Context Navigation

← Previous Period
Next Period →

Timeline

Jul 30, 2016:

6:08 PM Changeset in webkit [203952] by mark.lam@apple.com

5 edits
2 adds in trunk

Assertion failure while setting the length of an ArrayClass array.
https://bugs.webkit.org/show_bug.cgi?id=160381
<rdar://problem/27328703>

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

When setting large length values, we're currently treating ArrayClass as a
ContiguousIndexingType array. This results in an assertion failure. This is
now fixed.

There are currently only 2 places where we create arrays with indexing type
ArrayClass: ArrayPrototype and RuntimeArray. The fix in JSArray:;setLength()
takes care of ArrayPrototype.

RuntimeArray already checks for the setting of its length property, and will
throw a RangeError. Hence, there's no change is needed for the RuntimeArray.
Instead, I added some test cases ensure that the check and throw behavior does
not change without notice.

runtime/JSArray.cpp:

(JSC::JSArray::setLength):

tests/stress/array-setLength-on-ArrayClass-with-large-length.js: Added.

(toString):
(assertEqual):

tests/stress/array-setLength-on-ArrayClass-with-small-length.js: Added.

(toString):
(assertEqual):

LayoutTests:

Test that RuntimeArrays will throw an error if we try to set its length.

platform/mac/fast/dom/wrapper-classes-objc.html:
platform/mac/fast/dom/wrapper-classes-objc-expected.txt:

5:46 PM Changeset in webkit [203951] by Chris Dumez

6 edits in trunk/Source/WebCore

Unreviewed, rebaseline bindings tests.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_set_property): Deleted.
(webkit_dom_test_obj_get_property): Deleted.
(webkit_dom_test_obj_class_init): Deleted.

bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjStrictTypeCheckingAttribute): Deleted.
(WebCore::jsTestObjStrictFloat): Deleted.
(WebCore::setJSTestObjStrictTypeCheckingAttribute): Deleted.
(WebCore::setJSTestObjStrictFloat): Deleted.

bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj strictTypeCheckingAttribute]): Deleted.
(-[DOMTestObj setStrictTypeCheckingAttribute:]): Deleted.
(-[DOMTestObj strictFloat]): Deleted.
(-[DOMTestObj setStrictFloat:]): Deleted.

5:29 PM Changeset in webkit [203950] by Chris Dumez

18 edits in trunk

Enable strict type checking for Window dictionary members
https://bugs.webkit.org/show_bug.cgi?id=160356

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

web-platform-tests/dom/events/Event-subclasses-constructors-expected.txt:

Source/WebCore:

Enable strict type checking for Window dictionary members. Technically,
we should do strict type checking of all wrapper types but this patch
focuses on Window because it is common to pass a Window dictionary
member to Event constructors.

By strict type checking, I mean that we should throw a TypeError is
the value is not null/undefined and does not implement the Window
interface:

http://heycam.github.io/webidl/#es-interface

Firefox and Chrome comply with the specification already.

No new tests, updated / rebaselined existing tests.

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::convertValue):

LayoutTests:

Update existing tests to reflect behavior change.

fast/events/constructors/composition-event-constructor-expected.txt:
fast/events/constructors/composition-event-constructor.html:
fast/events/constructors/focus-event-constructor-expected.txt:
fast/events/constructors/focus-event-constructor.html:
fast/events/constructors/keyboard-event-constructor-expected.txt:
fast/events/constructors/keyboard-event-constructor.html:
fast/events/constructors/mouse-event-constructor.html:
fast/events/constructors/ui-event-constructor-expected.txt:
fast/events/constructors/ui-event-constructor.html:
fast/events/constructors/wheel-event-constructor.html:
platform/mac/fast/events/constructors/mouse-event-constructor-expected.txt:
platform/mac/fast/events/constructors/wheel-event-constructor-expected.txt:

resources/js-test-pre.js:

Add a shouldThrowErrorName() utility function that is similar to shouldThrow()
but only checks the error name instead of the full error message. Checking
only the error name has the benefit of working across browsers and facilitating
refactoring of error messages.

5:23 PM Changeset in webkit [203949] by Chris Dumez

43 edits in trunk

[WebIDL] Enable strict type checking for nullable attribute setters of wrapper types
https://bugs.webkit.org/show_bug.cgi?id=160375

Reviewed by Darin Adler.

Source/WebCore:

Enable strict type checking for nullable attribute setters of wrapper types:

For such attributes, if the JS tries to assign a value that is not null /
undefined and does not have the expected wrapper type, then we now throw a
TypeError instead of silently converting the value to null.

This behavior is consistent with Chrome and Firefox. It also helps identify
bugs in JavaScript code.

No new tests, updated existing tests.

Modules/webaudio/AudioBufferSourceNode.idl:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::setJSTestObjTestNullableObjAttr):
(WebCore::setJSTestObjMutablePoint):
(WebCore::setJSTestObjImmutablePoint):

bindings/scripts/test/TestObj.idl:
dom/Document.idl:
html/HTMLTableElement.idl:
svg/SVGAngle.idl:
svg/SVGAnimatedBoolean.idl:
svg/SVGAnimatedEnumeration.idl:
svg/SVGAnimatedInteger.idl:
svg/SVGAnimatedNumber.idl:
svg/SVGLength.idl:
svg/SVGMatrix.idl:
svg/SVGNumber.idl:
svg/SVGPathSegArcAbs.idl:
svg/SVGPathSegArcRel.idl:
svg/SVGPathSegCurvetoCubicAbs.idl:
svg/SVGPathSegCurvetoCubicRel.idl:
svg/SVGPathSegCurvetoCubicSmoothAbs.idl:
svg/SVGPathSegCurvetoCubicSmoothRel.idl:
svg/SVGPathSegCurvetoQuadraticAbs.idl:
svg/SVGPathSegCurvetoQuadraticRel.idl:
svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl:
svg/SVGPathSegCurvetoQuadraticSmoothRel.idl:
svg/SVGPathSegLinetoAbs.idl:
svg/SVGPathSegLinetoHorizontalAbs.idl:
svg/SVGPathSegLinetoHorizontalRel.idl:
svg/SVGPathSegLinetoRel.idl:
svg/SVGPathSegLinetoVerticalAbs.idl:
svg/SVGPathSegLinetoVerticalRel.idl:
svg/SVGPathSegMovetoAbs.idl:
svg/SVGPathSegMovetoRel.idl:
svg/SVGPoint.idl:
svg/SVGPreserveAspectRatio.idl:
svg/SVGRect.idl:

LayoutTests:

Rebaseline / update existing tests to reflect behavior change.

fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance-expected.txt:
fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance.html:
webaudio/convolver-setBuffer-null-expected.txt:
webaudio/convolver-setBuffer-null.html:

2:12 PM Changeset in webkit [203948] by ap@apple.com

2 edits in branches/safari-602-branch/LayoutTests

Merge r203947.

2016-07-30 Alexey Proskuryakov <ap@apple.com>

macOS Sierra test result gardening for media/video-loop.html.

platform/mac/TestExpectations:

2:08 PM Changeset in webkit [203947] by ap@apple.com

2 edits in trunk/LayoutTests

macOS Sierra test result gardening for media/video-loop.html.

platform/mac/TestExpectations:

1:33 PM Changeset in webkit [203946] by ap@apple.com

2 edits in branches/safari-602-branch/LayoutTests

Merge r203945.

2016-07-30 Alexey Proskuryakov <ap@apple.com>

macOS Sierra test result gardening.

platform/mac-wk1/TestExpectations:

1:30 PM Changeset in webkit [203945] by ap@apple.com

2 edits in trunk/LayoutTests

macOS Sierra test result gardening.

platform/mac-wk1/TestExpectations:

12:27 PM Changeset in webkit [203944] by mitz@apple.com

2 edits in trunk/Source/WebKit2

[Xcode] WebKit.framework is touched on incremental build even if nothing’s changed
https://bugs.webkit.org/show_bug.cgi?id=160383

Reviewed by Tim Horton.

WebKit2.xcodeproj/project.pbxproj: Removed the output files listed under the Copy iOS Sandbox Profiles for Manual Sandboxing script build phase, because it doesn’t produce those files on macOS. With no outputs listed, the script will still run every time, but the fact that it has run won’t trigger touching the framework.

12:27 PM Changeset in webkit [203943] by commit-queue@webkit.org

4 edits
2 adds in trunk

Synchronous preflight should check for successful responses
https://bugs.webkit.org/show_bug.cgi?id=159350

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-30
Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/xmlhttprequest/access-control-preflight-not-successful.html

loader/CrossOriginPreflightChecker.cpp:

(WebCore::CrossOriginPreflightChecker::doPreflight): Adding successful response check for synchronous
preflighting.

LayoutTests:

http/tests/xmlhttprequest/access-control-preflight-not-successful-expected.txt: Added.
http/tests/xmlhttprequest/access-control-preflight-not-successful.html: Added, not all tests are passing as CORS checks.

for redirections are not well supported for synchronous loading.

http/tests/xmlhttprequest/resources/status-404-without-body.php:

7:16 AM Changeset in webkit [203942] by Manuel Rego Casasnovas

2 edits in trunk/Tools

Unreviewed: add myself to the reviewers list.

Scripts/webkitpy/common/config/contributors.json:

1:35 AM Changeset in webkit [203941] by Chris Dumez

24 edits in trunk

[WebIDL] Enable strict type checking for operations' nullable parameters of wrapper types
https://bugs.webkit.org/show_bug.cgi?id=160374

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

web-platform-tests/dom/nodes/DOMImplementation-createDocument-expected.txt:

Source/WebCore:

Enable strict type checking for operations' nullable parameters of
wrapper types to comply with the Web IDL specification:

For such parameters, if the JS passes a value that is not null /
undefined and does not have the expected wrapper type, then we now
throw a TypeError instead of silently converting the value to null.

This behavior is consistent with Chrome and Firefox. It also helps
identify bugs in JavaScript code.

No new tests, rebaselined existing tests.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateParametersCheck):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapper):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapperIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalXPathNSResolver):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
(WebCore::jsTestObjPrototypeFunctionConvert2):
(WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod3): Deleted.
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod5): Deleted.
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod): Deleted.
(WebCore::jsTestObjPrototypeFunctionOrange): Deleted.

LayoutTests:

Update / rebaseline existing tests to reflect behavior change. Also fix
several bugs in tests that became obvious now that we throw.

editing/execCommand/indent-pre-expected.txt:
editing/execCommand/indent-pre.html:
editing/selection/4895428-2.html:
editing/selection/move-by-word-visually-null-box.html:
fast/dom/DOMImplementation/detached-doctype.html:
fast/dom/MutationObserver/observe-attributes.html:
fast/dom/Node/contains-method-expected.txt:
fast/dom/Node/script-tests/contains-method.js:
fast/dom/Window/webkitConvertPoint.html:
fast/dom/adopt-node-crash-2.html:
fast/dom/incompatible-operations-expected.txt:
fast/dom/incompatible-operations.html:
fast/events/selectstart-by-arrow-keys.html:
fast/images/image-copy-memory-usage.html:
fast/xsl/xslt-processor-expected.txt:
http/tests/misc/webtiming-cross-origin-and-back1.html:
platform/mac/fast/dom/Window/webkitConvertPoint-expected.txt:
svg/custom/unicode-in-tspan-multi-svg-crash.html:

Jul 29, 2016:

11:39 PM Changeset in webkit [203940] by ap@apple.com

4 edits in trunk/Tools

Undo r203939, and copy over a rule that clips the logos.

Sierra wasn't the only logo without transparency.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Images/Sierra.png:
BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Images/Sierra@2x.png:
BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Styles/Main.css:

9:42 PM Changeset in webkit [203939] by commit-queue@webkit.org

3 edits in trunk/Tools

The Sierra asset at build.webkit.org/dashboard/images/Sierra*.png has a white background
https://bugs.webkit.org/show_bug.cgi?id=160377

Patch by Alan Sien Wei Hshieh <hshieh@apple.com> on 2016-07-29
Reviewed by Brian Weinstein.

Update assets to remove the white background and use a transparent background instead.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Images/Sierra.png:
BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Images/Sierra@2x.png:

8:22 PM Changeset in webkit [203938] by ddkilzer@apple.com

12 edits in trunk/Source/ThirdParty/ANGLE

ANGLE: Fix global constructors and exit-time destructors
<https://webkit.org/b/160332>

Reviewed by Darin Adler.

Configurations/Base.xcconfig:
Add warning flags.

src/common/angleutils.cpp:

(FormatString):

src/common/angleutils.h:

(MakeStaticString):

src/common/debug.cpp:
src/common/mathutil.cpp:

(gl::g_sharedexp_max):
(gl::convertRGBFloatsTo999E5):

src/compiler/translator/ShaderLang.cpp:

(ShGetUniformRegisterMap):

src/libANGLE/Caps.cpp:

(gl::TextureCapsMap::get):

src/libANGLE/Device.cpp:

(egl::GetDeviceSet):

src/libANGLE/Display.cpp:

(egl::Display::getClientExtensionString):

src/libANGLE/formatutils.cpp:

(gl::BuildFormatMap):
(gl::BuildInternalFormatInfoMap):
(gl::GetInternalFormatMap):
(gl::BuildAllSizedInternalFormatSet):
(gl::GetSizedInternalFormat):
(gl::GetAllSizedInternalFormats):

src/libANGLE/validationES3.cpp:

(gl::BuildES3FormatSet):
(gl::ValidateTexImageFormatCombination):
(gl::BuildSizedEffectiveInternalFormatList):
(gl::BuildUnsizedEffectiveInternalFormatList):
(gl::GetEffectiveInternalFormat):
(gl::BuildValidES3CopyTexImageCombinations):
(gl::IsValidES3CopyTexImageCombination):

Fix global constructors and exit-time destructors.

7:02 PM Changeset in webkit [203937] by keith_miller@apple.com

3 edits in trunk/Source/JavaScriptCore

TypedArray super constructor has some incompatabilities
https://bugs.webkit.org/show_bug.cgi?id=160369

Reviewed by Filip Pizlo.

This patch fixes the length proprety of the TypedArray super constructor.
Additionally, the TypedArray super constructor should no longer be callable.

Also, this patch fixes the expected result of some test262 tests.

runtime/JSTypedArrayViewConstructor.cpp:

(JSC::JSTypedArrayViewConstructor::finishCreation):
(JSC::constructTypedArrayView):
(JSC::JSTypedArrayViewConstructor::getCallData):

tests/test262.yaml:

6:25 PM Changeset in webkit [203936] by ddkilzer@apple.com

2 edits in trunk/Tools

Ignore most check-webkit-style checks for ANGLE project
<https://webkit.org/b/160333>

Reviewed by Daniel Bates.

Scripts/webkitpy/style/checker.py: Ignore all checkers except:
No tabs.
No spaces at the end of lines.
No carriage returns (DOS line endings).

6:08 PM Changeset in webkit [203935] by Chris Dumez

15 edits
2 adds in trunk

Window's named properties should be exposed on a WindowProperties object in its prototype
https://bugs.webkit.org/show_bug.cgi?id=160354

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Window's named properties should be exposed on a WindowProperties object
in its prototype:

http://heycam.github.io/webidl/#named-properties-object

Firefox and Chrome both comply with the specification. However, WebKit
had no "WindowProperties" object in the Window prototype chain and the
named properties are exposed on the Window object itself.

No new tests, rebaselined existing tests.

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSBindingsAllInOne.cpp:
bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertySlot):
(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess): Deleted.
(WebCore::JSDOMWindow::put): Deleted.
(WebCore::JSDOMWindow::putByIndex): Deleted.
(WebCore::JSDOMWindow::getEnumerableLength): Deleted.

bindings/js/JSDOMWindowProperties.cpp: Added.

(WebCore::jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter):
(WebCore::JSDOMWindowProperties::getOwnPropertySlot):
(WebCore::JSDOMWindowProperties::getOwnPropertySlotByIndex):

bindings/js/JSDOMWindowProperties.h: Added.

(WebCore::JSDOMWindowProperties::create):
(WebCore::JSDOMWindowProperties::createStructure):
(WebCore::JSDOMWindowProperties::JSDOMWindowProperties):

bindings/js/JSDOMWindowShell.cpp:

(WebCore::JSDOMWindowShell::setWindow):

LayoutTests:

fast/dom/Window/es52-globals-expected.txt:

Update / Rebaseline test now that named properties are no longer reported as "own"
properties on the Window object. I have verified that the test gives the
same result in Firefox and Chrome.

fast/loader/window-clearing-expected.txt:

Rebaseline test that prints one more line because there is one more
object in Window's prototype chain.

http/tests/security/window-named-proto-expected.txt:
http/tests/security/window-named-valueOf-expected.txt:

Rebaseline 2 security tests that give slightly different output. The new
output is identical to the one in Firefox and Chrome. The tests are not
failing since they are not alert'ing content from the other frame.
The reason those tests were logging a security error is because we would
previously prevent named property access if the frame name conflicts with
a property name in the Window prototype, and we now no longer
differentiate this case.

5:54 PM Changeset in webkit [203934] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking http/tests/xmlhttprequest/workers/methods-async.html as flaky on ios-simulator release WK2
https://bugs.webkit.org/show_bug.cgi?id=160368

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:

5:53 PM Changeset in webkit [203933] by bshafiei@apple.com

5 edits in branches/safari-602-branch/Source

Versioning.

5:39 PM Changeset in webkit [203932] by Ryan Haddad

3 edits
1 copy
1 move in trunk/LayoutTests

Rebaseline fast/block/float/overhanging-tall-block.html for Sierra.

Unreviewed test gardening.

platform/mac-elcapitan/fast/block/float/overhanging-tall-block-expected.png: Renamed from LayoutTests/platform/mac/fast/block/float/overhanging-tall-block-expected.png.
platform/mac-elcapitan/fast/block/float/overhanging-tall-block-expected.txt: Copied from LayoutTests/platform/mac/fast/block/float/overhanging-tall-block-expected.txt.
platform/mac/TestExpectations:
platform/mac/fast/block/float/overhanging-tall-block-expected.txt:

5:30 PM Changeset in webkit [203931] by dbates@webkit.org

3 edits
4 adds in trunk

Crash under HTMLMediaElement::{resolve, reject}PendingPlayPromises() when playback is interrupted
https://bugs.webkit.org/show_bug.cgi?id=160366
<rdar://problem/27317407>

Reviewed by Eric Carlson.

Source/WebCore:

Fixes a crash/assertion failure in DeferredWrapper::{resolve, rejectWithValue}() caused by a Promise
being settled twice. In particular, if a system interruption occurs when media.play() is invoked
the returned Promise may ultimately be settled twice upon cessation of the interruption.

A Promise can be settled (resolved) exactly once. When a system interruption occurs media
playback is paused and resumes on cessation of the interruption. Currently we also immediately
reject the Promise p retuned by media.play() if the interruption occurs during its invocation.
So, when we resume playback on cessation of an interruption we try to resolve p again. But a
Promise can only be resolved once and hence we violate the assertions that p has both a valid
reference to a JSPromiseDeferred object and a reference to the global object of the page.

Tests: media/non-existent-video-playback-interrupted.html

media/video-playback-interrupted.html

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::play): Modified to reject the Promise and return immediately if
playInternal() returns false.
(WebCore::HTMLMediaElement::playInternal): Treat an interruption as success and return true
so that HTMLMediaElement::play() adds the Promise to the end of the list of pending promises.
We treat an interruption as a success because we will resume playback (assuming the media
can be loaded and is well-formed) upon cessation of the interruption and therefore can either
fulfill or reject the Promise object returned by media.play().

LayoutTests:

media/non-existent-video-playback-interrupted-expected.txt: Added.
media/non-existent-video-playback-interrupted.html: Added.
media/video-playback-interrupted-expected.txt: Added.
media/video-playback-interrupted.html: Added.

5:13 PM Changeset in webkit [203930] by dbates@webkit.org

2 edits in trunk/Source/WebCore

[iOS] HTMLMediaElement::updateVolume() calls MediaPlayer::volume() on null media player
https://bugs.webkit.org/show_bug.cgi?id=160353

Reviewed by Eric Carlson.

Using testing functions HTMLMediaElement::updateVolume() can be called on a <video> element
without an associated video. We should support this usage on iOS just as we do for non-iOS
ports.

The use of testing functions to call HTMLMediaElement::updateVolume() on a <video> element
without an associated video is demonstrated by the test LayoutTests/media/video-muted-after-setting-page-muted-state.html.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::updateVolume):

5:11 PM Changeset in webkit [203929] by Ryan Haddad

2 edits in trunk/LayoutTests

Land test expectations for rdar://problem/27611932.

platform/mac-wk1/TestExpectations:

5:11 PM Changeset in webkit [203928] by Wenson Hsieh

5 edits
2 adds in trunk

Media controls are not displayed for some autoplaying videos at certain browser dimensions
https://bugs.webkit.org/show_bug.cgi?id=160360
<rdar://problem/27179484>

Reviewed by Myles C. Maxfield.

Source/WebCore:

Previously, if a video's aspect ratio fell outside of the range [0.5, 1.8], we would
not consider it main content and would subsequently not show media controls for it.
This meant that on many websites that scale video dimensions to match the mainframe,
if the mainframe is too wide (e.g. full bounds on a widescreen display) we would not
consider the video to be main content. To fix this, we only consider aspect ratio to
be a requirement if the video does not already take up most of the space in the
mainframe.

Covered by two new TestWebKitAPI unit tests.

html/MediaElementSession.cpp:

(WebCore::isElementLargeRelativeToMainFrame):
(WebCore::isElementLargeEnoughForMainContent):

Tools:

Adds two tests verifying that videos may be considered main content as long as they
are large enough and cover a majority of the mainframe's viewport.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/VideoControlsManager.mm:

(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/full-size-autoplaying-video-with-audio.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/skinny-autoplaying-video-with-audio.html: Added.

5:07 PM Changeset in webkit [203927] by Ryan Haddad

2 edits
23 adds in trunk/LayoutTests

Test gardening on ios-simualtor after some media tests were unskipped in r203906.

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:
platform/ios-simulator/media/audio-controls-rendering-expected.txt: Added.
platform/ios-simulator/media/audio-repaint-expected.txt: Added.
platform/ios-simulator/media/controls-strict-expected.txt: Added.
platform/ios-simulator/media/controls-styling-strict-expected.txt: Added.
platform/ios-simulator/media/controls-without-preload-expected.txt: Added.
platform/ios-simulator/media/media-controls-clone-expected.txt: Added.
platform/ios-simulator/media/track/track-cue-rendering-horizontal-expected.txt: Added.
platform/ios-simulator/media/track/track-cue-rendering-vertical-expected.txt: Added.
platform/ios-simulator/media/video-aspect-ratio-expected.txt: Added.
platform/ios-simulator/media/video-controls-captions-trackmenu-expected.txt: Added.
platform/ios-simulator/media/video-controls-captions-trackmenu-hide-on-click-expected.txt: Added.
platform/ios-simulator/media/video-controls-captions-trackmenu-localized-expected.txt: Added.
platform/ios-simulator/media/video-controls-captions-trackmenu-sorted-expected.txt: Added.
platform/ios-simulator/media/video-controls-rendering-expected.txt: Added.
platform/ios-simulator/media/video-display-toggle-expected.txt: Added.
platform/ios-simulator/media/video-empty-source-expected.txt: Added.
platform/ios-simulator/media/video-layer-crash-expected.txt: Added.
platform/ios-simulator/media/video-no-audio-expected.txt: Added.
platform/ios-simulator/media/video-transformed-expected.txt: Added.
platform/ios-simulator/media/video-volume-slider-expected.txt: Added.
platform/ios-simulator/media/video-zoom-controls-expected.txt: Added.
platform/ios-simulator/media/video-zoom-expected.txt: Added.

5:07 PM Changeset in webkit [203926] by bshafiei@apple.com

1 copy in tags/Safari-602.1.44

New tag.

4:42 PM Changeset in webkit [203925] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Undefined Behavior in JSValue cast from NaN
https://bugs.webkit.org/show_bug.cgi?id=160322

Patch by Jonathan Bedard <Jonathan Bedard> on 2016-07-29
Reviewed by Mark Lam.

JSValues can be constructed from doubles, and in some cases, are deliberately constructed with NaN values.

In circumstances where NaN is bound through the default JSValue constructor, however, an undefined conversion
to int32_t occurs. While the subsequent if statement should fail and construct the JSValue through the explicit
double constructor, given that the deliberate use of NaN is fairly common, it seems that the jsNaN() function
should immediately call the explicit double constructor both for efficiency and to prevent inadvertent
suppressing of any other bugs which may be instantiating a JSValue with a NaN double.

runtime/JSCJSValueInlines.h:

(JSC::jsNaN): Explicit double construction for NaN JSValues to avoid undefined behavior.

4:41 PM Changeset in webkit [203924] by Alan Bujtas

3 edits
2 adds in trunk

Do not set negative rate on AVSampleBufferRenderSynchronizer.
https://bugs.webkit.org/show_bug.cgi?id=160326
<rdar://problem/27355214>

Reviewed by Eric Carlson.

Source/WebCore:

Test: http/tests/media/media-source/mediasource-play-then-seek-back-with-remote-control.html

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setRateDouble):

LayoutTests:

Negative rate is not supported at the moment.

http/tests/media/media-source/mediasource-play-then-seek-back-with-remote-control-expected.txt: Added.
http/tests/media/media-source/mediasource-play-then-seek-back-with-remote-control.html: Added.

3:04 PM Changeset in webkit [203923] by msaboff@apple.com

7 edits in trunk/Source/JavaScriptCore

Refactor DFG::Node::hasLocal() to accessesStack()
https://bugs.webkit.org/show_bug.cgi?id=160357

Reviewed by Filip Pizlo.

Refactoring in preparation for using register arguments for JavaScript calls.

Renamed Node::hasLocal() to Node::accessesStack() and changed all uses accordingly.
Also changed uses of Node::hasVariableAccessData() to accessesStack() where that
use guards stack operation logic associated with the Node's VariableAccessData.

The hasVariableAccessData() check now implies no more than the node has a
VariableAccessData and nothing about its use of that data to coordinate stack
accesses.

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::methodOfGettingAValueProfileFor):

dfg/DFGLiveCatchVariablePreservationPhase.cpp:

(JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):

dfg/DFGMaximalFlushInsertionPhase.cpp:

(JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
(JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):

dfg/DFGNode.h:

(JSC::DFG::Node::containsMovHint):
(JSC::DFG::Node::accessesStack):
(JSC::DFG::Node::hasLocal): Deleted.

dfg/DFGPredictionInjectionPhase.cpp:

(JSC::DFG::PredictionInjectionPhase::run):

dfg/DFGValidate.cpp:

3:01 PM Changeset in webkit [203922] by mmaxfield@apple.com

4 edits in trunk/LayoutTests

[macOS Sierra] Test gardening after r198859
https://bugs.webkit.org/show_bug.cgi?id=160358
<rdar://problem/26422274>

Reviewed by Zalan Bujtas.

RTL Scrollbars are not enabled on WK1, so this test should be marked in the
same way as all the other RTL scrollbars tests.

TestExpectations:
platform/mac-wk1/TestExpectations:
platform/mac-wk2/TestExpectations:

1:58 PM Changeset in webkit [203921] by benjamin@webkit.org

6 edits in trunk/Source/JavaScriptCore

[JSC] Use the same data structures for DFG and Air Liveness Analysis
https://bugs.webkit.org/show_bug.cgi?id=160346

Reviewed by Geoffrey Garen.

In Air, we minimized memory accesses during liveness analysis
with a couple of tricks:
-Use a single Sparse Set ADT for the live value of each block.
-Manipulate compact positive indices instead of hashing values.

This patch brings the same ideas to DFG.

This patch still uses the same fixpoint algorithms.
The reason is Edge's KillStatus used by other phases. We cannot
use a block-boundary liveness algorithm and update KillStatus
simultaneously. It's something I'll probably revisit at some point.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):

dfg/DFGBasicBlock.h:
dfg/DFGGraph.h:

(JSC::DFG::Graph::maxNodeCount):
(JSC::DFG::Graph::nodeAt):

dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::setLiveValues):
(JSC::DFG::InPlaceAbstractState::endBasicBlock):

dfg/DFGLivenessAnalysisPhase.cpp:

(JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
(JSC::DFG::LivenessAnalysisPhase::run):
(JSC::DFG::LivenessAnalysisPhase::processBlock):
(JSC::DFG::LivenessAnalysisPhase::addChildUse):
(JSC::DFG::LivenessAnalysisPhase::process): Deleted.

1:43 PM Changeset in webkit [203920] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Inactive/active network bar segments overlap when latency is zero
https://bugs.webkit.org/show_bug.cgi?id=160147
<rdar://problem/27516007>

Reviewed by Joseph Pecoraro.

TimelineRecordBar should hide the inactive segment when its duration
is less than the minimum displayable size. The active segment can
assume the whole width of the bar.

UserInterface/Views/TimelineOverviewGraph.js:

(WebInspector.TimelineOverviewGraph.prototype.get secondsPerPixel):
Make secondsPerPixel available during TimelineRecordBars.refresh.

UserInterface/Views/TimelineRecordBar.js:

(WebInspector.TimelineRecordBar.prototype.refresh):
Check inactive duration against the minimum display size,
and add/remove DOM nodes and bar styles as needed.

1:29 PM Changeset in webkit [203919] by ap@apple.com

2 edits in trunk/LayoutTests

Remove a Sierra specific expectation for http/tests/navigation/forward-and-cancel.html,
we already have an identical one in platform/mac.

platform/mac-wk1/TestExpectations:

1:18 PM Changeset in webkit [203918] by dbates@webkit.org

2 edits in trunk/LayoutTests

Skip some media tests that fail on iOS

platform/ios-simulator/TestExpectations:

12:46 PM Changeset in webkit [203917] by mmaxfield@apple.com

2 edits in trunk/LayoutTests

[macOS Sierra] Unskip new emoji group candidates tests
https://bugs.webkit.org/show_bug.cgi?id=160351
<rdar://problem/27430381>

Reviewed by Alexey Proskuryakov.

platform/mac/TestExpectations:

12:45 PM Changeset in webkit [203916] by mmaxfield@apple.com

6 edits in trunk

Backspace key removes only the rainbow from the rainbow flag
https://bugs.webkit.org/show_bug.cgi?id=160349
<rdar://problem/27594995>

Reviewed by Dean Jackson.

Source/WebCore:

In r203330 I added support for new emoji group candidates. I accidentally
missed one of the new emoji code points.

Test: editing/deleting/delete-emoji.html

platform/text/CharacterProperties.h:

(WebCore::isEmojiGroupCandidate):

LayoutTests:

platform/mac/editing/deleting/delete-emoji-expected.txt:
platform/mac-yosemite/editing/deleting/delete-emoji-expected.txt:
platform/ios-simulator/editing/deleting/delete-emoji-expected.txt:

12:27 PM Changeset in webkit [203915] by mark.lam@apple.com

2 edits in trunk/Tools

Gardening: removed unused variable.

Not reviewed.

TestWebKitAPI/Tests/WTF/StringView.cpp:

(TestWebKitAPI::TEST):

12:19 PM Changeset in webkit [203914] by bshafiei@apple.com

5 edits in branches/safari-602-branch/Source/WebCore

Merge r203904. rdar://problem/27610935

12:11 PM Changeset in webkit [203913] by n_wang@apple.com

11 edits
2 adds in trunk

AX: Media controls accessibility improvement
https://bugs.webkit.org/show_bug.cgi?id=160223
<rdar://problem/27558003>

Reviewed by Eric Carlson.

Source/WebCore:

Changes in this patch:

Added a change observer for volume slider so that it will handle accessibility increment/decrement functions correctly.
Update the timer div's aria-label when time changes.
Added a keydown handler for left/right arrow adjusting the timeline, so that the value increment/decrement in a reasonable way.
Changed the mute button's role to checkbox since it only has on/off states.

Test: media/media-controls-accessibility.html

Modules/mediacontrols/mediaControlsApple.js:

(Controller.prototype.createControls):
(Controller.prototype.updatePictureInPictureButton):
(Controller.prototype.timelineStepFromVideoDuration):
(Controller.prototype.incrementTimelineValue):
(Controller.prototype.decrementTimelineValue):
(Controller.prototype.showInlinePlaybackPlaceholderWhenSafe):
(Controller.prototype.handleTimelineMouseUp):
(Controller.prototype.handleTimelineKeyDown):
(Controller.prototype.handleMuteButtonClicked):
(Controller.prototype.handleMinButtonClicked):
(Controller.prototype.handleMaxButtonClicked):
(Controller.prototype.updateVideoVolume):
(Controller.prototype.handleVolumeSliderInput):
(Controller.prototype.handleVolumeSliderChange):
(Controller.prototype.handleVolumeSliderMouseDown):
(Controller.prototype.updateTime):
(Controller.prototype.updateControlsWhileScrubbing):
(Controller.prototype.updateVolume):

LayoutTests:

accessibility/mac/video-volume-slider-accessibility-expected.txt:
accessibility/mac/video-volume-slider-accessibility.html:
accessibility/media-emits-object-replacement-expected.txt:
media/media-controls-accessibility-expected.txt: Added.
media/media-controls-accessibility.html: Added.
platform/efl/accessibility/media-element-expected.txt:
platform/efl/accessibility/media-emits-object-replacement-expected.txt:
platform/gtk/accessibility/media-element-expected.txt:
platform/gtk/accessibility/media-emits-object-replacement-expected.txt:
platform/mac/accessibility/media-element-expected.txt:

11:58 AM Changeset in webkit [203912] by Nikita Vasilyev

5 edits in trunk/Source/WebInspectorUI

REGRESSION (r195456): Web Inspector: Changing tabs in Styles sidebar shouldn't change sidebar's width
https://bugs.webkit.org/show_bug.cgi?id=159646
<rdar://problem/27286338>

Reviewed by Brian Burg.

Remember sidebar width on per tab basis. For example, Node, Styles, and Layers sidebar panels in
Elements tab should all have the same width, but Resource sidebar panel in Debugger tab should NOT
share its width Element tab's sidebar.

TabContentView stores the width but TabBrowser manages saving and restoring it.
The same way collapsed sidebar state is handled.

UserInterface/Views/Sidebar.js:

(WebInspector.Sidebar.prototype.set collapsed):
Don't change sidebar's width when sidebar panels change.

(WebInspector.Sidebar.prototype._recalculateWidth):
(WebInspector.Sidebar.prototype.set selectedSidebarPanel): Deleted.
Pass newWidth as an argument so it can be saved in TabBrowser.

UserInterface/Views/SidebarPanel.js:

(WebInspector.SidebarPanel): Deleted.
(WebInspector.SidebarPanel.prototype.get savedWidth): Deleted.
(WebInspector.SidebarPanel.prototype.sizeDidChange): Deleted.
Remove the per sidebar panel width setting that was added in r195456.

UserInterface/Views/TabBrowser.js:

(WebInspector.TabBrowser):
(WebInspector.TabBrowser.prototype._detailsSidebarWidthDidChange):
(WebInspector.TabBrowser.prototype._showDetailsSidebarPanelsForTabContentView):

UserInterface/Views/TabContentView.js:

(WebInspector.TabContentView):
(WebInspector.TabContentView.prototype.get detailsSidebarWidthSetting):
Store details sidebar width on TabContentView.

11:52 AM Changeset in webkit [203911] by mark.lam@apple.com

2 edits in trunk/Source/WTF

Make StringView capable of being passed or returned in only 2 registers.
https://bugs.webkit.org/show_bug.cgi?id=160344

Reviewed by Geoffrey Garen.

We just need to #if out copy and move constructors and assignment operators.

After this change, the following test code:

JS_EXPORT_PRIVATE StringView returnStringView(StringView sv)
{

return sv;

}

... compiles to the following for x86_64:

ZN3JSC16returnStringViewEN3WTF10StringViewE:
000000000093fb20 pushq %rbp
000000000093fb21 movq %rsp, %rbp
000000000093fb24 movq %rdi, %rax Copy from arg word 0 to ret word 0.
000000000093fb27 movq %rsi, %rdx Copy from arg word 1 to ret word 1.
000000000093fb2a popq %rbp
000000000093fb2b retq

... and this for arm64:

ZN3JSC16returnStringViewEN3WTF10StringViewE:
0000000000818504 ret arg word 0 and 1 are in the same regs as ret word 0 and 1.

wtf/text/StringView.h:

(WTF::StringView::StringView):
(WTF::StringView::~StringView):
(WTF::StringView::operator=):

11:47 AM Changeset in webkit [203910] by mark.lam@apple.com

2 edits in trunk/Source/WebCore

Remove an unused line of code.
https://bugs.webkit.org/show_bug.cgi?id=160350

Reviewed by Simon Fraser.

No new tests because there's no behavior change. Just removing dead code.

SVGInlineTextBox::paintText() instantiates a local variable selectionTextRun.
Thanks to analysis by Said Abou-Hallawa, we know that selectionTextRun
was introduced in https://trac.webkit.org/changeset/61393, but was later
rendered unused in https://trac.webkit.org/changeset/62099 because we
switched to using paintTextWithShadows() with the selectionStyle. Hence,
selectionTextRun can be removed.

rendering/svg/SVGInlineTextBox.cpp:

(WebCore::SVGInlineTextBox::paintText):

11:45 AM Changeset in webkit [203909] by rniwa@webkit.org

2 edits in trunk/Source/WebKit2

Crash with an Invalid Web Process IPC Message ID: WebPageProxy.AttributedStringForCharacterRangeCallback
https://bugs.webkit.org/show_bug.cgi?id=160334
<rdar://problem/27078089>

Reviewed by Alexey Proskuryakov.

The crash is most likely caused by an MESSAGE_CHECK failure in WebPageProxy::attributedStringForCharacterRangeCallback
which marks the currently dispatching message was invalid inside the macro.

Make sure we never fail this check by sending an empty EditingRange in attributedSubstringForCharacterRangeAsync when
the editing range we're about to send to the UIProcess is invalid in WebProcess.

Unfortunately, no new tests since we don't have any reproduction and I couldn't spot any code path in which we end up
with an invalid EditingRage here with multiple inspection of the relevant code.

WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::attributedSubstringForCharacterRangeAsync):

11:40 AM Changeset in webkit [203908] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Assertion in NetworkGridContentView when updating data grid for the first time
https://bugs.webkit.org/show_bug.cgi?id=160330
<rdar://problem/27600905>

Reviewed by Brian Burg.

When the first grid node is added, a view layout and current time update
are scheduled. A view layout occurring before the current time is updated
should be skipped, since the ruler end time hasn't been set.

UserInterface/Views/NetworkGridContentView.js:

(WebInspector.NetworkGridContentView.prototype.layout):
Skip layout until current time is updated.
(WebInspector.NetworkGridContentView.prototype._update):
Remove unused variables startTime and endTime. Don't force a layout
if the elapsed time is zero.

11:38 AM Changeset in webkit [203907] by Csaba Osztrogonác

3 edits
1 delete in trunk/Source

Remove PassRef.h after r177259
https://bugs.webkit.org/show_bug.cgi?id=160348

Reviewed by Andreas Kling.

Source/WebKit/win:

WebCoreSupport/WebVisitedLinkStore.h:

Source/WTF:

wtf/PassRef.h: Removed.

10:54 AM Changeset in webkit [203906] by dbates@webkit.org

3 edits in trunk/LayoutTests

Unskip some media tests on iOS when run in WebKitTestRunner

As a step towards running the various media tests on iOS, unskip LayoutTests/media
when run in WebKitTestRunner in the iOS Simulator. Incorporate the reasons we skip some
of the iOS tests from r189372. For now continue to skip LayoutTest/media when run in
DumpRenderTree in the iOS Simulator as many tests crash and are otherwise flaky. Further
investigation is required.

platform/ios-simulator-wk1/TestExpectations:
platform/ios-simulator/TestExpectations:

10:49 AM Changeset in webkit [203905] by Wenson Hsieh

2 edits in trunk/Tools

Add TestWebKitAPI support for interacting with media controls
https://bugs.webkit.org/show_bug.cgi?id=160342
<rdar://problem/27610246>

Reviewed by Beth Dakin.

Adds support for testing interaction with some media controls, as well as a basic test
verifying that media control teardown after interaction does not result in a crash.

TestWebKitAPI/Tests/WebKit2Cocoa/VideoControlsManager.mm:

(-[WKWebView mouseDownAtPoint:]):
(-[WKWebView performAfterLoading:]):
(TestWebKitAPI::TEST):

10:47 AM Changeset in webkit [203904] by eric.carlson@apple.com

5 edits in trunk/Source/WebCore

Change internal AVCaptureDeviceType typedef name
https://bugs.webkit.org/show_bug.cgi?id=160345
<rdar://problem/27610935>

Reviewed by Dean Jackson.

platform/mediastream/mac/AVAudioCaptureSource.mm:

(WebCore::AVAudioCaptureSource::create): AVCaptureDeviceType -> AVCaptureDeviceTypedef
(WebCore::AVAudioCaptureSource::AVAudioCaptureSource): Ditto.

platform/mediastream/mac/AVCaptureDeviceManager.mm:

(WebCore::AVCaptureDeviceManager::captureDeviceList): Ditto.
(WebCore::shouldConsiderDeviceInDeviceList): Ditto.
(WebCore::AVCaptureDeviceManager::refreshCaptureDeviceList): Ditto.
(WebCore::AVCaptureDeviceManager::createMediaSourceForCaptureDeviceWithConstraints): Ditto.
(WebCore::AVCaptureDeviceManager::deviceConnected): Ditto.
(WebCore::AVCaptureDeviceManager::deviceDisconnected): Ditto.
(-[WebCoreAVCaptureDeviceManagerObserver deviceDisconnected:]): Ditto.

platform/mediastream/mac/AVMediaCaptureSource.mm:

(WebCore::globaVideoCaptureSerialQueue): Ditto.
(WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Ditto.

platform/mediastream/mac/AVVideoCaptureSource.mm:

(WebCore::AVVideoCaptureSource::create): Ditto.
(WebCore::AVVideoCaptureSource::AVVideoCaptureSource): Ditto.

10:38 AM Changeset in webkit [203903] by dino@apple.com

2 edits in trunk/Source/WebCore

color-gamut media query returns incorrect results
https://bugs.webkit.org/show_bug.cgi?id=160166
<rdar://problem/27537577>

Reviewed by Darin Adler.

While I was unable to reproduce the originator's issue,
we communicated via email and it might have been related
to a customized color space calibration on an external
display.

Anyway, I took this opportunity to update to use the
more appropriate API for detection on macOS Sierra.

Covered by the existing fast/media/mq-color-gamut.html test.

platform/mac/PlatformScreenMac.mm:

(WebCore::screenSupportsExtendedColor): Use NSScreen canRepresentDisplayGamut.

10:19 AM Changeset in webkit [203902] by commit-queue@webkit.org

4 edits in trunk

Crash Log Clobbering on Unbound Crashes
https://bugs.webkit.org/show_bug.cgi?id=160198
<rdar://problem/27472618>

Patch by Jonathan Bedard <Jonathan Bedard> on 2016-07-29
Reviewed by Alexey Proskuryakov.

Scripts/webkitpy/common/system/crashlogs.py:

(CrashLogs): Fix header order.

Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:

(TestResultWriter.output_filename): Only remove file extension if it is clearly a file extension.

10:00 AM Changeset in webkit [203901] by commit-queue@webkit.org

5 edits
4 adds in trunk

HTMLVideoElement with MediaStream src shows paused image when all video tracks are disabled
https://bugs.webkit.org/show_bug.cgi?id=160222
<rdar://problem/27557313>

Patch by George Ruan <gruan@apple.com> on 2016-07-29
Reviewed by Eric Carlson.

Source/WebCore:

Tests: fast/mediastream/MediaStream-video-element-video-tracks-disabled-then-enabled.html

fast/mediastream/MediaStream-video-element-video-tracks-disabled.html

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::enqueueVideoSampleBufferFromTrack): Change criteria to enqueue a
Sample Buffer to the AVSampleBufferDisplayLayer to allow an initial frame to be shown.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::shouldEnqueueVideoSampleBuffer): Allow an initial frame to be shown.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::flushAndRemoveVideoSampleBuffers): Removes all buffers from the
AVSampleBufferDisplayLayer.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::ensureLayer): Make the AVSampleBufferDisplayLayer's background black.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::updateDisplayMode): Remove all buffers from the AVSampleBufferDisplayLayer
when state of MediaPlayerPrivateMediaStreamAVFObjC is changed to None of PaintItBlack.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::updatePausedImage): Updates paused image.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::pause): Calls updatePausedImage.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::paintCurrentFrameInContext): Allow an initial frame to be painted to canvas.

LayoutTests:

fast/mediastream/MediaStream-video-element-video-tracks-disabled-expected.html: Added.
fast/mediastream/MediaStream-video-element-video-tracks-disabled-then-enabled-expected.txt: Added.
fast/mediastream/MediaStream-video-element-video-tracks-disabled-then-enabled.html: Added. Checks

that the video frames display captured media if all video tracks were disabled and then a single
video track is re-enabled. This test also checks that an initial frame is painted to
canvas if the video has not yet been played.

fast/mediastream/MediaStream-video-element-video-tracks-disabled.html: Added. Reference tests the

frames of the video to be black, since the canvas is painted black regardless of the state of the video frames
if displayMode of MediaPlayerPrivateMediaStreamAVFObjC is PaintItBlack.

platform/mac-wk2/TestExpectations: MediaStream-video-element-video-tracks-disabled.html fails on El

Capitan due to incorrect behavior of AVSampleBufferDisplayLayer's API call flushAndRemoveImage.

7:12 AM Changeset in webkit [203900] by commit-queue@webkit.org

16 edits in trunk

[Fetch API] Activate credentials mode
https://bugs.webkit.org/show_bug.cgi?id=160292

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-29
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/cors/cors-cookies-expected.txt:
web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt:
web-platform-tests/fetch/api/cors/cors-cookies.js: Fixin otherRemote computation.

(corsCookies): ensuring cookie clean-up is done in case of error before going to the next test.

web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt:
web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker-expected.txt:
web-platform-tests/fetch/api/credentials/cookies-expected.txt:
web-platform-tests/fetch/api/credentials/cookies-worker-expected.txt:

Source/WebCore:

Covered by updated and rebased tests.

Previously the allowCredentials option was computed by DocumentThreadableLoader clients.
This option is really similar to the credentials flag in the fetch specification and should be handled at lower levels.
In the future, it might be good to retire that option.

In case of Omit mode, we need to explicitely disable cookies in DocumentThreadableLoader.
This should be updated so that ResourceLoader does it, depending on credential flag being set or not.

Updated DocumentThreadableLoader clients to only use FetchOptions::Credentials.
This allows to link code more easely to specification.

Modules/fetch/FetchLoader.cpp:

(WebCore::FetchLoader::start): Removing use of allowCredentials option. Using FetchOptions::Credentials instead.

fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start): Ditto.

inspector/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::loadResource): Ditto.

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Computing allowCredentials from FetchOptions::Credentials.
(WebCore::DocumentThreadableLoader::loadRequest): Enabling cookie only if allowed to use credentials. This is in
particular useful for FetchOptions::Credentials::Omit mode.

page/EventSource.cpp:

(WebCore::EventSource::connect): Removing use of allowCredentials option. Using FetchOptions::Credentials instead.

workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
(WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.

xml/XMLHttpRequest.cpp: Ditto.

(WebCore::XMLHttpRequest::createRequest):

7:00 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

4:08 AM Changeset in webkit [203899] by commit-queue@webkit.org

18 edits
4 copies
1 delete in trunk

CrossOrigin preflight checker should compute the right Access-Control-Request-Headers value
https://bugs.webkit.org/show_bug.cgi?id=160028

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-29
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt:
web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt:
web-platform-tests/fetch/api/cors/cors-no-preflight.js:

(corsNoPreflight): fixing bugs in that test and adding new test to cover mime type checking that should ignore case.

web-platform-tests/fetch/api/cors/cors-preflight-worker.html:
web-platform-tests/fetch/api/cors/cors-preflight.html:
web-platform-tests/fetch/api/cors/cors-preflight.js:

(corsPreflight): Adding safe headers to the request and checking more precisely sent Access-Control-Request-Headers header value.

Source/WebCore:

Covered by updated test.

Computing Access-Control-Request-Headers value according https://fetch.spec.whatwg.org/#cors-preflight-fetch:

Remove safe headers
lowercase header names
sort lexicographically header names

The only difference is that we keep separating headers with ', ' instead of ',' as per the spec.
Also, some headers that might be safe are still marked as unsafe (DPR, Downlink...).

Moved setting of Origin header after preflighting, consistently with fetch spec.

loader/CrossOriginAccessControl.cpp:

(WebCore::createAccessControlPreflightRequest): Implementing new computation of Access-Control-Request-Headers.

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest): Removing call to updateRequestForAccessControl (which sets Origin header value).
(WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Adding call to updateRequestForAccessControl.
(WebCore::DocumentThreadableLoader::preflightSuccess): Ditto.

platform/network/HTTPParsers.cpp:

(WebCore::isCrossOriginSafeRequestHeader): Helper routine to implement https://fetch.spec.whatwg.org/#cors-safelisted-request-header.

platform/network/HTTPParsers.h:

LayoutTests:

Rebasing regular tests. Also updating skipped worker tests.

platform/ios-simulator-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt: Added.
platform/ios-simulator-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt: Added.
platform/ios-simulator-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt: Added.
platform/mac-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt: Added.
platform/mac-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt: Added.
platform/mac-wk2/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt: Added.
platform/mac/TestExpectations:

3:49 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:58 AM Changeset in webkit [203898] by Csaba Osztrogonác

2 edits in trunk/Tools

Update for contributors.json
https://bugs.webkit.org/show_bug.cgi?id=160294

Patch by Tibor Meszaros <tmeszaros.u-szeged@partner.samsung.com> on 2016-07-29

Scripts/webkitpy/common/config/contributors.json:

12:59 AM Changeset in webkit [203897] by Yusuke Suzuki

2 edits in trunk/Source/JavaScriptCore

Unreviewed, ByValInfo is only used in JIT enabled environments
https://bugs.webkit.org/show_bug.cgi?id=158908

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::stronglyVisitStrongReferences):

12:37 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

12:21 AM Changeset in webkit [203896] by fred.wang@free.fr

6 edits in trunk/Source/WebCore

Parse the operator text on the MathMLOperatorElement class.
https://bugs.webkit.org/show_bug.cgi?id=160241

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-29
Reviewed by Darin Adler.

The text of the MathML operators is important to determine form or dictionary properties and
hence provide default values when no explicit attributes are privided. Since that text only
depends on the MathML DOM content, it makes sense to move its parsing into
MathMLOperatorElement. Anonymous operators created by the mfenced elements still need to be
handled specially and this will be true for all the operator properties that can just be
determined in MathMLOperatorElement. Hence in a follow-up patch we will introduce a class
to move all the code specific to mfenced in a class derived from RenderMathMLOperator while
we continue to move the corresponding code for non-anonymous into MathMLOperatorElement.

No new tests, behavior is unchanged.

mathml/MathMLOperatorElement.cpp: Include header for hyphenMinus/minusSign characters.

(WebCore::MathMLOperatorElement::parseOperatorText): Move that code from rebuildTokenContent
(WebCore::MathMLOperatorElement::operatorText): Helper function to get the cached text.
(WebCore::MathMLOperatorElement::childrenChanged): Make the cached text dirty.

mathml/MathMLOperatorElement.h: Update defitions and add a member for the operator text.
mathml/MathMLTextElement.h: Make childrenChanged overridable.
rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::element): Helper function to cast to a MathMLOperatorElement.
(WebCore::RenderMathMLOperator::textContent): Helper function to call
MathMLOperatorElement::operatorText or fallback to m_textContent for anonymous operators.
m_textContent and this special case can be moved into a derived class later.
(WebCore::RenderMathMLOperator::setOperatorProperties): Call textContent().
(WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Ditto.
(WebCore::RenderMathMLOperator::rebuildTokenContent): Remove the string parameter and the
parsing of the operator text.
(WebCore::RenderMathMLOperator::updateTokenContent): Call textContent(). The special function
for anonymous operators also parses the text content but this could be moved into a derived
class later.
(WebCore::RenderMathMLOperator::shouldAllowStretching): Call textContent().
(WebCore::RenderMathMLOperator::useMathOperator): Ditto.
(WebCore::RenderMathMLOperator::RenderMathMLOperator): No need to initialize m_textContent
as it is not used anymore for non-anonymous renderers.

rendering/mathml/RenderMathMLOperator.h: Update definitions and call textContent().

12:15 AM Changeset in webkit [203895] by Yusuke Suzuki

33 edits
1 add in trunk/Source/JavaScriptCore

JSC::Symbol should be hash-consed
https://bugs.webkit.org/show_bug.cgi?id=158908

Reviewed by Filip Pizlo.

Previously, SymbolImpls held by symbols represent identity of symbols.
When we check the equality between symbols, we need to load SymbolImpls of symbols and compare them.

This patch performs hash-consing onto the symbols. We cache symbols in per-VM's SymbolImpl-keyed WeakGCMap.
When creating a new symbol from SymbolImpl, we first query to this map and reuse the previously created symbol
if it is found. This ensures that one-on-one correspondence between SymbolImpl and symbol. So now, we can use
pointer-comparison to query the equality of symbols.

This change drops SymbolImpl loads when checking the equality. Furthermore, we can use DFG CheckCell to symbol
when we would like to ensure that the given value is the expected symbol. This cleans up GetByVal's symbol-keyd
caching. Then, we changed CheckIdent to CheckStringIdent since it only checks the string case now. The symbol
case is handled by CheckCell.

Additionally, this patch also cleans up Map / Set implementation since we can use the logic for JSCell to symbols.

The performance effects in the related benchmarks are the followings.

baseline patch

bigswitch-indirect-symbol-or-undefined 85.6214+-1.0063 ^{63.0522+-0.8615} definitely 1.3579x faster
bigswitch-indirect-symbol 84.9653+-0.6258 ^{80.4900+-0.8008} definitely 1.0556x faster
fold-put-by-val-with-symbol-to-multi-put-by-offset

9.4396+-0.3726 9.2941+-0.3311 might be 1.0157x faster

inlined-put-by-val-with-symbol-transition

49.5477+-0.2401 ? 49.7533+-0.3369 ?

get-by-val-with-symbol-self-or-proto 11.9740+-0.0798 ? 12.1706+-0.2723 ? might be 1.0164x slower
get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple

4.1364+-0.0841 4.0872+-0.0925 might be 1.0120x faster

put-by-val-with-symbol 11.3709+-0.0223 11.3613+-0.0264
get-by-val-with-symbol-proto-or-self 11.8984+-0.0706 ? 11.9030+-0.0787 ?
polymorphic-put-by-val-with-symbol 31.4176+-0.0558 31.3825+-0.0447
implicit-bigswitch-indirect-symbol 61.3115+-0.6577 ^{58.0098+-0.1212} definitely 1.0569x faster
get-by-val-with-symbol-bimorphic-check-structure-elimination-simple

3.3139+-0.0565 ^{2.9947+-0.0732} definitely 1.1066x faster

get-by-val-with-symbol-chain-from-try-block

2.2316+-0.0179 2.2137+-0.0210

get-by-val-with-symbol-bimorphic-check-structure-elimination

10.6031+-0.2216 ^{10.0939+-0.1977} definitely 1.0504x faster

get-by-val-with-symbol-check-structure-elimination

8.5576+-0.1521 ^{7.7107+-0.1308} definitely 1.1098x faster

put-by-val-with-symbol-slightly-polymorphic

3.1957+-0.0538 ^{2.9181+-0.0708} definitely 1.0951x faster

put-by-val-with-symbol-replace-and-transition

11.8253+-0.0757 ^{11.6590+-0.0351} definitely 1.0143x faster

<geometric> 13.3911+-0.0527 ^{12.7376+-0.0457} definitely 1.0513x faster

bytecode/ByValInfo.h:
bytecode/CodeBlock.cpp:

(JSC::CodeBlock::stronglyVisitStrongReferences):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::hasUidOperand):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileSymbolEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality):
(JSC::DFG::SpeculativeJIT::compileCheckStringIdent):
(JSC::DFG::SpeculativeJIT::extractStringImplFromBinarySymbols): Deleted.
(JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
(JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality): Deleted.

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality):
(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckIdent): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::lowSymbolUID): Deleted.

jit/JIT.h:
jit/JITOperations.cpp:

(JSC::tryGetByValOptimize):

jit/JITPropertyAccess.cpp:

(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitByValIdentifierCheck):
(JSC::JIT::privateCompileGetByValWithCachedId):
(JSC::JIT::privateCompilePutByValWithCachedId):
(JSC::JIT::emitIdentifierCheck): Deleted.

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitPutByValWithCachedId):

runtime/JSCJSValue.cpp:

(JSC::JSValue::dumpInContextAssumingStructure):

runtime/JSCJSValueInlines.h:

(JSC::JSValue::equalSlowCaseInline):
(JSC::JSValue::strictEqualSlowCaseInline): Deleted.

runtime/JSFunction.cpp:

(JSC::JSFunction::setFunctionName):

runtime/MapData.h:
runtime/MapDataInlines.h:

(JSC::JSIterator>::clear): Deleted.
(JSC::JSIterator>::find): Deleted.
(JSC::JSIterator>::add): Deleted.
(JSC::JSIterator>::remove): Deleted.
(JSC::JSIterator>::replaceAndPackBackingStore): Deleted.