonio Gomes.

We are failing to detect zones when parsing /proc/zoneinfo.

  • UIProcess/linux/MemoryPressureMonitor.cpp:

(WebKit::lowWatermarkPages): Use strncmp since we want to know whether the line starts with "Node".
(WebKit::MemoryPressureMonitor::MemoryPressureMonitor): Stop the polling if we fail to get the memory available,
because that means it's not sopported in the system for whatever reason.

6:02 AM Changeset in webkit [203450] by Chris Dumez
  • 4 edits in trunk/Source/WebCore

PostResolutionCallbackDisabler can resume pending requests while a ResourceLoadSuspender is alive
​https://bugs.webkit.org/show_bug.cgi?id=159962
<rdar://problem/21439264>

Reviewed by David Kilzer.

PostResolutionCallbackDisabler can resume pending requests while a ResourceLoadSuspender
is alive. We have both PostResolutionCallbackDisabler and ResourceLoadSuspender that
call LoaderStrategy::suspendPendingRequests() / LoaderStrategy::resumePendingRequests().
However, PostResolutionCallbackDisabler and ResourceLoadSuspender are not aware of each
other. It is therefore possible for a PostResolutionCallbackDisabler object to get
destroyed, causing LoaderStrategy::resumePendingRequests() to be called while a
ResourceLoadSuspender object is alive.

This leads to hard to investigate crashes where we end up re-entering WebKit and killing
the style resolver.

This patch drops ResourceLoadSuspender and uses PostResolutionCallbackDisabler instead.
There was only one user of ResourceLoadSuspender and PostResolutionCallbackDisabler
is better because it manages a resolutionNestingDepth counter internally to make sure
it only calls LoaderStrategy::resumePendingRequests() once all
PostResolutionCallbackDisabler instances are destroyed.

No new tests, there is no easy way to reproduce the crashes.

  • dom/Document.cpp:

(WebCore::Document::styleForElementIgnoringPendingStylesheets):

  • loader/LoaderStrategy.cpp:

(WebCore::ResourceLoadSuspender::ResourceLoadSuspender): Deleted.
(WebCore::ResourceLoadSuspender::~ResourceLoadSuspender): Deleted.

  • loader/LoaderStrategy.h:
5:17 AM Changeset in webkit [203449] by Carlos Garcia Campos
  • 5 edits in trunk/Source/WebKit2

[Threaded Compositor] Web Process crash when the layer tree host is destroyed
​https://bugs.webkit.org/show_bug.cgi?id=159922

Reviewed by Sergio Villar Senin.

It happens when the layer tree host is destroyed after the didChangeVisibleRect is scheduled to be run in the
main thread, but before it's actually dispatched. In that case the threaded compositor client points to a
deleted object and crashes when trying to dereference it.

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:

(WebKit::ThreadedCompositor::~ThreadedCompositor): Add an assert to ensure invalidate is always called before
the object is deleted.
(WebKit::ThreadedCompositor::invalidate): Terminate the compositing thread and nullify the client.
(WebKit::ThreadedCompositor::didChangeVisibleRect): Return early if the client is null when the task is
dispatched in the main thread.

  • Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h: Add invalidate().
  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:

(WebKit::ThreadedCoordinatedLayerTreeHost::invalidate): Invalidate the ThreadedCompositor and chain up.

  • WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:
3:55 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr
(diff)
1:50 AM Changeset in webkit [203448] by Csaba Osztrogonác
  • 2 edits in trunk/Tools

Fix expectedFailErrorHandler in run-jsc-stress-tests
​https://bugs.webkit.org/show_bug.cgi?id=159811

Reviewed by Yusuke Suzuki.

  • Scripts/run-jsc-stress-tests:
1:49 AM Changeset in webkit [203447] by Csaba Osztrogonác
  • 2 edits in trunk/Tools

Unreviewed Mac cmake buildfix after r203426. Just for fun.

  • TestWebKitAPI/PlatformMac.cmake:
12:30 AM Changeset in webkit [203446] by Csaba Osztrogonác
  • 2 edits in trunk

JSC JIT Broken on ARMv7 Traditional (without Thumb2)
​https://bugs.webkit.org/show_bug.cgi?id=159880

Reviewed by Carlos Garcia Campos.

  • Source/cmake/OptionsCommon.cmake: Use the BFD linker on ARM traditional because of a gold linker bug.
Note: See TracTimeline for information about the timeline view.