Timeline

May 21, 2017:

11:57 PM Changeset in webkit [217206] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit2

Add more input validation in Connection::readBytesFromSocket()
​https://bugs.webkit.org/show_bug.cgi?id=171871

Reviewed by Michael Catanzaro.

Check the control message length is in the limits. Credit to Nathan Crandall for reporting this issue and
submitting an equivalent fix.

• Platform/IPC/unix/ConnectionUnix.cpp:

(IPC::readBytesFromSocket):

11:55 PM Changeset in webkit [217205] by pvollan@apple.com

• 2 edits in trunk/LayoutTests

Unreviewed Windows test gardening, skip tests which are timing out.

• platform/win/TestExpectations:

11:30 PM Changeset in webkit [217204] by pvollan@apple.com

• 2 edits in trunk/LayoutTests

[Win] Update expectations for layout tests.
​https://bugs.webkit.org/show_bug.cgi?id=172437

Unreviewed test gardening, update test expectations for failing tests.

• platform/win/TestExpectations:

11:27 PM Changeset in webkit [217203] by Michael Catanzaro

• 6 edits in trunk

[GTK] Remove Firefox user agent quirk for Google domains
​https://bugs.webkit.org/show_bug.cgi?id=171941

Reviewed by Carlos Garcia Campos.

Source/WebCore:

• platform/UserAgentQuirks.cpp:

(WebCore::UserAgentQuirks::quirksForURL):
(WebCore::UserAgentQuirks::stringForQuirk):
(WebCore::urlRequiresFirefoxBrowser): Deleted.
(WebCore::UserAgentQuirks::firefoxRevisionString): Deleted.

• platform/UserAgentQuirks.h:
• platform/gtk/UserAgentGtk.cpp:

(WebCore::buildUserAgentString):

Tools:

• TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:

(TestWebKitAPI::TEST):
(TestWebKitAPI::assertUserAgentForURLHasFirefoxBrowserQuirk): Deleted.

11:24 PM Changeset in webkit [217202] by Yusuke Suzuki

• 27 edits
  1 add in trunk

[FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=172216

Reviewed by Saam Barati.

JSTests:

• stress/array-storage-get-by-val.js: Added.

(shouldBe):
(testOutOfBound):
(testInBound):
(testSlowPutOutOfBound):
(testSlowPutInBound):

Source/JavaScriptCore:

This patch adds GetByVal support for ArrayStorage and SlowPutArrayStorage.
To lower CheckInBounds in FTL, we add a new GetVectorLength op. It only accepts
ArrayStorage and SlowPutArrayStorage, then it produces vector length.
CheckInBounds uses this vector length to perform bound checking for ArrayStorage
and SlowPutArrayStorage.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::permitsBoundsCheckLowering):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

• dfg/DFGHeapLocation.h:
• dfg/DFGIntegerRangeOptimizationPhase.cpp:
• dfg/DFGNode.h:

(JSC::DFG::Node::hasArrayMode):

• dfg/DFGNodeType.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forIndexingType):
(JSC::FTL::AbstractHeapRepository::forArrayType):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetVectorLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitArrayStoragePutByVal):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emitArrayStorageLoad):
(JSC::JIT::emitArrayStoragePutByVal):

11:00 PM Changeset in webkit [217201] by Yusuke Suzuki

• 2 edits in trunk/JSTests

Unreviewed, fix commented out tests
​https://bugs.webkit.org/show_bug.cgi?id=172225

• stress/get-by-val-string.js:

(object.43):
(Hello):
(Hello.prototype.get 42):
(Hello.prototype.43):
(Derived):
(shouldBe):
(throw.new.Error): Deleted.

10:47 PM Changeset in webkit [217200] by sbarati@apple.com

• 6 edits
  1 add in trunk

We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
​https://bugs.webkit.org/show_bug.cgi?id=171041
<rdar://problem/32082516>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/lexical-scoping-for-loop.js: Added.

(assert):
(test1):
(test2):
(test3):
(test4):
(test5):
(test6):
(let.test7):
(let.test8):
(let.test9):
(let.test10):
(let.test11):
(let.test12):

Source/JavaScriptCore:

We were treating a for-loop variable declaration potentially as a top
level statement, e.g, in a program like this:
`
function foo() {

for (let variable of expr) { }

}
`
But we should not be. This had the consequence of making this type of program
throw a syntax error:
`
function foo(arg) {

for (let arg of expr) { }

}
`
even though it should not. The fix is simple, we just need to increment the
statement depth before parsing anything inside the for loop.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseForStatement):

LayoutTests:

• js/parser-syntax-check-expected.txt:
• js/script-tests/parser-syntax-check.js:

10:33 PM Changeset in webkit [217199] by Yusuke Suzuki

• 4 edits
  1 add in trunk

[JSC] Make get_by_val & string "499" to number 499
​https://bugs.webkit.org/show_bug.cgi?id=172225

Reviewed by Saam Barati.

JSTests:

• stress/get-by-val-string.js: Added.

(shouldBe):
(shouldThrow):
(object.43):
(Hello):
(Hello.prototype.get 42):
(Hello.prototype.43):
(Derived):

Source/JavaScriptCore:

Property subscript will be converted by ToString. So JS code is not aware of
the original type of the subscript value. But our get_by_val can leverage
information if the given subscript is number. Thus, passing number instead of
string can improve the performance of get_by_val in all the tiers.

In this patch, we add BytecodeGenerator::emitNodeForProperty. It attempts to
convert the given value to Int32 index constant if the given value is a string
that can be converted to Int32.

This patch improves SixSpeed map-string.es5 by 9.8x. This accessing form can
appear in some code like accessing the result of JSON.

map-string.es5 1640.6738+-110.9182 ^{167.4121+-23.8328} definitely 9.8002x faster

• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitNodeForProperty):
(JSC::BytecodeGenerator::emitNodeForLeftHandSideForProperty):

• bytecompiler/NodesCodegen.cpp:

(JSC::TaggedTemplateNode::emitBytecode):
(JSC::BracketAccessorNode::emitBytecode):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_putByValDirect):
(JSC::FunctionCallBracketNode::emitBytecode):
(JSC::PostfixNode::emitBracket):
(JSC::PrefixNode::emitBracket):
(JSC::AssignBracketNode::emitBytecode):
(JSC::ReadModifyBracketNode::emitBytecode):
(JSC::ForInNode::emitLoopHeader):
(JSC::ForOfNode::emitBytecode):
(JSC::ObjectPatternNode::bindValue):
(JSC::AssignmentElementNode::bindValue):

2:29 PM Changeset in webkit [217198] by sbarati@apple.com

• 2 edits in trunk/Source/JavaScriptCore

We overwrite the callee save space on the stack when throwing stack overflow from wasm
​https://bugs.webkit.org/show_bug.cgi?id=172316

Reviewed by Mark Lam.

When throwing a stack overflow exception, the overflow
thunk would do the following:

move fp, sp
populate argument registers
call C code

However, the C function is allowed to clobber our spilled
callee saves that live below fp. The reason I did this move is that
when we jump to this code, we've proven that sp is out of bounds on
the stack. So we're not allowed to just use its value or keep growing
the stack from that point. However, this patch revises this approach
to be the same in spirit, but actually correct. We conservatively assume
the B3 function we're coming from could have saved all callee saves.
So we emit code like this now:

add -maxNumCalleeSaveSpace, fp, sp
populate argument registers
call C code

This ensures our callee saves will not be overwritten. Note
that fp is still in a valid stack range here, since the thing
calling the wasm code did a stack check. Also note that maxNumCalleeSaveSpace
is less than our redzone size, so it's safe to decrement sp by
this amount.

The previously added wasm stack overflow test is an instance crash
without this change on arm64. It also appears that this test crashed
on some other x86 devices.

• wasm/WasmThunks.cpp:

(JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):

8:08 AM Changeset in webkit [217197] by Antti Koivisto

• 6 edits
  2 adds in trunk

matchMedia('print').addListener() fires in WK1 but never in WK2 when printing (breaks printing Google maps, QuickLooks)
​https://bugs.webkit.org/show_bug.cgi?id=172361
<rdar://problem/28777408>

Reviewed by Sam Weinig.

Source/WebCore:

Test: fast/media/matchMedia-print.html

• page/FrameView.cpp:

(WebCore::FrameView::layout):

Evaluate matchMedia queries unconditionally. No idea why it wasn't like that.

• testing/Internals.cpp:

(WebCore::Internals::setPrinting):

Add testing support. The existing ways to do printing testing were unable to hit this bug as
they had too much additional gunk.

• testing/Internals.h:
• testing/Internals.idl:

LayoutTests:

• fast/media/matchMedia-print-expected.txt: Added.
• fast/media/matchMedia-print.html: Added.

7:40 AM Changeset in webkit [217196] by Alan Bujtas

• 2 edits in trunk/Source/WebCore

Remove redundant FrameView ref in FrameView::performPostLayoutTasks
​https://bugs.webkit.org/show_bug.cgi?id=172422

Reviewed by Antti Koivisto.

This was added to protect FrameView from getting destroyed in updateEmbeddedObjects(), but r169475 changed
the embedded object update to be asynchronous.

• page/FrameView.cpp:

(WebCore::FrameView::performPostLayoutTasks):

May 20, 2017:

11:01 PM Changeset in webkit [217195] by ap@apple.com

• 3 edits in trunk/LayoutTests

Correct line endings in a couple files.

• fast/canvas/script-tests/canvas-gradient-without-path.js:
• fast/dom/Geolocation/page-reload-cancel-permission-requests.html:

7:10 PM Changeset in webkit [217194] by Chris Dumez

• 10 edits
  3 deletes in trunk

Drop [NoInterfaceObject] from RTCDTMFSender and RTCStatsReport
​https://bugs.webkit.org/show_bug.cgi?id=172418

Reviewed by Youenn Fablet.

Source/JavaScriptCore:

Add CommonIdentifiers that are now needed.

• runtime/CommonIdentifiers.h:

Source/WebCore:

Drop [NoInterfaceObject] from RTCDTMFSender and RTCStatsReport to match the specification:

• ​https://www.w3.org/TR/webrtc/#rtcdtmfsender
• ​https://www.w3.org/TR/webrtc/#rtcstatsreport-object

Firefox exposes both RTCDTMFSender and RTCStatsReport. Chrome exposes RTCStatsReport only.
RTCDTMFSender seems to be currently disabled at build time currently so the change to
its interface does not currently impact Web-exposed behavior, only the change to the
RTCStatsReport interface currently does.

No new tests, rebaselined existing test.

• Modules/mediastream/RTCDTMFSender.idl:
• Modules/mediastream/RTCStatsReport.idl:

Drop [NoInterfaceObject].

• Modules/mediastream/RTCIceCandidateEvent.cpp: Removed.
• Modules/mediastream/RTCIceCandidateEvent.h: Removed.
• Modules/mediastream/RTCIceCandidateEvent.idl: Removed.

Drop class and IDL that are no longer used. They were not even part of any project files.
RTCIceCandidateEvent has been renamed to RTCPeerConnectionIceEvent, which we support.

LayoutTests:

Rebaseline existing test to reflect change.

• platform/mac-elcapitan/js/dom/global-constructors-attributes-expected.txt:
• platform/mac-wk1/js/dom/global-constructors-attributes-expected.txt:
• platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
• platform/mac/js/dom/global-constructors-attributes-expected.txt:

3:40 PM Changeset in webkit [217193] by Yusuke Suzuki

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, add scope.release() to propertyIsEnumerable functions.
​https://bugs.webkit.org/show_bug.cgi?id=172411

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncPropertyIsEnumerable):

• runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncPropertyIsEnumerable):

1:07 PM Changeset in webkit [217192] by Yusuke Suzuki

• 16 edits
  2 deletes in trunk/Source/JavaScriptCore

[JSC] Drop MapBase
​https://bugs.webkit.org/show_bug.cgi?id=172417

Reviewed by Sam Weinig.

MapBase is a purely additional indirection. JSMap and JSSet can directly inherit HashMapImpl.
Thus MapBase is unnecessary. This patch drops it.
It is good because we can eliminate one indirection when accessing to map implementation.
Moreover, we can drop one unnecessary allocation per Map and Set.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):

• runtime/HashMapImpl.cpp:

(JSC::HashMapImpl<HashMapBucket>::estimatedSize):
(JSC::getHashMapImplKeyClassInfo): Deleted.
(JSC::getHashMapImplKeyValueClassInfo): Deleted.

• runtime/HashMapImpl.h:

(JSC::HashMapImpl::finishCreation):
(JSC::HashMapImpl::get):
(JSC::HashMapImpl::info): Deleted.
(JSC::HashMapImpl::createStructure): Deleted.
(JSC::HashMapImpl::create): Deleted.

• runtime/JSMap.h:

(JSC::JSMap::set):
(JSC::JSMap::get): Deleted.

• runtime/JSMapIterator.cpp:

(JSC::JSMapIterator::finishCreation):

• runtime/JSSet.h:

(JSC::JSSet::add): Deleted.

• runtime/JSSetIterator.cpp:

(JSC::JSSetIterator::finishCreation):

• runtime/MapBase.cpp: Removed.
• runtime/MapBase.h: Removed.
• runtime/MapPrototype.cpp:

(JSC::mapProtoFuncSize):

• runtime/SetConstructor.cpp:

(JSC::constructSet):

• runtime/SetPrototype.cpp:

(JSC::setProtoFuncSize):

• runtime/VM.cpp:

(JSC::VM::VM):

1:02 PM Changeset in webkit [217191] by Yusuke Suzuki

• 6 edits in trunk/Source/JavaScriptCore

[JSC] Speedup Object.assign for slow case by using propertyIsEnumerable
​https://bugs.webkit.org/show_bug.cgi?id=172411

Reviewed by Sam Weinig.

We use @Reflect.@getOwnPropertyDescriptor() to check

1. the descriptor exists,
2. and the descriptor.enumrable is true

But Object::propertyIsEnumerable does the completely same thing without
allocating a new object for property descriptor.

In this patch, we add a new private function @propertyIsEnumerable, and
use it in Object.assign implementation. It does not allocate unnecessary
objects. It is good for GC-pressure and performance.

This patch improves SixSpeed object-assign.es6 by 1.7x. While this patch
does not introduce a fast path for objects that do not have accessors,
and it could speed up things further, this patch can speed up the common
slow path cases that is the current implementation of Object.assign.

object-assign.es6 1103.2487+-21.5602 ^{621.8478+-34.9875} definitely 1.7741x faster

• builtins/BuiltinNames.h:
• builtins/ObjectConstructor.js:

(globalPrivate.enumerableOwnProperties):
(assign):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncPropertyIsEnumerable):

• runtime/JSGlobalObjectFunctions.h:

12:56 PM Changeset in webkit [217190] by commit-queue@webkit.org

• 2 edits in trunk/Tools

[GTK] gtkdoc-fixxref needs --module argument to work
​https://bugs.webkit.org/show_bug.cgi?id=172415

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2017-05-20
Reviewed by Michael Catanzaro.

• gtk/gtkdoc.py:

(GTKDoc._run_gtkdoc_fixxref):

12:25 PM Changeset in webkit [217189] by Michael Catanzaro

• 2 edits in trunk/Source/WebKit2

-Wreturn-type warning triggered by WKNotification.cpp:77
​https://bugs.webkit.org/show_bug.cgi?id=172414

Reviewed by Sam Weinig.

• UIProcess/API/C/WKNotification.cpp:

(WKNotificationCopyDir):

12:14 PM Changeset in webkit [217188] by Chris Dumez

• 7 edits in trunk

Value for iterator property is wrong for maplike interfaces
​https://bugs.webkit.org/show_bug.cgi?id=172410

Reviewed by Sam Weinig.

Source/WebCore:

Value for iterator property was wrong for maplike interfaces. The iterator property is
supposed to have the same value as the 'entries' property but we were using the value
of the 'values' property.

Specification:

• ​https://heycam.github.io/webidl/#es-map-entries
• ​https://heycam.github.io/webidl/#es-iterator

This impacts the iterator of the RTCStatsReport interface.

No new tests, updated existing test.

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

• bindings/scripts/test/JS/JSMapLike.cpp:

(WebCore::JSMapLikePrototype::finishCreation):

• bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:

(WebCore::JSReadOnlyMapLikePrototype::finishCreation):

LayoutTests:

Extend test coverage to test the RTCStatsReport iterator.

• webrtc/video-stats.html:

11:58 AM Changeset in webkit [217187] by Chris Dumez

• 2 edits in trunk/Source/WebCore

Drop superfluous iterator property setting in addValueIterableMethods()
​https://bugs.webkit.org/show_bug.cgi?id=172409

Reviewed by Youenn Fablet.

Drop superfluous iterator setting in addValueIterableMethods(). The bindings already take care of
adding the iterator property before calling addValueIterableMethods().

No new tests, no Web-facing behavior change.

• bindings/js/JSDOMIterator.cpp:

(WebCore::addValueIterableMethods):

11:15 AM Changeset in webkit [217186] by ap@apple.com

• 2 edits in trunk/Tools

make-new-script-test should create tests that use js-test.js, not js-test-pre.js
​https://bugs.webkit.org/show_bug.cgi?id=172416

Reviewed by Daniel Bates.

• Scripts/make-new-script-test:

9:55 AM Changeset in webkit [217185] by jer.noble@apple.com

• 19 edits
  6 adds in trunk

[MSE][Mac] Support painting MSE video-element to canvas
​https://bugs.webkit.org/show_bug.cgi?id=125157
<rdar://problem/23062016>

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/media-source/media-source-paint-to-canvas.html

In order to have access to decoded video data for painting, decode the encoded samples manually
instead of adding them to the AVSampleBufferDisplayLayer. To facilitate doing so, add a new
utility class WebCoreDecompressionSession, which can decode samples and store them.

For the purposes of this patch, to avoid double-decoding of video data and to avoid severe complication
of our sample delivery pipeline, we will only support painting of decoded video samples when the video is
not displayed in the DOM.

• Modules/mediasource/MediaSource.cpp:

(WebCore::MediaSource::seekToTime): Always send waitForSeekCompleted() to give private a chance to delay seek completion.

• Modules/mediasource/SourceBuffer.cpp:

(WebCore::SourceBuffer::sourceBufferPrivateReenqueSamples): Added.

• Modules/mediasource/SourceBuffer.h:
• WebCore.xcodeproj/project.pbxproj:
• platform/cf/CoreMediaSoftLink.cpp: Added new soft link macros.
• platform/cf/CoreMediaSoftLink.h: Ditto.
• platform/cocoa/CoreVideoSoftLink.cpp: Ditto.
• platform/cocoa/CoreVideoSoftLink.h: Ditto.
• platform/graphics/SourceBufferPrivateClient.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::sampleBufferDisplayLayer): Simple accessor.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::decompressionSession): Ditto.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::MediaPlayerPrivateMediaSourceAVFObjC):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::load): Update whether we should be displaying in a layer or decompression session..
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVisible): Ditto.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::waitForSeekCompleted): m_seeking is now an enum.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seeking): Ditto.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekCompleted): Ditto. If waiting for a video frame, delay completing seek.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::nativeImageForCurrentTime): Call updateLastImage() and return result.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::updateLastImage): Fetch the image for the current time.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::paint): Pass to paintCurrentFrameInCanvas.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::paintCurrentFrameInContext): Get a native image, and render it.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::acceleratedRenderingStateChanged): Create or destroy a layer or decompression session as appropriate.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureLayer): Creates a layer.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::destroyLayer): Destroys a layer.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureDecompressionSession): Creates a decompression session.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::destroyDecompressionSession): Destroys a decompression session.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setHasAvailableVideoFrame): If seek completion delayed, complete now. Ditto for ready state change.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setReadyState): If waiting for a video frame, delay ready state change.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer): Deleted.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::removeDisplayLayer): Deleted.

• platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
• platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:

(WebCore::MediaSourcePrivateAVFObjC::hasVideo): Promote to a class function.
(WebCore::MediaSourcePrivateAVFObjC::hasSelectedVideo): Return whether any of the active source buffers have video and are selected.
(WebCore::MediaSourcePrivateAVFObjC::hasSelectedVideoChanged): Call setSourceBufferWithSelectedVideo().
(WebCore::MediaSourcePrivateAVFObjC::setVideoLayer): Set (or clear) the layer on the selected buffer.
(WebCore::MediaSourcePrivateAVFObjC::setDecompressionSession): Ditto for decompression session.
(WebCore::MediaSourcePrivateAVFObjC::setSourceBufferWithSelectedVideo): Remove the layer and decompression session from the unselected

buffer and add the decompression session or layer to the newly selected buffer.

(WebCore::MediaSourcePrivateAVFObjCHasVideo): Deleted.

• platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
• platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:

(WebCore::SourceBufferPrivateAVFObjC::destroyRenderers): Clear the videoLayer and decompressionSession.
(WebCore::SourceBufferPrivateAVFObjC::hasSelectedVideo): Return whether the buffer has a selected video track.
(WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled): The media player now manages the video layer and decompression session lifetimes.
(WebCore::SourceBufferPrivateAVFObjC::flush): Flush the decompression session, if it exists.
(WebCore::SourceBufferPrivateAVFObjC::enqueueSample): Enqueue to the decompression session, if it exists.
(WebCore::SourceBufferPrivateAVFObjC::isReadyForMoreSamples): As the decompression session, if it exists.
(WebCore::SourceBufferPrivateAVFObjC::didBecomeReadyForMoreSamples): Tell the decompression session to stop requesting data, if it exists.
(WebCore::SourceBufferPrivateAVFObjC::notifyClientWhenReadyForMoreSamples): Request media data from the decompression session, if it exists.
(WebCore::SourceBufferPrivateAVFObjC::setVideoLayer): Added.
(WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession): Added.

• platform/graphics/cocoa/WebCoreDecompressionSession.h: Added.

(WebCore::WebCoreDecompressionSession::create):
(WebCore::WebCoreDecompressionSession::isInvalidated):
(WebCore::WebCoreDecompressionSession::createWeakPtr):

• platform/graphics/cocoa/WebCoreDecompressionSession.mm: Added.

(WebCore::WebCoreDecompressionSession::WebCoreDecompressionSession): Register for media data requests.
(WebCore::WebCoreDecompressionSession::invalidate): Unregister for same.
(WebCore::WebCoreDecompressionSession::maybeBecomeReadyForMoreMediaDataCallback): Pass to maybeBecomeReadyForMoreMediaData.
(WebCore::WebCoreDecompressionSession::maybeBecomeReadyForMoreMediaData): Check in-flight decodes, and decoded frame counts.
(WebCore::WebCoreDecompressionSession::enqueueSample): Pass the sample to be decoded on a background queue.
(WebCore::WebCoreDecompressionSession::decodeSample): Decode the sample.
(WebCore::WebCoreDecompressionSession::decompressionOutputCallback): Call handleDecompressionOutput.
(WebCore::WebCoreDecompressionSession::handleDecompressionOutput): Pass decoded sample to be enqueued on the main thread.
(WebCore::WebCoreDecompressionSession::getFirstVideoFrame):
(WebCore::WebCoreDecompressionSession::enqueueDecodedSample): Enqueue the frame (if it's a displayed frame).
(WebCore::WebCoreDecompressionSession::isReadyForMoreMediaData): Return whether we've hit our high water sample count.
(WebCore::WebCoreDecompressionSession::requestMediaDataWhenReady):
(WebCore::WebCoreDecompressionSession::stopRequestingMediaData): Unset the same.
(WebCore::WebCoreDecompressionSession::notifyWhenHasAvailableVideoFrame): Set a callback to notify when a decoded frame has been enqueued.
(WebCore::WebCoreDecompressionSession::imageForTime): Successively dequeue images until reaching one at or beyond the requested time.
(WebCore::WebCoreDecompressionSession::flush): Synchronously empty the producer and consumer queues.
(WebCore::WebCoreDecompressionSession::getDecodeTime): Utility method.
(WebCore::WebCoreDecompressionSession::getPresentationTime): Ditto.
(WebCore::WebCoreDecompressionSession::getDuration): Ditto.
(WebCore::WebCoreDecompressionSession::compareBuffers): Ditto.

• platform/cocoa/VideoToolboxSoftLink.cpp: Added.
• platform/cocoa/VideoToolboxSoftLink.h: Added.

LayoutTests:

• media/media-source/content/test-fragmented.mp4: Add a 'edts' atom to move the presentation time for the

first sample to 0:00.

• media/media-source/content/test-fragmented-manifest.json:
• media/media-source/media-source-paint-to-canvas-expected.txt: Added.
• media/media-source/media-source-paint-to-canvas.html: Added.