Timeline

Dec 25, 2016:

11:47 PM Changeset in webkit [210150] by Chris Fleizach

• 3 edits
  2 adds in trunk

AX: Headers of table not read by VoiceOver
​https://bugs.webkit.org/show_bug.cgi?id=158693
<rdar://problem/26771065>

Reviewed by Darin Adler.

Source/WebCore:

If a table cell header is hidden, by pushing off screen then the content won't be accessible.
It seems that unless specifically requested (such as using aria-hidden), we should try to return
that table cell header.

Test: accessibility/hidden-th-still-column-header.html

• accessibility/AccessibilityTableColumn.cpp:

(WebCore::AccessibilityTableColumn::headerObjectForSection):

LayoutTests:

• accessibility/hidden-th-still-column-header-expected.txt: Added.
• accessibility/hidden-th-still-column-header.html: Added.

10:35 PM Changeset in webkit [210149] by Yusuke Suzuki

• 43 edits
  2 adds in trunk

Propagate the source origin as much as possible
​https://bugs.webkit.org/show_bug.cgi?id=166348

Reviewed by Darin Adler.

JSTests:

• stress/source-origin.js: Added.

(shouldBe):

Source/JavaScriptCore:

This patch introduces CallFrame::callerSourceOrigin, SourceOrigin class
and SourceProvider::m_sourceOrigin. CallFrame::callerSourceOrigin returns
an appropriate SourceOrigin if possible. If we cannot find the appropriate
one, we just return null SourceOrigin.

This paves the way for implementing the module dynamic-import[1].
When the import operator is evaluated, it will resolve the module
specifier with this propagated source origin of the caller function.

To support import operator inside the dynamic code generation
functions (like eval, new Function, indirect call to eval),
we need to propagate the caller's source origin to the generated
source code.

We do not use sourceURL for that purpose. This is because we
would like to keep sourceURL for eval / new Function null.
This sourceURL will be used for the stack dump for errors with line/column
numbers. Dumping the caller's sourceURL with line/column numbers are
meaningless. So we would like to keep it null while we would like
to propagate SourceOrigin for dynamic imports.

[1]: ​https://github.com/tc39/proposal-dynamic-import

• API/JSBase.cpp:

(JSEvaluateScript):
(JSCheckScriptSyntax):

• API/JSObjectRef.cpp:

(JSObjectMakeFunction):

• API/JSScriptRef.cpp:

(OpaqueJSScript::create):
(OpaqueJSScript::vm):
(OpaqueJSScript::OpaqueJSScript):
(parseScript):

• JavaScriptCore.xcodeproj/project.pbxproj:
• Scripts/builtins/builtins_templates.py:
• Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
• Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
• Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
• Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
• Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
• Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
• builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::BuiltinExecutables):
(JSC::BuiltinExecutables::createDefaultConstructor):

• debugger/DebuggerCallFrame.cpp:

(JSC::DebuggerCallFrame::evaluateWithScopeExtension):

• inspector/InjectedScriptManager.cpp:

(Inspector::InjectedScriptManager::createInjectedScript):

• inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):

• inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::parse):

• interpreter/CallFrame.cpp:

(JSC::CallFrame::callerSourceOrigin):

• interpreter/CallFrame.h:
• interpreter/Interpreter.cpp:

(JSC::eval):

• jsc.cpp:

(jscSource):
(GlobalObject::finishCreation):
(extractDirectoryName):
(currentWorkingDirectory):
(GlobalObject::moduleLoaderResolve):
(functionRunString):
(functionLoadString):
(functionCallerSourceOrigin):
(functionCreateBuiltin):
(functionCheckModuleSyntax):
(runInteractive):

• parser/SourceCode.h:

(JSC::makeSource):

• parser/SourceProvider.cpp:

(JSC::SourceProvider::SourceProvider):

• parser/SourceProvider.h:

(JSC::SourceProvider::sourceOrigin):
(JSC::StringSourceProvider::create):
(JSC::StringSourceProvider::StringSourceProvider):
(JSC::WebAssemblySourceProvider::create):
(JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):

• runtime/FunctionConstructor.cpp:

(JSC::constructFunction):
(JSC::constructFunctionSkippingEvalEnabledCheck):

• runtime/FunctionConstructor.h:
• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncEval):

• runtime/ModuleLoaderPrototype.cpp:

(JSC::moduleLoaderPrototypeParseModule):

• runtime/ScriptExecutable.h:

(JSC::ScriptExecutable::sourceOrigin):

• runtime/SourceOrigin.h: Added.

(JSC::SourceOrigin::SourceOrigin):
(JSC::SourceOrigin::string):
(JSC::SourceOrigin::isNull):

• tools/FunctionOverrides.cpp:

(JSC::initializeOverrideInfo):

Source/WebCore:

• bindings/js/CachedScriptSourceProvider.h:

(WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):

• bindings/js/JSLazyEventListener.cpp:

(WebCore::JSLazyEventListener::initializeJSFunction):

• bindings/js/ScriptSourceCode.h:

(WebCore::ScriptSourceCode::ScriptSourceCode):

• bridge/NP_jsobject.cpp:

(_NPN_Evaluate):

• bridge/objc/WebScriptObject.mm:

(-[WebScriptObject evaluateWebScript:]):

Source/WebKit/mac:

• Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::evaluate):

Source/WebKit/win:

• Plugins/PluginPackage.cpp:

(WebCore::NPN_Evaluate):
(WebCore::makeSource): Deleted.

Source/WebKit2:

• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

(WebKit::NPRuntimeObjectMap::evaluate):

5:33 PM Changeset in webkit [210148] by weinig@apple.com

• 38 edits
  2 adds in trunk

[WebIDL] Remove (most) custom bindings for the IndexedDB code
​https://bugs.webkit.org/show_bug.cgi?id=166451

Reviewed by Darin Adler.

Source/WebCore:

Removes the custom bindings for all but one attribute (IDBRequest.result) in
the IndexedDB code.

• Adds a new WebIDL extension type, IDBKey, to represent the complex key conversion rules IndexedDB specifies.
• Replaces custom bindings for IDBCursor.source with use of a union.
• Replaces custom enum type checking for IDBCursor.direction with a WebIDL enum.
• Replaces custom code generation for IDBKeyPaths with a union.

• CMakeLists.txt:
• DerivedSources.make:
• WebCore.xcodeproj/project.pbxproj:

Add new files.

• Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::source):
(WebCore::IDBCursor::direction):
(WebCore::IDBCursor::directionNext): Deleted.
(WebCore::IDBCursor::directionNextUnique): Deleted.
(WebCore::IDBCursor::directionPrev): Deleted.
(WebCore::IDBCursor::directionPrevUnique): Deleted.
(WebCore::IDBCursor::stringToDirection): Deleted.
(WebCore::IDBCursor::directionToString): Deleted.

• Modules/indexeddb/IDBCursor.h:

(WebCore::IDBCursor::objectStore): Deleted.
(WebCore::IDBCursor::index): Deleted.
Replace custom enum checking with direct use of the enum, letting the generator
handle the checks. Also adds source function which returns a Variant.

• Modules/indexeddb/IDBCursor.idl:

Remove custom annotation and use correct types.

• Modules/indexeddb/IDBCursorDirection.h: Added.
• Modules/indexeddb/IDBCursorDirection.idl: Added.

• Modules/indexeddb/IDBIndex.cpp:

(WebCore::IDBIndex::openCursor):
(WebCore::IDBIndex::openKeyCursor):

• Modules/indexeddb/IDBIndex.h:
• Modules/indexeddb/IDBIndex.idl:
• Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::openCursor):
(WebCore::IDBObjectStore::openKeyCursor):

• Modules/indexeddb/IDBObjectStore.h:
• Modules/indexeddb/IDBObjectStore.idl:

Replace Strings with IDBCursorDirection enums.

• Modules/indexeddb/IDBKeyRange.idl:

Remove annotation and use new IDBKey extension type.

• Modules/indexeddb/IDBOpenDBRequest.cpp:

(WebCore::IDBOpenDBRequest::onSuccess):
(WebCore::IDBOpenDBRequest::onUpgradeNeeded):
(WebCore::IDBOpenDBRequest::onDeleteDatabaseSuccess):
Use ReadyState enum in place of the old m_isDone boolean.

• Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::IDBRequest):
(WebCore::IDBRequest::error):
(WebCore::IDBRequest::source):
(WebCore::IDBRequest::dispatchEvent):
(WebCore::IDBRequest::willIterateCursor):
(WebCore::IDBRequest::completeRequestAndDispatchEvent):
(WebCore::IDBRequest::readyState): Deleted.

• Modules/indexeddb/IDBRequest.h:

(WebCore::IDBRequest::readyState):
(WebCore::IDBRequest::isDone):
(WebCore::IDBRequest::objectStoreSource): Deleted.
(WebCore::IDBRequest::indexSource): Deleted.
(WebCore::IDBRequest::cursorSource): Deleted.

• Modules/indexeddb/IDBRequest.idl:

Replace the readyState String with a enum, and the custom source binding with a
source function that returns a Variant.

• Modules/indexeddb/IndexedDB.h:

Add the missing values to CursorDirection to make it comply with the IDL definition.

• bindings/generic/IDLTypes.h:
• bindings/js/JSDOMConvert.h:

(WebCore::JSConverter<IDLIDBKey<T>>::convert):
Add new extension type IDLIDBKey.

• bindings/js/JSIDBCursorCustom.cpp:

(WebCore::JSIDBCursor::source): Deleted.

• bindings/js/JSIDBRequestCustom.cpp:

(WebCore::JSIDBRequest::source): Deleted.
Remove custom bindings.

• bindings/scripts/CodeGenerator.pm:

(IsBuiltinType):

• bindings/scripts/CodeGeneratorJS.pm:

(GetBaseIDLType):
(NativeToJSValueDOMConvertNeedsState):
(NativeToJSValueDOMConvertNeedsGlobalObject):
(NativeToJSValue):
Add support for IDBKey, and remove custom code for IndexedDB in core conversion logic.

• bindings/scripts/IDLAttributes.txt:

Remove now unused ImplementationReturnType attribute.

• inspector/InspectorIndexedDBAgent.cpp:

Update to work with new functions taking enums rather than strings.

LayoutTests:

• storage/indexeddb/exceptions-expected.txt:
• storage/indexeddb/exceptions-private-expected.txt:
• storage/indexeddb/index-basics-expected.txt:
• storage/indexeddb/index-basics-private-expected.txt:
• storage/indexeddb/index-basics-workers-expected.txt:
• storage/indexeddb/objectstore-cursor-expected.txt:
• storage/indexeddb/objectstore-cursor-private-expected.txt:

Update results for improved exception messages.

3:57 PM Changeset in webkit [210147] by Simon Fraser

• 10 edits
  10 adds in trunk

REGRESSION (r209299): Selection is broken when you zoom in webpage using trackpad
​https://bugs.webkit.org/show_bug.cgi?id=166472
rdar://problem/29675551

Reviewed by Tim Horton.

Source/WebCore:

r209299 broke autoscroll in zoomed pages because it changed RenderLayer::scrollRectToVisible()
to shrink viewRect by page scale. This is incorrect for all callers of scrollRectToVisible, since
the "absoluteRect" passed in is actually in zoomed document coordinates for all the callers I tested.

This code is also fixed to account for headers and footers. getRectToExpose() takes rectangles
in "scroll view contents" coordinates (i.e. including header, and zoomed document), so doesn't need
the separate visibleRectRelativeToDocument parameter.

Tests: fast/events/autoscroll-main-document.html

fast/events/autoscroll-when-zoomed.html
fast/events/drag-select-when-zoomed-with-header.html
fast/events/drag-select-when-zoomed.html
fast/scrolling/scroll-to-anchor-zoomed-header.html

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollRectToVisible):
(WebCore::RenderLayer::getRectToExpose):

• rendering/RenderLayer.h:

Tools:

These changes are necessary to allow the mouse to leave the WTR window while
drag-scrolling, to test autoscroll. Previously, we were never calling -mouseDragged
(which DRT does); we'd always go through mouseMoved, which hits an early return
in WebViewImpl::mouseMoved() when the point is outside the view.

• WebKitTestRunner/mac/EventSenderProxy.mm:

(WTR::EventSenderProxy::mouseMoveTo):

LayoutTests:

Add some test coverage for autoscroll of the main document. I could only get this
working in WebKitTestRunner, not DumpRenderTree.

• TestExpectations:
• fast/events/autoscroll-main-document-expected.txt: Added.
• fast/events/autoscroll-main-document.html: Added.
• fast/events/autoscroll-when-zoomed-expected.txt: Added.
• fast/events/autoscroll-when-zoomed.html: Added.
• fast/events/drag-select-when-zoomed-expected.txt: Added.
• fast/events/drag-select-when-zoomed-with-header-expected.txt: Added.
• fast/events/drag-select-when-zoomed-with-header.html: Added.
• fast/events/drag-select-when-zoomed.html: Added.
• fast/scrolling/scroll-to-anchor-zoomed-header-expected.txt: Added.
• fast/scrolling/scroll-to-anchor-zoomed-header.html: Added.
• fast/transforms/selection-bounds-in-transformed-view.html: Revert the target scroll position to what it was

before r209299, and improve the failure output.

• platform/ios-simulator/TestExpectations:
• platform/mac-wk2/TestExpectations:

Dec 24, 2016:

1:26 PM Changeset in webkit [210146] by commit-queue@webkit.org

• 16 edits
  2 adds in trunk

[test262] Fixing mapped arguments object property test case
​https://bugs.webkit.org/show_bug.cgi?id=159398

Patch by Caio Lima <Caio Lima> on 2016-12-24
Reviewed by Saam Barati.

JSTests:

• stress/arguments-bizarre-behaviour-disable-enumerability.js:
• stress/arguments-define-property.js: Added.

(assert):
(testProperties):

• stress/arguments-non-configurable.js: Added.

(assert):
(tryChangeNonConfigurableDescriptor):
(set tryChangeNonConfigurableDescriptor):
(tryChangeWritableOfNonConfigurableDescriptor):

• test262.yaml:

Source/JavaScriptCore:

This patch changes GenericArguments' override mechanism to
implement corret behavior on ECMAScript test262 suite test cases of
mapped arguments object with non-configurable and non-writable
property. Also it is ensuring that arguments[i]
cannot be deleted when argument "i" is {configurable: false}.

The previous implementation is against to the specification for 2 reasons:

1. Every argument in arguments object are {writable: true} by default (​http://www.ecma-international.org/ecma-262/7.0/index.html#sec-createunmappedargumentsobject). It means that we have to stop mapping a defined property index if the new property descriptor contains writable (i.e writable is present) and its value is false (also check ​https://tc39.github.io/ecma262/#sec-arguments-exotic-objects-defineownproperty-p-desc). Previous implementation considers {writable: false} if writable is not present.

2. When a property is overriden, "delete" operation is always returning true. However delete operations should follow the specification.

We created an auxilary boolean array named m_modifiedArgumentsDescriptor
to store which arguments[i] descriptor was changed from its default
property descriptor. This modification was necessary because m_overrides
was responsible to keep this information at the same time
of keeping information about arguments mapping. The problem of this apporach was
that we needed to call overridesArgument(i) as soon as the ith argument's property
descriptor was changed and it stops the argument's mapping as sideffect, producing
wrong behavior.
To keep tracking arguments mapping status, we renamed DirectArguments::m_overrides to
DirectArguments::m_mappedArguments and now we it is responsible to manage if an
argument[i] is mapped or not.
With these 2 structures, now it is possible to an argument[i] have its property
descriptor modified and don't stop the mapping as soon as it happens. One example
of that wrong behavior can be found on arguments-bizarre-behaviour-disable-enumerability
test case, that now is fixed by this new mechanism.

• bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generateWithGuard):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):

• jit/JITOperations.cpp:

(JSC::canAccessArgumentIndexQuickly):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitDirectArgumentsGetByVal):

• runtime/DirectArguments.cpp:

(JSC::DirectArguments::estimatedSize):
(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::overrideThings):
(JSC::DirectArguments::overrideThingsIfNecessary):
(JSC::DirectArguments::unmapArgument):
(JSC::DirectArguments::copyToArguments):
(JSC::DirectArguments::overridesSize):
(JSC::DirectArguments::overrideArgument): Deleted.

• runtime/DirectArguments.h:

(JSC::DirectArguments::length):
(JSC::DirectArguments::isMappedArgument):
(JSC::DirectArguments::isMappedArgumentInDFG):
(JSC::DirectArguments::getIndexQuickly):
(JSC::DirectArguments::setIndexQuickly):
(JSC::DirectArguments::overrodeThings):
(JSC::DirectArguments::initModifiedArgumentsDescriptorIfNecessary):
(JSC::DirectArguments::setModifiedArgumentDescriptor):
(JSC::DirectArguments::isModifiedArgumentDescriptor):
(JSC::DirectArguments::offsetOfMappedArguments):
(JSC::DirectArguments::offsetOfModifiedArgumentsDescriptor):
(JSC::DirectArguments::canAccessIndexQuickly): Deleted.
(JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG): Deleted.
(JSC::DirectArguments::offsetOfOverrides): Deleted.

• runtime/GenericArguments.h:
• runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::visitChildren):
(JSC::GenericArguments<Type>::getOwnPropertySlot):
(JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
(JSC::GenericArguments<Type>::getOwnPropertyNames):
(JSC::GenericArguments<Type>::put):
(JSC::GenericArguments<Type>::putByIndex):
(JSC::GenericArguments<Type>::deleteProperty):
(JSC::GenericArguments<Type>::deletePropertyByIndex):
(JSC::GenericArguments<Type>::defineOwnProperty):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptorIfNecessary):
(JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
(JSC::GenericArguments<Type>::isModifiedArgumentDescriptor):
(JSC::GenericArguments<Type>::copyToArguments):

• runtime/ScopedArguments.cpp:

(JSC::ScopedArguments::visitChildren):
(JSC::ScopedArguments::unmapArgument):
(JSC::ScopedArguments::overrideArgument): Deleted.

• runtime/ScopedArguments.h:

(JSC::ScopedArguments::isMappedArgument):
(JSC::ScopedArguments::isMappedArgumentInDFG):
(JSC::ScopedArguments::getIndexQuickly):
(JSC::ScopedArguments::setIndexQuickly):
(JSC::ScopedArguments::initModifiedArgumentsDescriptorIfNecessary):
(JSC::ScopedArguments::setModifiedArgumentDescriptor):
(JSC::ScopedArguments::isModifiedArgumentDescriptor):
(JSC::ScopedArguments::canAccessIndexQuickly): Deleted.
(JSC::ScopedArguments::canAccessArgumentIndexQuicklyInDFG): Deleted.

10:00 AM Changeset in webkit [210145] by Alan Bujtas

• 8 edits in trunk/Source/WebCore

RenderBlockFlow::moveFloatsTo does not move floats.
​https://bugs.webkit.org/show_bug.cgi?id=166467

Reviewed by Darin Adler.

RenderBlockFlow::moveFloatsTo name is misleading. Floats are not moved from "this" to
the new RenderBlockFlow parent, but rather they are copied so that overhanging floats
don't get lost.

Covered by existing tests.

• rendering/FloatingObjects.cpp:

(WebCore::FloatingObject::cloneForNewParent):
(WebCore::FloatingObject::unsafeClone): Deleted.

• rendering/FloatingObjects.h:
• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::addFloatsToNewParent):
(WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
(WebCore::RenderBlockFlow::moveFloatsTo): Deleted.

• rendering/RenderBlockFlow.h:
• rendering/RenderRubyBase.cpp:

(WebCore::RenderRubyBase::mergeChildrenWithBase):

• rendering/RenderRubyBase.h:
• rendering/RenderRubyRun.cpp:

(WebCore::RenderRubyRun::removeChild):