⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Dec 29, 2016:

10:46 AM Changeset in webkit [210205] by Chris Fleizach
  • 2 edits in trunk/Source/WebCore

AX: Need to expose frames to iOS Accessibility
​https://bugs.webkit.org/show_bug.cgi?id=166571
<rdar://problem/29823724>

Reviewed by Darin Adler.

To support navigation by frame for VoiceOver on iOS, we need to expose the frame ancestor.

  • accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper _accessibilityFrameAncestor]):

10:28 AM Changeset in webkit [210204] by sbarati@apple.com
  • 57 edits in trunk/JSTests

WebAssembly: Rebase spec-tests now that wabt has been updated to produce certain kinds of invalid modules
​https://bugs.webkit.org/show_bug.cgi?id=166491
<rdar://problem/29814999>

Reviewed by Yusuke Suzuki.

Based off these revisions:

The reason for the rebase is that wabt was updated to stop
silently rejecting invalid modules. This was needed because
some of the spec tests check to make sure that the module
is invalid, but wabt was silently ignoring the errors and
generating valid modules:
​https://github.com/WebAssembly/wabt/issues/256

  • wasm.yaml:
  • wasm/spec-tests/address.wast.js:
  • wasm/spec-tests/binary.wast.js:
  • wasm/spec-tests/block.wast.js:
  • wasm/spec-tests/br.wast.js:
  • wasm/spec-tests/br_if.wast.js:
  • wasm/spec-tests/br_table.wast.js:
  • wasm/spec-tests/break-drop.wast.js:
  • wasm/spec-tests/call.wast.js:
  • wasm/spec-tests/call_indirect.wast.js:
  • wasm/spec-tests/comments.wast.js:
  • wasm/spec-tests/conversions.wast.js:
  • wasm/spec-tests/custom_section.wast.js:
  • wasm/spec-tests/endianness.wast.js:
  • wasm/spec-tests/exports.wast.js:
  • wasm/spec-tests/f32.wast.js:
  • wasm/spec-tests/f32_cmp.wast.js:
  • wasm/spec-tests/f64.wast.js:
  • wasm/spec-tests/f64_cmp.wast.js:
  • wasm/spec-tests/fac.wast.js:
  • wasm/spec-tests/float_exprs.wast.js:
  • wasm/spec-tests/float_literals.wast.js:
  • wasm/spec-tests/float_memory.wast.js:
  • wasm/spec-tests/float_misc.wast.js:
  • wasm/spec-tests/forward.wast.js:
  • wasm/spec-tests/func.wast.js:
  • wasm/spec-tests/func_ptrs.wast.js:
  • wasm/spec-tests/get_local.wast.js:
  • wasm/spec-tests/globals.wast.js:
  • wasm/spec-tests/i32.wast.js:
  • wasm/spec-tests/i64.wast.js:
  • wasm/spec-tests/imports.wast.js:
  • wasm/spec-tests/int_exprs.wast.js:
  • wasm/spec-tests/int_literals.wast.js:
  • wasm/spec-tests/left-to-right.wast.js:
  • wasm/spec-tests/linking.wast.js:
  • wasm/spec-tests/loop.wast.js:
  • wasm/spec-tests/memory.wast.js:
  • wasm/spec-tests/memory_redundancy.wast.js:
  • wasm/spec-tests/memory_trap.wast.js:
  • wasm/spec-tests/names.wast.js:
  • wasm/spec-tests/nop.wast.js:
  • wasm/spec-tests/resizing.wast.js:
  • wasm/spec-tests/return.wast.js:
  • wasm/spec-tests/select.wast.js:
  • wasm/spec-tests/set_local.wast.js:
  • wasm/spec-tests/skip-stack-guard-page.wast.js:
  • wasm/spec-tests/stack.wast.js:
  • wasm/spec-tests/start.wast.js:
  • wasm/spec-tests/store_retval.wast.js:
  • wasm/spec-tests/switch.wast.js:
  • wasm/spec-tests/tee_local.wast.js:
  • wasm/spec-tests/traps.wast.js:
  • wasm/spec-tests/typecheck.wast.js:
  • wasm/spec-tests/unreachable.wast.js:
  • wasm/spec-tests/unwind.wast.js:

Dec 28, 2016:

7:10 PM Changeset in webkit [210203] by sbarati@apple.com
  • 4 edits
    1 add in trunk

WebAssembly: Don't allow duplicate export names
​https://bugs.webkit.org/show_bug.cgi?id=166490
<rdar://problem/29815000>

Reviewed by Keith Miller.

JSTests:

  • wasm.yaml:
  • wasm/function-tests/invalid-duplicate-export.js: Added.

Source/JavaScriptCore:

  • wasm/WasmModuleParser.cpp:
4:18 PM Changeset in webkit [210202] by sbarati@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

Unreviewed. Fix jsc.cpp build error.

  • jsc.cpp:

(functionTestWasmModuleFunctions):

4:06 PM Changeset in webkit [210201] by sbarati@apple.com
  • 40 edits
    5 adds in trunk

WebAssembly: Implement grow_memory and current_memory
​https://bugs.webkit.org/show_bug.cgi?id=166448
<rdar://problem/29803676>

Reviewed by Keith Miller.

JSTests:

I rewrote some of the testWasmModuleFunctions that used Memory to use
the JS API since the jsc.cpp version can no longer use memory.

  • wasm.yaml:
  • wasm/function-tests/add-12.js:

(testWasmModuleFunctions):

  • wasm/function-tests/br-if-loop-less-than.js:

(testWasmModuleFunctions):

  • wasm/function-tests/brTableAsIf.js:

(testWasmModuleFunctions):

  • wasm/function-tests/brTableManyValues.js:

(testWasmModuleFunctions):

  • wasm/function-tests/brTableWithLoop.js:

(testWasmModuleFunctions):

  • wasm/function-tests/dumb-eq-if-then-else.js:
  • wasm/function-tests/eqz.js:
  • wasm/function-tests/grow-memory-2.js: Added.

(const.func):
(assert.eq.instance.exports.foo):

  • wasm/function-tests/grow-memory-3.js: Added.
  • wasm/function-tests/grow-memory-4.js: Added.

(const.func):

  • wasm/function-tests/grow-memory.js: Added.

(binaryShouldNotParse):
(assert.truthy):
(assert.eq):
(memory.grow):

  • wasm/function-tests/i32-load.js:

(testWasmModuleFunctions):

  • wasm/function-tests/i32-load8-s.js:
  • wasm/function-tests/max.js:
  • wasm/function-tests/min.js:
  • wasm/js-api/memory-grow.js: Added.

(i.i):
(assertEq):

  • wasm/js-api/test_memory.js:
  • wasm/wasm.json:

Source/JavaScriptCore:

This patch implements grow_memory, current_memory, and WebAssembly.prototype.grow.
See relevant spec texts here:

​https://github.com/WebAssembly/design/blob/master/Semantics.md#linear-memory-accesses
​https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymemoryprototypegrow

I also fix a couple miscellaneous bugs:

  1. Data section now understands full init_exprs.
  2. parseVarUint1 no longer has a bug where we allow values larger than 1 if

their bottom 8 bits are zero.

Since the JS API can now grow memory, we need to make calling an import
and call_indirect refresh the base memory register and the size registers.

  • jsc.cpp:

(functionTestWasmModuleFunctions):

  • runtime/Options.h:
  • runtime/VM.h:
  • wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::reloadPinnedRegisters):
(JSC::Wasm::B3IRGenerator::emitReloadPinnedRegisters):
(JSC::Wasm::createJSToWasmWrapper):
(JSC::Wasm::parseAndCompile):

  • wasm/WasmFormat.cpp:

(JSC::Wasm::Segment::create):

  • wasm/WasmFormat.h:

(JSC::Wasm::I32InitExpr::I32InitExpr):
(JSC::Wasm::I32InitExpr::globalImport):
(JSC::Wasm::I32InitExpr::constValue):
(JSC::Wasm::I32InitExpr::isConst):
(JSC::Wasm::I32InitExpr::isGlobalImport):
(JSC::Wasm::I32InitExpr::globalImportIndex):
(JSC::Wasm::Segment::byte):
(JSC::Wasm::ModuleInformation::importFunctionCount):
(JSC::Wasm::ModuleInformation::hasMemory):

  • wasm/WasmFunctionParser.h:
  • wasm/WasmMemory.cpp:

(JSC::Wasm::Memory::Memory):
(JSC::Wasm::Memory::grow):

  • wasm/WasmMemory.h:

(JSC::Wasm::Memory::size):
(JSC::Wasm::Memory::sizeInPages):
(JSC::Wasm::Memory::offsetOfMemory):
(JSC::Wasm::Memory::isValid): Deleted.
(JSC::Wasm::Memory::grow): Deleted.

  • wasm/WasmModuleParser.cpp:

(JSC::Wasm::makeI32InitExpr):

  • wasm/WasmModuleParser.h:
  • wasm/WasmPageCount.h:

(JSC::Wasm::PageCount::bytes):
(JSC::Wasm::PageCount::pageCount):
(JSC::Wasm::PageCount::fromBytes):
(JSC::Wasm::PageCount::operator+):

  • wasm/WasmParser.h:

(JSC::Wasm::Parser<SuccessType>::parseVarUInt1):

  • wasm/WasmValidate.cpp:
  • wasm/js/JSWebAssemblyInstance.h:

(JSC::JSWebAssemblyInstance::offsetOfMemory):

  • wasm/js/JSWebAssemblyMemory.cpp:

(JSC::JSWebAssemblyMemory::~JSWebAssemblyMemory):
(JSC::JSWebAssemblyMemory::grow):

  • wasm/js/JSWebAssemblyMemory.h:

(JSC::JSWebAssemblyMemory::offsetOfMemory):

  • wasm/js/JSWebAssemblyModule.h:

(JSC::JSWebAssemblyModule::functionImportCount):
(JSC::JSWebAssemblyModule::jsEntrypointCalleeFromFunctionIndexSpace):
(JSC::JSWebAssemblyModule::wasmEntrypointCalleeFromFunctionIndexSpace):
(JSC::JSWebAssemblyModule::importCount): Deleted.

  • wasm/js/WebAssemblyFunction.cpp:

(JSC::callWebAssemblyFunction):

  • wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::constructJSWebAssemblyInstance):

  • wasm/js/WebAssemblyMemoryConstructor.cpp:

(JSC::constructJSWebAssemblyMemory):

  • wasm/js/WebAssemblyMemoryPrototype.cpp:

(JSC::getMemory):
(JSC::webAssemblyMemoryProtoFuncBuffer):
(JSC::webAssemblyMemoryProtoFuncGrow):

  • wasm/js/WebAssemblyModuleRecord.cpp:

(JSC::WebAssemblyModuleRecord::link):
(JSC::dataSegmentFail):
(JSC::WebAssemblyModuleRecord::evaluate):

  • wasm/wasm.json:
6:36 AM Changeset in webkit [210200] by clopez@igalia.com
  • 4 edits in trunk/LayoutTests

[Gardening] Remove INDIE_UI related entries from TestExpectation files.
​https://bugs.webkit.org/show_bug.cgi?id=165881

Unreviewed.

  • platform/efl/TestExpectations:
  • platform/gtk/TestExpectations:
  • platform/win/TestExpectations:
4:16 AM Changeset in webkit [210199] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r206637 - Unreviewed, fix 32-bit build.

  • loader/cache/CachedImage.cpp:

(WebCore::CachedImage::decodedSizeChanged):

4:15 AM Changeset in webkit [210198] by Carlos Garcia Campos
  • 11 edits in releases/WebKitGTK/webkit-2.14

Merge r206635 - Change the MemoryCache and CachedResource adjustSize functions to take a long argument
​https://bugs.webkit.org/show_bug.cgi?id=162708
<rdar://problem/28555702>

Reviewed by Brent Fulgham.

Source/WebCore:

Because the MemoryCache stores the size of the cached memory in unsigned,
two problems my happen when reporting a change in the size of the memory:

  1. Signed integer overflow -- which can happen because MemoryCache::adjustSize() takes a signed integer argument. If the allocated or the freed memory size is larger than the maximum of a signed integer, an overflow will happen. For the image caching code, this can be seen where the unsigned decodedSize is casted to an integer before passing it to ImageObserver::decodedSizeChanged().
  1. Unsigned integer overflow -- which can happen if the new allocated memory size plus the currentSize exceeds the maximum of unsigned. This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize or m_deadSize without checking whether this addition will overflow or not. We do not assert for overflow although we assert for underflow.

The fix for these two problems can be the following:

  1. Make all the adjustSize functions all the way till MemoryCache::adjustSize() take a signed long integer argument.
  1. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.
  • loader/cache/CachedImage.cpp:

(WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.

  • loader/cache/CachedImage.h:
  • loader/cache/CachedResource.cpp:

(WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::CachedResource::setEncodedSize): Ditto.

  • loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
(WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::MemoryCache::remove): Ditto.
(WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.

  • loader/cache/MemoryCache.h:
  • platform/graphics/ImageFrameCache.cpp:

(WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
(WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
(WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
(WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
(WebCore::ImageFrameCache::decodedSizeReset): Ditto.
(WebCore::ImageFrameCache::didDecodeProperties): Ditto.
(WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
(WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
(WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().

  • platform/graphics/ImageFrameCache.h:
  • platform/graphics/ImageObserver.h:
  • platform/graphics/IntSize.h:

(WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.

  • platform/graphics/cg/PDFDocumentImage.cpp:

(WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().

LayoutTests:

3:06 AM Changeset in webkit [210197] by svillar@igalia.com
  • 3 edits in trunk/Source/WebCore

[css-grid] Move Grid into GridSizingData
​https://bugs.webkit.org/show_bug.cgi?id=165654

Reviewed by Darin Adler.

The grid track sizing algorithm has been using the m_grid attribute from RenderGrid to
compute the sizes of the tracks unconditionally. However the goal is to make it work against
a generic instance of the Grid class, so that the intrinsic size computation and the layout
processes could be effectively decoupled.

Instead of passing the Grid as a new argument to all the track sizing algorithm methods we
leverage the existence of GridSizingData which is already passed to all of them. This data
structure holds from now on a reference to the Grid instance so that the track sizing
algorithm could use it.

No new tests as this is a refactoring.

  • rendering/RenderGrid.cpp:

(WebCore::RenderGrid::GridSizingData::GridSizingData):
(WebCore::RenderGrid::GridSizingData::grid):
(WebCore::RenderGrid::computeTrackBasedLogicalHeight):
(WebCore::RenderGrid::computeTrackSizesForDirection):
(WebCore::RenderGrid::repeatTracksSizingIfNeeded):
(WebCore::RenderGrid::layoutBlock):
(WebCore::RenderGrid::guttersSize):
(WebCore::RenderGrid::computeIntrinsicLogicalWidths):
(WebCore::RenderGrid::computeIntrinsicLogicalHeight):
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::computeFlexSizedTracksGrowth):
(WebCore::RenderGrid::computeFlexFactorUnitSize):
(WebCore::RenderGrid::findFlexFactorUnitSize):
(WebCore::RenderGrid::rawGridTrackSize):
(WebCore::RenderGrid::gridTrackSize):
(WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
(WebCore::RenderGrid::tracksAreWiderThanMinTrackBreadth):
(WebCore::RenderGrid::trackSizesForComputedStyle):
(WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
(WebCore::RenderGrid::layoutGridItems):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::assumedRowsSizeForOrthogonalChild):
(WebCore::RenderGrid::gridAreaBreadthForChild):
(WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
(WebCore::RenderGrid::populateGridPositionsForDirection):
(WebCore::RenderGrid::columnAxisOffsetForChild):
(WebCore::RenderGrid::rowAxisOffsetForChild):
(WebCore::RenderGrid::findChildLogicalPosition):
(WebCore::RenderGrid::numTracks):
(WebCore::RenderGrid::paintChildren):

  • rendering/RenderGrid.h:
3:04 AM Changeset in webkit [210196] by Carlos Garcia Campos
  • 15 edits in releases/WebKitGTK/webkit-2.14/Source

Merge r208168 - Do a better job of protecting Frame objects in the context of JavaScript calls
​https://bugs.webkit.org/show_bug.cgi?id=164163
<rdar://problem/28955249>

Reviewed by Darin Adler.

Source/WebCore:

  • editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::respondToUnappliedSpellCorrection): Protected the Frame.

  • editing/Editor.cpp:

(WebCore::Editor::setTextAsChildOfElement): Ditto.

  • editing/EditorCommand.cpp:

(WebCore::executeSwapWithMark): Ditto.

  • editing/TypingCommand.cpp:

(WebCore::TypingCommand::deleteKeyPressed): Ditto.
(WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.

  • editing/mac/EditorMac.mm:

(WebCore::Editor::replaceNodeFromPasteboard): Ditto.

  • page/ContextMenuController.cpp:

(WebCore::ContextMenuController::contextMenuItemSelected): Ditto.

  • page/DOMSelection.cpp:

(WebCore::DOMSelection::collapse): Ditto.
(WebCore::DOMSelection::collapseToEnd): Ditto.
(WebCore::DOMSelection::collapseToStart): Ditto.
(WebCore::DOMSelection::setBaseAndExtent): Ditto.
(WebCore::DOMSelection::setPosition): Ditto.
(WebCore::DOMSelection::modify): Ditto.
(WebCore::DOMSelection::extend): Ditto.
(WebCore::DOMSelection::addRange): Ditto.
(WebCore::DOMSelection::deleteFromDocument): Ditto.

  • page/DragController.cpp:

(WebCore::setSelectionToDragCaret): Ditto.
(WebCore::DragController::startDrag): Ditto.

  • page/Frame.cpp:

(WebCore::Frame::checkOverflowScroll): Ditto.

  • page/TextIndicator.cpp:

(WebCore::TextIndicator::createWithRange): Ditto.

Source/WebKit2:

  • WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:

(WebKit::InjectedBundleRangeHandle::renderedImage): Protected the Frame.

  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::insertTextAsync): Ditto.
(WebKit::WebPage::setComposition): Ditto.

  • WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::insertDictatedTextAsync): Ditto.

2:37 AM Changeset in webkit [210195] by Carlos Garcia Campos
  • 9 edits
    2 adds in releases/WebKitGTK/webkit-2.14

Merge r208003 - Prevent hit tests from being performed on an invalid render tree
​https://bugs.webkit.org/show_bug.cgi?id=163877
<rdar://problem/28675761>

Reviewed by Simon Fraser.

Source/WebCore:

Changeset r200971 added code to ensure that layout is up-to-date before hit testing, but did
so only for the main frame. It was still possible to enter cross-frame hit testing with a
subframe needing style recalc. In that situation, the subframe's updateLayout() would get
called, which could trigger a compositing change that marked the parent frame as needing style
recalc. A subsequent layout on the parent frame (for example by hit testing traversing into
a second subframe) could then mutate the parent frame's layer tree while hit testing was
traversing it.

This patch modifies the hit test logic to ensure that a recursive layout is performed so that
we always perform hit tests on a clean set of frames. It also adds some assertions to warn
us if we encounter this invalid state.

Tested by fast/layers/prevent-hit-test-during-layout.html.

  • dom/Document.cpp:

(WebCore::Document::scheduleStyleRecalc): Assert that we are not hit testing
during style recalculation.

  • page/EventHandler.cpp:

(WebCore::EventHandler::hitTestResultAtPoint): Ensure that we have a clean render tree
when hit testing.

  • page/FrameView.cpp:

(WebCore::FrameView::setNeedsLayout): Assert that we are not in the process of hit testing
when we schedule a layout.

  • rendering/RenderView.cpp:

(WebCore::RenderView::hitTest): Mark RenderView as in an active hit test.

  • rendering/RenderView.h:

LayoutTests:

  • fast/layers/prevent-hit-test-during-layout-expected.txt: Added.
  • fast/layers/prevent-hit-test-during-layout.html: Added.
  • platform/efl/TestExpectations: Skip on this platform.
  • platform/gtk/TestExpectations: Skip on this platform.
  • platform/ios-simulator/TestExpectations: Skip on this platform.
  • platform/win/TestExpectations: Skip on this platform.
2:30 AM Changeset in webkit [210194] by Carlos Garcia Campos
  • 3 edits
    2 adds in releases/WebKitGTK/webkit-2.14

Merge r207930 - Ignore out-of-flow siblings when searching for a spanner candidate.
​https://bugs.webkit.org/show_bug.cgi?id=164042.
<rdar://problem/28758456>

Reviewed by Simon Fraser.

Source/WebCore:

While searching for the spanner candidates in a flow thread, we have to take into account
whether renderers are in- or out-of-flow.
What it means is that while traversing the renderer tree to find the the candidate
renderer (next sibling/ancestor's next child in pre-order traversal), we have to check if the candidate
is in the same layout context too.

Test: fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html

  • rendering/RenderMultiColumnFlowThread.cpp:

(WebCore::spannerPlacehoderCandidate):
(WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):

LayoutTests:

  • fast/multicol/crash-when-spanner-candidate-is-out-of-flow-expected.txt: Added.
  • fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html: Added.
2:28 AM Changeset in webkit [210193] by Carlos Garcia Campos
  • 20 edits in releases/WebKitGTK/webkit-2.14/Source

Merge r207708 - Bug 163762: IntSize::area() should used checked arithmetic
<​https://webkit.org/b/163762>

Reviewed by Darin Adler.

Source/WebCore:

No new tests since no change in nominal behavior.

  • platform/graphics/IntSize.h:

(WebCore::IntSize::area): Change to return a
Checked<unsigned, T> value. Use WTF:: namespace to avoid
including another header.

  • platform/graphics/IntRect.h:

(WebCore::IntRect::area): Ditto.

The remaining changes are to use the Checked<unsigned> return
value of IntSize::area() and IntRect::area() correctly in
context, in addition to items noted below.

  • html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::isTopLevelFullPagePlugin):
Declare contentWidth and contentHeight as float values to
prevent overflow when computing the area, and to make the
inequality comparison in the return statement uses the same type
for both sides.

  • html/ImageData.cpp:

(WebCore::ImageData::ImageData):

  • html/MediaElementSession.cpp:

(WebCore::isElementRectMostlyInMainFrame):

  • platform/graphics/ImageBackingStore.h:

(WebCore::ImageBackingStore::setSize): Restructure logic to
compute area only once.
(WebCore::ImageBackingStore::clear):

  • platform/graphics/ImageFrame.h:

(WebCore::ImageFrame::frameBytes):

  • platform/graphics/ImageSource.cpp:

(WebCore::ImageSource::maximumSubsamplingLevel):

  • platform/graphics/ca/LayerPool.cpp:

(WebCore::LayerPool::backingStoreBytesForSize):

  • platform/graphics/cg/ImageDecoderCG.cpp:

(WebCore::ImageDecoder::frameBytesAtIndex):

  • platform/graphics/filters/FEGaussianBlur.cpp:

(WebCore::FEGaussianBlur::platformApplySoftware):

  • platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::asUnmultipliedImage):
(WebCore::FilterEffect::asPremultipliedImage):
(WebCore::FilterEffect::copyUnmultipliedImage):
(WebCore::FilterEffect::copyPremultipliedImage):
(WebCore::FilterEffect::createUnmultipliedImageResult):
(WebCore::FilterEffect::createPremultipliedImageResult):

  • platform/graphics/win/ImageBufferDataDirect2D.cpp:

(WebCore::ImageBufferData::getData): Update overflow check,
rename local variable to numBytes, and compute numBytes once.

  • platform/graphics/win/ImageDecoderDirect2D.cpp:

(WebCore::ImageDecoder::frameBytesAtIndex):

  • platform/image-decoders/ImageDecoder.cpp:

(WebCore::ImageDecoder::frameBytesAtIndex):

  • platform/ios/LegacyTileLayerPool.mm:

(WebCore::LegacyTileLayerPool::bytesBackingLayerWithPixelSize):

  • rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::requiresCompositingForCanvas):

  • rendering/shapes/Shape.cpp:

(WebCore::Shape::createRasterShape):

Source/WebKit2:

  • Shared/ShareableBitmap.cpp:

(WebKit::ShareableBitmap::create): Add overflow check and return
nullptr on overflow.
(WebKit::ShareableBitmap::createShareable): Ditto.
(WebKit::ShareableBitmap::create): Change debug assert for
adequate buffer size check into release check.

  • Shared/ShareableBitmap.h:

(WebKit::ShareableBitmap::numBytesForSize): Change to return a
Checked<unsigned, RecordOverflow> value.
(WebKit::ShareableBitmap::sizeInBytes):

  • Shared/cairo/ShareableBitmapCairo.cpp:

(WebKit::ShareableBitmap::numBytesForSize): Ditto.

  • UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _takeViewSnapshot]): Call unsafeGet().

Tools:

  • TestWebKitAPI/Tests/WebCore/IntRect.cpp:

(TestWebKitAPI::TEST): Call unsafeGet().

  • TestWebKitAPI/Tests/WebCore/IntSize.cpp:

(TestWebKitAPI::TEST): Ditto.

1:59 AM Changeset in webkit [210192] by Gyuyoung Kim
  • 2 edits in trunk/LayoutTests

[EFL] Gardening on 28th Dec.

Unreviewed EFL gardening.

  • platform/efl/TestExpectations: Mark failing tests to Failure or ImageOnlyFailure.
1:47 AM Changeset in webkit [210191] by Carlos Garcia Campos
  • 6 edits
    2 adds in releases/WebKitGTK/webkit-2.14

Merge r207692 - SVG should not paint selection within a mask
​https://bugs.webkit.org/show_bug.cgi?id=163772
<rdar://problem/28705129>

Reviewed by Simon Fraser.

Source/WebCore:

When masking content, we shouldn't paint the text
selection as we are rendering into the masking
offscreen buffer.

Test: svg/masking/mask-should-not-paint-selection.html

  • rendering/PaintPhase.h: Add a new behavior - PaintBehaviorSkipSelectionHighlight.
  • rendering/svg/SVGInlineTextBox.cpp:

(WebCore::SVGInlineTextBox::paint): Don't update the selectionStyle if
PaintBehaviorSkipSelectionHighlight is true.

  • rendering/svg/SVGRenderingContext.cpp:

(WebCore::SVGRenderingContext::renderSubtreeToImageBuffer): Add PaintBehaviorSkipSelectionHighlight
to the PaintInfo.

LayoutTests:

  • svg/masking/mask-should-not-paint-selection-expected.html: Added.
  • svg/masking/mask-should-not-paint-selection.html: Added.
1:40 AM Changeset in webkit [210190] by Carlos Garcia Campos
  • 14 edits
    2 adds in releases/WebKitGTK/webkit-2.14

Merge r207229 - Web Inspector: Improve support for logging Proxy objects in console
​https://bugs.webkit.org/show_bug.cgi?id=163323
<rdar://problem/28432553>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

This is based off of similiar patches in Blink for Proxy handling.

  • bindings/ScriptValue.cpp:

(Deprecated::ScriptValue::isEqual):
Use strict equality. This is the intent, and it prevents the possibility of triggering
primitive conversion on objects in previous ConsoleMessage argument lists.

  • inspector/InjectedScriptSource.js:

(InjectedScript.prototype._propertyDescriptors):
Bail if the object is a Proxy.

(InjectedScript.prototype._describe):
Provide a friendlier name, "Proxy" instead of "ProxyObject".

(InjectedScript.RemoteObject):
When generating a preview for a Proxy object, generate it from the final target
and mark it as lossy so that the object can always be expanded to get the internal
target/handler properties.

  • inspector/JSInjectedScriptHost.h:
  • inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::subtype):
New subtype for Proxy objects.

(Inspector::JSInjectedScriptHost::proxyTargetValue):
Resolve the final target value for a Proxy.

  • inspector/JSInjectedScriptHostPrototype.cpp:

(Inspector::JSInjectedScriptHostPrototype::finishCreation):
(Inspector::jsInjectedScriptHostPrototypeFunctionProxyTargetValue):
Add the new method.

  • inspector/ScriptArguments.cpp:

(Inspector::ScriptArguments::getFirstArgumentAsString):
Avoid triggering Proxy traps on a Proxy object when getting a quick
string description for ConsoleMessages.

  • inspector/protocol/Runtime.json:

Add new "proxy" subtype.

Source/WebInspectorUI:

  • UserInterface/Views/ConsoleMessageView.js:

(WebInspector.ConsoleMessageView.prototype._formatParameter):
Treat a Proxy like any other object.

LayoutTests:

  • inspector/console/console-log-proxy-expected.txt: Added.
  • inspector/console/console-log-proxy.html: Added.

Add a test specific to console logs of Proxy objects to ensure the get
trap is not used in different cases.

  • inspector/model/remote-object-expected.txt:
  • inspector/model/remote-object.html:
  • platform/mac/inspector/model/remote-object-expected.txt:

Update results for Proxy objects and include a test for a multi-level
Proxy object, which should preview the target.

1:35 AM Changeset in webkit [210189] by Carlos Garcia Campos
  • 59 edits
    7 adds in releases/WebKitGTK/webkit-2.14

Merge r206809 - Do not follow redirects when sending violation report
​https://bugs.webkit.org/show_bug.cgi?id=162520
<rdar://problem/27957639>

Reviewed by Alex Christensen.

Source/WebCore:

Do not follow redirects when sending a Content Security Policy or XSS Auditor violation report
as redirects can be used to forward report details to a third-party.

This changes makes WebKit more closely conform to the reporting requirements in section Reporting
of the Content Security Level 2 standard: <​https://w3c.github.io/webappsec-csp/2/#violation-reports>
(Editor's Draft, 25 April 2016).

Tests: http/tests/security/contentSecurityPolicy/report-blocked-uri-and-do-not-follow-redirect-when-sending-report.php

http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report.html
http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report.html

  • loader/LoaderStrategy.h: Modified createPingHandle() to take a boolean, shouldFollowRedirects,

whether to follow redirect responses for a ping request.

  • loader/PingLoader.cpp:

(WebCore::PingLoader::loadImage): Pass ShouldFollowRedirects::Yes to PingLoader::startPingLoad to
keep our current behavior.
(WebCore::PingLoader::sendPing): Ditto. Note our current behavior of following redirects matches
the behavior described in the section "Hyperlink auditing" of the HTML standard:
<​https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing> (23 September 2016).
(WebCore::PingLoader::sendViolationReport): Pass ShouldFollowRedirects::No to PingLoader::startPingLoad
so that we do not follow redirects when sending a violation report.
(WebCore::PingLoader::startPingLoad): Modified to take argument shouldFollowRedirects whether to
follow redirect responses for a ping request.

  • loader/PingLoader.h:
  • platform/network/PingHandle.h: Add boolean m_shouldFollowRedirects. I grouped this boolean with

the existing boolean, m_shouldUseCredentialStorage, as opposed to appending to the end of the class
definition to avoid increasing object size as clang will coalesces the two bools into a single
machine word. Override ResourceHandleClient::willSendRequest() and ResourceHandleClient::willSendRequestAsync()
to follow a redirect, if applicable.

Source/WebKit:

Update implementation of legacy WebKit loader strategy to pass through a boolean,
shouldFollowRedirects, to PingHandle as to whether to follow redirect responses
for a ping request.

  • WebCoreSupport/WebResourceLoadScheduler.cpp:

(WebResourceLoadScheduler::createPingHandle):

  • WebCoreSupport/WebResourceLoadScheduler.h:

Source/WebKit2:

Update the non-Network Session WebKit2 implementation to follow redirect responses for a ping
request, if applicable. I did not update the Network Session implementation at this time. I
will fix it in <​https://bugs.webkit.org/show_bug.cgi?id=162580>.

  • NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::loadPing): Tell PingHandle whether to follow redirects.

  • NetworkProcess/NetworkLoadParameters.h:
  • NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::encode): Encode NetworkResourceLoadParameters::shouldFollowRedirects.
(WebKit::NetworkResourceLoadParameters::decode): Decode NetworkResourceLoadParameters::shouldFollowRedirects.

  • NetworkProcess/PingLoad.h: Added FIXME comment to implement support for following redirects,

if applicable (for hyperlink auditing). See <​https://bugs.webkit.org/show_bug.cgi?id=162580>
for more details.

  • WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::createPingHandle): Modified to take a boolean whether to follow
redirects responses and set NetworkResourceLoadParameters::shouldFollowRedirects as appropriate.

  • WebProcess/Network/WebLoaderStrategy.h:

LayoutTests:

Add tests for Content Security Policy and XSS Auditor to ensure that we do not follow redirects
when sending a violation report. Modified http/tests/security/contentSecurityPolicy/resources/save-report.php
to save the URL of the original ping request and conditionally clear cookies. Modified
http/tests/security/xssAuditor/resources/echo-intertag.pl to support testing for the XSS Auditor.
These changes together with the existing HTTP Host information that is saved with the report we can detect
if a redirect occurred when saving a report.

Updated expected results of existing tests now that we emit the URL of the ping request in the saved report.

  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-and-do-not-follow-redirect-when-sending-report-expected.txt: Added.
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-and-do-not-follow-redirect-when-sending-report.php: Added.
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
  • http/tests/security/contentSecurityPolicy/resources/save-report-and-redirect-to-save-report.php: Added.
  • http/tests/security/contentSecurityPolicy/resources/save-report.php:
  • http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report-expected.txt: Added.
  • http/tests/security/xssAuditor/report-script-tag-and-do-not-follow-redirect-when-sending-report.html: Added.
  • http/tests/security/xssAuditor/report-script-tag-expected.txt:
  • http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report-expected.txt: Added.
  • http/tests/security/xssAuditor/report-script-tag-full-block-and-do-not-follow-redirect-when-sending-report.html: Added.
  • http/tests/security/xssAuditor/report-script-tag-full-block-expected.txt:
  • http/tests/security/xssAuditor/report-script-tag-replace-state-expected.txt:
  • http/tests/security/xssAuditor/resources/echo-intertag.pl:
1:35 AM Changeset in webkit [210188] by Carlos Garcia Campos
  • 49 edits in releases/WebKitGTK/webkit-2.14

Merge r206278 - [CSP] Violation report may be sent to wrong domain on frame-ancestors violation
​https://bugs.webkit.org/show_bug.cgi?id=162079
<rdar://problem/28321575>

Reviewed by Andy Estes.

Source/WebCore:

Fixes an issue where a CSP violation report may be sent to the wrong domain when the
frame-ancestors directive is violated. In particular, when the frame-ancestors directive
is violated for a page that specifies a report URI that is a relative URL then the
report URI would be resolved with respect to the parent frame's document URL and hence
be sent to the domain of the parent frame's document.

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Adjust the report URL with respect
to the blocked URL when we do not have a script execution context.

LayoutTests:

Modified http/tests/security/contentSecurityPolicy/resources/save-report.php to print the HTTP Host header as a means
to validate that the CSP violation report was sent to the appropriate host. Update test expectations.

Note that the presence of "localhost" in the HTTP Host header in the test results for tests
security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin.html and
security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https.html
verify that we resolve a relative URL CSP report URI with respect to the blocked URL.

  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https.html:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin.html:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https.html:
  • http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin.html:
  • http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-allowed-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
  • http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
  • http/tests/security/contentSecurityPolicy/resources/save-report.php:
  • http/tests/security/xssAuditor/report-script-tag-expected.txt:
  • http/tests/security/xssAuditor/report-script-tag-full-block-expected.txt:
  • http/tests/security/xssAuditor/report-script-tag-replace-state-expected.txt:
1:24 AM Changeset in webkit [210187] by Carlos Garcia Campos
  • 5 edits in releases/WebKitGTK/webkit-2.14/Source

Merge r206132 - Suppress JavaScript prompts early on in certain cases
​https://bugs.webkit.org/show_bug.cgi?id=162243
rdar://problem/27661602

Reviewed by Geoffrey Garen.

Source/WebCore:

Export symbols needed by WebKit2.

  • loader/FrameLoader.h:
  • loader/FrameLoaderStateMachine.h:

Source/WebKit2:

  • WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::shouldSuppressJavaScriptDialogs):
Add helper function.

(WebKit::WebChromeClient::runJavaScriptAlert):
(WebKit::WebChromeClient::runJavaScriptConfirm):
(WebKit::WebChromeClient::runJavaScriptPrompt):
Call helper function and return early if we should supress dialogs.

1:14 AM Changeset in webkit [210186] by Carlos Garcia Campos
  • 3 edits
    1 add in releases/WebKitGTK/webkit-2.14

Merge r206472 - B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
​https://bugs.webkit.org/show_bug.cgi?id=162644

Reviewed by Keith Miller.

JSTests:

  • stress/chill-mod-chill-mod.js: Added.

(foo):

Source/JavaScriptCore:

If you forget to update the predecessors of your successors, then bad things will happen if you
do something that requires accurate predecessors for correctness. lowerMacros() uses
BlockInsertionSet, which relies on accurate predecessors.

  • b3/B3LowerMacros.cpp:
1:11 AM Changeset in webkit [210185] by Carlos Garcia Campos
  • 14 edits in releases/WebKitGTK/webkit-2.14

Merge r205190 - [Fetch API] Blob not found URL should result in a network error
​https://bugs.webkit.org/show_bug.cgi?id=161381

Patch by Youenn Fablet <​youenn@apple.com> on 2016-08-30
Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

  • web-platform-tests/fetch/api/basic/scheme-blob-expected.txt:
  • web-platform-tests/fetch/api/basic/scheme-blob-worker-expected.txt:
  • web-platform-tests/fetch/api/basic/scheme-blob-worker.html:
  • web-platform-tests/fetch/api/basic/scheme-blob.html:
  • web-platform-tests/fetch/api/basic/scheme-blob.js:

(invalidRequestMethods.forEach):

Source/WebCore:

Covered by rebased and updated tests.

Raising a network error if no blob can be found from the URL.
It is no longer notified by a 404 response.

Updated FileReaderLoader to generate the correct exception.

Made some clean-up in the code, in particular adding an enum class for BlobResourceHandle errors.

  • fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::didFail):
(WebCore::FileReaderLoader::toErrorCode):
(WebCore::FileReaderLoader::httpStatusCodeToErrorCode):

  • fileapi/FileReaderLoader.h:
  • platform/network/BlobResourceHandle.cpp:

(WebCore::BlobResourceHandle::loadResourceSynchronously):
(WebCore::BlobResourceHandle::doStart):
(WebCore::BlobResourceHandle::didGetSize):
(WebCore::BlobResourceHandle::readSync):
(WebCore::BlobResourceHandle::readFileSync):
(WebCore::BlobResourceHandle::readAsync):
(WebCore::BlobResourceHandle::didOpen):
(WebCore::BlobResourceHandle::didRead):
(WebCore::BlobResourceHandle::failed):
(WebCore::BlobResourceHandle::notifyResponse):
(WebCore::BlobResourceHandle::notifyResponseOnError):
(WebCore::BlobResourceHandle::notifyFail):

  • platform/network/BlobResourceHandle.h:

LayoutTests:

  • fast/files/apply-blob-url-to-xhr-expected.txt:
  • fast/files/workers/worker-apply-blob-url-to-xhr-expected.txt:
1:06 AM Changeset in webkit [210184] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.14

Revert "Merge r204266 - Popups opened from a sandboxed iframe should themselves be sandboxed"

This reverts commit r210183. r204266 is before 2.14 branch point so this
was an empty commit.

12:59 AM Changeset in webkit [210183] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.14

Merge r204266 - Popups opened from a sandboxed iframe should themselves be sandboxed
​https://bugs.webkit.org/show_bug.cgi?id=134850
<rdar://problem/27375388>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/window-opened-from-sandboxed-iframe-should-inherit-sandbox.html

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):

Now copies the opener's frame loader effective sandbox flags to the
new frame loader.

LayoutTests:

  • http/tests/security/resources/anchor-tag-with-blank-target.html: Added.
  • http/tests/security/resources/page-executing-javascript.html: Added.
  • http/tests/security/window-opened-from-sandboxed-iframe-should-inherit-sandbox-expected.txt: Added.
  • http/tests/security/window-opened-from-sandboxed-iframe-should-inherit-sandbox.html: Added.
12:51 AM Changeset in webkit [210182] by Carlos Garcia Campos
  • 2 edits in releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore

Merge r205882 - DFG NewArrayBuffer node should watch for "have a bad time" state change.
​https://bugs.webkit.org/show_bug.cgi?id=161927
<rdar://problem/27995222>

Reviewed by Geoffrey Garen.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

12:49 AM WebKitGTK/2.14.x edited by Carlos Garcia Campos
(diff)
Note: See TracTimeline for information about the timeline view.