Timeline

Apr 7, 2017:

10:30 PM Changeset in webkit [215141] by keith_miller@apple.com

• 2 edits in trunk/Source/JavaScriptCore

WebAssembly: Fix issue with BrTable targeting a Loop
​https://bugs.webkit.org/show_bug.cgi?id=170638

Reviewed by Saam Barati.

This fixes the same issue V8 had in: ​https://github.com/WebAssembly/spec/pull/456#event-1033547537

• wasm/WasmValidate.cpp:

(JSC::Wasm::Validate::ControlData::branchTargetSignature):

8:53 PM Changeset in webkit [215140] by Simon Fraser

• 3 edits in trunk/Source/WebCore

Build fix: TimerBase::start(double, double) can't be inline and exported,
so make it non-inline.

• platform/Timer.cpp:

(WebCore::TimerBase::start):

• platform/Timer.h:

(WebCore::TimerBase::start): Deleted.

8:22 PM Changeset in webkit [215139] by keith_miller@apple.com

• 2 edits in trunk/Source/WTF

Unreviewed, remove constexpr function since GTK didn't like it.

• wtf/PriorityQueue.h:

(WTF::PriorityQueue::parentOf):

7:26 PM Changeset in webkit [215138] by commit-queue@webkit.org

• 7 edits in trunk/Source/WebKit2

Modernize WebPage.h
​https://bugs.webkit.org/show_bug.cgi?id=170633

Patch by Alex Christensen <​achristensen@webkit.org> on 2017-04-07
Reviewed by Joseph Pecoraro.

• UIProcess/API/APIUIClient.h:

(API::UIClient::createNewPage):

• UIProcess/API/C/WKPage.cpp:

(WebKit::RunBeforeUnloadConfirmPanelResultListener::create):
(WebKit::RunJavaScriptAlertResultListener::create):
(WebKit::RunJavaScriptConfirmResultListener::create):
(WebKit::RunJavaScriptConfirmResultListener::RunJavaScriptConfirmResultListener):
(WebKit::RunJavaScriptPromptResultListener::create):
(WebKit::RunJavaScriptPromptResultListener::RunJavaScriptPromptResultListener):
(WKPageSetPageUIClient):

• UIProcess/Cocoa/UIDelegate.h:
• UIProcess/Cocoa/UIDelegate.mm:

(WebKit::UIDelegate::UIClient::createNewPage):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::loadDataImpl):
(WebKit::WebPage::loadStringImpl):
(WebKit::WebPage::loadData):
(WebKit::WebPage::scaledSnapshotWithOptions):
(WebKit::WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction):
(WebKit::WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension):

• WebProcess/WebPage/WebPage.h:

7:23 PM Changeset in webkit [215137] by Chris Dumez

• 2 edits in trunk/Source/WebCore

REGRESSION (r203941): iAd Producer widgets fail to play in iBooks
​https://bugs.webkit.org/show_bug.cgi?id=170635
<rdar://problem/30797958>

Reviewed by Daniel Bates.

Extend the MouseEvent::initMouseEvent() workaround we added for iAd Producer
to iBooks since the iBooks widgets generated by iAd Producer contain the same
bug.

• dom/MouseEvent.cpp:

(WebCore::MouseEvent::initMouseEventQuirk):

6:33 PM Changeset in webkit [215136] by Chris Dumez

• 12 edits in trunk/Source

Start using MonotonicTime / Seconds in Timer class
​https://bugs.webkit.org/show_bug.cgi?id=170625

Reviewed by Simon Fraser.

Source/WebCore:

Start using MonotonicTime / Seconds in Timer class. More work will be needed
for the transition to be complete. I plan to do this in a follow-up.

• page/DOMTimer.cpp:

(WebCore::DOMTimer::alignedFireTime):

• page/DOMTimer.h:
• page/SuspendableTimer.cpp:

(WebCore::SuspendableTimer::suspend):
(WebCore::SuspendableTimer::startRepeating):
(WebCore::SuspendableTimer::startOneShot):
(WebCore::SuspendableTimer::repeatInterval):
(WebCore::SuspendableTimer::augmentFireInterval):
(WebCore::SuspendableTimer::augmentRepeatInterval):

• page/SuspendableTimer.h:

(WebCore::SuspendableTimer::startRepeating):
(WebCore::SuspendableTimer::startOneShot):
(WebCore::SuspendableTimer::augmentFireInterval):
(WebCore::SuspendableTimer::augmentRepeatInterval):

• platform/ThreadTimers.cpp:

(WebCore::ThreadTimers::ThreadTimers):
(WebCore::ThreadTimers::setSharedTimer):
(WebCore::ThreadTimers::updateSharedTimer):
(WebCore::ThreadTimers::sharedTimerFiredInternal):
(WebCore::ThreadTimers::fireTimersInNestedEventLoop):

• platform/ThreadTimers.h:
• platform/Timer.cpp:

(WebCore::TimerHeapLessThanFunction::operator()):
(WebCore::TimerBase::TimerBase):
(WebCore::TimerBase::start):
(WebCore::TimerBase::stop):
(WebCore::TimerBase::nextFireInterval):
(WebCore::TimerBase::heapPop):
(WebCore::TimerBase::updateHeapIfNeeded):
(WebCore::TimerBase::setNextFireTime):
(WebCore::TimerBase::nextUnalignedFireInterval):

• platform/Timer.h:

(WebCore::TimerBase::start):
(WebCore::TimerBase::startOneShot):
(WebCore::TimerBase::repeatInterval):
(WebCore::TimerBase::repeatIntervalSeconds):
(WebCore::TimerBase::augmentFireInterval):
(WebCore::TimerBase::augmentRepeatInterval):
(WebCore::TimerBase::alignedFireTime):
(WebCore::TimerBase::isActive):

• testing/Internals.cpp:

(WebCore::Internals::isTimerThrottled):

Source/WTF:

Add modulo operator to MonotonicTime.

• wtf/MonotonicTime.h:

(WTF::MonotonicTime::operator%):

6:15 PM Changeset in webkit [215135] by keith_miller@apple.com

• 8 edits
  2 adds in trunk

Add a PriorityQueue class
​https://bugs.webkit.org/show_bug.cgi?id=170579

Reviewed by Saam Barati.

Source/JavaScriptCore:

Update Wasm::Worklist to use WTF::PriorityQueue.

• wasm/WasmWorklist.cpp:

(JSC::Wasm::Worklist::enqueue):
(JSC::Wasm::Worklist::completePlanSynchronously):
(JSC::Wasm::Worklist::stopAllPlansForVM):
(JSC::Wasm::Worklist::~Worklist):
(JSC::Wasm::Worklist::iterate): Deleted.

• wasm/WasmWorklist.h:

(JSC::Wasm::Worklist::isHigherPriority):
(JSC::Wasm::Worklist::Comparator::operator()): Deleted.

Source/WTF:

This patch adds a new PriorityQueue class that is backed by
WTF::Vector. It also has a number of other niceties such as being
able to iterate the queue and increase or decrease keys.

One note is that increaseKey and decreaseKey are O(n) rather than
O(log(n)). Traditionally, the lookup of the key is done with a
hash map but that's not feasible here. This is because unless the
queue's element type is a pointer there is no good way maintain a
persistent reference to every entry in the queue while we sift.
The only way to update the location of an entry is to do a hash
table lookup with the entry's hash but this is probably more
expensive than just doing a linear search.

Also, add comparison operator functions, which can be passed to PriorityQueue.

• WTF.xcodeproj/project.pbxproj:
• wtf/MathExtras.h:

(isLessThan):
(isLessThanEqual):
(isGreaterThan):
(isGreaterThanEqual):

• wtf/PriorityQueue.h: Added.

(WTF::PriorityQueue::size):
(WTF::PriorityQueue::isEmpty):
(WTF::PriorityQueue::enqueue):
(WTF::PriorityQueue::peek):
(WTF::PriorityQueue::dequeue):
(WTF::PriorityQueue::decreaseKey):
(WTF::PriorityQueue::increaseKey):
(WTF::PriorityQueue::begin):
(WTF::PriorityQueue::end):
(WTF::PriorityQueue::isValidHeap):
(WTF::PriorityQueue::parentOf):
(WTF::PriorityQueue::leftChildOf):
(WTF::PriorityQueue::rightChildOf):
(WTF::PriorityQueue::siftUp):
(WTF::PriorityQueue::siftDown):

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WTF/PriorityQueue.cpp: Added.

(operator _z ):
(enqueue):
(dequeue):
(TEST):
(compareMove):

6:11 PM Changeset in webkit [215134] by Chris Dumez

• 3 edits in trunk/LayoutTests

Unreviewed, update 2 media tests after r215120 so they work on iOS.

Setting the volume is a no-op on iOS so mute the video instead.

• media/video-restricted-invisible-autoplay-allowed-when-visible.html:
• media/video-restricted-invisible-autoplay-not-allowed.html:

5:56 PM Changeset in webkit [215133] by msaboff@apple.com

• 3 edits in trunk/JSTests

Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
​https://bugs.webkit.org/show_bug.cgi?id=170580

Reviewed by JF Bastien.

Commented out subtest that expects defineProperty("length") to a getter on a
sealed function shouldn't throw.

• ChakraCore.yaml:
• ChakraCore/test/es6/ES6Function_bugs.js:

5:24 PM Changeset in webkit [215132] by commit-queue@webkit.org

• 10 edits in trunk/Source

Use audit_token_t instead of pid_t for checking sandbox of other processes
​https://bugs.webkit.org/show_bug.cgi?id=170616
<rdar://problem/31158189>

Patch by Alex Christensen <​achristensen@webkit.org> on 2017-04-07
Reviewed by Daniel Bates.

Source/WebKit2:

pid's can be reused, so it's theoretically unsafe to use the pid of another process to check whether it's sandboxed.
Use an audit_token_t instead to be more sure that we are not mistakenly checking a new process that has reused the
old process's pid. For the current process, though, we have no xpc_connection_t to the process because we are the process.

• PluginProcess/mac/PluginProcessMac.mm:

(WebKit::PluginProcess::initializeSandbox):

• Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm:

(WebKit::XPCServiceInitializerDelegate::isClientSandboxed):

• Shared/mac/SandboxUtilities.h:
• Shared/mac/SandboxUtilities.mm:

(WebKit::currentProcessIsSandboxed):
(WebKit::connectedProcessIsSandboxed):
(WebKit::processIsSandboxed): Deleted.

• UIProcess/Cocoa/WebProcessProxyCocoa.mm:

(WebKit::WebProcessProxy::platformIsBeingDebugged):

• UIProcess/Plugins/mac/PluginInfoStoreMac.mm:

(WebKit::PluginInfoStore::shouldUsePlugin):

• UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::platformGetLaunchOptions):

Source/WTF:

• wtf/spi/darwin/SandboxSPI.h:

Declare more SPI.

5:21 PM Changeset in webkit [215131] by commit-queue@webkit.org

• 17 edits
  13 copies
  5 adds in trunk

Source/JavaScriptCore:
WebGPU: implement ComputeCommandEncoder and related components
​https://bugs.webkit.org/show_bug.cgi?id=170444

Patch by Yuichiro Kikura <​y.kikura@gmail.com> on 2017-04-07
Reviewed by Alex Christensen.

I added some identifiers related with WebGPUComputeCommandEncoder based on the proposal.
​https://webkit.org/wp-content/uploads/webgpu-api-proposal.html

• runtime/CommonIdentifiers.h:

Source/WebCore:
WebGPU: implement ComputeCommandEncoder and related components
​https://bugs.webkit.org/show_bug.cgi?id=170444

Patch by Yuichiro Kikura <​y.kikura@gmail.com> on 2017-04-07
Reviewed by Alex Christensen.

I implemented WebGPUComputeCommandEncoder and related components based on the WebGPU proposal.
​https://webkit.org/wp-content/uploads/webgpu-api-proposal.html

Test: fast/canvas/webgpu/webgpu-dispatch.html

• CMakeLists.txt:
• DerivedSources.make:
• PlatformMac.cmake:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/JSWebGPUCommandBufferCustom.cpp: Added.

(WebCore::JSWebGPUCommandBuffer::completed):

• html/canvas/WebGPUCommandBuffer.cpp:

(WebCore::WebGPUCommandBuffer::createComputeCommandEncoder):

• html/canvas/WebGPUCommandBuffer.h:
• html/canvas/WebGPUCommandBuffer.idl:
• html/canvas/WebGPUComputeCommandEncoder.cpp: Added.

(WebCore::GPUSizeMake):
(WebCore::WebGPUComputeCommandEncoder::create):
(WebCore::WebGPUComputeCommandEncoder::WebGPUComputeCommandEncoder):
(WebCore::WebGPUComputeCommandEncoder::~WebGPUComputeCommandEncoder):
(WebCore::WebGPUComputeCommandEncoder::setComputePipelineState):
(WebCore::WebGPUComputeCommandEncoder::setBuffer):
(WebCore::WebGPUComputeCommandEncoder::dispatch):
(WebCore::WebGPUComputeCommandEncoder::endEncoding):

• html/canvas/WebGPUComputeCommandEncoder.h: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.h.

(WebCore::WebGPUComputeCommandEncoder::computeCommandEncoder):

• html/canvas/WebGPUComputeCommandEncoder.idl: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.
• html/canvas/WebGPUComputePipelineState.cpp: Copied from Source/WebCore/platform/graphics/gpu/GPUCommandBuffer.cpp.

(WebCore::WebGPUComputePipelineState::create):
(WebCore::WebGPUComputePipelineState::WebGPUComputePipelineState):
(WebCore::WebGPUComputePipelineState::~WebGPUComputePipelineState):

• html/canvas/WebGPUComputePipelineState.h: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.h.

(WebCore::WebGPUComputePipelineState::computePipelineState):

• html/canvas/WebGPUComputePipelineState.idl: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.
• html/canvas/WebGPURenderingContext.cpp:

(WebCore::WebGPURenderingContext::createComputePipelineState):

• html/canvas/WebGPURenderingContext.h:
• html/canvas/WebGPURenderingContext.idl:
• html/canvas/WebGPUSize.h: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.
• html/canvas/WebGPUSize.idl: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.
• platform/graphics/cocoa/GPUCommandBufferMetal.mm:

(WebCore::GPUCommandBuffer::completed):

• platform/graphics/cocoa/GPUComputeCommandEncoderMetal.mm: Added.

(WebCore::MTLSizeMake):
(WebCore::GPUComputeCommandEncoder::GPUComputeCommandEncoder):
(WebCore::GPUComputeCommandEncoder::setComputePipelineState):
(WebCore::GPUComputeCommandEncoder::setBuffer):
(WebCore::GPUComputeCommandEncoder::dispatch):
(WebCore::GPUComputeCommandEncoder::endEncoding):
(WebCore::GPUComputeCommandEncoder::platformComputeCommandEncoder):

• platform/graphics/cocoa/GPUComputePipelineStateMetal.mm: Copied from Source/WebCore/platform/graphics/gpu/GPUCommandBuffer.cpp.

(WebCore::GPUComputePipelineState::GPUComputePipelineState):
(WebCore::GPUComputePipelineState::platformComputePipelineState):

• platform/graphics/gpu/GPUCommandBuffer.cpp:

(WebCore::GPUCommandBuffer::createComputeCommandEncoder):

• platform/graphics/gpu/GPUCommandBuffer.h:
• platform/graphics/gpu/GPUComputeCommandEncoder.cpp: Copied from Source/WebCore/platform/graphics/gpu/GPUCommandBuffer.cpp.

(WebCore::GPUComputeCommandEncoder::create):
(WebCore::GPUComputeCommandEncoder::~GPUComputeCommandEncoder):
(WebCore::GPUComputeCommandEncoder::setComputePipelineState):
(WebCore::GPUComputeCommandEncoder::setBuffer):
(WebCore::GPUComputeCommandEncoder::endEncoding):

• platform/graphics/gpu/GPUComputeCommandEncoder.h: Copied from Source/WebCore/platform/graphics/gpu/GPUCommandBuffer.h.
• platform/graphics/gpu/GPUComputePipelineState.cpp: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.

(WebCore::GPUComputePipelineState::create):
(WebCore::GPUComputePipelineState::~GPUComputePipelineState):

• platform/graphics/gpu/GPUComputePipelineState.h: Copied from Source/WebCore/platform/graphics/gpu/GPUCommandBuffer.h.
• platform/graphics/gpu/GPUSize.h: Copied from Source/WebCore/html/canvas/WebGPUCommandBuffer.idl.

LayoutTests:
WebGPU: implement ComputeCommandEncoder and related components
​https://bugs.webkit.org/show_bug.cgi?id=170444

Patch by Yuichiro Kikura <​y.kikura@gmail.com> on 2017-04-07
Reviewed by Alex Christensen.

Added a test case to ensure ComputeCommandEncoder is dispatched successfully

• fast/canvas/webgpu/webgpu-dispatch-expected.txt: Added.
• fast/canvas/webgpu/webgpu-dispatch.html: Added.

5:00 PM Changeset in webkit [215130] by commit-queue@webkit.org

• 3 edits in trunk/Source/ThirdParty/libwebrtc

Enable SSE4 and NEON optimizations of libopus where available
​https://bugs.webkit.org/show_bug.cgi?id=170592

Patch by Alex Christensen <​achristensen@webkit.org> on 2017-04-07
Reviewed by Youenn Fablet.

• Configurations/opus.xcconfig:
• libwebrtc.xcodeproj/project.pbxproj:

4:59 PM Changeset in webkit [215129] by Brent Fulgham

• 2 edits in trunk/Source/WebKit2

[WK2][iOS] Add CoreMedia entitlement for WebProcess
​https://bugs.webkit.org/show_bug.cgi?id=170623
<rdar://problem/30020073>

Reviewed by Youenn Fablet.

Add new "com.apple.tcc.delegated-services" entitlement to allow CoreMedia
to work properly in WebRTC.

• Configurations/WebContent-iOS.entitlements:

4:25 PM Changeset in webkit [215128] by jmarcell@apple.com

• 8 edits
  1 move in tags/Safari-604.1.16.1

Cherry-pick r214946. rdar://problem/31472278

4:25 PM Changeset in webkit [215127] by jmarcell@apple.com

• 7 edits in tags/Safari-604.1.16.1/Source

Versioning.

4:11 PM Changeset in webkit [215126] by jmarcell@apple.com

• 7 edits in trunk/Source

Versioning.

4:02 PM Changeset in webkit [215125] by commit-queue@webkit.org

• 4 edits in trunk/Source

Private browsing sessions should not look in keychain for client certificates
​https://bugs.webkit.org/show_bug.cgi?id=170618
<rdar://problem/18457427>

Patch by Alex Christensen <​achristensen@webkit.org> on 2017-04-07
Reviewed by Dan Bernstein.

Source/WebCore:

Our client certificate testing in WebKit leaves much to be desired.
See rdar://problem/17694210 for reproduction steps.

• platform/spi/cf/CFNetworkSPI.h:

Add some new SPI.

Source/WebKit2:

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForSessionID):

3:48 PM Changeset in webkit [215124] by Alan Bujtas

• 4 edits
  2 adds in trunk

Simple line layout: FlowContents::segmentIndexForRunSlow skips empty runs.
​https://bugs.webkit.org/show_bug.cgi?id=170552

Reviewed by Antti Koivisto.

Source/WebCore:

The compare function passed to std::lower_bound completely misses empty runs.

Test: fast/text/simple-line-layout-hover-over-subsequent-linebreaks.html

• rendering/SimpleLineLayoutFlowContents.cpp:

(WebCore::SimpleLineLayout::FlowContents::segmentIndexForRunSlow):

LayoutTests:

• fast/text/simple-line-layout-hover-over-subsequent-linebreaks-expected.txt: Added.
• fast/text/simple-line-layout-hover-over-subsequent-linebreaks.html: Added.

3:22 PM Changeset in webkit [215123] by Chris Dumez

• 5 edits in trunk/Source

We should log how much CPU a background process was using when killing it due to CPU limiting
​https://bugs.webkit.org/show_bug.cgi?id=170619

Reviewed by Andreas Kling.

Source/WebCore:

CPUMonitor now passes the CPU usage to the callback when it exceeds the threashold.

• platform/CPUMonitor.cpp:

(WebCore::CPUMonitor::timerFired):

• platform/CPUMonitor.h:

Source/WebKit2:

• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::updateBackgroundCPUMonitorState):

3:13 PM Changeset in webkit [215122] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Mark media/modern-media-controls/media-controller/media-controller-auto-hide-mouse-leave-after-play.html as flaky.
​https://bugs.webkit.org/show_bug.cgi?id=168540

Unreviewed test gardening.

• platform/mac/TestExpectations:

3:13 PM Changeset in webkit [215121] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Mark inspector/codemirror/prettyprinting-css.html as a flaky timeout.
​https://bugs.webkit.org/show_bug.cgi?id=170615

Unreviewed test gardening.

• platform/mac/TestExpectations:

3:04 PM Changeset in webkit [215120] by Chris Dumez

• 5 edits
  1 copy
  1 add in trunk

Audible autoplay videos should not get paused when outside the viewport
​https://bugs.webkit.org/show_bug.cgi?id=170610
<rdar://problem/31505984>

Reviewed by Eric Carlson.

Source/WebCore:

Audible autoplay videos should not get paused when outside the viewport as this
would be observable by the user.

Test: media/video-restricted-invisible-autoplay-allowed-if-audible.html

• html/MediaElementSession.cpp:

(WebCore::MediaElementSession::autoplayPermitted):

LayoutTests:

Add layout test coverage.

• media/video-restricted-invisible-autoplay-allowed-if-audible-expected.txt: Added.
• media/video-restricted-invisible-autoplay-allowed-if-audible.html: Copied from LayoutTests/media/video-restricted-invisible-autoplay-not-allowed.html.
• media/video-restricted-invisible-autoplay-allowed-when-visible.html:
• media/video-restricted-invisible-autoplay-not-allowed.html:

2:52 PM Changeset in webkit [215119] by rniwa@webkit.org

• 1 edit
  2 moves in trunk/Tools

Replace ES6SampleBench by ARES-6 in run-benchmark
​https://bugs.webkit.org/show_bug.cgi?id=170585

Reviewed by Saam Barati.

Updated the plan file for ES6SampleBench to run ARES-6 instead. Also increased the number of iterations
from 4 to 8 to match teh default, and reduced the number of browser instances to use from 5 to 3.

• Scripts/webkitpy/benchmark_runner/data/patches/ARES-6.patch: Renamed from ES6SampleBench.patch.
• Scripts/webkitpy/benchmark_runner/data/plans/ares6.plan: Renamed from es6bench.plan.

2:45 PM Changeset in webkit [215118] by rniwa@webkit.org

• 2 edits in trunk/Websites/perf.webkit.org

Make cycler page scroll down when a dashboard is too tall for the current viewport size
​https://bugs.webkit.org/show_bug.cgi?id=170588

Rubber-stamped by Chris Dumez.

Updated the cycler page to scroll down smoothly over 500ms and scroll up again before moving to the next page
when a dashboard page is too tall to be shown at once. For now, we assume that each dashboard's height is no
more than 2x the height of the viewport.

• public/cycler.html:

2:37 PM Changeset in webkit [215117] by mmaxfield@apple.com

• 5 edits in trunk

REGRESSION(r211382): Complex text with justification erroneously overflows containers
​https://bugs.webkit.org/show_bug.cgi?id=170399
<rdar://problem/31442008>

Reviewed by Simon Fraser.

Source/WebCore:

When we perform justification, we adjust glyphs' advances to add extra space between words.
ComplexTextController maintains an invariant where m_totalWidth is equal to the sum of these
advances. However, in RTL text, inserting extra justification space to the left of a glyph
would break that invariant, and would increase the advances of two glyphs instead of just
one. Then, when we go to draw the text, the sum of the advances is wider than m_totalWidth,
which means the glyphs would be drawn outside of their container.

This regressed in r211382 simply because of an oversight and because there were no tests for
this codepath.

Test: ComplexTextControllerTest.TotalWidthWithJustification

• platform/graphics/ComplexTextController.cpp:

(WebCore::ComplexTextController::adjustGlyphsAndAdvances):

• rendering/InlineBox.h:

(WebCore::InlineBox::InlineBox):

Tools:

Check for the invariant that the sum of the advances is equal to m_totalWidth.

• TestWebKitAPI/Tests/WebCore/ComplexTextController.cpp:

(TestWebKitAPI::TEST_F):

1:49 PM Changeset in webkit [215116] by Chris Dumez

• 5 edits
  3 adds in trunk

Throttle / Align DOM Timers in cross-origin iframes to 30fps
​https://bugs.webkit.org/show_bug.cgi?id=170613
<rdar://problem/31506444>

Reviewed by Simon Fraser.

Source/WebCore:

Throttle / Align DOM Timers in cross-origin iframes to 30fps unless the user
has interacted with them, in order to reduce power use.

Test: http/tests/frame-throttling/timer-throttle-in-cross-origin-subframe.html

• dom/Document.cpp:

(WebCore::Document::domTimerAlignmentInterval):
(WebCore::Document::updateLastHandledUserGestureTimestamp):

• page/DOMTimer.h:

LayoutTests:

Add layout test coverage.

• http/tests/frame-throttling/resources/timer-throttling-frame.html: Added.
• http/tests/frame-throttling/timer-throttle-in-cross-origin-subframe-expected.txt: Added.
• http/tests/frame-throttling/timer-throttle-in-cross-origin-subframe.html: Added.

12:57 PM Changeset in webkit [215115] by wilander@apple.com

• 2 edits in trunk/Source/WebCore

Follow-up fix for Soup platform.
​https://bugs.webkit.org/show_bug.cgi?id=170322

Unreviewed build fix. Error introduced by me in
​https://trac.webkit.org/changeset/215104/webkit.

No new tests.

• platform/network/soup/SocketStreamHandleImpl.h:

Move parameter change to the right
SocketStreamHandleImpl::create() function.

12:42 PM Changeset in webkit [215114] by sbarati@apple.com

• 2 edits in trunk/Source/JavaScriptCore

WebAssembly: Module::getOrCreateCodeBlock is wrong
​https://bugs.webkit.org/show_bug.cgi?id=170612

Reviewed by Keith Miller.

When we were getting a module's CodeBlock, we were checking if !runnable(),
and if !runnable(), we were re-creating the CodeBlock. This is wrong, since
!runnable() is true while the CodeBlock is compiling. Instead, we should check
if we've finished compiling, and if so, if that compilation failed.

• wasm/WasmModule.cpp:

(JSC::Wasm::Module::getOrCreateCodeBlock):

12:31 PM Changeset in webkit [215113] by Matt Baker

• 3 edits in trunk/Source/WebInspectorUI

Web Inspector: DOM/XHR breakpoint tree elements shouldn't persist their represented objects
​https://bugs.webkit.org/show_bug.cgi?id=170611
<rdar://problem/31506161>

Reviewed by Joseph Pecoraro.

Prevent tree elements for DOM and XHR breakpoints from persisting their
represented objects.

• UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):

• UserInterface/Views/NavigationSidebarPanel.js:

(WebInspector.NavigationSidebarPanel.prototype._isTreeElementWithoutRepresentedObject):

12:28 PM Changeset in webkit [215112] by Ryan Haddad

• 2 edits in trunk/Tools

[ios-simulator] API test WebKit2.WKWebProcessPlugInRangeHandle timing out
​https://bugs.webkit.org/show_bug.cgi?id=167594

Unreviewed test gardening.

Disable this test because it is still timing out on the bots.

• TestWebKitAPI/Tests/WebKit2Cocoa/BundleRangeHandle.mm:

(TEST):

12:17 PM Changeset in webkit [215111] by Wenson Hsieh

• 2 edits in trunk/Source/WebKit2

Missing conversion from window to content coordinates when adjusting unobscured content rects for input view
​https://bugs.webkit.org/show_bug.cgi?id=170603

Reviewed by Simon Fraser.

Refactors -[WKContentView _computeUnobscuredContentRectRespectingInputViewBounds:unobscuredContentRect:inputViewBounds:scale:]
to convert the input view bounds into content coordinates instead of using the zoom scale to adjust the height of inputViewBounds.
Covered by the existing LayoutTest, fixed-element-on-bottom-with-keyboard.html.

• UIProcess/ios/WKContentView.mm:

(-[WKContentView _computeUnobscuredContentRectRespectingInputViewBounds:unobscuredContentRect:inputViewBounds:scale:]):

12:13 PM Changeset in webkit [215110] by Ryan Haddad

• 2 edits in trunk/LayoutTests/imported/w3c

Rebaseline another test after r215096.
​https://bugs.webkit.org/show_bug.cgi?id=170561
<rdar://problem/7415154>

Unreviewed test gardening.

• web-platform-tests/url/url-setters-expected.txt:

12:07 PM Changeset in webkit [215109] by Jonathan Bedard

• 2 edits in trunk/Tools

REGRESSION (r214553): Allow layout-tests to be run from Xcode without re-directing stdout, stdin and stderr
​https://bugs.webkit.org/show_bug.cgi?id=170601
<rdar://problem/31492696>

Reviewed by Simon Fraser.

• TestRunnerShared/IOSLayoutTestCommunication.cpp:

(setUpIOSLayoutTestCommunication): Skip TCP setup if no port is in the environment.
(tearDownIOSLayoutTestCommunication): Only teardown if TCP was used.

12:06 PM Changeset in webkit [215108] by aakash_jain@apple.com

• 4 edits in trunk/Tools

Add support for test262 JavaScriptCore tests
​https://bugs.webkit.org/show_bug.cgi?id=170523

Reviewed by Daniel Bates.

• BuildSlaveSupport/build.webkit.org-config/config.json: Added bot433 and bot434.
• BuildSlaveSupport/build.webkit.org-config/master.cfg:

(RunTest262Tests): Added class to run Test262 tests.
(RunTest262Tests.start): Added.
(RunTest262Tests.countFailures): Method to count the failures.
(Test262Factory): Added Test262 factory class.

• BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:

(RunTest262TestsTest): Added unit tests.
(RunTest262TestsTest.assertResults): Helper method.
(RunTest262TestsTest.test_no_regressions_output): Added test case.
(test_failure_output): Same.
(test_failures_output): Same.

12:03 PM Changeset in webkit [215107] by commit-queue@webkit.org

• 2 edits in trunk/Source/WTF

Include cstdio before using sscanf and stderr
​https://bugs.webkit.org/show_bug.cgi?id=170098

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2017-04-07
Reviewed by Michael Catanzaro.

• wtf/NumberOfCores.cpp:

11:52 AM Changeset in webkit [215106] by Michael Catanzaro

• 6 edits in trunk

[GTK] Various build errors when plugin support is disabled
​https://bugs.webkit.org/show_bug.cgi?id=170015

Reviewed by Carlos Garcia Campos.

.:

Allow building with ENABLE_NETSCAPE_PLUGIN_API=ON and ENABLE_X11_TARGET=OFF. This should be
possible as Carlos worked to ensure windowless plugins work properly outside X11. The GTK2
plugin process still depends on ENABLE_X11_TARGET because a plugin that uses GTK+ surely
wants to display a window, and is not going to work outside X11. (If the plugin links to
GTK+ but does not display a window, it's dumb and deserves to be broken.)

Also, make ENABLE_PLUGIN_PROCESS conditional on ENABLE_NETSCAPE_PLUGIN_API, not
ENABLE_X11_TARGET.

• Source/cmake/OptionsGTK.cmake:

Source/WebKit2:

• PluginProcess/unix/PluginControllerProxyUnix.cpp:
• UIProcess/API/gtk/WebKitWebsiteData.cpp:

(recordContainsSupportedDataTypes):
(toWebKitWebsiteDataTypes):

• UIProcess/API/gtk/WebKitWebsiteDataManager.cpp:

(toWebsiteDataTypes):

11:49 AM Changeset in webkit [215105] by commit-queue@webkit.org

• 2 edits in trunk/Tools

[JSC] Change --debug option to --debugger
​https://bugs.webkit.org/show_bug.cgi?id=170587

Patch by Caio Lima <Caio Lima> on 2017-04-07
Reviewed by Keith Miller.

• Scripts/run-jsc:

This patch is changing the new debugger flag for Tools/Scripts/run-jsc
to --debugger to avoid shadowing --debug flag used to run JSC with
Debug build.

11:36 AM Changeset in webkit [215104] by wilander@apple.com

• 12 edits in trunk/Source

WebSocket streams should have network usage attributed to correct process
​https://bugs.webkit.org/show_bug.cgi?id=170322
<rdar://problem/26413551>

Reviewed by Alex Christensen.

Source/WebCore:

Tested manually since it requires a per-app VPN.

• page/SocketProvider.cpp:

(WebCore::SocketProvider::createSocketStreamHandle):

Sends in an empty struct since it doesn't have access to
platform dependent sourceApplicationAuditData.

• platform/network/SocketStreamHandle.h:

Declaration of a per-platform struct to hold CF data for
Cocoa platforms.

• platform/network/cf/SocketStreamHandleImpl.h:

(WebCore::SocketStreamHandleImpl::create):

Now takes WebCore::SourceApplicationAuditToken which is
passed on to the constructor.

• platform/network/cf/SocketStreamHandleImplCFNet.cpp:

(WebCore::SocketStreamHandleImpl::SocketStreamHandleImpl):

Now takes WebCore::SourceApplicationAuditToken which is
passed on to the streams once created.

(WebCore::SocketStreamHandleImpl::createStreams):

Now sets kCFStreamPropertySourceApplication for the two
streams.

• platform/network/curl/SocketStreamHandleImpl.h:

(WebCore::SocketStreamHandleImpl::create):

Added unused WebCore::SourceApplicationAuditToken parameter.

• platform/network/soup/SocketStreamHandleImpl.h:
• platform/network/soup/SocketStreamHandleImplSoup.cpp:

(WebCore::SocketStreamHandleImpl::create):

Added unused WebCore::SourceApplicationAuditToken parameter.

Source/WebKit2:

Changes here are due to the added WebCore::SourceApplicationAuditToken parameter
in WebCore::SocketStreamHandleImpl::create().
WebKit::NetworkSocketStream takes it and passes it on.

• NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::createSocketStream):

• NetworkProcess/NetworkSocketStream.cpp:

(WebKit::NetworkSocketStream::create):
(WebKit::NetworkSocketStream::NetworkSocketStream):

• NetworkProcess/NetworkSocketStream.h:

11:25 AM Changeset in webkit [215103] by sbarati@apple.com

• 24 edits
  4 adds in trunk/Source

WebAssembly: Make to a compilation API that allows for multi-VM concurrent compilations of Wasm Modules
​https://bugs.webkit.org/show_bug.cgi?id=170488

Reviewed by JF Bastien.

Source/JavaScriptCore:

This patch adds a class called Wasm::Module. It contains the bits from
JSWebAssemblyModule that were not VM specific. JSWebAssemblyModule
now has a Ref<Wasm::Module>. Similarly, there is now a Wasm::CodeBlock,
which owns the non-VM-specific bits that JSWebAssemblyCodeBlock used
to own.

This patch also simplifies how we verify and compile code. Wasm::Module
now has an API for both sync/async validation and compilation. This
API abstracts away how Wasm::Plan works.

This is hopefully the last patch needed before we can implement
window.postMessage for a JSWebAssemblyModule. I think all that's
needed now to implement postMessage is simply creating a new
JSWebAssemblyModule with the underlying Wasm::Module.

This patch is neutral on WasmBench.

Finally, this patch changes the promise deferred timer to
allow for new tasks to be added while we're executing
a task. Before, we'd deadlock if this happened.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• jsc.cpp:

(functionTestWasmModuleFunctions):

• runtime/PromiseDeferredTimer.cpp:

(JSC::PromiseDeferredTimer::doWork):
(JSC::PromiseDeferredTimer::scheduleWorkSoon):

• runtime/PromiseDeferredTimer.h:
• wasm/WasmB3IRGenerator.cpp:
• wasm/WasmBinding.cpp:

(JSC::Wasm::wasmToJs):
(JSC::Wasm::wasmToWasm):
(JSC::Wasm::exitStubGenerator): Deleted.

• wasm/WasmBinding.h:
• wasm/WasmCodeBlock.cpp: Added.

(JSC::Wasm::CodeBlock::CodeBlock):
(JSC::Wasm::CodeBlock::waitUntilFinished):
(JSC::Wasm::CodeBlock::compileAsync):
(JSC::Wasm::CodeBlock::isSafeToRun):

• wasm/WasmCodeBlock.h: Added.

(JSC::Wasm::CodeBlock::create):
(JSC::Wasm::CodeBlock::compilationFinished):
(JSC::Wasm::CodeBlock::runnable):
(JSC::Wasm::CodeBlock::errorMessage):
(JSC::Wasm::CodeBlock::functionImportCount):
(JSC::Wasm::CodeBlock::jsEntrypointCalleeFromFunctionIndexSpace):
(JSC::Wasm::CodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace):

• wasm/WasmModule.cpp: Added.

(JSC::Wasm::Module::Module):
(JSC::Wasm::makeValidationResult):
(JSC::Wasm::Module::validateSyncImpl):
(JSC::Wasm::Module::getOrCreateCodeBlock):
(JSC::Wasm::Module::compileSync):
(JSC::Wasm::Module::makeValidationCallback):
(JSC::Wasm::Module::compileAsync):

• wasm/WasmModule.h: Added.

(JSC::Wasm::Module::create):
(JSC::Wasm::Module::validateSync):
(JSC::Wasm::Module::validateAsync):
(JSC::Wasm::Module::signatureIndexFromFunctionIndexSpace):
(JSC::Wasm::Module::moduleInformation):
(JSC::Wasm::Module::nonNullCodeBlock):

• wasm/WasmPlan.cpp:

(JSC::Wasm::Plan::Plan):
(JSC::Wasm::Plan::addCompletionTask):
(JSC::Wasm::Plan::prepare):
(JSC::Wasm::Plan::compileFunctions):
(JSC::Wasm::Plan::complete):
(JSC::Wasm::Plan::tryRemoveVMAndCancelIfLast):
(JSC::Wasm::Plan::cancel): Deleted.

• wasm/WasmPlan.h:

(JSC::Wasm::Plan::dontFinalize):
(JSC::Wasm::Plan::takeWasmToWasmExitStubs):
(JSC::Wasm::Plan::mode):
(JSC::Wasm::Plan::takeWasmExitStubs): Deleted.
(JSC::Wasm::Plan::vm): Deleted.

• wasm/WasmWorklist.cpp:

(JSC::Wasm::Worklist::stopAllPlansForVM):

• wasm/js/JSWebAssemblyCodeBlock.cpp:

(JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
(JSC::JSWebAssemblyCodeBlock::isSafeToRun):
(JSC::JSWebAssemblyCodeBlock::initialize): Deleted.

• wasm/js/JSWebAssemblyCodeBlock.h:

(JSC::JSWebAssemblyCodeBlock::create):
(JSC::JSWebAssemblyCodeBlock::functionImportCount):
(JSC::JSWebAssemblyCodeBlock::jsEntrypointCalleeFromFunctionIndexSpace):
(JSC::JSWebAssemblyCodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace):
(JSC::JSWebAssemblyCodeBlock::wasmToJsCallStubForImport):
(JSC::JSWebAssemblyCodeBlock::mode): Deleted.
(JSC::JSWebAssemblyCodeBlock::initialized): Deleted.
(JSC::JSWebAssemblyCodeBlock::plan): Deleted.
(JSC::JSWebAssemblyCodeBlock::runnable): Deleted.
(JSC::JSWebAssemblyCodeBlock::errorMessage): Deleted.
(JSC::JSWebAssemblyCodeBlock::setJSEntrypointCallee): Deleted.
(JSC::JSWebAssemblyCodeBlock::setWasmEntrypointCallee): Deleted.

• wasm/js/JSWebAssemblyInstance.cpp:

(JSC::JSWebAssemblyInstance::finalizeCreation):
(JSC::JSWebAssemblyInstance::addUnitializedCodeBlock): Deleted.

• wasm/js/JSWebAssemblyInstance.h:

(JSC::JSWebAssemblyInstance::initialized): Deleted.

• wasm/js/JSWebAssemblyModule.cpp:

(JSC::JSWebAssemblyModule::createStub):
(JSC::JSWebAssemblyModule::JSWebAssemblyModule):
(JSC::JSWebAssemblyModule::finishCreation):

• wasm/js/JSWebAssemblyModule.h:

(JSC::JSWebAssemblyModule::moduleInformation):
(JSC::JSWebAssemblyModule::signatureIndexFromFunctionIndexSpace):
(JSC::JSWebAssemblyModule::module):

• wasm/js/WebAssemblyFunction.cpp:

(JSC::WebAssemblyFunction::create):

• wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::constructJSWebAssemblyInstance):

• wasm/js/WebAssemblyModuleConstructor.cpp:

(JSC::WebAssemblyModuleConstructor::createModule):

• wasm/js/WebAssemblyPrototype.cpp:

(JSC::reject):
(JSC::webAssemblyCompileFunc):
(JSC::resolve):
(JSC::instantiate):
(JSC::compileAndInstantiate):
(JSC::webAssemblyValidateFunc):

Source/WTF:

• wtf/SharedTask.h: Make SharedTaskFunctor forward its arguments.

11:15 AM Changeset in webkit [215102] by achristensen@apple.com

• 3 edits in trunk/Source/WebCore

REGRESSION(r204512): WebSocket errors with "Failed to send WebSocket frame." if too much data is sent
​https://bugs.webkit.org/show_bug.cgi?id=170463

Reviewed by Michael Catanzaro.

This only reproduces when using WebSockets to communicate with an external server.
When communicating with a local server, CFWriteStreamWrite succeeds too reliably, so
CFWriteStreamCanAcceptBytes returns true, when sometimes it doesn't when communicating
across the real internet.

• platform/network/cf/SocketStreamHandleImplCFNet.cpp:

(WebCore::SocketStreamHandleImpl::platformSendInternal):

• platform/network/soup/SocketStreamHandleImplSoup.cpp:

(WebCore::SocketStreamHandleImpl::platformSendInternal):
Returning std::nullopt means there was an error, which is not true when the socket stream
is in a state where it cannot be written to because it is actively communicating.
Returning 0 means 0 new bytes were sent, so we will try again later.

11:01 AM Changeset in webkit [215101] by Michael Catanzaro

• 2 edits in trunk/Source/WebKit2

Unreviewed, fix missing return value warning

• UIProcess/WebProcessProxy.cpp:

(WebKit::diagnosticLoggingKeyForSimulatedCrashReason):

10:56 AM Changeset in webkit [215100] by jmarcell@apple.com

• 1 copy in tags/Safari-604.1.16.1

New tag.

10:29 AM Changeset in webkit [215099] by eric.carlson@apple.com

• 9 edits in trunk/Source/WebCore

MediaSample should store video sample rotation instead of orientation
​https://bugs.webkit.org/show_bug.cgi?id=170598

Reviewed by Youenn Fablet.

No new tests, no functional change.

• platform/MediaSample.h:

(WebCore::MediaSample::videoRotation):
(WebCore::MediaSample::videoOrientation): Deleted.

• platform/graphics/avfoundation/MediaSampleAVFObjC.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::videoTransformationMatrix):
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::enqueueVideoSample):
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::updateDisplayLayer):

• platform/mediastream/mac/AVVideoCaptureSource.mm:

(WebCore::AVVideoCaptureSource::processNewFrame):

• platform/mediastream/mac/RealtimeIncomingVideoSource.cpp:

(WebCore::RealtimeIncomingVideoSource::OnFrame):
(WebCore::RealtimeIncomingVideoSource::processNewSample):

• platform/mediastream/mac/RealtimeIncomingVideoSource.h:

• platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp:

(WebCore::RealtimeOutgoingVideoSource::videoSampleAvailable):

9:57 AM Changeset in webkit [215098] by Brent Fulgham

• 15 edits in trunk/LayoutTests

Rebaseline additional tests after r215096.
​https://bugs.webkit.org/show_bug.cgi?id=170561
<rdar://problem/7415154>

LayoutTests/imported/w3c:

• web-platform-tests/cors/allow-headers-expected.txt:
• web-platform-tests/cors/origin-expected.txt:

LayoutTests:

• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-cross-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-cross-in-same-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-cross-self-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-nested-same-in-same-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-none-block-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-self-block-expected.txt:
• http/tests/security/no-popup-from-sandbox-top-expected.txt:
• http/tests/xmlhttprequest/origin-exact-matching-expected.txt:

9:22 AM Changeset in webkit [215097] by commit-queue@webkit.org

• 2 edits in trunk

[CMake][Windows] WebKitGUID.lib should be built with the release CRT
​https://bugs.webkit.org/show_bug.cgi?id=170593

Patch by Fujii Hironori <Fujii Hironori> on 2017-04-07
Reviewed by Brent Fulgham.

Source/cmake/OptionsWin.cmake has a trick to force using the
release CRT even for debug build configuration. But, this works
only for C++, but for C. As the result, WebKitGUID.lib is built
with the debug CRT in debug build configuration because it has C
source files.

• Source/cmake/OptionsWin.cmake: Process CMAKE_C_FLAGS_* as well as CMAKE_CXX_FLAGS_*.

9:02 AM Changeset in webkit [215096] by Brent Fulgham

• 50 edits in trunk

WebKit should percent encode single quotes in query strings
​https://bugs.webkit.org/show_bug.cgi?id=170561
<rdar://problem/7415154>

Reviewed by Alex Christensen.

Source/WebCore:

Modify the characterClassTable to instruct the URLParser to convert
the single-quote character ' to %27 in URL query strings.

Tests: URLParserTest in TestWebKitAPI.

fast/events/popup-blocked-from-unique-frame-via-window-open-named-sibling-frame.html
fast/frames/xss-auditor-handles-file-urls.html
http/tests/security/xssAuditor

• platform/URLParser.cpp:

Tools:

Add a test case for single-quote in the URL query string.

• TestWebKitAPI/Tests/WebCore/URLParser.cpp:

LayoutTests:

Rebaseline tests after change.

• fast/events/popup-blocked-from-unique-frame-via-window-open-named-sibling-frame-expected.txt:
• fast/frames/xss-auditor-handles-file-urls-expected.txt:
• http/tests/security/xssAuditor/base-href-control-char-expected.txt:
• http/tests/security/xssAuditor/base-href-expected.txt:
• http/tests/security/xssAuditor/base-href-null-char-expected.txt:
• http/tests/security/xssAuditor/base-href-scheme-relative-expected.txt:
• http/tests/security/xssAuditor/embed-tag-control-char-expected.txt:
• http/tests/security/xssAuditor/embed-tag-expected.txt:
• http/tests/security/xssAuditor/embed-tag-javascript-url-expected.txt:
• http/tests/security/xssAuditor/embed-tag-null-char-expected.txt:
• http/tests/security/xssAuditor/form-action-expected.txt:
• http/tests/security/xssAuditor/formaction-on-button-expected.txt:
• http/tests/security/xssAuditor/formaction-on-input-expected.txt:
• http/tests/security/xssAuditor/frameset-injection-expected.txt:
• http/tests/security/xssAuditor/full-block-base-href-expected.txt:
• http/tests/security/xssAuditor/full-block-link-onclick-expected.txt:
• http/tests/security/xssAuditor/full-block-object-tag-expected.txt:
• http/tests/security/xssAuditor/full-block-script-tag-with-source-expected.txt:
• http/tests/security/xssAuditor/iframe-injection-expected.txt:
• http/tests/security/xssAuditor/iframe-javascript-url-more-encoding-expected.txt:
• http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding-expected.txt:
• http/tests/security/xssAuditor/img-onerror-non-ASCII-char-expected.txt:
• http/tests/security/xssAuditor/link-onclick-ampersand-expected.txt:
• http/tests/security/xssAuditor/link-onclick-control-char-expected.txt:
• http/tests/security/xssAuditor/link-onclick-entities-expected.txt:
• http/tests/security/xssAuditor/link-onclick-expected.txt:
• http/tests/security/xssAuditor/link-onclick-null-char-expected.txt:
• http/tests/security/xssAuditor/object-embed-tag-control-char-expected.txt:
• http/tests/security/xssAuditor/object-embed-tag-expected.txt:
• http/tests/security/xssAuditor/object-embed-tag-null-char-expected.txt:
• http/tests/security/xssAuditor/object-tag-expected.txt:
• http/tests/security/xssAuditor/object-tag-javascript-url-expected.txt:
• http/tests/security/xssAuditor/script-tag-expression-follows-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-16bit-unicode4-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-16bit-unicode5-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-comma-01-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-source-control-char-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-source-entities-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-source-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-source-null-char-expected.txt:
• http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query-expected.txt:
• http/tests/security/xssAuditor/svg-animate-expected.txt:
• http/tests/security/xssAuditor/svg-script-tag-expected.txt:
• http/tests/security/xssAuditor/xss-filter-bypass-big5-expected.txt:
• http/tests/security/xssAuditor/xss-filter-bypass-sjis-expected.txt:

8:24 AM Changeset in webkit [215095] by commit-queue@webkit.org

• 3 edits in trunk/LayoutTests

Improve some WebRTC flaky tests
​https://bugs.webkit.org/show_bug.cgi?id=170584

Patch by Youenn Fablet <​youenn@apple.com> on 2017-04-07
Reviewed by Alex Christensen.

• webrtc/libwebrtc/descriptionGetters.html:
• webrtc/video-replace-track-to-null.html:

8:05 AM Changeset in webkit [215094] by Alan Bujtas

• 6 edits
  3 adds in trunk

Text insertion cursor disappears after pressing enter
​https://bugs.webkit.org/show_bug.cgi?id=169291
<rdar://problem/30899611>

Reviewed by Tim Horton.

Source/WebCore:

Positon upstream/downstream (as the result of VisiblePosition -> canonicalPosition) require
linebox tree. In addition to regular text, we need to bail out of simple line layout on line breaks too.

Test: editing/simple-line-layout-caret-is-gone.html

• dom/Position.cpp:

(WebCore::ensureLineBoxesIfNeeded):
(WebCore::Position::upstream):
(WebCore::Position::downstream):
(WebCore::Position::getInlineBoxAndOffset):

• rendering/RenderLineBreak.cpp:

(WebCore::RenderLineBreak::ensureLineBoxes):
(WebCore::RenderLineBreak::positionForPoint):
(WebCore::RenderLineBreak::setSelectionState):
(WebCore::RenderLineBreak::collectSelectionRects):
(WebCore::ensureLineBoxes): Deleted.

• rendering/RenderLineBreak.h:

LayoutTests:

• editing/simple-line-layout-caret-is-gone-expected.txt: Added.
• editing/simple-line-layout-caret-is-gone.html: Added.

7:13 AM Changeset in webkit [215093] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

[GTK] Fix codec name in OWR ASSERT
​https://bugs.webkit.org/show_bug.cgi?id=170600

Patch by Xan Lopez <​xlopez@igalia.com> on 2017-04-07
Reviewed by Carlos Garcia Campos.

• platform/mediastream/openwebrtc/MediaEndpointOwr.cpp:

(WebCore::MediaEndpointOwr::prepareMediaSession): uppercase the
codec name we are looking for, that's how they appear in the
vector.

6:43 AM Changeset in webkit [215092] by pvollan@apple.com

• 3 edits in trunk/Source/WebCore

Add hasVideo property to WebAVPlayerController.
​https://bugs.webkit.org/show_bug.cgi?id=170545
rdar://problem/31325182

Reviewed by Eric Carlson.

Add a new "hasVideo" property which can be used to discover if any video content is present in the playback item,
whether video content is currently enabled or not.

• platform/ios/WebAVPlayerController.h:
• platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(WebVideoFullscreenInterfaceAVKit::hasVideoChanged):

5:52 AM Changeset in webkit [215091] by magomez@igalia.com

• 2 edits in trunk/Source/WebCore

[GTK+] Animations not played properly when using synchronous decoding
​https://bugs.webkit.org/show_bug.cgi?id=170591

Reviewed by Carlos Garcia Campos.

Fix an index error when destroying decoded frames that was sometimes deleting the frame we wanted
to keep.

Covered by exitent tests.

• platform/graphics/ImageFrameCache.cpp:

(WebCore::ImageFrameCache::destroyDecodedData):

5:01 AM Changeset in webkit [215090] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

[GTK] Add message about missing codecs to ASSERT in OWR
​https://bugs.webkit.org/show_bug.cgi?id=170596

Patch by Xan Lopez <Xan Lopez> on 2017-04-07
Reviewed by Carlos Garcia Campos.

• platform/mediastream/openwebrtc/MediaEndpointOwr.cpp:

(WebCore::MediaEndpointOwr::prepareMediaSession): add a message
about the missing coded to the ASSERT.

4:59 AM Changeset in webkit [215089] by tpopela@redhat.com

• 2 edits in trunk/Source/WebCore

AX: Don't crash if no renderer is available for AccessibilityRenderObject
​https://bugs.webkit.org/show_bug.cgi?id=170448

Reviewed by Chris Fleizach.

Don't crash or assert if no renderer is available, but early return
gracefully (as in other places in the AccessibilityRenderObject.cpp).
Spotted by running some tests through dogtail.

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::isOffScreen):
(WebCore::AccessibilityRenderObject::isUnvisited):
(WebCore::AccessibilityRenderObject::isVisited):

3:43 AM Changeset in webkit [215088] by Carlos Garcia Campos

• 18 edits
  1 add in trunk/Source

[GTK] Update the priorities used in glib main loop sources
​https://bugs.webkit.org/show_bug.cgi?id=170457

Reviewed by Žan Doberšek.

Source/JavaScriptCore:

• runtime/JSRunLoopTimer.cpp:

(JSC::JSRunLoopTimer::JSRunLoopTimer):

Source/WebCore:

• platform/glib/MainThreadSharedTimerGLib.cpp:

(WebCore::MainThreadSharedTimer::MainThreadSharedTimer):

• platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:

(WebCore::TextureMapperPlatformLayerProxy::TextureMapperPlatformLayerProxy):
(WebCore::TextureMapperPlatformLayerProxy::activateOnCompositingThread):

Source/WebKit2:

• Shared/CoordinatedGraphics/threadedcompositor/CompositingRunLoop.cpp:

(WebKit::CompositingRunLoop::CompositingRunLoop):

• UIProcess/DrawingAreaProxyImpl.cpp:

(WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
(WebKit::DrawingAreaProxyImpl::DrawingMonitor::DrawingMonitor):

• UIProcess/gtk/WaylandCompositor.cpp:

(WebKit::createWaylandLoopSource):

• WebProcess/WebPage/AcceleratedDrawingArea.cpp:

(WebKit::AcceleratedDrawingArea::AcceleratedDrawingArea):

• WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:

(WebKit::CompositingCoordinator::CompositingCoordinator):

• WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h:
• WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:

(WebKit::CoordinatedLayerTreeHost::CoordinatedLayerTreeHost):

• WebProcess/WebPage/DrawingAreaImpl.cpp:

(WebKit::DrawingAreaImpl::DrawingAreaImpl):

Source/WTF:

Add an enum to define prirorities used in different GLib main sources. It allows to give them a better name
than high, low, medium, etc., but also to document them and other GLib based ports can define their own
values without changing all the places where they are used. The default values are based on the priorities
pre-defined by GLib.

• wtf/glib/MainThreadGLib.cpp:

(WTF::MainThreadDispatcher::MainThreadDispatcher):

• wtf/glib/RunLoopGLib.cpp:

(WTF::RunLoop::RunLoop):
(WTF::RunLoop::dispatchAfter):
(WTF::RunLoop::TimerBase::TimerBase):

• wtf/glib/RunLoopSourcePriority.h: Added.
• wtf/linux/MemoryPressureHandlerLinux.cpp:

(WTF::MemoryPressureHandler::EventFDPoller::EventFDPoller):

12:37 AM Changeset in webkit [215087] by zandobersek@gmail.com

• 2 edits in trunk/Source/WebCore

[GCrypt] Implement AES_CBC support
​https://bugs.webkit.org/show_bug.cgi?id=170550

Reviewed by Michael Catanzaro.

Implement the CryptoAlgorithmAES_CBC::platform{Encrypt,Decrypt}
functionality for configurations that use libgcrypt. This is done
by leveraging the gcry_cipher_* APIs for the AES algorithm that's
deduced appropriately from the key size and the CBC cipher mode.
Additionally, the PKCS#7 padding is implemented for each operation,
as demanded by the Web Crypto specification.

No new tests -- current ones cover this sufficiently, but are not yet
enabled due to missing platform-specific SUBTLE_CRYPTO implementations.

• crypto/gcrypt/CryptoAlgorithmAES_CBCGCrypt.cpp:

(WebCore::gcryptEncrypt):
(WebCore::gcryptDecrypt):
(WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):

12:36 AM Changeset in webkit [215086] by zandobersek@gmail.com

• 4 edits in trunk/Source/WebCore

[GCrypt] Implement raw and JWK imports and exports for EC keys
​https://bugs.webkit.org/show_bug.cgi?id=170546

Reviewed by Michael Catanzaro.

Source/WebCore:

Implement import and export operations for EC keys, covering the raw
and JWK import/export types.

CryptoKeyEC::platformImportRaw() builds a public-key s-expression,
providing the curve name and the key data, and yields the gcry_sexp_t
object to the new CryptoKeyEC.

CryptoKeyEC::platformImportJWKPublic() first constructs a Vector<uint8_t>
object that contains the EC point in the uncompressed format. It then
puts that data into a newly-constructed public-key s-expression that is
then used to construct the new CryptoKeyEC object.

CryptoKeyEC::platformImportJWKPrivate() constructs the EC point data just
the same, but it also lays out the private key field element data into
the private-key s-expression that's then handed off to the CryptoKeyEC
object.

CryptoKeyEC::platformExportRaw() constructs a new EC operations context
and then uses it to retrieve the q parameter as an MPI. A Vector<uint8_t>
is retrieved from the MPI data through the extractMPIData() helper
function.

CryptoKeyEC::platformAddFieldElements() similarly uses the EC operations
context to retrieve the q parameter data, which it then splits into the
x and y field elements and Base64 URL-encodes them into a form that can
be placed in a JsonWebKey. If the key is private, the d parameter is
retrieved in the same fashion and again Base64 URL-encoded and stored
in the JsonWebKey object.

No new tests -- current ones cover this sufficiently, but are not yet
enabled due to other missing platform-specific SUBTLE_CRYPTO
implementations.

• crypto/gcrypt/CryptoKeyECGCrypt.cpp:

(WebCore::uncompressedPointSizeForCurve):
(WebCore::uncompressedFieldElementSizeForCurve):
(WebCore::extractMPIData):
(WebCore::CryptoKeyEC::platformImportRaw):
(WebCore::CryptoKeyEC::platformImportJWKPublic):
(WebCore::CryptoKeyEC::platformImportJWKPrivate):
(WebCore::CryptoKeyEC::platformExportRaw):
(WebCore::CryptoKeyEC::platformAddFieldElements):

Source/WebCore/PAL:

Add HandleDeleter specizalizations for gcry_ctx_t and gcry_mpi_t types.

• pal/crypto/gcrypt/Handle.h:

(PAL::GCrypt::HandleDeleter<gcry_ctx_t>::operator()):
(PAL::GCrypt::HandleDeleter<gcry_mpi_t>::operator()):

12:35 AM Changeset in webkit [215085] by zandobersek@gmail.com

• 3 edits in trunk/Source/WebCore

[GCrypt] Implement CryptoKeyRSA::generatePair()
​https://bugs.webkit.org/show_bug.cgi?id=170350

Reviewed by Michael Catanzaro.

Start implementing the libgcrypt-based platform bits of CryptoKeyRSA.

Implement generatePair() by constructing a genkey s-expression
that requests a generation of an RSA key that should use a modulus
of the specified bit-length and the specified exponent. The exponent
is extracted from an uint8_t array through a helper function. The
modulus length value is checked to be at least 16, since libgcrypt
does not support generating primes of less than that length in bits.

The returned s-expression upon request will contain the data for
both the public and the private key. gcry_sexp_t handles representing
those s-expressions are then passed to CryptoKeyRSA::create() before
invoking the success callback with a new CryptoKeyPair object in a
separate ScriptExecutionContext task.

The CryptoKeyRSA constructor simply has the notImplemented() call
removed. The destructor now invokes the HandleDeleter<gcry_sexp_t>
object instance to destroy the object represented by the
m_platformKey handle.

The methods in CryptoKeyRSA.cpp are also reordered to follow the
declaration order used in the header.

No new tests -- current ones cover this sufficiently, but are not yet
enabled due to other missing platform-specific SUBTLE_CRYPTO
implementations.

• crypto/gcrypt/CryptoKeyRSAGCrypt.cpp:

(WebCore::CryptoKeyRSA::CryptoKeyRSA):
(WebCore::CryptoKeyRSA::~CryptoKeyRSA):
(WebCore::exponentVectorToUInt32):
(WebCore::CryptoKeyRSA::generatePair):
(WebCore::CryptoKeyRSA::importSpki):
(WebCore::CryptoKeyRSA::importPkcs8):
(WebCore::CryptoKeyRSA::exportPkcs8):
(WebCore::CryptoKeyRSA::buildAlgorithm):
(WebCore::CryptoKeyRSA::exportData):

• crypto/keys/CryptoKeyRSA.h:

Apr 6, 2017:

8:45 PM Changeset in webkit [215084] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit2

Add WKContentExtensionStore.h and WKContentExtension.h to public WebKit.h
​https://bugs.webkit.org/show_bug.cgi?id=170533

Patch by Alex Christensen <​achristensen@webkit.org> on 2017-04-06
Reviewed by Daniel Bates.

• Shared/API/Cocoa/WebKit.h:

In r213696 I added two public headers. All public headers in WebKit are included with
#import <WebKit/WebKit.h>

7:45 PM Changeset in webkit [215083] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

[Debug] ASSERT(!throwScope.exception()) on imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html
​https://bugs.webkit.org/show_bug.cgi?id=170395
<rdar://problem/31394017>

Patch by Youenn Fablet <​youenn@apple.com> on 2017-04-06
Reviewed by Mark Lam.

• bindings/js/JSDOMPromise.cpp:

(WebCore::DeferredPromise::reject): Exiting early in case of scope having an exception.
Adding an assertion to ensure this is a worker termination exception.

7:40 PM Changeset in webkit [215082] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Source Map Resources should show up in the Debugger Sources list
​https://bugs.webkit.org/show_bug.cgi?id=170581
<rdar://problem/31269140>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2017-04-06
Reviewed by Matt Baker.

• UserInterface/Views/DebuggerSidebarPanel.js:

(WebInspector.DebuggerSidebarPanel):
Include SourceMapResources in the DebuggerSidebar's Sources tree outline.

7:14 PM EnvironmentVariables edited by clopez@igalia.com

(diff)

7:12 PM EnvironmentVariables edited by clopez@igalia.com

efl port gone (diff)

5:59 PM Changeset in webkit [215081] by mmaxfield@apple.com

• 4 edits in trunk

Make FontWithFeatures test font pass OTS
​https://bugs.webkit.org/show_bug.cgi?id=169788

Reviewed by Tim Horton.

Tools:

OTS, or the OpenType Sanitizer, is a check which tells if fonts are properly formed.
Previously, our FontWithFeatures test font did not pass this check. This patch updates
the font to pass the checks. Now, we can use this font on other platforms, and
contribute the font to the W3C for testing the CSS Fonts level 3 spec.

• FontWithFeatures/FontWithFeatures/FontCreator.cpp:

(Generator::appendCFFTable):
(Generator::Feature::operator<):
(Generator::appendGSUBTable):
(Generator::appendOS2Table):
(Generator::appendFormat4CMAPTable):
(Generator::appendHEADTable):
(Generator::appendHHEATable):
(Generator::NameRecord::operator<):
(Generator::appendNameSubtable):
(Generator::appendNAMETable):

LayoutTests:

Updated font to the one which passes the tests.

• css3/resources/FontWithFeatures.otf:

5:53 PM Changeset in webkit [215080] by ap@apple.com

• 2 edits in trunk/Tools

Disable flaky WebKit2.ResizeWithHiddenContentDoesNotHang
for ​https://bugs.webkit.org/show_bug.cgi?id=170195

• TestWebKitAPI/Tests/WebKit2Cocoa/AnimatedResize.mm:

5:47 PM Changeset in webkit [215079] by jiewen_tan@apple.com

• 3 edits in trunk/LayoutTests

LayoutTest crypto/subtle/aes-ctr-encrypt-malformed-parameters.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=170571

Unreviewed.

• crypto/subtle/aes-ctr-encrypt-malformed-parameters-expected.txt:
• crypto/subtle/aes-ctr-encrypt-malformed-parameters.html:

5:39 PM Changeset in webkit [215078] by Joseph Pecoraro

• 3 edits in trunk/Source/WebKit2

Web Inspector: Hangs when loading under SpeculativeLoad::shouldCaptureExtraNetworkLoadMetrics
​https://bugs.webkit.org/show_bug.cgi?id=170575

Rubber-stamped by Brian Burg.

• NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::shouldCaptureExtraNetworkLoadMetrics): Deleted.

• NetworkProcess/cache/NetworkCacheSpeculativeLoad.h:

m_networkLoad is a wrapper around this as the client, so we would infinite loop here.

5:39 PM Changeset in webkit [215077] by akling@apple.com

• 2 edits in trunk/Source/WebCore

Inaudible background tabs should become eligible for memory kill after 8 minutes
​https://bugs.webkit.org/show_bug.cgi?id=170574
<rdar://problem/31488686>

Reviewed by Gavin Barraclough.

Lower the delay for potentially marking background tabs as inactive from 60 minutes to 8 minutes.
Letting a tab misbehave in the background for an entire hour was overly charitable.

• page/PerformanceMonitor.cpp:

5:39 PM Changeset in webkit [215076] by commit-queue@webkit.org

• 4 edits in trunk/Source/WebKit2

Unreviewed, rolling out r214973.
​https://bugs.webkit.org/show_bug.cgi?id=170578

Causes issues in Safari (Requested by bradee-oh on #webkit).

Reverted changeset:

"Refactor so WebsiteDataStores always have a StorageManager."
​https://bugs.webkit.org/show_bug.cgi?id=170521
​http://trac.webkit.org/changeset/214973

5:38 PM Changeset in webkit [215075] by Wenson Hsieh

• 3 edits
  2 adds in trunk

Scroll offset jumps after a programmatic scroll in an overflow container with scroll snapping
​https://bugs.webkit.org/show_bug.cgi?id=170560
<rdar://problem/31484693>

Reviewed by Tim Horton.

Source/WebCore:

Test: css3/scroll-snap/scroll-snap-programmatic-overflow-scroll.html

Logic for maintaining the scroll snap state in ScrollController was previously removed from iOS when refactoring
ScrollController. This was done because scroll snapping on iOS is driven not by the ScrollController (as it is
on Mac) but rather by sending scroll snap offsets to the UI process and hooking into UIScrollView delegates to
handle retargeted scrolling.

However, on iOS, this ScrollController state is still important for the purposes of keeping the last active
snap point index in sync with the UI process when the scroll offset changes outside of a user gesture (i.e.
programmatic scrolling). Since the UI process does not get a chance to update the active snap offset during a
programmatic scroll, our last active snap offset state was only being updated to the last snap position that the
user manually scrolled to, making programmatic scrolling jump to this offset.

To fix this, we need to update scroll snap state on iOS within ScrollController. Also adds a new Layout test
that exercises programmatic scrolling in an overflow scrolling container on all platforms.

• platform/cocoa/ScrollController.mm:

(WebCore::otherScrollEventAxis):
(WebCore::ScrollController::updateScrollSnapState):
(WebCore::ScrollController::updateScrollSnapPoints):

LayoutTests:

Add a test verifying that programmatically changing the scroll offset of an overflow container does not cause the
scroll offset to jump back to the last active snap position. See WebCore ChangeLog for more details.

• css3/scroll-snap/scroll-snap-programmatic-overflow-scroll-expected.txt: Added.
• css3/scroll-snap/scroll-snap-programmatic-overflow-scroll.html: Added.

5:36 PM Changeset in webkit [215074] by dino@apple.com

• 2 edits in trunk/Websites/webkit.org

Fix broken link.

• demos/webgpu/index.html:

5:26 PM Changeset in webkit [215073] by fpizlo@apple.com

• 4 edits
  2 moves in trunk/Source/JavaScriptCore

Rename allocateStack to allocateStackByGraphColoring.

Rubber stamped by Saam Barati.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• b3/air/AirAllocateStack.cpp: Removed.
• b3/air/AirAllocateStack.h: Removed.
• b3/air/AirAllocateStackByGraphColoring.cpp: Copied from Source/JavaScriptCore/b3/air/AirAllocateStack.cpp.

(JSC::B3::Air::allocateStackByGraphColoring):
(JSC::B3::Air::allocateStack): Deleted.

• b3/air/AirAllocateStackByGraphColoring.h: Copied from Source/JavaScriptCore/b3/air/AirAllocateStack.h.
• b3/air/AirGenerate.cpp:

(JSC::B3::Air::prepareForGeneration):

5:16 PM Changeset in webkit [215072] by msaboff@apple.com

• 6 edits
  2 adds in trunk

Cannot Object.seal() or Object.freeze() global "this"
​https://bugs.webkit.org/show_bug.cgi?id=170549

Reviewed by Mark Lam.

JSTests:

Enabled failing tests fixed by the corresponding code change:

ChakraCore/test/LetConst/delete.js
ChakraCore/test/LetConst/dop.js
ChakraCore/test/LetConst/dop1.js

• ChakraCore.yaml:
• ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
• ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.

Source/JavaScriptCore:

Needed to implement JSProxy::isExtensible() which returns the results of calling
the same on wrapped object.

Implemented step 11 of Runtime Semantics: EvalDeclarationInstantiation from the ECMAScript
spec to properly return a TypeError object when attempting to add properties to a
non-extensible global object.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

• runtime/JSProxy.cpp:

(JSC::JSProxy::isExtensible):

• runtime/JSProxy.h:

5:11 PM Changeset in webkit [215071] by fpizlo@apple.com

• 14 edits
  1 add
  1 delete in trunk/Source

Linear scan should run liveness only once
​https://bugs.webkit.org/show_bug.cgi?id=170569

Reviewed by Keith Miller.

Source/JavaScriptCore:

Air has a longstanding design bug that Tmps from different banks are indexed independently. This
means that all of our analyses over Tmps do separate GP and FP passes. This does have some
marginal benefits (the rest of the algorithm is specialized for Bank) but it's probably net bad.
However, I don't want to think about solving that general problem.

Instead, this just makes linear scan use a UnifiedTmpLiveness that uses a single "linear"
indexing for GP and FP. This lets me avoid the much larger refactoring (which would involve
substantial changes in graph coloring) while getting the bulk of the benefit (liveness runs once,
instead of twice, for linear scan).

This patch implements a lot of plumbing to make it possible for Liveness<> to view Tmps as having
a unified indexing scheme. Tmp calls this LinearlyIndexed (to match the naming convention of
AbsolutelyIndexed and Indexed), while AirLiveness calls this UnifiedTmpLiveness. With this
change, -O1 never does any liveness analysis that uses separate GP and FP passes. I think this
eliminates any urgency from the larger Tmp indexing bug. We can probably live with graph coloring
doing separate passes.

This is a ~6% speed-up for wasm -O1 compile times. I think this means that linear scan is no
longer the longest pole in the tent.

• JavaScriptCore.xcodeproj/project.pbxproj:
• b3/B3VariableLiveness.h:

(JSC::B3::VariableLivenessAdapter::prepareToCompute):

• b3/air/AirAllocateRegistersByLinearScan.cpp:

(JSC::B3::Air::allocateRegistersByLinearScan):

• b3/air/AirCode.h:

(JSC::B3::Air::Code::forEachTmp):

• b3/air/AirLiveness.h:
• b3/air/AirLivenessAdapter.h:

(JSC::B3::Air::LivenessAdapter::Actions::Actions):
(JSC::B3::Air::LivenessAdapter::LivenessAdapter):
(JSC::B3::Air::LivenessAdapter::adapter):
(JSC::B3::Air::LivenessAdapter::prepareToCompute):
(JSC::B3::Air::LivenessAdapter::actionsAt):
(JSC::B3::Air::LivenessAdapter::forEachUse):
(JSC::B3::Air::LivenessAdapter::forEachDef):
(JSC::B3::Air::TmpLivenessAdapter::numIndices):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::UnifiedTmpLivenessAdapter):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::numIndices):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::acceptsBank):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::acceptsRole):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::valueToIndex):
(JSC::B3::Air::UnifiedTmpLivenessAdapter::indexToValue):

• b3/air/AirLivenessConstraints.h: Removed.
• b3/air/AirRegLiveness.h:

(JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):

• b3/air/AirTmp.cpp:
• b3/air/AirTmp.h:
• b3/air/AirTmpInlines.h:

(JSC::B3::Air::Tmp::LinearlyIndexed::LinearlyIndexed):
(JSC::B3::Air::Tmp::LinearlyIndexed::index):
(JSC::B3::Air::Tmp::linearlyIndexed):
(JSC::B3::Air::Tmp::indexEnd):
(JSC::B3::Air::Tmp::absoluteIndexEnd):
(JSC::B3::Air::Tmp::linearIndexEnd):
(JSC::B3::Air::Tmp::tmpForAbsoluteIndex):
(JSC::B3::Air::Tmp::tmpForLinearIndex):

• b3/air/AirTmpMap.h: Added.

(JSC::B3::Air::TmpMap::TmpMap):
(JSC::B3::Air::TmpMap::resize):
(JSC::B3::Air::TmpMap::clear):
(JSC::B3::Air::TmpMap::operator[]):
(JSC::B3::Air::TmpMap::append):

Source/WTF:

Have Liveness<> call Adapter::prepareToCompute(), since this makes it a lot easier to implement
constraint generation, since the constraint generator now gets to run after the Adapter is fully
constructed.

• wtf/IndexMap.h:

(WTF::IndexMap::append): Also make this a bit more versatile.

• wtf/Liveness.h:

(WTF::Liveness::LocalCalc::Iterable::contains):
(WTF::Liveness::Iterable::contains):
(WTF::Liveness::compute):

5:04 PM Changeset in webkit [215070] by Simon Fraser

• 7 edits
  5 adds in trunk

Throttle requestAnimationFrame in cross-origin iframes to 30fps
​https://bugs.webkit.org/show_bug.cgi?id=170534

Reviewed by Dan Bates.

Source/WebCore:

Add a throttling reason to ScriptedAnimationController which is NonInteractedCrossOriginFrame,
set on cross-origin iframes whose documents have never seen a user interaction. It's cleared
as soon as an interaction on this frame or a child frame is detected.

Move the initialization of the LowPowerMode throttling reason to Document::requestAnimationFrame(),
since it's more appropriate to compute NonInteractedCrossOriginFrame here than down in ScriptedAnimationController,
and best to do both in the same place.

Tests: http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html

• dom/Document.cpp:

(WebCore::Document::requestAnimationFrame):
(WebCore::Document::updateLastHandledUserGestureTimestamp):

• dom/Document.h:

(WebCore::Document::hasHadUserInteraction):

• dom/ScriptedAnimationController.cpp:

(WebCore::ScriptedAnimationController::ScriptedAnimationController):
(WebCore::throttlingReasonToString):
(WebCore::ScriptedAnimationController::interval):

• dom/ScriptedAnimationController.h:
• loader/FrameLoader.cpp:

(WebCore::shouldAskForNavigationConfirmation):

LayoutTests:

• http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe-expected.txt: Added.
• http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html: Added.
• http/tests/frame-throttling/resources/requestAnimationFrame-frame.html: Added.

5:01 PM Changeset in webkit [215069] by Simon Fraser

• 8 edits in trunk/Source/WebCore

Use the Accelerate framework to optimize FEColorMatrix operations
​https://bugs.webkit.org/show_bug.cgi?id=170518

Reviewed by Tim Horton.

On macOS and iOS, we can use the Accelerate framework (vImage) to do color matrix
math to optimize color matrix, hue rotate, saturation and luminosity to alpha filters.

Change ImageBuffer::getUnmultipliedImageData() and getPremultipliedImageData() to
return the size of the returned Uint8ClampedArray in physical pixels, because we
need to pass that to vImage.

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::getImageData):

• platform/graphics/ImageBuffer.h:
• platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBuffer::getUnmultipliedImageData):
(WebCore::ImageBuffer::getPremultipliedImageData):

• platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::getUnmultipliedImageData):
(WebCore::ImageBuffer::getPremultipliedImageData):

• platform/graphics/filters/FEColorMatrix.cpp:

(WebCore::effectApplyAccelerated):
(WebCore::effectType):
(WebCore::FEColorMatrix::platformApplySoftware):

• platform/graphics/filters/FEDropShadow.cpp:

(WebCore::FEDropShadow::platformApplySoftware):

• platform/graphics/win/ImageBufferDirect2D.cpp:

(WebCore::ImageBuffer::getUnmultipliedImageData):
(WebCore::ImageBuffer::getPremultipliedImageData):

5:01 PM Changeset in webkit [215068] by Simon Fraser

• 1 edit in trunk/Source/WebCore/ChangeLog

Do some minor FEColorMatrix code cleanup and optimization
​https://bugs.webkit.org/show_bug.cgi?id=170474

Reviewed by Dean Jackson.

Don't switch inside of a pixel processing loop; repeat the loop inside switch (filterType).

Change matrix() and saturateAndHueRotate() to dereference the source pixels once, instead
of multiple times, which is faster.

This kind of code benefits from aligning things with spaces for readability, so do so,
violating webkit style.

Add some off-by-default performance logging code.

Increases pixel processing performance from about 86ms per megapixel to 65ms per megapixel.

• platform/graphics/filters/FEColorMatrix.cpp:

(WebCore::matrix):
(WebCore::saturateAndHueRotate):
(WebCore::effectType):
(WebCore::FEColorMatrix::platformApplySoftware):

4:24 PM Changeset in webkit [215067] by Ryan Haddad

• 3 edits
  2 deletes in trunk

Unreviewed, rolling out r215041.

The LayoutTest for this change is failing on ios-simulator.

Reverted changeset:

"Rendering flexbox children across columns"
​https://bugs.webkit.org/show_bug.cgi?id=164166
​http://trac.webkit.org/changeset/215041

4:11 PM Changeset in webkit [215066] by Ryan Haddad

• 16 edits in trunk

Unreviewed, rolling out r215046.

This change broke internal builds.

Reverted changeset:

"WebRTC tests gardening"
​https://bugs.webkit.org/show_bug.cgi?id=170508
​http://trac.webkit.org/changeset/215046

3:58 PM Changeset in webkit [215065] by commit-queue@webkit.org

• 23 edits in trunk/Source

Web Inspector: Only Capture Extra Network Load Metrics when there is a Web Inspector Frontend
​https://bugs.webkit.org/show_bug.cgi?id=170525

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2017-04-06
Reviewed by Youenn Fablet.

Source/WebCore:

Covered by existing tests that when Web Inspector is open we enable collecting the extra data.

• inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::firstFrontendCreated):
(WebCore::InspectorInstrumentation::lastFrontendDeleted):

• inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::frontendCreated):
(WebCore::InspectorInstrumentation::frontendDeleted):
When the first frontend is created enable a new loader strategy to
collect extra network load metrics. When the last frontend is closed
disable the extra metrics.

• loader/LoaderStrategy.h:
• platform/PlatformStrategies.h:

New load strategy to enable/disable new metrics.

Source/WebKit:

• WebCoreSupport/WebResourceLoadScheduler.h:

Source/WebKit2:

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didFinishCollectingMetrics:]):
Only collect extra metrics if the WebProcess this load is for has enabled
collecting extra metrics.

• WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::setCaptureExtraNetworkLoadMetricsEnabled):

• WebProcess/Network/WebLoaderStrategy.h:
• NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::setCaptureExtraNetworkLoadMetricsEnabled):

• NetworkProcess/NetworkConnectionToWebProcess.h:

(WebKit::NetworkConnectionToWebProcess::captureExtraNetworkLoadMetricsEnabled):

• NetworkProcess/NetworkConnectionToWebProcess.messages.in:

New bool state toggled through the loader policy.

• NetworkProcess/NetworkDataTask.cpp:

(WebKit::NetworkDataTask::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTaskClient::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/NetworkLoad.h:
• NetworkProcess/NetworkLoadClient.h:

(WebKit::NetworkLoadClient::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/NetworkResourceLoader.h:
• NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::shouldCaptureExtraNetworkLoadMetrics):

• NetworkProcess/cache/NetworkCacheSpeculativeLoad.h:

Default handling for network loads is to not include extra data. Thread
client messages back from the NetworkLoads / SpeculativeLoads to check
the NetworkConnectionToWebProcess state on whether or not we should collect
extra metrics.

3:39 PM Changeset in webkit [215064] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Skip a test that was accidentally enabled with r214982.

Unreviewed test gardening.

• platform/ios/TestExpectations:

3:38 PM Changeset in webkit [215063] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit/mac

Obj-C bindings build fails with CSS_DEVICE_ADAPTATION turned on
​https://bugs.webkit.org/show_bug.cgi?id=170566

Reviewed by Simon Fraser.

• DOM/DOMCSS.mm:

(kitClass):
Use the WebCore-side enum for this, since that's actually what we're switching over.
This allows us to handle values here without adding them to the API header.
All of the other kitClass() functions work the same way.
Also, unindent for style purposes.

3:02 PM Changeset in webkit [215062] by Joseph Pecoraro

• 14 edits
  3 adds in trunk

Web Inspector: Show all headers in the Request Headers section of the Resource details sidebar
​https://bugs.webkit.org/show_bug.cgi?id=16531
<rdar://problem/5712895>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

• inspector/protocol/Network.json:

Optional refined list of request headers in Metrics.

Source/WebCore:

Test: http/tests/inspector/network/resource-request-headers.html

• loader/ResourceTiming.cpp:

(WebCore::ResourceTiming::ResourceTiming):
Eliminate unnecessary data from the NetworkLoadTiming object
when it is used for ResourceTiming. This clears up some memory
that will otherwise never be used.

• platform/network/NetworkLoadMetrics.h:

(WebCore::NetworkLoadMetrics::isolatedCopy):
(WebCore::NetworkLoadMetrics::reset):
(WebCore::NetworkLoadMetrics::clearNonTimingData):
(WebCore::NetworkLoadMetrics::operator==):
(WebCore::NetworkLoadMetrics::encode):
(WebCore::NetworkLoadMetrics::decode):
Include an optional HTTPHeaderMap for a refined list of
request headers for this network load.

• inspector/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::buildObjectForMetrics):
Include request headers with other optional metrics data
when the load is completed.

Source/WebInspectorUI:

• UserInterface/Models/Resource.js:

(WebInspector.Resource.prototype.updateWithMetrics):
Update request headers if provided in metrics.

Source/WebKit2:

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didFinishCollectingMetrics:]):
Include a complete list of the request headers sent for this load.
There may be headers that WebCore did not know about and developer
tools should be informed of.

LayoutTests:

• http/tests/inspector/network/resource-request-headers-expected.txt: Added.
• http/tests/inspector/network/resource-request-headers.html: Added.
• http/tests/inspector/network/resources/basic-auth.php: Added.

Test coverage for Cookie and Basic Authentication headers.

• platform/mac/TestExpectations:
• platform/mac-wk1/TestExpectations:
• platform/win/TestExpectations:

Mark the test as expected to fail on WebKit1 CFNetwork based platforms,
and ElCapitan which uses the legacy non-NSURLSession loading path.

2:56 PM Changeset in webkit [215061] by rniwa@webkit.org

• 21 edits
  1 add in trunk/Websites/perf.webkit.org

Each build request should be associated with a repository group
​https://bugs.webkit.org/show_bug.cgi?id=170528

Rubber-stamped by Chris Dumez.

Make the buildbot syncing script use the concept of repository groups so that each repository group can post
a different set of properties to buildbot. In order to do this, we associate each build request with
a repository group to use. Each triggerable's repository groups is now updated by the syncing scripts via
/api/update-triggerable just the same way the set of the supported platform, test pairs are updated.

Each repository group specifies the list of repositories, a dictionary that maps the buildbot property name
to either a string value or a repository name enclosed in < and >:

`js
"repositoryGroups": {

"webkit-svn": {

"repositories": ["WebKit", "macOS"],
"properties": {"os": "<macOS>", "wk": "<WebKit>"}

}

}
`

With this, removed the support for specifying a repository to use in generic dictionary of properties via
a dictionary with a single key of "root", "rootOptions", and "rootsExcluding". We now validate that the list of
repositories in each repository group matches exactly the ones used in buildbot properties as well as ones in
build requests.

After this patch, sync-with-buildbot.js will no longer schedule a build request without a repository group.
Run the appropriate database queries to set the repository group on each build request. Because of this change,
this patch also makes BuildbotTriggerable.prototype.syncOnce more robust against invalid build requests.
Instead of throwing an exception and exiting early, it simply skips all build requests that belong to the same
test group if the next build request to be scheduled does not specify a repository group.

• init-database.sql: Add request_repository_group column to build_requests table, and a unique constraint for

repository and group pair in triggerable_repositories table.

• public/api/update-triggerable.php:

(main): Validate and insert repository groups.
(validate_configurations): Extracted from main.
(validate_repository_groups): Added.

• public/v3/models/repository.js:

(Repository.findTopLevelByName): Added.

• public/include/build-requests-fetcher.php:

(BuildRequestsFetcher::results_internal): Include the repository group of each request in the JSON response.

• public/include/repository-group-finder.php: Added. A helper class to find the repository group for a given

triggerable for a list of repositories.
(RepositoryGroupFinder): Added.
(RepositoryGroupFinder::construct): Added.
(RepositoryGroupFinder::find_by_repositories): Added.
(RepositoryGroupFinder::populate_map): Added.

• public/privileged-api/create-test-group.php:

(main): Each element in an array returned by ensure_commit_sets and commit_sets_from_revision_sets now contains
"set", the list of commit IDs, and "repository_group", the repository group identified for each commit set.
Use that to set the repository group in each new build request.
(commit_sets_from_revision_sets): Use RepositoryGroupFinder to find the right repository group.
(ensure_commit_sets): Ditto. There is no need to find a repository group for each commit set here since its
argument is keyed by the repository name. e.g. {"WebKit": [123, 456], "macOS": ["16A323", "16A323"]}

• public/v3/models/build-request.js:

(BuildRequest):
(BuildRequest.prototype.triggerable): Added.
(BuildRequest.prototype.repositoryGroup): Added.
(BuildRequest.constructBuildRequestsFromData): Resolve the triggerable and the repository group.

• public/v3/models/triggerable.js:

(Triggerable.prototype.name): Added.
(Triggerable.prototype.acceptedRepositories): Deleted.
(TriggerableRepositoryGroup):
(TriggerableRepositoryGroup.prototype.accepts): Added. Retruns true if the repository group

• server-tests/api-build-requests-tests.js: Added a test for getting the repository group of a build request.
• server-tests/api-manifest-tests.js: Added assertions for the repository groups.
• server-tests/api-report-tests.js:

(.emptyReport):
(.reportWithTwoLevelsOfAggregations):

• server-tests/api-update-triggerable.js: Added test cases for updating the repository groups associated with

a triggerable.
(.updateWithOSXRepositoryGroup):
(.mapRepositoriesByGroup):

• server-tests/privileged-api-create-test-group-tests.js:

(addTriggerableAndCreateTask): Add two repository groups for testing. Added assertions for repository groups
in existing test cases, and added a test case for creating a test group with two different repository groups.

• server-tests/resources/mock-data.js:

(MockData.resetV3Models): Reset TriggerableRepositoryGroup's static maps.
(MockData.emptyTriggeragbleId): Added.
(MockData.macosRepositoryId): Added.
(MockData.webkitRepositoryId): Added.
(MockData.gitWebkitRepositoryId): Added.
(MockData.addMockData): Create repository groups as needed. Renamed the "OS X" repository to "macOS" since some
tests were using the latter, and now we need mock data to be consistent across tests due to stricter checks.
(MockData.addEmptyTriggerable): Added. Used in api-update-triggerable.js.
(MockData.addMockTestGroupWithGitWebKit): Added. Used in api-build-requests-tests.js.
(MockData.addAnotherMockTestGroup): Cleanup.
(MockData.mockTestSyncConfigWithSingleBuilder): Updated the mock configuration per code changes.
(MockData.mockTestSyncConfigWithTwoBuilders): Ditto.

• server-tests/tools-buildbot-triggerable-tests.js: Updated a test case testing /api/update-triggerable to test

updating the set of repository groups in addition to the set of test, platform pairs.
(.refetchManifest): Added.

• tools/js/buildbot-syncer.js:

(BuildbotSyncer): Now takes a set of configurations shared across syncers: repositoryGroups, slaveArgument,
and buildRequestArgument as the third argument.
(BuildbotSyncer.prototype.repositoryGroups): Added.
(BuildbotSyncer.prototype._testGroupMapForBuildRequests): Cleaned up the code to use Array.prototype.find.
Also added an assertion that the build request is associated with a repository group.
(BuildbotSyncer.prototype._propertiesForBuildRequest): Removed the support for using an arbitary property to
specify a revision in favor of explicity listing each property and repository name in a repository group.
(BuildbotSyncer._loadConfig): Removed the support for "shared", which specified the set of buildbot properties
shared across syncers, the name of properties which specifies the build slave name and build request ID. These
values are not stored as top-level properties and superseded by the concept of repository groups.
(BuildbotSyncer._parseRepositoryGroup): Parses and validates repository groups.
(BuildbotSyncer._createTestConfiguration): We no longer expect each configuration to specify a dictionary of
properties or buildRequestArgument (often inherited from shared).
(BuildbotSyncer._validateAndMergeConfig): Removed "slaveArgument" and "buildRequestArgument" from the list of
allowed proeprties in each configuration now that they're specified as top-level properties.

• tools/js/buildbot-triggerable.js:

(BuildbotTriggerable.prototype.updateTriggerable): Update the associated repository groups.
(BuildbotTriggerable.prototype.syncOnce): Skip test groups for which the next build request to be scheduled is
not included in the list of valid build requests.
(BuildbotTriggerable.prototype._validateRequests): Now returns the list of valid build requests, which excludes
those that lack a repository group set.
(BuildbotTriggerable.prototype._nextRequestInGroup): Extracted from _scheduleRequestIfSlaveIsAvailable. Finds
the next build request to be scheduled for the test group.
(BuildbotTriggerable.prototype._scheduleRequestIfSlaveIsAvailable): Renamed from
_scheduleNextRequestInGroupIfSlaveIsAvailable. Now takes the syncer and the slave name as arguments instead of
a test group information since syncOnce now calls _nextRequestInGroup to find the next build request.

• tools/js/v3-models.js:

• unit-tests/build-request-tests.js: Fixed the test name.

• unit-tests/buildbot-syncer-tests.js: Removed tests for "rootOptions" and "rootsExcluding", and added tests

for parsing repository groups.
(sampleiOSConfig): Updated the mock configuration per code changes.
(sampleiOSConfigWithExpansions): Ditto.
(smallConfiguration): Ditto. Now returns the entire configuration instead of a single builder configuration.
Various test cases have been updated to reflect this.
(createSampleBuildRequest): Removed the git hash of WebKit to match the repository groups listed in the mock
configurations. The git hash was there to test "rootOptions", which this patch removed.
(samplePendingBuild): Removed "root_dict" from the list of properties. This was used to test "rootsExcluding"
which, again, this patch removed.
(sampleInProgressBuild): Ditto.
(sampleFinishedBuild): Ditto.

• unit-tests/resources/mock-v3-models.js:

(MockModels.inject): Added ock repository groups so that existing tests will continue to function.

2:35 PM Changeset in webkit [215060] by andersca@apple.com

• 2 edits in trunk/Source/WebKit2

OptionSet options need to be powers of two
​https://bugs.webkit.org/show_bug.cgi?id=170565

Reviewed by Chris Dumez.

Change Cache::Option to be powers of two.

• NetworkProcess/cache/NetworkCache.h:

2:12 PM Changeset in webkit [215059] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebCore

Follow up to r209304, remove line numbers from one more StyleRule construction
​https://bugs.webkit.org/show_bug.cgi?id=170564

Reviewed by Simon Fraser.

• css/StyleRule.cpp:

(WebCore::StyleRuleViewport::StyleRuleViewport):
This one was missed in r209304.

2:11 PM Changeset in webkit [215058] by timothy_horton@apple.com

• 5 edits in trunk/Source/WebCore

Remove an unused member and constructor parameter from CSSPropertyParser
​https://bugs.webkit.org/show_bug.cgi?id=170562

Reviewed by Simon Fraser.

• css/parser/CSSParser.cpp:

(WebCore::CSSParser::parseSingleValue):
(WebCore::CSSParser::parseValueWithVariableReferences):

• css/parser/CSSParserImpl.cpp:

(WebCore::CSSParserImpl::consumeDeclarationValue):

• css/parser/CSSPropertyParser.cpp:

(WebCore::CSSPropertyParser::CSSPropertyParser):
(WebCore::CSSPropertyParser::parseValue):
(WebCore::CSSPropertyParser::parseSingleValue):

• css/parser/CSSPropertyParser.h:

It is possible to get Clang to complain about the unused member, though
I'm not sure why it doesn't in the build today.

1:58 PM Changeset in webkit [215057] by fpizlo@apple.com

• 2 edits in trunk/Source/JavaScriptCore

B3 -O1 should generate better code than -O0
​https://bugs.webkit.org/show_bug.cgi?id=170563

Reviewed by Michael Saboff.

Prior to this change, code generated by -O1 ran slower than code generated by -O0. This turned
out to be because of reduceStrength optimizations that increase live ranges and create register
pressure, which then creates problems for linear scan.

It seemed obvious that canonicalizations that help isel, constant folding, and one-for-one
strength reductions should stay. It also seemed obvious that SSA and CFG simplification are fast
and harmless. So, I focused on removing:

• CSE, which increases live ranges. This is a risky optimization when we know that we've chosen to use a bad register allocator.

• Sophisticated strength reductions that create more code, like the insane division optimization.

• Anything that inserts basic blocks.

CSE appeared to be the cause of half of the throughput regression of -O1 but none of the compile
time. This change also reduces the running time of reduceStrength by making it not a fixpoint at
optLevel<2.

This makes wasm -O1 compile 17% faster. This makes wasm -O1 run 19% faster. This makes -O1 code
run 3% faster than -O0, and compile about 4% slower than -O0. We may yet end up choosing to use
-O0, but at least now -O1 isn't totally useless.

• b3/B3ReduceStrength.cpp:

1:38 PM Changeset in webkit [215056] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

LayoutTest fast/mediastream/getUserMedia-webaudio.html is flaky
​https://bugs.webkit.org/show_bug.cgi?id=167513

Patch by Youenn Fablet <​youenn@apple.com> on 2017-04-06
Reviewed by Eric Carlson.

• fast/mediastream/getUserMedia-webaudio.html: Removing unecessary flaky check.

1:18 PM Changeset in webkit [215055] by akling@apple.com

• 3 edits in trunk/Source/WTF

Kill any WebContent process using over 16 GB of memory.
​https://bugs.webkit.org/show_bug.cgi?id=170515
<rdar://problem/29930931>

Reviewed by Antti Koivisto.

Restructure the code since it was getting out of sync with the intended behavior.
Now there's a thresholdForMemoryKill() which returns the current memory limit based
on the process status.

The memory usage policy is separated from the killing, and now only drives the
asynchronous invocations of pressure relief that occur when we pass over one of
the policy edges (now 1GB for Conservative, 2GB for Strict.)

Removed the "Panic" policy and moved the memory kill logic to shrinkOrDie().

Behavior as of this patch:

• Everyone gets killed over 16 GB.
• Inactive processes get killed over 4 GB.
• Strict memory usage policy kicks in at 2 GB.
• Conservative memory usage policy at 1 GB.

Like before, we make a best-effort attempt to free up memory before killing the process.

• wtf/MemoryPressureHandler.cpp:

(WTF::toString):
(WTF::MemoryPressureHandler::thresholdForMemoryKill):
(WTF::thresholdForPolicy):
(WTF::policyForFootprint):
(WTF::MemoryPressureHandler::shrinkOrDie):
(WTF::MemoryPressureHandler::setMemoryUsagePolicyBasedOnFootprint):
(WTF::MemoryPressureHandler::measurementTimerFired):

• wtf/MemoryPressureHandler.h:

1:03 PM Changeset in webkit [215054] by Alan Bujtas

• 7 edits
  2 adds in trunk

Simple line layout: Hittest always returns the first renderer in the block.
​https://bugs.webkit.org/show_bug.cgi?id=170520
<rdar://problem/30979175>

Reviewed by Antti Koivisto.

Source/WebCore:

This is incorrect now with <br> support (multiple renderers within the same block flow).

Test: fast/dom/Document/CaretRangeFromPoint/simple-line-layout-hittest-with-caret-range-from-point.html

• rendering/RenderText.cpp:

(WebCore::RenderText::positionForPoint): Related fix. We don't yet support positionForPoint with multiple renderes.

• rendering/SimpleLineLayoutFlowContents.h:

(WebCore::SimpleLineLayout::FlowContents::segmentForRun): Empty runs are all valid.

• rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::hitTestFlow):
(WebCore::SimpleLineLayout::collectFlowOverflow):

• rendering/SimpleLineLayoutResolver.cpp:

(WebCore::SimpleLineLayout::LineResolver::Iterator::operator*): This should eventually return a list of renderes.

• rendering/SimpleLineLayoutResolver.h:

(WebCore::SimpleLineLayout::RunResolver::flowContents):

LayoutTests:

• fast/dom/Document/CaretRangeFromPoint/simple-line-layout-hittest-with-caret-range-from-point-expected.html: Added.
• fast/dom/Document/CaretRangeFromPoint/simple-line-layout-hittest-with-caret-range-from-point.html: Added.

12:51 PM Changeset in webkit [215053] by Jon Davis

• 6 edits in trunk

Updates feature status for recently shipped features
​https://bugs.webkit.org/show_bug.cgi?id=170359

Reviewed by Brian Burg.
Source/JavaScriptCore:

Changed "Done" status to "Supported".

• features.json:

Source/WebCore:

Added missing Gamepad entry.
Changed "Done" status to "Supported".
Also changed status from "In Development" to "Supported" for:

• CSS Grid Layout Level 1
• CSS Inline Layout Module Level 3
• CSS Scroll Snap Points Module Level 1
• CSS Color Level 4
• Fetch API
• Indexed Database 2.0
• Media Capture and Streams
• Pointer Lock
• Preload
• Input Events

• features.json:

Websites/webkit.org:

Added styles for "Supported" status.

• wp-content/themes/webkit/status.php:

11:58 AM Changeset in webkit [215052] by bshafiei@apple.com

• 4 edits in branches/safari-604.1.14-branch/Source/WebCore

Merged r214930. rdar://problem/31445339

11:56 AM Changeset in webkit [215051] by jiewen_tan@apple.com

• 28 edits
  2 copies
  50 adds in trunk

[WebCrypto] Add support for AES-CTR
​https://bugs.webkit.org/show_bug.cgi?id=169761
<rdar://problem/31331321>

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

• web-platform-tests/WebCryptoAPI/derive_bits_keys/pbkdf2.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/derive_bits_keys/test_pbkdf2-expected.txt:
• web-platform-tests/WebCryptoAPI/encrypt_decrypt/aes_cbc.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/encrypt_decrypt/aes_ctr.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/encrypt_decrypt/test_aes_cbc-expected.txt:
• web-platform-tests/WebCryptoAPI/encrypt_decrypt/test_aes_ctr-expected.txt:
• web-platform-tests/WebCryptoAPI/generateKey/failures_AES-CTR.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/generateKey/successes_AES-CTR.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/generateKey/test_aes-ctr-expected.txt:
• web-platform-tests/WebCryptoAPI/generateKey/test_failures_AES-CTR-expected.txt:
• web-platform-tests/WebCryptoAPI/generateKey/test_successes_AES-CTR-expected.txt:
• web-platform-tests/WebCryptoAPI/import_export/symmetric_importKey.worker-expected.txt:
• web-platform-tests/WebCryptoAPI/import_export/test_symmetric_importKey-expected.txt:

Source/WebCore:

This patch adds support for AES-CTR. Operations of AES-CTR include: encrypt, decrypt, generateKey,
importKey, exportKey, wrapKey, and unwrapKey. This implementation follows the latest WebCryptoAPI
spec: ​https://www.w3.org/TR/WebCryptoAPI/#aes-ctr.

Tests: crypto/subtle/aes-ctr-encrypt-malformed-parameters.html

crypto/subtle/aes-ctr-encrypt-overflow.html
crypto/subtle/aes-ctr-generate-export-key-jwk-length-128.html
crypto/subtle/aes-ctr-generate-export-key-jwk-length-192.html
crypto/subtle/aes-ctr-generate-export-key-jwk-length-256.html
crypto/subtle/aes-ctr-generate-export-raw-key.html
crypto/subtle/aes-ctr-generate-key-encrypt-decrypt.html
crypto/subtle/aes-ctr-generate-key.html
crypto/subtle/aes-ctr-import-jwk-key-length-128.html
crypto/subtle/aes-ctr-import-jwk-key-length-192.html
crypto/subtle/aes-ctr-import-jwk-key-length-256.html
crypto/subtle/aes-ctr-import-key-decrypt.html
crypto/subtle/aes-ctr-import-key-encrypt.html
crypto/subtle/aes-ctr-import-key-unwrap-jwk-key.html
crypto/subtle/aes-ctr-import-key-unwrap-raw-key.html
crypto/subtle/aes-ctr-import-key-wrap-jwk-key.html
crypto/subtle/aes-ctr-import-key-wrap-raw-key.html
crypto/subtle/aes-ctr-import-raw-key.html
crypto/workers/subtle/aes-ctr-import-key-decrypt.html
crypto/workers/subtle/aes-ctr-import-key-encrypt.html
crypto/workers/subtle/aes-ctr-import-key-unwrap-key.html
crypto/workers/subtle/aes-ctr-import-key-wrap-key.html

• CMakeLists.txt:
• DerivedSources.make:
• PlatformGTK.cmake:
• PlatformMac.cmake:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/JSSubtleCryptoCustom.cpp:

(WebCore::normalizeCryptoAlgorithmParameters):

• crypto/CryptoAlgorithmParameters.h:
• crypto/algorithms/CryptoAlgorithmAES_CTR.cpp: Added.

(WebCore::usagesAreInvalidForCryptoAlgorithmAES_CTR):
(WebCore::parametersAreValid):
(WebCore::CryptoAlgorithmAES_CTR::create):
(WebCore::CryptoAlgorithmAES_CTR::identifier):
(WebCore::CryptoAlgorithmAES_CTR::encrypt):
(WebCore::CryptoAlgorithmAES_CTR::decrypt):
(WebCore::CryptoAlgorithmAES_CTR::generateKey):
(WebCore::CryptoAlgorithmAES_CTR::importKey):
(WebCore::CryptoAlgorithmAES_CTR::exportKey):
(WebCore::CryptoAlgorithmAES_CTR::getKeyLength):

• crypto/algorithms/CryptoAlgorithmAES_CTR.h: Added.
• crypto/gcrypt/CryptoAlgorithmAES_CTRGCrypt.cpp: Added.

(WebCore::CryptoAlgorithmAES_CTR::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CTR::platformDecrypt):

• crypto/mac/CryptoAlgorithmAES_CTRMac.cpp: Added.

(WebCore::bigIntegerToSize):
(WebCore::transformAES_CTR):
(WebCore::CryptoAlgorithmAES_CTR::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CTR::platformDecrypt):

• crypto/mac/CryptoAlgorithmRegistryMac.cpp:

(WebCore::CryptoAlgorithmRegistry::platformRegisterAlgorithms):

• crypto/parameters/AesCtrParams.idl: Added.
• crypto/parameters/CryptoAlgorithmAesCtrParams.h: Added.

LayoutTests:

• crypto/subtle/aes-ctr-encrypt-malformed-parameters-expected.txt: Added.
• crypto/subtle/aes-ctr-encrypt-malformed-parameters.html: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-128-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-128.html: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-192-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-192.html: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-256-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-export-key-jwk-length-256.html: Added.
• crypto/subtle/aes-ctr-generate-export-raw-key-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-export-raw-key.html: Added.
• crypto/subtle/aes-ctr-generate-key-encrypt-decrypt-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-key-encrypt-decrypt.html: Added.
• crypto/subtle/aes-ctr-generate-key-expected.txt: Added.
• crypto/subtle/aes-ctr-generate-key.html: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-128-expected.txt: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-128.html: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-192-expected.txt: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-192.html: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-256-expected.txt: Added.
• crypto/subtle/aes-ctr-import-jwk-key-length-256.html: Added.
• crypto/subtle/aes-ctr-import-key-decrypt-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-decrypt.html: Added.
• crypto/subtle/aes-ctr-import-key-encrypt-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-encrypt.html: Added.
• crypto/subtle/aes-ctr-import-key-unwrap-jwk-key-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-unwrap-jwk-key.html: Added.
• crypto/subtle/aes-ctr-import-key-unwrap-raw-key-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-unwrap-raw-key.html: Added.
• crypto/subtle/aes-ctr-import-key-wrap-jwk-key-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-wrap-jwk-key.html: Added.
• crypto/subtle/aes-ctr-import-key-wrap-raw-key-expected.txt: Added.
• crypto/subtle/aes-ctr-import-key-wrap-raw-key.html: Added.
• crypto/subtle/aes-ctr-import-raw-key-expected.txt: Added.
• crypto/subtle/aes-ctr-import-raw-key.html: Added.
• crypto/subtle/aes-generate-key-malformed-parameters-expected.txt:
• crypto/subtle/aes-generate-key-malformed-parameters.html:
• crypto/subtle/aes-import-key-malformed-parameters-expected.txt:
• crypto/subtle/aes-import-key-malformed-parameters.html:
• crypto/workers/subtle/aes-ctr-import-key-decrypt-expected.txt: Added.
• crypto/workers/subtle/aes-ctr-import-key-decrypt.html: Added.
• crypto/workers/subtle/aes-ctr-import-key-encrypt-expected.txt: Added.
• crypto/workers/subtle/aes-ctr-import-key-encrypt.html: Added.
• crypto/workers/subtle/aes-ctr-import-key-unwrap-key-expected.txt: Added.
• crypto/workers/subtle/aes-ctr-import-key-unwrap-key.html: Added.
• crypto/workers/subtle/aes-ctr-import-key-wrap-key-expected.txt: Added.
• crypto/workers/subtle/aes-ctr-import-key-wrap-key.html: Added.
• crypto/workers/subtle/resources/aes-ctr-import-key-decrypt.js: Added.
• crypto/workers/subtle/resources/aes-ctr-import-key-encrypt.js: Added.
• crypto/workers/subtle/resources/aes-ctr-import-key-unwrap-key.js: Added.
• crypto/workers/subtle/resources/aes-ctr-import-key-wrap-key.js: Added.

11:53 AM Changeset in webkit [215050] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Mark inspector/codemirror/prettyprinting-css-rules.html as flaky on release.
​https://bugs.webkit.org/show_bug.cgi?id=153460

Unreviewed test gardening.

• platform/mac/TestExpectations:

11:53 AM Changeset in webkit [215049] by commit-queue@webkit.org

• 2 edits in trunk/Source/ThirdParty/libwebrtc

WebRTC aborts when trying to sleep on a wrong thread
​https://bugs.webkit.org/show_bug.cgi?id=170492
<rdar://problem/31446377>

Patch by Youenn Fablet <​youenn@apple.com> on 2017-04-06
Reviewed by Eric Carlson.

Libwebrtc network thread is set up so that it does not accept blocking calls to other threads.
as per ChannelManager::Init() in channelmanager.cc.
But rtc::Thread::SleepMs expects to block it.
Marking thread as blockable before calling SleepMs and resetting the value if needed afterwards.

• Source/webrtc/media/sctp/sctptransport.cc:

11:52 AM Changeset in webkit [215048] by bshafiei@apple.com

• 7 edits in branches/safari-604.1.14-branch/Source

Versioning.

11:50 AM Changeset in webkit [215047] by Matt Baker

• 4 edits in trunk/Source/WebInspectorUI

Web Inspector: Reorder Debugger tab sidebar panels: Scope Chain, Resource, Probes
​https://bugs.webkit.org/show_bug.cgi?id=170418
<rdar://problem/31410771>

Reviewed by Timothy Hatcher.

Maintain the sidebar panel order defined by TabContentView when adding
and removing panels.

• UserInterface/Views/ContentBrowserTabContentView.js:

(WebInspector.ContentBrowserTabContentView.prototype.showDetailsSidebarPanels):
Insert sidebar panel based on the panel order defined by TabContentView.

• UserInterface/Views/DebuggerTabContentView.js:

(WebInspector.DebuggerTabContentView):

• UserInterface/Views/Sidebar.js:

(WebInspector.Sidebar.prototype.addSidebarPanel):
Implemented as an insert at the end.
(WebInspector.Sidebar.prototype.insertSidebarPanel):
Allow inserting into the sidebar panel collection.
(WebInspector.Sidebar.prototype.removeSidebarPanel):
Remove unused return value.

11:48 AM Changeset in webkit [215046] by commit-queue@webkit.org

• 16 edits in trunk

WebRTC tests gardening
​https://bugs.webkit.org/show_bug.cgi?id=170508

Patch by Youenn Fablet <​youenn@apple.com> on 2017-04-06
Reviewed by Eric Carlson.

Source/JavaScriptCore:

• Configurations/FeatureDefines.xcconfig:

Source/WebCore:

• Configurations/FeatureDefines.xcconfig: Changing webrtc enabling for ios.

Source/WebCore/PAL:

• Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

• Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

• Configurations/FeatureDefines.xcconfig:

Tools:

• TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

LayoutTests:

• platform/ios-wk1/TestExpectations:
• platform/ios-wk2/TestExpectations:
• platform/ios/TestExpectations:

11:35 AM Changeset in webkit [215045] by akling@apple.com

• 2 edits in trunk/Source/WebCore

Stop forcing CA commit when memory pressure changes.
​https://bugs.webkit.org/show_bug.cgi?id=170522
<rdar://problem/31460236>

Reviewed by Antti Koivisto.

Don't force a CA commit when reaching critical memory pressure. We're already doing a ton
of work in response to the pressure, and this was really a hack to try to react quickly on
512 MB devices which we don't support anymore.

• page/MemoryRelease.cpp:

(WebCore::releaseCriticalMemory):

11:32 AM Changeset in webkit [215044] by Antti Koivisto

• 9 edits in trunk

Implement testing mode for disk cache
​https://bugs.webkit.org/show_bug.cgi?id=170547

Reviewed by Andreas Kling.

Source/WebKit2:

Disable read timeouts and cache shrinking in TestRunner to eliminate potential sources of randomness.

Cache directories are deleted by TestRunner so lack of shrinking does not consume the disk.

This is enabled by the existing WKContextUseTestingNetworkSession SPI.

• NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::initialize):

• NetworkProcess/cache/NetworkCache.h:
• NetworkProcess/cache/NetworkCacheStorage.cpp:

(WebKit::NetworkCache::Storage::open):
(WebKit::NetworkCache::Storage::Storage):
(WebKit::NetworkCache::Storage::dispatchReadOperation):
(WebKit::NetworkCache::Storage::shrinkIfNeeded):

• NetworkProcess/cache/NetworkCacheStorage.h:
• NetworkProcess/cocoa/NetworkProcessCocoa.mm:

(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):

LayoutTests:

Enable a few disabled tests to see how it goes.

• platform/mac-wk2/TestExpectations:

10:25 AM Changeset in webkit [215043] by commit-queue@webkit.org

• 6 edits in trunk

[Readable Streams API] Implement ReadableStreamBYOBRequest respondWithNewView()
​https://bugs.webkit.org/show_bug.cgi?id=170339

Patch by Romain Bellessort <​romain.bellessort@crf.canon.fr> on 2017-04-06
Reviewed by Youenn Fablet.

Source/WebCore:

Implemented ReadableStreamBYOBRequest respondWithNewView().

Added new tests to check respondWithNewView() behaviour.

• Modules/streams/ReadableByteStreamInternals.js:

(readableByteStreamControllerRespondWithNewView): Added.

• Modules/streams/ReadableStreamBYOBRequest.js:

(respondWithNewView): Updated.

LayoutTests:

Added new tests addressing respondWithNewView() behaviour.

• streams/readable-stream-byob-request-expected.txt: Updated.
• streams/readable-stream-byob-request.js: Added new tests.

10:20 AM Changeset in webkit [215042] by eric.carlson@apple.com

• 2 edits in trunk/Source/WebCore

[MediaStream] Host application should be able to mute and unmute media streams
​https://bugs.webkit.org/show_bug.cgi?id=170519
<rdar://problem/31174326>

Unreviewed, fix crash introduced in r214980.

• Modules/mediastream/MediaStream.cpp:

(WebCore::MediaStream::MediaStream): NULL-check page.

9:44 AM Changeset in webkit [215041] by hyatt@apple.com

• 3 edits
  2 adds in trunk

Rendering flexbox children across columns
​https://bugs.webkit.org/show_bug.cgi?id=164166
<rdar://problem/29055587>

Reviewed by Zalan Bujtas.

Source/WebCore:

Added fast/multicol/flexbox-rows.html.

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::adjustForUnsplittableChild):
Treat block-level flexboxes that occur inside block flows the same as replaced
and unsplittable elements and push them to the next page if they don't fit. We don't
update the minimum page height though, since the flexbox is not really unsplittable.

LayoutTests:

• fast/multicol/flexbox-rows-expected.html: Added.
• fast/multicol/flexbox-rows.html: Added.

9:39 AM Changeset in webkit [215040] by Chris Dumez

• 3 edits in trunk/Source/WebKit2

[WK2] Add C private API to toggle invisibleAutoplayNotPermitted setting
​https://bugs.webkit.org/show_bug.cgi?id=170524
<rdar://problem/31461472>

Reviewed by Eric Carlson.

Add C private API to toggle invisibleAutoplayNotPermitted setting.

• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetInvisibleMediaAutoplayPermitted):
(WKPreferencesGetInvisibleMediaAutoplayPermitted):

• UIProcess/API/C/WKPreferencesRefPrivate.h:

8:58 AM Changeset in webkit [215039] by Jonathan Bedard

• 2 edits in trunk/Tools

REGRESSION: Simulators failing to install after launch_app times out
<rdar://problem/31478107>

Unreviewed infrastructure fix.

• Scripts/webkitpy/xcode/simulated_device.py:

(SimulatedDevice.launch_app._install_timeout): Raise RuntimeError, not Exception.

8:23 AM Changeset in webkit [215038] by commit-queue@webkit.org

• 3 edits in trunk/Source/JavaScriptCore

[JSC][MIPS][DFG] Use x86 generic HasOwnProperty
​https://bugs.webkit.org/show_bug.cgi?id=170222

Patch by Guillaume Emont <​guijemont@igalia.com> on 2017-04-06
Reviewed by Yusuke Suzuki.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
use the X86 special version for HasOwnProperty on MIPS too.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
use the X86 special version for HasOwnProperty on MIPS too.

8:01 AM Changeset in webkit [215037] by Carlos Garcia Campos

• 1 copy in releases/WebKitGTK/webkit-2.14.6

WebKitGTK+ 2.14.6

8:01 AM Changeset in webkit [215036] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.14

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.14.6 release.

.:

• Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

• gtk/NEWS: Add release notes for 2.14.6.

6:02 AM Changeset in webkit [215035] by Carlos Garcia Campos

• 8 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r214283 - [GTK] Honor GTK+ font settings
​https://bugs.webkit.org/show_bug.cgi?id=82889

Reviewed by Carlos Garcia Campos.

After much discussion with Behdad and Martin (who is still not completely convinced I think
:) I want to merge cairo font options into the Fontconfig pattern used for rendering using
cairo_ft_font_options_substitute(). This is how the API was designed to be used anyway.
Fontconfig will still have final say over whether to actually respect the desktop settings
or not, so it can still choose to ignore the desktop's settings, but I don't think it makes
sense to have desktop-wide font settings and not tell Fontconfig about them, especially when
the whole point of WebKitGTK+ is desktop integration. This should also reduce complaints
that we're not following desktop settings and that we're drawing fonts differently than
Firefox.

• PlatformGTK.cmake:
• platform/graphics/cairo/CairoUtilities.cpp:

(WebCore::getDefaultCairoFontOptions):

• platform/graphics/cairo/CairoUtilities.h:
• platform/graphics/freetype/FontCacheFreeType.cpp:

(WebCore::createFontConfigPatternForCharacters):
(WebCore::strongAliasesForFamily):
(WebCore::FontCache::createFontPlatformData):

• platform/graphics/freetype/FontPlatformDataFreeType.cpp:

(WebCore::getDefaultFontconfigOptions):
(WebCore::getDefaultCairoFontOptions): Deleted.

• platform/graphics/gtk/GdkCairoUtilities.cpp:

(getDefaultCairoFontOptions):

5:56 AM Changeset in webkit [215034] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r214246 - [Soup] "Only from websites I visit" cookie policy is broken
​https://bugs.webkit.org/show_bug.cgi?id=168912

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Do not reset the first party for cookies on redirects. That's properly done for the main
resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
wrong (which is what we were doing since r143931).

The most notable effect was that subresources loaded via redirects were effectively
bypassing the "no third party" policy for cookies.

Test: http/tests/security/cookies/third-party-cookie-blocking-redirect.html

• platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::doRedirect):

Source/WebKit2:

Do not reset the first party for cookies on redirects. That's properly done for the main
resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
wrong (which is what we were doing since r143931).

The most notable effect was that subresources loaded via redirects were effectively
bypassing the "no third party" policy for cookies.

• NetworkProcess/soup/NetworkDataTaskSoup.cpp:

(WebKit::NetworkDataTaskSoup::continueHTTPRedirection):

LayoutTests:

• http/tests/security/cookies/third-party-cookie-blocking-redirect-expected.txt: Added.
• http/tests/security/cookies/third-party-cookie-blocking-redirect.html: Added.

5:53 AM Changeset in webkit [215033] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r214162 - [Cairo] Ensure depth and stencil renderbuffers are created on GLESv2
​https://bugs.webkit.org/show_bug.cgi?id=166643

Patch by Emanuele Aina <Emanuele Aina> on 2017-03-20
Reviewed by Darin Adler.

If the gfx device doesn't support GL_OES_packed_depth_stencil, the
separate depth and stencil buffers are not generated.

Copy what GraphicsContext3DEfl used to do and apply it in
GraphicsContext3DCairo.

The Intel gfx driver seem to tolerate unbound renderbuffers, but
enabling debugging in Mesa yields an error:

$ MESA_DEBUG=1 \

MESA_EXTENSION_OVERRIDE=-GL_OES_packed_depth_stencil
./bin/MiniBrowser ​http://webglsamples.org/aquarium/aquarium.html

Mesa: User error: GL_INVALID_OPERATION in glRenderbufferStorage(no renderbuffer bound)

• platform/graphics/GraphicsContext3D.h:
• platform/graphics/cairo/GraphicsContext3DCairo.cpp:

(WebCore::GraphicsContext3D::GraphicsContext3D):
Ensure separate depth and stencil renderbuffers are created.
(WebCore::GraphicsContext3D::~GraphicsContext3D):
Ensure separate depth and stencil renderbuffers are released.

5:51 AM Changeset in webkit [215032] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r214100 - [Cairo] Handle the blend mode in GraphicsContext::drawPattern
​https://bugs.webkit.org/show_bug.cgi?id=169746

Reviewed by Žan Doberšek.

We are not taking into account the blend mode when passing the cairo operator to drawPatternToCairoContext().
This is based on patch by Žan Doberšek, just adding the toCairoOperator changes to make it easier to handle
it. Instead of checking everywhere if blend mode is Normal to decide whether to use toCairoOperator with
CompositeOperator or BlendMode, there's no a single toCairoOperator that receives both parameters, but BlendMode
is optional and defaults to Normal.

• platform/graphics/cairo/CairoUtilities.cpp:

(WebCore::toCairoCompositeOperator):
(WebCore::toCairoOperator):

• platform/graphics/cairo/CairoUtilities.h:
• platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::setPlatformCompositeOperation):
(WebCore::GraphicsContext::drawPattern):

5:50 AM Changeset in webkit [215031] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212431 - [GTK] scroll with transparent background not repainted after scrollY >= 32768
​https://bugs.webkit.org/show_bug.cgi?id=154283

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Due to a limitation of the pixman backend, which uses 16 bits to hold signed integers, cairo is
not able to draw anything when using transformation matrices with values bigger than 32768. When
drawing patterns into large pages, the matrices values can overflow those 16 bits, so cairo doesn't
draw anything in, which causes the reported transparent backgrounds.

The patch modifies the transformation matrices both from the current context and the pattern we
are painting, to avoid them to hold values that cannot stored in 16 bits.

There's still the possibility that this happens, but it would require using a pattern with a size
bigger than 32768.

Based on a previous patch by Gwang Yoon Hwang <​yoon@igalia.com>.

Test: fast/backgrounds/background-repeat-long-scroll.html

• platform/graphics/cairo/CairoUtilities.cpp:

(WebCore::drawPatternToCairoContext):

LayoutTests:

Test to ensure that the background pattern of an element is properly being drawn when it's in a position
bigger than 32768.

• fast/backgrounds/background-repeat-long-scroll-expected.html: Added.
• fast/backgrounds/background-repeat-long-scroll.html: Added.

5:48 AM Changeset in webkit [215030] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r213522 - ShadowBlur::calculateLayerBoundingRect doesn't need to return the enclosingIntRect of layerRect
​https://bugs.webkit.org/show_bug.cgi?id=168650

Patch by Fujii Hironori <Fujii Hironori> on 2017-03-07
Reviewed by Simon Fraser.

No new tests, no behavior change.

• platform/graphics/ShadowBlur.h: Change the type of return value

from IntRect to IntSize.

• platform/graphics/ShadowBlur.cpp:

(WebCore::ShadowBlur::calculateLayerBoundingRect): Ditto.
(WebCore::ShadowBlur::drawRectShadow): Rename a variable layerRect layerSize.
(WebCore::ShadowBlur::drawInsetShadow): Ditto.
(WebCore::ShadowBlur::drawRectShadowWithoutTiling): Ditto.
(WebCore::ShadowBlur::drawInsetShadowWithoutTiling): Ditto.
(WebCore::ShadowBlur::beginShadowLayer): Ditto.

5:45 AM Changeset in webkit [215029] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r213276 - [GTK] Crash in WebCore::CoordinatedGraphicsLayer::notifyFlushRequired
​https://bugs.webkit.org/show_bug.cgi?id=166420

Reviewed by Žan Doberšek.

This is happening when closing a page that is being inspected. When CoordinatedGraphicsLayer::removeFromParent()
is called, the coordinator has already been invalidated, so all its layers were set a nullptr coordinator. I
think it's safe to simply handle m_coordinator being nullptr in notifyFlushRequired().

• platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::notifyFlushRequired): Return early if the coordinator is nullptr.

5:44 AM Changeset in webkit [215028] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore

Merge r213275 - Incorrect RELEASE_ASSERT in JSGlobalObject::addStaticGlobals()
​https://bugs.webkit.org/show_bug.cgi?id=169034

Reviewed by Mark Lam.

It should not assign to offset, but compare to offset.

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::addStaticGlobals):

5:43 AM Changeset in webkit [215027] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.14

Merge r213224 - [GTK] fast/canvas/canvas-createPattern-video-loading.html makes its subsequent test timeout
​https://bugs.webkit.org/show_bug.cgi?id=169019

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

The timeout happens normally when the media player is deleted and the pipeline state is set to NULL. The call to
gst_element_set_state() never returns because of different deadlocks with the video sink. Sometimes the deadlock
happens with the sample mutex used by VideoRenderRequestScheduler. VideoRenderRequestScheduler::requestRender()
calls webkitVideoSinkRepaintRequested() with the lock held, that ends up calling
MediaPlayerPrivateGStreamerBase::triggerRepaint(). When rendering can't be accelerated the draw timer is
scheduled and triggerRepaint blocks until the timer is fired. If the media player is destroyed before the timer
is fired, when setting the pipeline state to NULL, other VideoRenderRequestScheduler methods can be called, like
stop() that tries to get the sample mutex that is still held by requestRender(). So, first we need to make
sure that requestRender() releases the lock before calling webkitVideoSinkRepaintRequested(). But that's not
enough, we also need to ensure that the pipeline is set to NULL state after everyting has been properly
stopped. This is currently done in ~MediaPlayerPrivateGStreamer that happens before
~MediaPlayerPrivateGStreamerBase, so gst_element_set_state() is hanging before allowing the
MediaPlayerPrivateGStreamerBase to be cleaned up. We should move the call to the end of
~MediaPlayerPrivateGStreamerBase and ensure the draw timer and mutex are properly cleaned up before.

Fixes: fast/canvas/canvas-createPattern-video-loading.html

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer): Do not reset pipeline here.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase): Stop the draw mutex and notify the
lock to ensure we unblock. Do the pipeline reset at the end.

• platform/graphics/gstreamer/VideoSinkGStreamer.cpp:

(VideoRenderRequestScheduler::requestRender): Release the mutex lock before calling webkitVideoSinkRepaintRequested().

LayoutTests:

Unskip tests previously skipped because of this timeout.

• platform/gtk/TestExpectations:

5:39 AM Changeset in webkit [215026] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r213219 - [Cairo] Incorrectly determining height in GraphicsContext::roundToDevicePixels()
​https://bugs.webkit.org/show_bug.cgi?id=169031

Reviewed by Carlos Garcia Campos.

We should compare if height is between -1 and 0 and not mixing height
and width together.

• platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::roundToDevicePixels):

5:38 AM Changeset in webkit [215025] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r212968 - [GTK] WebkitWebProcess crashes on exit on nvidia if threaded compositing is enabled
​https://bugs.webkit.org/show_bug.cgi?id=165522

Reviewed by Carlos Garcia Campos.

Before destrying a GLContextGLX we need to set the default framebufer to avoid a bug
in some nvidia drivers. Ensure that we set the context as current before performing
that operation, and set the appropriate current context after doing so.

No new tests.

• platform/graphics/glx/GLContextGLX.cpp:

(WebCore::GLContextGLX::~GLContextGLX):

5:37 AM Changeset in webkit [215024] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.14/Source/WebKit2

Merge r212891 - [GTK] Crash attempting to load Flash plugin in Wayland
​https://bugs.webkit.org/show_bug.cgi?id=163159

Reviewed by Michael Catanzaro.

The problem is that we check if the current diplay is X11 or Wayland also in the plugin process, but with GTK2
plugins the display is always X11. We should early reject plugins requiring GTK2 in the UI process when the
current display is Wayland.

• UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp:

(WebKit::PluginInfoStore::getPluginInfo):

• UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:

(WebKit::PluginProcessProxy::scanPlugin):

• UIProcess/gtk/WebPageProxyGtk.cpp:

(WebKit::WebPageProxy::createPluginContainer): Add an assert to ensure this message is never received on a
non-X11 display.

• WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::createPluginContainer): Never send CreatePluginContainer message to the UI process if the
display is not X11.

5:35 AM Changeset in webkit [215023] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r212889 - [GStreamer] Several layout tests trigger GStreamer-CRITICAL : gst_bin_get_by_name: assertion 'GST_IS_BIN (bin)' failed
​https://bugs.webkit.org/show_bug.cgi?id=167016

Reviewed by Xabier Rodriguez-Calvar.

This is because we create AudioSourceProviderGStreamer objects that are never loaded. In the destructor the
AudioSourceProviderGStreamer calls gst_bin_get_by_name() on its m_audioSinkBin that is nullptr. We could simply
check m_audioSinkBin in the destructor, but I think it's better to simply not create
AudioSourceProviderGStreamer for nothing. MediaPlayerPrivateGStreamer should create the AudioSourceProvider on demand.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer): Do not create the AudioSourceProvider.
(WebCore::MediaPlayerPrivateGStreamer::createAudioSink): Call ensureAudioSourceProvider() before using m_audioSourceProvider.
(WebCore::MediaPlayerPrivateGStreamer::ensureAudioSourceProvider): Create the AudioSourceProvider if needed.
(WebCore::MediaPlayerPrivateGStreamer::audioSourceProvider): Ensure and return the m_audioSourceProvider.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:

5:33 AM Changeset in webkit [215022] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebKit2

Merge r213638 - Correctly process the return value of gdk_drag_context_get_selected_action()

Reviewed by Carlos Garcia Campos.

It returns the action itself and not the bitmask.

• UIProcess/gtk/DragAndDropHandler.cpp:

(WebKit::DragAndDropHandler::drop):

5:33 AM Changeset in webkit [215021] by Carlos Garcia Campos

• 7 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212881 - [GTK] Drag and drop is always moving the content even if copy is requested
​https://bugs.webkit.org/show_bug.cgi?id=168424

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Drag and drop is always moving the content around even if the copy is
requested (i.e. by pressing the Control key).

Test: editing/pasteboard/drag-drop-copy-content.html

• page/gtk/DragControllerGtk.cpp:

(WebCore::DragController::isCopyKeyDown):

Source/WebKit2:

Drag and drop is always moving the content around even if the copy is
requested (i.e. by pressing the Control key).

• UIProcess/gtk/DragAndDropHandler.cpp:

(WebKit::DragAndDropHandler::drop):

LayoutTests:

Mark the editing/pasteboard/drag-drop-copy-content.html as failing
as WTR doesn't know how to perform drag and drop in WK2. Also the
test does not pass on the mac WK1, created a bug for it.

• platform/efl/TestExpectations:
• platform/gtk-wayland/TestExpectations:
• platform/gtk/TestExpectations:
• platform/mac-wk2/TestExpectations:
• platform/mac/TestExpectations:

5:29 AM Changeset in webkit [215020] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.14/Source/WebKit2

Merge r213060 - [GTK] Flickering when leaving accelerated compositing mode
​https://bugs.webkit.org/show_bug.cgi?id=168911

Reviewed by Žan Doberšek.

It doesn't always happen, and it's too fast, more noticeable in websites with a dark background, because we are
drawing a single white frame. This happens when we leave AC mode during the layer flush that schedules an update
on the compositor, which at that point only clears the area and renders nothing. However,
CoordinatedGraphicsScene::paintToCurrentGLContext() always renders a white background when no web view color has
been set. And that's the white frame we get. We could prevent that last update from happening by checking if we
still have a graphics root layer after syncDisplayState() in the layer flush, the same way we check the layer
tree host is still valid.

• WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h:
• WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:

(WebKit::CoordinatedLayerTreeHost::layerFlushTimerFired):

5:28 AM Changeset in webkit [215019] by Carlos Garcia Campos

• 3 edits in releases/WebKitGTK/webkit-2.14/Source/WebKit2

Merge r213061 - [GTK] Rendering artifacts when resizing the window in X11 with AC mode enabled
​https://bugs.webkit.org/show_bug.cgi?id=168728

Reviewed by Žan Doberšek.

This happens because the pixmap we create from the redirected window is uninitialized until the threaded
compositor renders into it. We should always initialize the pixmap right after it's created.

• WebProcess/WebPage/gtk/AcceleratedSurfaceX11.cpp:

(WebKit::defaultVisual): Helper static method to get the default GdkVisual.
(WebKit::AcceleratedSurfaceX11::AcceleratedSurfaceX11): Use createPixmap().
(WebKit::AcceleratedSurfaceX11::createPixmap): Create and initialize the pixmap.
(WebKit::AcceleratedSurfaceX11::resize): Use createPixmap().

• WebProcess/WebPage/gtk/AcceleratedSurfaceX11.h:

5:24 AM Changeset in webkit [215018] by Carlos Garcia Campos

• 7 edits
  1 add in releases/WebKitGTK/webkit-2.14/Source/WebKit2

Merge r213030 - [GTK] Hangs when showing Google search results
​https://bugs.webkit.org/show_bug.cgi?id=168699

Reviewed by Žan Doberšek.

Connection::sendOutgoingMessage() can poll forever if sendmsg fails with EAGAIN or EWOULDBLOCK. For example if
socket read buffers are full, poll will be blocked until we read the pending data, but we can't read because
the thread is blocked in the poll. In case of EAGAIN/EWOULDBLOCK we should poll using the run loop, to allow
reads to happen in thread while we wait for the socket to be writable again. In the GTK+ port we use
GSocketMonitor to poll socket file descriptor without blocking, using the run loop. This patch renames the
socket monitor as readSocketMonitor and adds another one for polling output. When sendmsg fails with
EAGAIN/EWOULDBLOCK, the pending message is saved and the write monitor starts polling. Once the socket is
writable again we send the pending message. Helper class MessageInfo and a new one UnixMessage have been moved
to its own header file to be able to use std::unique_ptr member to save the pending message.

• Platform/IPC/Connection.cpp: Include UnixMessage.h as required by std::unique_ptr.
• Platform/IPC/Connection.h: Add write socket monitor and also keep the GSocket as a member to reuse it.
• Platform/IPC/glib/GSocketMonitor.cpp: Use Function instead of std::function.

(IPC::GSocketMonitor::start):

• Platform/IPC/glib/GSocketMonitor.h:
• Platform/IPC/unix/ConnectionUnix.cpp:

(IPC::Connection::platformInitialize): Initialize the GSocket here since we rely on it to take the ownership of
the descriptor. We were leaking it if the connection was invalidated without being opened.
(IPC::Connection::platformInvalidate): Destroy the GSocket even when not connected. Also stop the write monitor.
(IPC::Connection::processMessage):
(IPC::Connection::open):
(IPC::Connection::platformCanSendOutgoingMessages): Return false if we have a pending message to ensure
Connection doesn't try to send more messages until the pending message is dispatched. We don't need to check
m_isConnected because the caller already checks that.
(IPC::Connection::sendOutgoingMessage): Split it in two. This creates and prepares a UnixMessage and then calls
sendOutputMessage() to do the rest.
(IPC::Connection::sendOutputMessage): Send the message, or save it if sendmsg fails with EAGAIN or EWOULDBLOCK
to be sent later when the socket is writable.

• Platform/IPC/unix/UnixMessage.h: Added.

(IPC::MessageInfo::MessageInfo):
(IPC::MessageInfo::setMessageBodyIsOutOfLine):
(IPC::MessageInfo::isMessageBodyIsOutOfLine):
(IPC::MessageInfo::bodySize):
(IPC::MessageInfo::attachmentCount):
(IPC::UnixMessage::UnixMessage):
(IPC::UnixMessage::~UnixMessage):
(IPC::UnixMessage::attachments):
(IPC::UnixMessage::messageInfo):
(IPC::UnixMessage::body):
(IPC::UnixMessage::bodySize):
(IPC::UnixMessage::appendAttachment):

• PlatformGTK.cmake:

4:23 AM Changeset in webkit [215017] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212026 - Crash under FormSubmission::create()
​https://bugs.webkit.org/show_bug.cgi?id=167200
<rdar://problem/30096323>

Patch by Chris Dumez <Chris Dumez> on 2017-02-09
Reviewed by Darin Adler.

Source/WebCore:

The issue is that FormSubmission::create() was iterating over
form.associatedElements() as was calling Element::appendFormData()
in the loop. HTMLObjectElement::appendFormData() was calling
pluginWidget(PluginLoadingPolicy::Load) which causes a synchronous
layout and can fire events (such as focus event) synchronously.
Firing those events synchronously allows the JS to modify the
form.associatedElements() vector we are currently iterating on.

To avoid this issue, we now call pluginWidget(PluginLoadingPolicy::DoNotLoad)
in HTMLObjectElement::appendFormData() as we are not allowed to fire
synchronous events at this point. I also added a security assertion
in FormSubmission::create() to catch cases where we fire JS events
while iterating over the form associated elements to more easily
notice these things in the future.

Test: fast/forms/formsubmission-appendFormData-crash.html

• html/HTMLObjectElement.cpp:

(WebCore::HTMLObjectElement::appendFormData):

• loader/FormSubmission.cpp:

(WebCore::FormSubmission::create):

LayoutTests:

Add layout test coverage.

• fast/forms/formsubmission-appendFormData-crash-expected.txt: Added.
• fast/forms/formsubmission-appendFormData-crash.html: Added.

3:46 AM Changeset in webkit [215016] by Carlos Garcia Campos

• 3 edits
  1 add in releases/WebKitGTK/webkit-2.14

Merge r212022 - B3::Procedure::deleteOrphans() should neutralize upsilons with dead phis.
​https://bugs.webkit.org/show_bug.cgi?id=167437
<rdar://problem/30198083>

Patch by Mark Lam <​mark.lam@apple.com> on 2017-02-09
Reviewed by Filip Pizlo.

JSTests:

• stress/b3-delete-orphans-should-neutralize-upsilons-with-dead-phis.js: Added.

Source/JavaScriptCore:

• b3/B3Procedure.cpp:

(JSC::B3::Procedure::deleteOrphans):

3:42 AM Changeset in webkit [215015] by Carlos Garcia Campos

• 6 edits
  6 adds in releases/WebKitGTK/webkit-2.14

Merge r212621 - REGRESSION(r212218): Assertion failures in and after parserRemoveChild
​https://bugs.webkit.org/show_bug.cgi?id=168458

Reviewed by Antti Koivisto.

Source/WebCore:

The bug was caused by parserRemoveChild not preceeding to remove oldChild even when
oldChild had been inserted elsewhere during unload evnets of the disconnected frames.
Fixed the bug by checking this condition and exiting early.

Also fixed various callers of parserRemoveChild to not call parserAppendChild when
the removed node had already been inserted elsewhere by scripts.

Tests: fast/parser/adoption-agency-unload-iframe-3.html

fast/parser/adoption-agency-unload-iframe-4.html
fast/parser/xml-error-unload-iframe.html

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::parserRemoveChild): Exit early when the node had been
inserted elsewhere while firing unload events. Also moved the call to
notifyRemovePendingSheetIfNeeded outside NoEventDispatchAssertion since it can
synchrnously fire a focus event.
(WebCore::ContainerNode::parserAppendChild): Moved adoptNode call to inside
NoEventDispatchAssertion since adoptNode call here should never mutate DOM.

• html/parser/HTMLConstructionSite.cpp:

(WebCore::executeReparentTask): Added an early exit when the node had already been
inserted elsewhere.
(WebCore::executeInsertAlreadyParsedChildTask): Ditto.

• xml/XMLErrors.cpp:

(WebCore::XMLErrors::insertErrorMessageBlock): Ditto.

• xml/parser/XMLDocumentParser.cpp:

(WebCore::XMLDocumentParser::end): Fixed a crash unveiled by one of the test cases.
Exit early when insertErrorMessageBlock detached the parser (by author scripts).
(WebCore::XMLDocumentParser::finish): Keep the parser alive until we exit.

LayoutTests:

Add tests to make sure parserAppendChild aren't called when a node removed by parserRemoveChild
had already been been inserted elsewhere by scripts.

• fast/parser/adoption-agency-unload-iframe-3-expected.txt: Added.
• fast/parser/adoption-agency-unload-iframe-3.html: Added.
• fast/parser/adoption-agency-unload-iframe-4-expected.txt: Added.
• fast/parser/adoption-agency-unload-iframe-4.html: Added.
• fast/parser/xml-error-unload-iframe-expected.txt: Added.
• fast/parser/xml-error-unload-iframe.html: Added.

3:42 AM Changeset in webkit [215014] by Carlos Garcia Campos

• 5 edits
  6 adds in releases/WebKitGTK/webkit-2.14

Merge r212218 - parserRemoveChild should unload subframes
​https://bugs.webkit.org/show_bug.cgi?id=168151

Reviewed by Darin Adler.

Source/WebCore:

Fix the bug that the adoption agency algorithm does not unload subframes as it disconnects nodes.

Also moved calls to nodeWillBeRemoved inside NoEventDispatchAssertion to expand on r211965.

Tests: fast/parser/adoption-agency-clear-focus-range.html

fast/parser/adoption-agency-unload-iframe-1.html
fast/parser/adoption-agency-unload-iframe-2.html

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::takeAllChildrenFrom): Rewritten using idioms used in removeChildren and parserAppendChild.

Disconnect all subframes first since this can synchronously dispatch an unload event. Then update DOM ranges,
the focused element, and other states in the document.

Second, use the regular removeBetween, notifyChildNodeRemoved, childrenChanged sequence of calls to disconnect nodes
instead of a single call to removeDetachedChildren to properly disconnect child nodes since those nodes may have
already come live due to execution of synchronous scripts prior to the adoption agency algorithm has run, or in
response to the unload event we just dispatched.

Third, append these nodes using parserAppendChild to avoid dispatching mutation events.

(WebCore::willRemoveChild): Removed the call to nodeWillBeRemoved. It's now called within NoEventDispatchAssertion
in each call site of willRemoveChild and willRemoveChildren.
(WebCore::willRemoveChildren): Ditto.
(WebCore::ContainerNode::removeChild): Call nodeWillBeRemoved inside NoEventDispatchAssertion.
(WebCore::ContainerNode::replaceAllChildren): Call nodeWillBeRemoved inside NoEventDispatchAssertion.
(WebCore::ContainerNode::parserRemoveChild): Disconnect subframes and update document's states.

• html/parser/HTMLConstructionSite.cpp:

(WebCore::executeTakeAllChildrenAndReparentTask): Add a release assert that new parent does not already have a parent.

LayoutTests:

Add two W3C-style testharness tests for unloading iframes inside the adoption agency algorithm.

Also added a test to make sure ContainerNode::takeAllChildrenFrom adjusts the focused element and DOM ranges.

• fast/css/stylesheet-candidate-nodes-crash-expected.txt: Rebaselined. The difference comes from the fact

iframe now is unloaded in parserRemoveChild as expected and then reloaded in parserAppendChild inside
insertErrorMessageBlock as opposed to after the parser had completed as if the iframe had never been detached.

• fast/parser/adoption-agency-clear-focus-range-expected.txt: Added.
• fast/parser/adoption-agency-clear-focus-range.html: Added.
• fast/parser/adoption-agency-unload-iframe-1-expected.txt: Added.
• fast/parser/adoption-agency-unload-iframe-1.html: Added.
• fast/parser/adoption-agency-unload-iframe-2-expected.txt: Added.
• fast/parser/adoption-agency-unload-iframe-2.html: Added.

3:42 AM Changeset in webkit [215013] by Carlos Garcia Campos

• 7 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r211256 - Revert r210474 it is no longer needed
​https://bugs.webkit.org/show_bug.cgi?id=167487

Reviewed by Daniel Bates.

Revert r210474 it is no longer needed after r211254.

• dom/Document.cpp:

(WebCore::Document::canNavigate):

• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick):

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::handleClick):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::urlSelected):
(WebCore::FrameLoader::submitForm):
(WebCore::FrameLoader::loadFrameRequest):

• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::defaultEventHandler):

• svg/SVGAElement.cpp:

(WebCore::SVGAElement::defaultEventHandler):

3:13 AM Changeset in webkit [215012] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212214 - REGRESSION (r179497): Crash inside setAttributeNode
​https://bugs.webkit.org/show_bug.cgi?id=168161
<rdar://problem/30451581>

Reviewed by Andreas Kling.

Source/WebCore:

The bug was caused by setAttributeNode calling setAttributeInternal with the same element data as the one used
to call removeAttributeInternal despite of the fact removeAttributeInternal could have invoked arbitrary scripts
and mutated element's m_elementData.

Fixed the bug by calling with setAttributeInternal with the result of new invocation of ensureUniqueElementData().

Test: fast/dom/Attr/make-unique-element-data-while-replacing-attr.html

• dom/Element.cpp:

(WebCore::Element::setAttributeNode):

LayoutTests:

Added a regression test.

• fast/dom/Attr/make-unique-element-data-while-replacing-attr-expected.txt: Added.
• fast/dom/Attr/make-unique-element-data-while-replacing-attr.html: Added.

3:09 AM Changeset in webkit [215011] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212029 - Make sure Event keeps its current target element alive
​https://bugs.webkit.org/show_bug.cgi?id=167885
<rdar://problem/30376972>

Patch by Chris Dumez <Chris Dumez> on 2017-02-09
Reviewed by Brent Fulgham.

Source/WebCore:

Make sure Event keeps its current target element alive to avoid
crashes if it is accessed by JS after it has been garbage collected.

Test: fast/events/currentTarget-gc-crash.html

• dom/Event.cpp:

(WebCore::Event::setCurrentTarget):

• dom/Event.h:

(WebCore::Event::currentTarget):

LayoutTests:

Add layout test reproducing the crash.

• fast/events/currentTarget-gc-crash-expected.txt: Added.
• fast/events/currentTarget-gc-crash.html: Added.

3:04 AM Changeset in webkit [215010] by Carlos Garcia Campos

• 6 edits
  4 adds in releases/WebKitGTK/webkit-2.14

Merge r212028 - Crash in render tree after dynamically mutating the slot value
​https://bugs.webkit.org/show_bug.cgi?id=167502

Patch by Ryosuke Niwa <​rniwa@webkit.org> on 2017-02-09
Reviewed by Antti Koivisto.

Source/WebCore:

The crash was caused by attributeChanged not destructing the render tree after an assigned element had been
removed from its slot. Since the style resolver can no longer find this element in the flat tree, we need to
delete its render object as if the element had been removed from the DOM tree.

Tests: fast/html/details-summary-slot.html

fast/shadow-dom/shadow-slot-attribute-change-crash.html

• dom/Element.cpp:

(WebCore::Element::attributeChanged):

• html/HTMLSummaryElement.cpp:

(WebCore::SummarySlotElement): Added. Always use the default slot regardless of the slot attribute's value.
(WebCore::HTMLSummaryElement::create): Use SummarySlotElement

LayoutTests:

Added regression tests for the crash, and one for assigning non-empty slot value to a child
of a summary element. The slot attribute should always be ignored since the fact summary
element has its own shadow tree is an implementation detail that should never be exposed.

• fast/html/details-summary-slot-expected.html: Added.
• fast/html/details-summary-slot.html: Added.
• fast/shadow-dom/shadow-slot-attribute-change-crash-expected.txt: Added.
• fast/shadow-dom/shadow-slot-attribute-change-crash.html: Added.

2:58 AM Changeset in webkit [215009] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit2

[GTK] Fix build with MEDIA_CAPTURE enabled
​https://bugs.webkit.org/show_bug.cgi?id=170539

Patch by Adrian Perez de Castro <Adrian Perez de Castro> on 2017-04-06
Reviewed by Carlos Garcia Campos.

• WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDeprecated.cpp:

(webkit_dom_html_input_element_get_capture): Add missing namespace in usage of WebCore::MediaCaptureTypeNone.

2:49 AM Changeset in webkit [215008] by Carlos Garcia Campos

• 3 edits
  4 adds in releases/WebKitGTK/webkit-2.14

Merge r212027 - Details element doesn't work correctly when mutating content between closing and opening
​https://bugs.webkit.org/show_bug.cgi?id=167310

Patch by Antti Koivisto <Antti Koivisto> on 2017-02-09
Reviewed by Ryosuke Niwa.

Source/WebCore:

Tests: fast/html/details-close-modify-open.html

fast/shadow-dom/slot-remove-mutate-add.html

• dom/SlotAssignment.cpp:

(WebCore::SlotAssignment::didChangeSlot):

Always reset the slot assignment when content is mutated.

LayoutTests:

• fast/html/details-close-modify-open-expected.html: Added.
• fast/html/details-close-modify-open.html: Added.
• fast/shadow-dom/slot-remove-mutate-add-expected.html: Added.
• fast/shadow-dom/slot-remove-mutate-add.html: Added.

2:46 AM Changeset in webkit [215007] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r212025 - Crash under HTMLFormElement::registerFormElement()
​https://bugs.webkit.org/show_bug.cgi?id=167162

Patch by Chris Dumez <Chris Dumez> on 2017-02-09
Reviewed by Ryosuke Niwa.

Source/WebCore:

didMoveToNewDocument() was re-registering FormAttributeTargetObserver
even if the element's inDocument was not set yet. As a result, it was
possible for FormAssociatedElement::resetFormOwner() to be called
when the element was in the tree but with its inDocument still being
false (because insertedInto() has not been called yet). This could
end up calling HTMLFormElement::registerFormElement() even though
the element is still recognized as detached. This is an issue because
HTMLFormElement::m_associatedElements's order and its corresponding
indexes (m_associatedElementsBeforeIndex / m_associatedElementsAfterIndex)
rely on the position of the element with regards to the form element
(before / inside / after).

To address the issue, we now only register the FormAttributeTargetObserver
in didMoveToNewDocument() if the inDocument flag is set to true. This
is similar to what is done at other call sites of
resetFormAttributeTargetObserver(). We also ignore the form content
attribute in HTMLFormElement::formElementIndex() if the element is
not connected.

As per the HTML specification [1], the form content attribute is only
taken if the element is connected (i.e. inDocument flag is true).

Note that FormAssociatedElement::findAssociatedForm() was already
ignoring the form content attribute if the element is disconnected.

[1] ​https://html.spec.whatwg.org/#reset-the-form-owner (step 3)

Test: fast/forms/registerFormElement-crash.html

• html/FormAssociatedElement.cpp:

(WebCore::FormAssociatedElement::didMoveToNewDocument):
Only call resetFormAttributeTargetObserver() if inDocument flag is set,
similarly to what is done at other call sites.

(WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):
Add an assertion to make sure no one call this method on an element that
is not connected.

• html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::formElementIndex):
Ignore the form content attribute if the element is not connected, as
per the HTML specification [1].

LayoutTests:

Add layout test coverage.

• fast/forms/registerFormElement-crash-expected.txt: Added.
• fast/forms/registerFormElement-crash.html: Added.

2:43 AM Changeset in webkit [215006] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14

Merge r212023 - Handle synchronous layout when setting a selection range
​https://bugs.webkit.org/show_bug.cgi?id=167092
<rdar://problem/30041640>

Reviewed by Antti Koivisto.

Source/WebCore:

The 'innerTextElement' of a form control can change during layout due
to arbitrary JavaScript executing. Handle the case where the inner text
element has changed so that current render box height is while setting
a selection range.

Test: fast/forms/input-type-change-during-selection.html

• html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::setSelectionRange):

LayoutTests:

• fast/forms/input-type-change-during-selection-expected.txt: Added.
• fast/forms/input-type-change-during-selection.html: Added.

2:35 AM Changeset in webkit [215005] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/LayoutTests

Merge r212020 - Unreviewed, fix test for new .caller with native code caller semantics.

• js/dom/function-dot-arguments-and-caller.html:

2:35 AM Changeset in webkit [215004] by Carlos Garcia Campos

• 3 edits
  1 add in releases/WebKitGTK/webkit-2.14

Merge r212009 - We should not allow Function.caller to be used on native functions
​https://bugs.webkit.org/show_bug.cgi?id=165628

Patch by Keith Miller <​keith_miller@apple.com> on 2017-02-09
Reviewed by Mark Lam.

JSTests:

• stress/caller-native-code.js: Added.

(f):

Source/JavaScriptCore:

Also remove unneeded dynamic cast.

• runtime/JSFunction.cpp:

(JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
(JSC::JSFunction::callerGetter):

2:31 AM Changeset in webkit [215003] by Carlos Garcia Campos

• 23 edits
  4 adds in releases/WebKitGTK/webkit-2.14

Merge r211965 - Adopting a child node of a script element can run script
​https://bugs.webkit.org/show_bug.cgi?id=167318

Patch by Ryosuke Niwa <​rniwa@webkit.org> on 2017-02-09
Reviewed by Darin Adler.

Source/WebCore:

The bug was caused by ScriptElement::childrenChanged indiscriminately running the script.
Do this only if some node has been inserted as spec'ed:

​https://html.spec.whatwg.org/multipage/scripting.html#script-processing-model
"The script element is connected and a node or document fragment is inserted into
the script element, after any script elements inserted at that time."

Split NonContentsChildChanged into NonContentsChildInserted and NonContentsChildRemoved to disambiguate
non-contents child such as text and element being removed or inserted. New behavior matches that of
Gecko and Chrome as well as the latest HTML5 specification.

Also deploy NoEventDispatchAssertion in more places. Unfortunately, this results in some DOM trees
internal to WebKit to be mutated while there is NoEventDispatchAssertion in the stack. Added a new RAII
object "EventAllowedScope" to temporarily disable this assertion within such a tree. CachedSVGFont's
ensureCustomFontData used to completely disable this assertion but we no longer have to do this either.

To clarify the new semantics, renamed isEventDispatchForbidden to isEventAllowedInMainThread with
the negated boolean value, and added a new variant isEventDispatchAllowedInSubtree, which checks
isEventDispatchForbidden() is true or if the node was one of an internal DOM node or its descendent
held by EventAllowedScope.

Inspired by ​https://chromium.googlesource.com/chromium/src/+/604e798ec6ee30f44d57a5c4a44ce3dab3a871ed

Tests: fast/html/script-must-not-run-when-child-is-adopted.html

fast/html/script-must-not-run-when-child-is-removed.html

• dom/CharacterData.cpp:

(WebCore::CharacterData::notifyParentAfterChange): Added NoEventDispatchAssertion.

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::insertBefore): Added NoEventDispatchAssertion around TreeScope's adoptIfNeeded
and insertBeforeCommon as done elsewhere.
(WebCore::ContainerNode::appendChildCommon): Added NoEventDispatchAssertion.
(WebCore::ContainerNode::changeForChildInsertion): Use NonContentsChildInserted here.
(WebCore::ContainerNode::notifyChildRemoved): Added NoEventDispatchAssertion.
(WebCore::ContainerNode::replaceChild): Moved adoptIfNeeded into NoEventDispatchAssertion.
(WebCore::ContainerNode::removeChild): Added NoEventDispatchAssertion.
(WebCore::ContainerNode::parserRemoveChild): Added NoEventDispatchAssertion.
(WebCore::ContainerNode::removeChildren): Call childrenChanged in NoEventDispatchAssertion.
(WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck): Moved adoptIfNeeded into
NoEventDispatchAssertion.
(WebCore::dispatchChildInsertionEvents): Check the forbidden-ness more precisely.
(WebCore::dispatchChildRemovalEvents): Ditto.

• dom/ContainerNode.h:

(WebCore::ContainerNode::ChildChange::isInsertion): Added.

• dom/ContainerNodeAlgorithms.cpp:

(WebCore::notifyChildNodeInserted): Check the forbidden-ness more precisely. Here, we check against
insertionPoint since EventAllowedScope checks against the root node.

• dom/Document.cpp:

(WebCore::Document::adoptNode): Assert the node to be adopted has not been inserted back, or else
remove() had resulted in an exception before calling TreeScope::adoptIfNeeded.

• dom/Element.cpp:

(WebCore::Element::childrenChanged):

• dom/NoEventDispatchAssertion.h:

(WebCore::NoEventDispatchAssertion::isEventDispatchForbidden): Added a new variant that takes a node.
If this node is a descendent of a node "marked as safe" by EventAllowedScope, then we don't consider
the event dispatch to be forbidden.
(WebCore::NoEventDispatchAssertion::dropTemporarily): Deleted.
(WebCore::NoEventDispatchAssertion::restoreDropped): Deleted.
(WebCore::NoEventDispatchAssertion::EventAllowedScope): Added. A RAII object which marks descendants of
a given node as "safe" for the purpose of checking isEventDispatchForbidden.
(WebCore::NoEventDispatchAssertion::EventAllowedScope::EventAllowedScope): Added. There can be a chain
of EventAllowedScope objects in the stack. s_currentScope points to the most recently instantiated
RAII object, and each instance remembers prior instance.
(WebCore::NoEventDispatchAssertion::EventAllowedScope::~EventAllowedScope): Added.
(WebCore::NoEventDispatchAssertion::EventAllowedScope::isAllowedNode): Added. Returns true if the given
node is a descendent of any node held by instances of EventAllowedScope.
(WebCore::NoEventDispatchAssertion::EventAllowedScope::isAllowedNodeInternal): Added. A helper function
for isAllowedNode.

• dom/Node.cpp:

(WebCore::Node::dispatchSubtreeModifiedEvent): Check the forbidden-ness more precisely.

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::childrenChanged): Only prepare the script if we've inserted nodes.
(WebCore::ScriptElement::executeClassicScript): Assert isEventDispatchForbidden is false since running
arbitrary author scripts can, indeed, result dispatch any events.

• dom/ScriptElement.h:
• html/HTMLElement.cpp:

(WebCore::textToFragment): Made this a static local function and not return an exception since there
is no way appendChild called in this function can throw an exception.
(WebCore::HTMLElement::setInnerText): Create EventAllowedScope for the fragment. It's called called by
HTMLTextAreaElement's childrenChanged to update its UA shadow tree, and it's dispatching as event on
a new fragment can't execute arbitrary scripts since it has never been exposed to author scripts.
Because of the precise-ness of this check, this does not disable the assertion for "this" element.
HTMLTextFormControlElement::setInnerTextValue explicitly creates another EventAllowedScope to mark
the shadow tree into which the fragment is inserted safe.
(WebCore::HTMLElement::setOuterText):

• html/HTMLElement.h:
• html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::childrenChanged):

• html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::setInnerTextValue): See above (setInnerText).

• html/track/VTTCue.cpp:

(WebCore::VTTCue::createCueRenderingTree): Create EventAllowedScope for the cloned fragment here since
the VTT tree is never exposed to author scripts.
(WebCore::VTTCue::updateDisplayTree): Ditto.

• loader/cache/CachedSVGFont.cpp:

(WebCore::CachedSVGFont::ensureCustomFontData): Use EventAllowedScope to disable assertions only on
the new SVG document we just created instead of disabling for all DOM trees.

• svg/SVGScriptElement.cpp:

(WebCore::SVGScriptElement::childrenChanged):

LayoutTests:

Added regression tests for adopting or removing a child node of a script element.
The script must not run when nodes are adopted or removed.

• fast/html/script-must-not-run-when-child-is-adopted-expected.txt: Added.
• fast/html/script-must-not-run-when-child-is-adopted.html: Added.
• fast/html/script-must-not-run-when-child-is-removed-expected.txt: Added.
• fast/html/script-must-not-run-when-child-is-removed.html: Added.

1:28 AM Changeset in webkit [215002] by Carlos Garcia Campos

• 4 edits
  2 adds in releases/WebKitGTK/webkit-2.14

Merge r211201 - Crash under DOMSelection::deleteFromDocument()
​https://bugs.webkit.org/show_bug.cgi?id=167232

Reviewed by Chris Dumez.

Source/WebCore:

The crash was caused by DOMSelection's deleteFromDocument() mutating contents inside the user-agent
shadow tree of an input element when the text field is readonly. Fixed the bug by exiting early
whenever the selection is inside a shadow tree since getSelection().getRangeAt(0) always returns
a range outside the input element or any shadow tree for that matter.

New behavior matches that of Gecko. The working draft spec of which I'm the editor states that
deleteFromDocument() must invoke Range's deleteContents() on the associated range, which is
the collapsed range returned by getSelection().getRangeAt(0) in the spec:
​https://www.w3.org/TR/2016/WD-selection-api-20160921/#widl-Selection-deleteFromDocument-void
And Range's deleteContents() immediately terminates in step 1 when start and end are identical:
​https://dom.spec.whatwg.org/commit-snapshots/6b7621282c2e3b222ac585650e484abf4c0a416b/

Note that Range's DOM mutating methods are not available inside an user-agent shadow tree because
WebKit never returns a Range whose end boundary points are inside the tree to author scripts.
Editing commands (ones executable from document.execCommand) that mutate DOM like this check whether
the content is editable or not. Since VisibleSelection's validate() function makes sure the selection
is either entirely within or outside of an root editable element (editing host in the W3C spec lingo),
editing commands should never mutate a random node inside an user-agent shadow tree.

Test: editing/selection/deleteFromDocument-shadow-tree-crash.html

• page/DOMSelection.cpp:

(WebCore::DOMSelection::deleteFromDocument):

LayoutTests:

Based on a patch by Chris Dumez. Add a regression test and rebaseline a Blink test as WebKit's
new behavior matches that of Gecko instead of Blink.

• editing/selection/deleteFromDocument-shadow-tree-crash-expected.txt: Added.
• editing/selection/deleteFromDocument-shadow-tree-crash.html: Added.
• imported/blink/editing/selection/deleteFromDocument-crash-expected.html:

1:24 AM Changeset in webkit [215001] by nael.ouedraogo@crf.canon.fr

• 2 edits in trunk

[GTK] Build fails when using icecream, ccache and cmake 3.6
​https://bugs.webkit.org/show_bug.cgi?id=170498

Reviewed by Michael Catanzaro.

Disable ninja response file when using icecream, ccache and cmake > 3.5.

• Source/cmake/OptionsCommon.cmake:

1:23 AM Changeset in webkit [215000] by Carlos Garcia Campos

• 7 edits
  1 add in releases/WebKitGTK/webkit-2.14

Merge r210837 - Nested parenthesized regular expressions with non-zero minimum counts appear to hang and use lots of memory
​https://bugs.webkit.org/show_bug.cgi?id=167125

Reviewed by Filip Pizlo.

JSTests:

• microbenchmarks/regexp-nested-nonzero-min-counted-parens.js: Added.

New test with limits that run slow and take a reasonable amount of memory
before the change and run fast, using little memory with the change.

Source/JavaScriptCore:

Changed Yarr to handle nested parenthesized subexpressions where the minimum count is
not 0 directly in the Yarr interpreter. Previously we'd factor an expression like
(a|b)+ into (a|b)(a|b)* with special handling for captures. This factoring was done
using a deep copy that doubled the size of the resulting expresion for each nested
parenthesized subexpression. Now the Yarr interpreter can directly process a regexp
like (a|b){2,42}.

The parser will allow one level of nested, non-zero minimum, counted parenthesis using
the old copy method. After one level, it will generate parenthesis terms with a non-zero
minimum. Such an expression wasn't handled by the Yarr JIT before the change, so this
change isn't a performance regression.

Added a minimum count to the YarrPattern and ByteTerm classes, and then factored that
minimum into the interpreter. A non-zero minimum is only handled by the Yarr interpreter.
If the Yarr JIT see such a term, it punts back to the interpreter.

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::backtrackPatternCharacter):
(JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
(JSC::Yarr::Interpreter::matchCharacterClass):
(JSC::Yarr::Interpreter::backtrackCharacterClass):
(JSC::Yarr::Interpreter::matchBackReference):
(JSC::Yarr::Interpreter::backtrackBackReference):
(JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
(JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
(JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
(JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
(JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
(JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
(JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
(JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
(JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
(JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
(JSC::Yarr::Interpreter::matchParentheses):
(JSC::Yarr::Interpreter::backtrackParentheses):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::ByteCompiler::atomPatternCharacter):
(JSC::Yarr::ByteCompiler::atomCharacterClass):
(JSC::Yarr::ByteCompiler::atomBackReference):
(JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
(JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
(JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
(JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
(JSC::Yarr::ByteCompiler::emitDisjunction):

• yarr/YarrInterpreter.h:

(JSC::Yarr::ByteTerm::ByteTerm):

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
(JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
(JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
(JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
(JSC::Yarr::YarrGenerator::generateTerm):
(JSC::Yarr::YarrGenerator::backtrackTerm):
(JSC::Yarr::YarrGenerator::generate):
(JSC::Yarr::YarrGenerator::backtrack):
(JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):

• yarr/YarrPattern.cpp:

(JSC::Yarr::YarrPatternConstructor::copyTerm):
(JSC::Yarr::YarrPatternConstructor::quantifyAtom):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::YarrPattern::YarrPattern):

• yarr/YarrPattern.h:

(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternTerm::quantify):
(JSC::Yarr::YarrPattern::reset):

1:05 AM Changeset in webkit [214999] by Carlos Garcia Campos

• 9 edits in releases/WebKitGTK/webkit-2.14/Source

Merge r210822 - Crash when closing tab with debugger paused
​https://bugs.webkit.org/show_bug.cgi?id=161746
<rdar://problem/15607819>

Reviewed by Brian Burg and Brent Fulgham.

Source/WebCore:

• page/Page.h:

(WebCore::Page::incrementNestedRunLoopCount):
(WebCore::Page::decrementNestedRunLoopCount):
(WebCore::Page::insideNestedRunLoop):
Keep track of whether or not this Page is inside of a nested run loop.
Currently the only nested run loop we know about is EventLoop used
by Web Inspector when debugging JavaScript.

(WebCore::Page::whenUnnested):
Callback that can be called when we are no longer inside of a nested
run loop.

(WebCore::Page::~Page):
Ensure we are not in a known nested run loop when destructing, since
that could be unsafe.

• inspector/PageScriptDebugServer.cpp:

(WebCore::PageScriptDebugServer::runEventLoopWhilePausedInternal):
Increment and decrement as we go into or leave the nested runloop.

• inspector/InspectorController.cpp:

(WebCore::InspectorController::inspectedPageDestroyed):
(WebCore::InspectorController::disconnectAllFrontends):
Rework destruction to allow disconnectAllFrontends to happen earlier
if necessary. WebKit clients may use this to disconnect remote
frontends when closing a Page.

Source/WebKit/mac:

• WebView/WebView.mm:

(WebKit::DeferredPageDestructor::createDeferredPageDestructor):
(WebKit::DeferredPageDestructor::DeferredPageDestructor):
(WebKit::DeferredPageDestructor::tryDestruction):
(-[WebView _close]):
Defer destruction of the Page if we are in a nested runloop.

Source/WebKit2:

• WebProcess/WebPage/WebPage.cpp:

(WebKit::DeferredPageDestructor::createDeferredPageDestructor):
(WebKit::DeferredPageDestructor::DeferredPageDestructor):
(WebKit::DeferredPageDestructor::tryDestruction):
(WebKit::WebPage::close):
Defer destruction of the Page and WebPage if we are in a nested runloop.
Also, proactively close all inspector frontends, including remote frontends.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::handleSyntheticClick):
(WebKit::WebPage::completeSyntheticClick):
Return early in some cases where a nested run loop may have closed
the WebPage on us while handling JavaScript events.

12:38 AM Changeset in webkit [214998] by Carlos Garcia Campos

• 7 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r210474 - Ensure navigation only allowed for documents not in the page cache
​https://bugs.webkit.org/show_bug.cgi?id=166773
<rdar://problem/29762809>

Reviewed by Brent Fulgham.

It is wise to ensure that navigation is only allowed when initiated from a document that
is not in- or about to be put in- the page cache. Such a navigation would surprise a
person that had navigated away from the initiating document among other issues.

• dom/Document.cpp:

(WebCore::Document::canNavigate): Only allow navigation if the document is not in the
page cache.

• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick): Ditto.

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::handleClick): Ditto.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::urlSelected): Assert triggering event's document is not in the
page cache.
(WebCore::FrameLoader::submitForm): Allow submission if the document is not in the
page cache.
(WebCore::FrameLoader::loadFrameRequest): Assert triggering event's document is not in
the page cache.

• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::defaultEventHandler): Only allow navigation if the document is
not in the page cache.

• svg/SVGAElement.cpp:

(WebCore::SVGAElement::defaultEventHandler): Ditto.

12:34 AM Changeset in webkit [214997] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.14/Source/WebCore

Merge r210508 - Evaluating window named element may return wrong result
​https://bugs.webkit.org/show_bug.cgi?id=166792
<rdar://problem/29801059>

Reviewed by Chris Dumez.

• bindings/js/JSDOMWindowProperties.cpp:

(WebCore::jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter):

12:32 AM Changeset in webkit [214996] by Carlos Garcia Campos

• 6 edits
  3 adds in releases/WebKitGTK/webkit-2.14

Merge r210468 - Regression(r189230): DOM Callbacks may use wrong global object
​https://bugs.webkit.org/show_bug.cgi?id=166784

Reviewed by Mark Lam.

Source/WebCore:

DOM Callbacks could end up using the wrong global object after r189230
because we were getting the globalObject from the callback object
instead of the one at the point the callback object was passed in by
JavaScript. This patch fixes the issue.

Test: fast/frames/frame-window-as-callback.html

• bindings/js/JSCallbackData.cpp:

(WebCore::JSCallbackData::invokeCallback):

• bindings/js/JSCallbackData.h:

(WebCore::JSCallbackData::globalObject):
(WebCore::JSCallbackData::JSCallbackData):
(WebCore::JSCallbackDataStrong::JSCallbackDataStrong):
(WebCore::JSCallbackDataStrong::callback):
(WebCore::JSCallbackDataStrong::invokeCallback):
(WebCore::JSCallbackDataWeak::JSCallbackDataWeak):
(WebCore::JSCallbackDataWeak::callback):
(WebCore::JSCallbackDataWeak::invokeCallback):

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateCallbackImplementationContent):

LayoutTests:

Add layout test coverage.

• fast/frames/frame-window-as-callback-expected.txt: Added.
• fast/frames/frame-window-as-callback.html: Added.
• fast/frames/resources/wrong-global-object.html: Added.